chore(deps): update terraform proxmox to v0.116.0

Garage's hourly full-sync cycles were the InvalidAccessKeyId source:
while a key-table sync runs, auth lookups transiently fail, and the
edge job's prune step kept landing inside the window (one sync ran
87 minutes). Both embedded stores get a weekly interval.

.github/workflows/dns.yaml

@@ -12,10 +12,14 @@ jobs:
   update-records:
     name: octodns
     runs-on: ubuntu-latest
-    container: octodns/cloudflare:latest
+    container: octodns/octodns:latest
     steps:
       - uses: actions/checkout@v4
+      - name: Install DNS providers
+        run: pip install octodns-cloudflare octodns-porkbun
       - name: octodns-sync - production
         run: octodns-sync --config-file ./config/production.yaml --doit
         env:
           CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
+          PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
+          PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}

dns/config/production.yaml

@@ -7,10 +7,24 @@ providers:
   cloudflare:
     class: octodns_cloudflare.CloudflareProvider
     token: env/CLOUDFLARE_TOKEN
+  porkbun:
+    class: octodns_porkbun.PorkbunProvider
+    api_key: env/PORKBUN_API_KEY
+    secret_key: env/PORKBUN_SECRET_KEY
 
 zones:
-  '*':
+  vhaudiquet.fr.:
     sources:
       - config
     targets:
       - cloudflare
+  buildpath.win.:
+    sources:
+      - config
+    targets:
+      - cloudflare
+  saggar.dev.:
+    sources:
+      - config
+    targets:
+      - porkbun

dns/production/saggar.dev.yaml

@@ -0,0 +1,17 @@
+---
+? ''
+: ttl: 600
+  type: A
+  value: 82.64.154.58
+api:
+  ttl: 600
+  type: A
+  value: 82.64.154.58
+docs:
+  ttl: 600
+  type: A
+  value: 82.64.154.58
+get:
+  ttl: 600
+  type: A
+  value: 82.64.154.58

dns/production/vhaudiquet.fr.yaml

@@ -383,6 +383,13 @@ photos:
   ttl: 300
   type: A
   value: 82.64.154.58
+pkgatlas:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 82.64.154.58
 sse-nook:
   octodns:
     cloudflare:

docker/personal/tandoor/docker-compose.yml

@@ -9,7 +9,7 @@ services:
 
   web_recipes:
     restart: always
-    image: vabene1111/recipes:2.6.15
+    image: vabene1111/recipes:2.6.13
     networks:
       - default
       - proxy

infra/r740/docker/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     docker = {
       source  = "kreuzwerker/docker"
-      version = "3.6.2"
+      version = "3.9.0"
     }
   }
 }

infra/r740/proxmox/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     proxmox = {
       source = "bpg/proxmox"
-      version = "0.81.0"
+      version = "0.116.0"
     }
   }
 }

kubernetes/dev/gitea/values.yaml

@@ -17,7 +17,7 @@ valkey-cluster:
 # Use standalone Valkey (replaces 'redis' in chart 12.x)
 valkey:
     enabled: true
-    master:
+    primary:
         resources:
             requests:
                 cpu: 100m
@@ -30,10 +30,10 @@ postgresql:
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:PtWMsukqbrWiVg==,iv:iQtDckrih/3ZKopzD9eEViOMZrvSulmCI5tHCsJph1A=,tag:7S54w4ADG7+8QNiLDw2Q0A==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:4Kd4qz3DuJboaA==,iv:I9K1+j2tv7MKel9ej2/AED0JrxIfeb3D1xdDKCS+jTs=,tag:MpQ0NjglUvGZXzeOQjIj3Q==,type:str]
-                password: ENC[AES256_GCM,data:jLC1oEl+ZAnpbw==,iv:PliGMmxHKn3eEt8uvsv9wL4syk91EC5OpA7AL5J0+4o=,tag:Oan4ek7m0Cxnl5bzOCGHXw==,type:str]
+                password: ENC[AES256_GCM,data:YX6VvEJWfkO0dg==,iv:ixQkW2q7Y9YRIGMIbqWclA5q9Ufw+lNS7Gc4Wd1toiY=,tag:krGDeY+E4+PUjowt8jKAmA==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:ricveNc=,iv:rPrHKhIzsNEQzoaX2cPDvVWjR7NIxsN1tBlzLB80IQ0=,tag:n64SpL6qM/IT9D7t85/Lvg==,type:str]
+                username: ENC[AES256_GCM,data:KvdO0oE=,iv:vFYOVlo2kvOHOhASDlccTfcpsgAkS6YXOLCm5sDcxaQ=,tag:9J6Dmc3vYpHlFSggoGVmLQ==,type:str]
     volumePermissions:
         enabled: true
     primary:
@@ -63,6 +63,7 @@ postgresql-ha:
 persistence:
     enabled: true
     subPath: data
+    size: 30Gi
 extraVolumes:
     - name: git
       nfs:
@@ -76,8 +77,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:9UuG23PYFiWrQKJX5xGxMgyWKLPFCxKjDUYJd59rMWcdAw619/v/Bw==,iv:AfHV1MzbYi5Z5Bb63/51Hmy9rM247b4quwKCzo7MpYw=,tag:pfpz7hhZyIUjIGGcxZVx/w==,type:str]
+          key: ENC[AES256_GCM,data:F0AGCSAkU2ZWmS4jniL8k32ABwrjtURAPLa3RKOCpJoaMkKRlRrqwA==,iv:vQcD73C3itBqKFEiv8PhLD2G3exC0zc2NDE3LGYpvXA=,tag:24nO98pP7a00sTBDWEMsBA==,type:str]
-          secret: ENC[AES256_GCM,data:PKFx/LhjwWJluC6/RHc1eMgw4TZXkXymNCrc7TQU6Bp5rGKHMvACC+G+MjXGylIMZVt65LHWq5YEHJNjO8HMsa4ejGukXDuU9sCgKaOOniCs3EQivfVsCCHtF/G48eULPkege7JRzTbmJSYJDnscsSikwvUDChy+zGlC2ZmBZjk=,iv:qsIaaeXepJ9ECilo+05+A0i2joxV0svBOjgL37DkimE=,tag:/3Xer7Yb6QyUtmPIOvSLQQ==,type:str]
+          secret: ENC[AES256_GCM,data:0/6XDvRXUnQXrJzivtDS6b+mmYjtOVcHhGmQJPFG1zDyO9BksHKau0D+hIsfM85761U7LAISct0HungGNeOQOULnmvVT8hEIgC21RHjArXztJY2964NS5XXfURc7pVxOJ7LSDFFd4azExwhrTktqmerG+F6SI5V/oq2iYYqJA7o=,iv:ShYcIgyccHvEFhVn++gBR7gmMOEKcBz9sj/Y+4pk/Hc=,tag:SkFM2d06O/zhpfVji4QDKA==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -103,37 +104,39 @@ gitea:
         indexer:
             ISSUE_INDEXER_TYPE: bleve
             REPO_INDEXER_ENABLED: true
-# Resource limits for Gitea container
+# Resource limits for Gitea container. Sized to receive a full linux
+# kernel tree: index-pack on ~12M objects needs several GiB and more
+# than half a core (the 1Gi limit OOMKilled the pod mid push).
 resources:
     requests:
-        cpu: 100m
-        memory: 512Mi
-    limits:
         cpu: 500m
         memory: 1Gi
+    limits:
+        cpu: "4"
+        memory: 6Gi
 replicaCount: 1
 sops:
-    lastmodified: "2026-09-09T21:39:30Z"
+    lastmodified: "2026-09-30T21:03:47Z"
-    mac: ENC[AES256_GCM,data:ACBKJLGUfWw9T3fOhQMT251gcLzG3bUXjUqBxG1DuPl8c8bblaIpLOu0QsrfQziQY3jM0DFJ2W/I2vjkrhCuCaZhZCtRg2nzUk+7HelqjEdKLphSuIdlHIkz7Icu+khShrwTgmQiE00Gg1WUsLRkKBgNsOm3TMK4wB874iBvSYY=,iv:Idp0+UBXaRFkpOFKFoRrLKuN1mOmfM7pukC22KkNiCU=,tag:fL9DzAo8FSx4PblVlTHtaQ==,type:str]
+    mac: ENC[AES256_GCM,data:eHMr2BqfWNI32S14XEivXtXSIRiCBCAQz06mwtbNyXc1dI6YgF4pKdyIbfRWQW0ZYcbvqKxtyugao+lhc24Ds/GgIbdwchlMyz/DyuOQtM5GMHcSoInQUQVGzrM8hSyztKzq10bH0DmKvT68+uaVx0hf6rzxEqLRb3GAk4q3310=,iv:5kJ6bYE/54EbDWctSXBcVTjJtc/J3mV664tFD1WTK90=,tag:AAbHK3njH0PCqw9yjSWevQ==,type:str]
     pgp:
-        - created_at: "2026-09-09T21:39:30Z"
+        - created_at: "2026-09-30T21:03:47Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+PK0/kUHlc+exa8slolUeTGjHzd/R1Dtux/+HJdC9Vpow
+            hQIMA7uy4qQr71wiAQ//Vf2Rdp8NG4AsbIIOiXabY3AzLyVbE9Pn52+FBF+NIfkS
-            ImAQvIdkEjwL0FmoA7Z4val/Wzx/YzFJ5r6sADNaQ9EG7QO+I8WY3VrKj5aRi0Qz
+            XDqlgvMAWHtmV2LzvJPwPIUjCZkoRwmDsh9zi+W1XzHh9kKxzwvIxfjiqm8fwJh8
-            +FgHAgng+wdRCCBoxv9Z+MTPSl4TwrKsbrulHAg7EayDKxwGzkyMrnxvukRqD8GB
+            gb4a/y5mkkEqs+H0zE1H4D91dPbfOmDABJKaePmWTB+tc48bY6qX+LYs7hkPwsHU
-            iMQCUadudR458fzB04dkhljAbl/FqX5ppflzEoGVCiRSBcWNkaHgyYqopYGzMASy
+            sN64cidbIbzBoq0t1TWZFkl6MZYWX9IyqJE1XcqYDAvwxlJ4JMJH2pGQlY8+7U96
-            KTzoV01adnOZY+xeZa5GasgCEbCU3BDesD9vBb+sFsRugVuRHzdyqp3nVBwudpeh
+            YQgbXhuAik5IzNQlmdpq0mt0j3KZgM7KbLJ2en6JAiO0EhD3xKbFnC0bPniUEX2c
-            OcE9MOMyBN1SAdx9RCsB8aHWYndF1dim84ZWgQThkLlA+7CWJt/NyFYwmMdqqzSv
+            Yv6Z/1NrmNImCwbOkrNF9sqto4d9VHFDH8udSHKCXcSbzJmkfF4XUOBuNxtprmQV
-            C7slojC6B8bb3863c5w3qe9TPPBwyTOcuNTMunr6wXidlPZWtsImhu/RX9fqzFjZ
+            Wlcw5ZMFpnOgRn+V2gb0Cd3cm5rje0QAYCgIGUfduvMm9BReAQTvpUdKkqKs0mLr
-            9X1+wAjAfs7AASeNJLFYqiPrknSAA3JumQZtrFC5dejpTj9H2ns6DkiHSZy8FA8O
+            XiRAG0HfjjGNcVqWA0H0L5UxlVwHJh6zSNHDzTPVlGenVcQSpiUORKxZqANpQchW
-            RuZ8hv/L8L8oilbubKnKFZLhR8lh8A1jXHUxzaEC/L4o4cd7/3TlEms/51yM9qYx
+            /wtFghatZFKbbzEz6Mo5C3hMKOXjl/VNWsmva8BoloDKPm9pWH5S4x0ExYiOWSOk
-            WJOz4H8lbphDYO4tFgsGAhL/yHbLHvww/X1hNldwI7mqYrFLSjIwxW2Oxo8c+QB6
+            Yk9j+twTgJXMeptO55qMCJKl6CcRsbgVr5yJJXWC6I3tr2ssx1BnSAPYDviuhsC1
-            yZ3VxTXuS9jEVpGTVhIOfepwS8rJQbTUeewqok3riw9GpSEFpOMWsBxlT6+HI8zS
+            YAbgFlvdzE6n8FmTixVwzVZrTbZV7alz9PECViMP5evAphe3n1MvnLEvMM0WOm/S
-            XgHPVohxe93kk51O7WjBgq8PAwG7DtWrygqWYORz+pTYN8wTtC4pfotiJZ7hv7Gv
+            XgG0Ty4hQ9ZD7gzhIrh06xVuh+MC/PaMYIZ7LBVHgQy8xbAgQH0qXkF39/9rCIws
-            NICEZlirrTUdIol8jyM+yRv1gWuYwQJpjnrQVY2AoAQX6ta5/3st24cyuGwGHO0=
+            A/D0FN29uXvfSWzlgSrGOj218eKHX9g+nZGIAHeejd/FJVnOKQpUboUlg/x3jqQ=
-            =Q6Pu
+            =943y
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/dev/pkgatlas/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pkgatlas
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: pkgatlas-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/dev/pkgatlas/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

kubernetes/dev/pkgatlas/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: pkgatlas

kubernetes/dev/pkgatlas/release.yaml

@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: pkgatlas
+                namespace: pkgatlas
+            chart: pkgatlas
+            # CI publishes a timestamped version on every main push and
+            # stamps appVersion with the commit SHA of the image it
+            # builds; this range always picks the latest one.
+            version: '>=0.4.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: pkgatlas-values

kubernetes/dev/pkgatlas/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm

kubernetes/dev/pkgatlas/values.yaml

@@ -0,0 +1,47 @@
+# Chart: https://git.vhaudiquet.fr/vhaudiquet/pkgatlas (chart/pkgatlas).
+# The image ships both binaries (build + serve) and runs as nonroot
+# (uid 65532, distroless). Everything else is chart default: discovery
+# first — build.enabled=false, the first refresh pass builds the whole
+# live rotation and /v1/readyz stays 503 until it lands; weekly
+# refresh after that.
+image:
+    repository: git.vhaudiquet.fr/vhaudiquet/pkgatlas
+ingress:
+    enabled: true
+    className: traefik
+    hosts:
+        - host: pkgatlas.vhaudiquet.fr
+          paths:
+            - path: /
+              pathType: Prefix
+    # TLS terminates at Caddy with the *.vhaudiquet.fr wildcard cert;
+    # Caddy proxies to Traefik by host, so no tls block here (same as
+    # gitea's ingress).
+    tls: []
+sops:
+    lastmodified: "2026-09-24T19:57:42Z"
+    mac: ENC[AES256_GCM,data:cidn6U0EFjuEx98GA8Jlppg3GobcGGrhs20dPoAnUXdpFogfsp3YOTPCKuKi0LrOw/fxBP84U4drx5lJcjL11Ft/Ozn6Z8tk3l8cdqK+BUm6yijtQ0PXHjPUJYNIeqxrQKJzFlVHS+tOARbhQ3DjoNt71WBMfSPUDcPxrbnwVAA=,iv:Yz85yh9jrLXf6DKeVmOLeiVCWcthKCPGCJJwR3RVikg=,tag:7Mdv4VZUpsjuysitx4b2DA==,type:str]
+    pgp:
+        - created_at: "2026-09-24T19:57:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+N+gGPOCbuxleT6xx0FduVN1vspYJlCyrtLsy632Yz17x
+            ucwqSuGciqUf2kF3GwnOzINEY0eLskbKHMX5wkbJg8+X6dXoRyiseX3fdNrpvMGR
+            P1ZC/C4O6BzQoPJOXDQZHuWPI0Imx61PlzDPzsJ44JBvwrkCKgoaWOvzMyTjZHiC
+            iplyHpzDR2sqfMe29aQICrEV6Z87eMWQ3wie6CzX2OYTj89BejsN2Ibg4n5cqdNO
+            c+mM7Ek2nSWMWYGbdL0W2N6WSIbGuQj/aVbS0s6585NUPJtmcznB7uosRroqfbd2
+            9SMP1gaUOr+00kykRxKtd/ZoW7S/21kGbZ8FwvtKZFrBwcoUuLehbSGAHRYLo6dI
+            5WGeky65IrvpKen8Q/B6o6EByTONt2h+XiyJyLwDLeFh13/ldkGqa1oW+4BTHuX9
+            2WvLOboHpr4MGQdO53Q8zm8VCGAltusII6ZVaoEyjilqZtC/Aa9XZIT/HshOGTQi
+            4CITE1BfGEApOcBbBQKdjYofdWcyuLSF/ertXvcvNiCoVe0wYiHSYUht+HulQ3t+
+            Z0K7C2sJ2bx8C+316b2MzCGVrVOuqDABpQJjIr4aiRG9v8BtYTaUc425CLm9TMtA
+            PmZR1Rqowy4ECekrbvk3lNjPoq13HLSqkm2ppL9WFub5zY2XY0npprSeUknTmSDS
+            XgGFDhcroUq0vTUlJbC015kpa6cpynwTmMuQrFaMPeKeBPkL4Le6QFJMjpIi3yg3
+            65bSBv5t7YXoHFJWVFYej005Lz1lxp1VtaMiA0bnKEnyh/SbfcUqD4d9P1WNx+4=
+            =ulvs
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/infrastructure/caddy-certificates/certificates.yaml

@@ -79,3 +79,67 @@ spec:
     - buildpath.win
   duration: 2160h # 90 days
   renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: saggar-dev
+  namespace: caddy
+spec:
+  secretName: saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: saggar.dev
+  dnsNames:
+    - saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: api-saggar-dev
+  namespace: caddy
+spec:
+  secretName: api-saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: api.saggar.dev
+  dnsNames:
+    - api.saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: docs-saggar-dev
+  namespace: caddy
+spec:
+  secretName: docs-saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: docs.saggar.dev
+  dnsNames:
+    - docs.saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: get-saggar-dev
+  namespace: caddy
+spec:
+  secretName: get-saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: get.saggar.dev
+  dnsNames:
+    - get.saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry

kubernetes/infrastructure/caddy/caddyfile.yaml

@@ -40,6 +40,8 @@ data:
 
         @umami       host umami.vhaudiquet.fr
 
+        @pkgatlas    host pkgatlas.vhaudiquet.fr
+
         handle @authentik {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
@@ -70,6 +72,9 @@ data:
         handle @umami {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
+        handle @pkgatlas {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
 
         # Docker VM services (via Docker Traefik)
         @alexscript     host alexscript.vhaudiquet.fr
@@ -102,3 +107,23 @@ data:
       tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
       reverse_proxy traefik.traefik.svc.cluster.local.:80
     }
+
+    saggar.dev {
+      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    api.saggar.dev {
+      tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    docs.saggar.dev {
+      tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    get.saggar.dev {
+      tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }

kubernetes/infrastructure/caddy/values.yaml

@@ -10,7 +10,7 @@ image:
     repository: caddy
     pullPolicy: IfNotPresent
     tagSuffix: ""
-    tag: 2.11.4
+    tag: 2.11.6
 service:
     type: LoadBalancer
     # Cluster (not Local) so any node can forward to pods on any other node.
@@ -36,25 +36,44 @@ health:
 volumes:
     - name: vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
+        secretName: ENC[AES256_GCM,data:16xnpbPT5Q3QPhiOVW09rO4=,iv:rITfPR/pb9otdRXURijM9l4eOyjAm/LpMCVzDI1HdiQ=,tag:XTt5U79sfX4F7gL3pdfCIQ==,type:str]
-        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
+        optional: ENC[AES256_GCM,data:ghlFPw==,iv:nZ6HKGVI7z0R7ZDnxdKCFdAtPrUCYTPc6C3ahLhi05o=,tag:zKbUifBUjU2haTMIldoKhA==,type:bool]
     - name: wildcard-vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
+        secretName: ENC[AES256_GCM,data:HFV3Bw6giG42LsVv7NHQCNbsk0ewFftMuNE=,iv:lhlMGwLwaKTjXwqErw/bsSG6zRuc9lfwwF9Ru/WiFG0=,tag:gU4IW396EUuiZUdRIz5neA==,type:str]
-        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
+        optional: ENC[AES256_GCM,data:NSoRKQ==,iv:0xYJ3X2fajkm+KuXLB67nzKJtlszZz/iLlpPBkPgsGc=,tag:pQ0P4pak230kfNvxILH7Hg==,type:bool]
     # semery.fr certs from cert-manager (OVH DNS-01)
     - name: semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
+        secretName: ENC[AES256_GCM,data:J7uLCquEggEP2naKHg==,iv:8RudvW7ki/DkWZwVHd1AXAt+6YrLrOpXotQDh9vwgp4=,tag:1PzTWbWEqKUdhlwRcctpGQ==,type:str]
-        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
+        optional: ENC[AES256_GCM,data:1q/Bng==,iv:jEnPnyR3pCV0CL8hK+NfMxH1LDKSRyansf6GZDshzQE=,tag:TzOXcGF91InOrCdCCm/Bcg==,type:bool]
     - name: wildcard-semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
+        secretName: ENC[AES256_GCM,data:5n5namMP+KepRLRQZgvzlr9hEzNmvQ==,iv:Xnh7FIAVaxQ1Mxd8+en8bM9ueFsG1ujxh472mQhqFFw=,tag:omVRURP2KbSEyHsUqUhfCg==,type:str]
-        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
+        optional: ENC[AES256_GCM,data:0GArbg==,iv:1wW6BFk6Vs2y42iIniy4YbMFBOYdqwXop2WCEldwBBA=,tag:gmZlb7zIh3W/0L3qg8XQCQ==,type:bool]
     - name: buildpath-win-tls
       secret:
-        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
+        secretName: ENC[AES256_GCM,data:CTR7I92zQSaOKCcLPGnAs4Q=,iv:egtHKvBbs1dJsMgoIFK+gyOnC7ZX/3UfaAGIDkryd+c=,tag:vk3xGP8YeXhQSi6QLk+3Ww==,type:str]
-        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
+        optional: ENC[AES256_GCM,data:nOml1Q==,iv:viRMNPrBLmm8IfJDqcfWOuyMx/y7eE0CTMYjWmK5/rE=,tag:VpAuffCx/VqP2X947l/p3A==,type:bool]
+    # saggar.dev cert from cert-manager (Porkbun DNS-01)
+    - name: saggar-dev-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:5eb4Fv9OJqjbPuxT1/8=,iv:ZsOSvoCc9+ZtTVboRKJBRR8FITk3gowa/uylv+mfA+k=,tag:hkoQ8QHt9evQfDUT4rq51Q==,type:str]
+        optional: ENC[AES256_GCM,data:iac+qA==,iv:hf1rDOHE3frRL702sotOP8akjBi20mRTXQ6vlUb4Ac0=,tag:+G8rgN61c5agYmbJsldqrA==,type:bool]
+    - name: api-saggar-dev-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:5NJaLtBQizRFNbF5IS2YbEmF,iv:lTJkrES8y7/QO73p7G8RG/CmxGedyXAvfrK3Q26OtU0=,tag:92P2+010Isgg3SQjYwPBCw==,type:str]
+        optional: ENC[AES256_GCM,data:3ax/5A==,iv:CvLi5JqkXPfq9+jVA/Q+mpdEZJ7UosxzZAR1aArpDbk=,tag:yOsLJuqtCrvg8YneJRUeoA==,type:bool]
+    # docs.saggar.dev cert — the saggar book (static nginx)
+    - name: docs-saggar-dev-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:xDf3adcsj6i0FJ2kAc5UxnVE3w==,iv:+qGMWJKoQo/MjibTR9mbgX3T6/xwr+vq1U+ef14xXfs=,tag:Y2jZHktvL8RKUacSv9JDJg==,type:str]
+        optional: ENC[AES256_GCM,data:wEEiYQ==,iv:zNWY0N5935+biGIjIl+q5XPyLLX7/ABhnwHsp4FEZpM=,tag:v8trm6fiM5q/T6EOh1fxcQ==,type:bool]
+    # get.saggar.dev cert — the saggar distribution host (garage web)
+    - name: get-saggar-dev-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:iFG9+7bSIUgFZpm8h5Tc362g,iv:Wm6cW1+ehjoylvjwSE3oT0VcQFZONq9znpfi2w/wP9U=,tag:UoEXdJzWoVX6/g8UtbByzQ==,type:str]
+        optional: ENC[AES256_GCM,data:t8VFbw==,iv:Imo0wBOb9ufS9YPqtTegEHQFnyhgSYmcg2FHEzBkW9I=,tag:19zicABMKqAR/nDr85WpCw==,type:bool]
     - name: routes
       configMap:
         name: caddy-routes
@@ -75,6 +94,18 @@ volumeMounts:
     - name: buildpath-win-tls
       mountPath: /etc/caddy/certs/buildpath-win
       readOnly: true
+    - name: saggar-dev-tls
+      mountPath: /etc/caddy/certs/saggar-dev
+      readOnly: true
+    - name: api-saggar-dev-tls
+      mountPath: /etc/caddy/certs/api-saggar-dev
+      readOnly: true
+    - name: docs-saggar-dev-tls
+      mountPath: /etc/caddy/certs/docs-saggar-dev
+      readOnly: true
+    - name: get-saggar-dev-tls
+      mountPath: /etc/caddy/certs/get-saggar-dev
+      readOnly: true
     - name: routes
       mountPath: /etc/caddy/routes
       readOnly: true
@@ -99,7 +130,7 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
+                    - key: ENC[AES256_GCM,data:RTux56Pd/U6b6MLk5uRUC2YXP3w=,iv:K/9+Mh8dyp9DOumKFLmZFHXqjxzhhYEKKSnXRc/Pb2A=,tag:fk03mWjQEQPCdALb2gEMdQ==,type:str]
                       operator: NotIn
                       values:
                         - "true"
@@ -113,35 +144,35 @@ affinity:
                 topologyKey: kubernetes.io/hostname
 tolerations:
     # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
+    - key: ENC[AES256_GCM,data:JPKKj4UA7JWi,iv:0PNgCHVFO2bywVfcXrOrcTQpNjz2TUUM0RrBmF6godw=,tag:h27cJ4dd9C1iLKgffNLVfQ==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
+      value: ENC[AES256_GCM,data:7dtvTUy+xUI=,iv:pQdnyz5X+gQB0DOFFxs5D+2RAPD8xl+hgJFwARcbBWo=,tag:A321CiM+q8tLJJyanRn/Ww==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
+    - key: ENC[AES256_GCM,data:t71fVLGG7y2am6kXa3DcpGt76uZJ+cOuYZKiaRF2LljtRCxzpw==,iv:Fa0zVUsH/TbWBbL2foIsvq7UQ2kIcA3yNvG2qMuGnng=,tag:KchzYUpe4Z6JIZCvSM2ztw==,type:str]
       operator: Exists
       effect: NoSchedule
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
+    lastmodified: "2026-10-04T21:14:10Z"
-    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
+    mac: ENC[AES256_GCM,data:vv4/zTp8LHusfYtM4xUwKHnesHu49VXfhRmKPo/nB7ItGYATsD5PtnXrGluOkwng/5pvRVs5WCtLt9fdZ9k7aKsfFHisi2OylEkx76xcAQ1f8GOCNkvfnjVuPEbaIZK1Mvdepbe1oZ0B4m5I2KqfvnUpXzmG82vNq0hj5vlQ1uM=,iv:7mKc4OBbPUYuLXer5f1OZcHggJBOu5rD/luh64in5lc=,tag:ch1Nvtyfa94AI9tAOm81hw==,type:str]
     pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-10-04T21:14:09Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
+            hQIMA7uy4qQr71wiAQ/+Io9dFjaXDz2CSdPjMBiT8ISxnUxZ9F3VX+bqKg9nRusr
-            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
+            slx5VsHGCsfK4DyF4GXcqsyDPkz6v39ehhUFdseZewg1AbYTNy9RIEgeSo3fwcnO
-            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
+            bee48z1Nti+8F3h+4O2ao+nGx4wSS6MYO3oO5vV5a4oNKe6T59X7eGT30uohatO6
-            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
+            jo6UuHu3/e7eyzK7/iSF3SemtkZ1ZiXOgKKeBXashrp+2vDdY+3ow/pRpFyohqWh
-            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
+            4mBt8SyCWOsf0BUdNZfJPDO594hwTjrrRIsmBeXde97rFXKBDd5tPR9tjNlihWsw
-            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
+            lC0e4331jvwns+rlSOASBX/BVsqVGh8nw/5XWxqW3oMqjvolgofGhP8CtFQkUuoq
-            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
+            VoHcgQd79wo0Q107wcp3ftMak010/NweAER1CFtCDBE6DAS05qaaOwwM3erusaw2
-            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
+            ZY/ezGULEmSgZ8RA3HHjtxo1ExLMZ+CpPb0mAAamql8O0uCpLl0TRkWvR4zwpo2K
-            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
+            ojOTW2dLjhJwJaodAMnKQm8mWtegC8Uektw1RdYCbCTD4sKv9vkxymnSLmE3dvWD
-            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
+            Htp/hCSTqDCc0sSBDdagIZWo8VtdduWqeGG7+Qs1wY+NizSlYRDmEsahbgPk9Bcu
-            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
+            W7vhpJFZ/98jxEmgaiUVJ3BVqZYiJBdDk4GvSw+/QmyNvd39xNLXIN3DcRTLmqvS
-            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
+            XgH/TZt96utCGDUjYFAFw4s4UL3EhttfDe+hSwzrAcslhjyeCORFhYrnwOncCr51
-            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
+            tr+maBFPip6FgASJQjDVnxtw9zFDfurbx8W2wk9uh6w3qw4jbGDq9wsI0wvfous=
-            =wlYf
+            =C10g
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml

@@ -42,3 +42,18 @@ spec:
         selector:
           dnsZones:
             - semery.fr
+      # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun)
+      - dns01:
+          webhook:
+            groupName: acme.saggar.dev
+            solverName: porkbun
+            config:
+              apiKey:
+                name: porkbun-api-credentials
+                key: api-key
+              secretApiKey:
+                name: porkbun-api-credentials
+                key: secret-key
+        selector:
+          dnsZones:
+            - saggar.dev

kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - clusterissuer.yaml
   - ovh-credentials-secret.yaml
   - ovh-secret-reader-rbac.yaml
+  - porkbun-api-credentials-secret.yaml

kubernetes/infrastructure/cert-manager-issuer/porkbun-api-credentials-secret.yaml

@@ -0,0 +1,49 @@
+# Porkbun API Credentials for DNS-01 Challenges (saggar.dev)
+#
+# Create an API key at https://porkbun.com/account (API Access section), and
+# enable API access on the domain: Domain Management -> Details -> API Access
+# (disabled per domain by default; the API returns a generic error otherwise).
+#
+# The secret MUST live in the cert-manager namespace: for a ClusterIssuer,
+# cert-manager reads webhook credential secrets from its cluster resource
+# namespace, which the webhook chart's RBAC already covers.
+#
+# SOPS will encrypt the stringData fields on pre-commit.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: porkbun-api-credentials
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-porkbun
+        app.kubernetes.io/component: porkbun-api-credentials
+type: Opaque
+stringData:
+    api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str]
+    secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str]
+sops:
+    lastmodified: "2026-09-27T23:12:14Z"
+    mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str]
+    pgp:
+        - created_at: "2026-09-27T23:12:14Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG
+            irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE
+            TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p
+            9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT
+            4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09
+            xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy
+            THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C
+            kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy
+            cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ
+            rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN
+            MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS
+            XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P
+            qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm
+            =AViA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/infrastructure/cert-manager-webhook-ovh/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cert-manager-webhook-ovh
         namespace: cert-manager
       chart: cert-manager-webhook-ovh
-      version: "0.9.16"
+      version: "0.9.17"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: cert-manager-webhook-porkbun-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomizeconfig.yaml

@@ -0,0 +1,11 @@
+nameReference:
+  - kind: HelmRepository
+    version: v1
+    fieldSpecs:
+      - path: spec/chart/spec/sourceRef/name
+        kind: HelmRelease
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/infrastructure/cert-manager-webhook-porkbun/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: cert-manager
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager-webhook-porkbun
+        namespace: cert-manager
+      chart: cert-manager-webhook-porkbun
+      version: "2.0.7"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: cert-manager-webhook-porkbun-values

kubernetes/infrastructure/cert-manager-webhook-porkbun/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: cert-manager
+spec:
+  interval: 1m
+  url: https://porkbun.octabits.io

kubernetes/infrastructure/cert-manager-webhook-porkbun/values.yaml

@@ -0,0 +1,49 @@
+# cert-manager-webhook-porkbun Values
+# groupName must match the ClusterIssuer webhook stanza
+groupName: acme.saggar.dev
+# cert-manager deployment configuration for RBAC
+# The chart creates RoleBindings so cert-manager's service account can reach
+# the webhook and read the Porkbun credential Secret
+certManager:
+    namespace: cert-manager
+    serviceAccountName: cert-manager
+# Restrict the webhook's Secret read access to the Porkbun credentials only
+rbac:
+    secretAccess:
+        secretNames:
+            - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str]
+# Pod configuration
+replicaCount: 1
+resources:
+    requests:
+        cpu: 10m
+        memory: 32Mi
+    limits:
+        memory: 128Mi
+sops:
+    lastmodified: "2026-09-27T22:55:14Z"
+    mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str]
+    pgp:
+        - created_at: "2026-09-27T22:55:14Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32
+            S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY
+            9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3
+            A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS
+            Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr
+            an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+
+            CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX
+            PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4
+            FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr
+            ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus
+            SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS
+            XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1
+            FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00=
+            =yh2A
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/infrastructure/mail/stalwart/release.yaml

@@ -14,7 +14,7 @@ spec:
         name: stalwart-helm
         namespace: stalwart
       chart: stalwart
-      version: "0.7.16"
+      version: "0.7.21"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -7,7 +7,7 @@
 # Container image
 image:
     repository: stalwartlabs/stalwart
-    tag: v0.16.20
+    tag: v0.16.24
     pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1

kubernetes/infrastructure/traefik/values.yaml

@@ -9,6 +9,11 @@ ports:
             trustedIPs:
                 - 127.0.0.1/32
                 - 10.0.0.0/8
+        transport:
+            respondingTimeouts:
+                # v3 default is 60s, counted over the whole request body:
+                # large HTTP git pushes die with a 504 past one minute.
+                readTimeout: 5m
 # Tolerate failover node
 tolerations:
     - key: ENC[AES256_GCM,data:r4uAu1ni9/Z8,iv:aKgn6DgT9XnjzmotnaEIL+WzUiQ34CazfervJwrYsdM=,tag:EeOY1YZwNCOPgHwXpas3ew==,type:str]

kubernetes/kustomization.yaml

@@ -29,12 +29,14 @@ resources:
   - dev/gitea
   - dev/harbor
   - dev/renovate
+  - dev/pkgatlas
   # Home (home automation)
   - home/home-assistant
   - home/zigbee2mqtt
   # Personal (apps storing my own content, grouped by content type)
   - personal/paperless
   - personal/radicale
+  - personal/syncthing
   - personal/media/photoprism
   - personal/notes/notesnook
   - personal/notes/obsidian-livesync
@@ -44,6 +46,8 @@ resources:
   - utilities/open-webui
   # Production (public-facing websites/apps)
   - production/buildpath
+  - production/saggar
+  - production/get-saggar
   - production/semery-fr
   - production/umami
   - production/vhaudiquet-fr

kubernetes/personal/notes/notesnook/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: notesnook
         namespace: notesnook
       chart: notesnook
-      version: '1.0.32'
+      version: '1.0.38'
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/openclaw/kustomization.yaml

@@ -5,5 +5,6 @@ resources:
   - openclaw-instance.yaml
   - openclaw-secrets.yaml
   - networkpolicy.yaml
+  - networkpolicy-lan-egress.yaml
   - networkpolicy-mail-egress.yaml
   - networkpolicy-radicale-egress.yaml

kubernetes/personal/openclaw/networkpolicy-lan-egress.yaml

@@ -0,0 +1,39 @@
+# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
+# only allows DNS (53) and TCP 443 outbound, so any other port toward the local
+# network is dropped. That blocks the OpenClaw pod from reaching LAN services
+# that do not speak HTTPS on 443. Measured from inside the pod against
+# 10.4.1.222, 443 returns RST (admitted, nothing listening) while 7020 times
+# out, which shows LAN routing works and only the port is being refused.
+#
+# The egress rule below sets no `ports`, because the goal is arbitrary LAN
+# services rather than one known port. Cluster CIDRs are excluded so this does
+# not become a blanket "any pod, any port" grant; the LAN is what gets admitted.
+# Note this is additive to the operator's rules, so DNS and 443 everywhere still
+# hold.
+#
+# Written as a sidecar policy rather than via the CR fields
+# spec.security.networkPolicy.additionalEgress / allowedEgressCIDRs, matching
+# the existing networkpolicy-mail-egress / -radicale-egress pattern. Those CR
+# fields DO appear in the 0.39.0 CRD template, contrary to the comments on the
+# sibling policies, so they are worth retrying once the installed CRD version is
+# confirmed. Until then the sidecar route is the one known to take effect.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openclaw-lan-egress
+  namespace: openclaw
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openclaw
+      app.kubernetes.io/name: openclaw
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+            except:
+              # Service CIDR and pod CIDR (infra/kube/talconfig.yaml).
+              - 10.96.0.0/12
+              - 10.244.0.0/16

kubernetes/personal/paperless/postgres-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: postgres
-      version: "0.20.4"
+      version: "0.20.6"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/redis-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: redis
-      version: "0.34.26"
+      version: "0.35.4"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/radicale/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: derwitt
         namespace: radicale
       chart: radicale
-      version: "2.1.0"
+      version: "2.1.2"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/syncthing/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: syncthing
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: syncthing-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/personal/syncthing/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/personal/syncthing/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: syncthing
+  labels:
+    app.kubernetes.io/name: syncthing
+    app.kubernetes.io/component: file-sync

kubernetes/personal/syncthing/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: k8s-home-lab
+        namespace: syncthing
+      chart: syncthing
+      version: "5.2.0"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: syncthing-values

kubernetes/personal/syncthing/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: k8s-home-lab
+  namespace: syncthing
+spec:
+  interval: 1h
+  url: https://k8s-home-lab.github.io/helm-charts/

kubernetes/personal/syncthing/values.yaml

@@ -0,0 +1,152 @@
+# Syncthing continuous file synchronization
+#
+# Sync ports (22000 TCP+QUIC, 21027 UDP) are exposed through LoadBalancer
+# services on the dedicated Cilium pool IP 10.2.2.7 (appended to
+# kubernetes/system/cilium/pool.yaml). The GUI goes through Traefik like the
+# other *.lan services.
+controller:
+    replicas: 1
+image:
+    repository: syncthing/syncthing
+    tag: "2.1"
+env:
+    - name: TZ
+      value: Europe/Paris
+    - name: PUID
+      value: "1000"
+    - name: PGID
+      value: "1000"
+podSecurityContext:
+    fsGroup: 1000
+service:
+    main:
+        ports:
+            http:
+                port: 8384
+    # Sync protocol and QUIC share 22000 on the pooled IP; LAN discovery
+    # rides on UDP 21027. externalTrafficPolicy Local preserves client IPs.
+    listen:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            listen:
+                enabled: true
+                port: 22000
+                protocol: TCP
+                targetPort: 22000
+            quic:
+                enabled: true
+                port: 22000
+                protocol: UDP
+                targetPort: 22000
+    discovery:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            discovery:
+                enabled: true
+                port: 21027
+                protocol: UDP
+                targetPort: 21027
+probes:
+    liveness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+    readiness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+ingress:
+    main:
+        enabled: true
+        ingressClassName: traefik
+        annotations:
+            external-dns.alpha.kubernetes.io/enabled: "true"
+        hosts:
+            - host: syncthing.lan
+              paths:
+                - path: /
+                  pathType: Prefix
+persistence:
+    config:
+        enabled: true
+        mountPath: /var/syncthing/config
+        storageClass: longhorn
+        size: 5Gi
+    # Shares are recreated by hand in the GUI after cutover — the instance
+    # boots with a fresh config (see plans/syncthing-docker-to-kube-migration.md):
+    # valentin's folders at /data/valentin/… and sarah's at /data/sarah/…, all
+    # backed by the same TrueNAS exports as the docker stack. Photoprism
+    # already mounts the valentin Photos export concurrently.
+    valentin-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Documents
+    valentin-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Photos
+    sarah-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Documents
+    sarah-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Photos
+resources:
+    requests:
+        memory: 512Mi
+    limits:
+        memory: 2Gi
+sops:
+    lastmodified: "2026-09-21T22:28:39Z"
+    mac: ENC[AES256_GCM,data:BR4P4s4C9n4bEHryqfHpzzFHxAlKeujFBO2Qhsc4qdkcI5dftJ7jrknWtW0uv1E2Aljp50Mx1Rk4wglaWh3MS/ZnY/1dUxCfKuXOGkv9+mymQxDk6zJLsUNTH7sMr5kzlVWfv3yzXF50HWuiNl71BAv4mtlrtarXS1KVQrCKNaA=,iv:aG9OxDOhwk7xYNbvESNMFnXIjKhbYNO0gvDn1a9QQvc=,tag:QxM3EX8V2KJzosRz5damrw==,type:str]
+    pgp:
+        - created_at: "2026-09-21T22:28:39Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//cvlMqPSaED2y5dsq8H/W/dqYVOeG7E/ZOuJGaYnImrrp
+            V2W6vPTzQ8QuYTKa1X4aOIlda04n7i2kDQCvpszmdpsU2y0SWtsgOBbyloIU3cAM
+            69HGd1SNqP/FayeZy/hHNvvEjmsgKX/9IV1YBGOcikmd7MqoxgGRgIxXORzY0dBG
+            7oREwV0HubdIBG6Fi6HUyN+Pugftpcumfwtl8ppPUYi1HGKzL5LzIT6gfqXtUcBg
+            8Wl2f0kMZsat1e05sZZah41dg+BAlyDgCRFo/ZQIhzHi28rJkZWG2aZxQfvAFMYJ
+            hUkjVyN7rAO01b2PsXK3bleFjD8iL8PhHY/Rio0/Uizjub7inako2SUd38D7X+ce
+            M1c2GoDVNmwZyXg7jBzb67JxLPn4Ic1kbjUi/JJL22rDzN0pBf6J7ExCpVGxrwK8
+            ++YDD1m/rY3YA8/ioM+pTu3ktEd1zu0T1yFySjgtvX8QVmOkrG1AA8E/N3+pzFWP
+            9wrJJ+yp5CYQl9d3j5LQcOzmvROi0EHjeZY75IHw8NwkyWdnRgWFIPsXxVoSUhSk
+            909RE//BuKSSRd1r9D/4w14Eb9KC74bIsUIflyK2Qs/N3rh9+/O8FS/5saryq7Er
+            GO3oAmFqC2F4Y6zFlmXkr43gBFjCPWl0DxI3uUK/gcw8kBpLSJex3j2sDaLViS/S
+            XgFsDLAjHnEo5DC+xyJQI5xMWsQzx/ASNZdBVLrnYPsRt+YG7qfu3lKNS9ujAG7K
+            ti58fACtT97K8IrUMNyEDGieFz65TYPcie4qILnDt2Hkr6QUEdBR8rvn/8z36D8=
+            =47Rw
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/production/get-saggar/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: get-saggar
+resources:
+  - namespace.yaml
+  - packages-auth-secret.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: get-saggar-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/production/get-saggar/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

kubernetes/production/get-saggar/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: get-saggar

kubernetes/production/get-saggar/packages-auth-secret.yaml

@@ -0,0 +1,38 @@
+# Basic auth for the private Gitea Helm repository (org `saggar`) —
+# same token as the saggar release's packages-auth-secret.yaml. The
+# pre-commit sops hook encrypts this file (name matches *secret.yaml).
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-packages-auth
+    namespace: get-saggar
+type: Opaque
+stringData:
+    username: ENC[AES256_GCM,data:bQ8HUwCqCEIWKQ==,iv:FFcNqBTrA2xJCD2EUf2k+8f1+8DZC9r7Z14Qns0TjH8=,tag:aKWUHSP+8yjbewr/vt3z8w==,type:str]
+    password: ENC[AES256_GCM,data:bfiHI6tHwtK1qYf9UdAplb5qNE7fceQDjUim3KlWU/sb4Q5mvqK6CQ==,iv:ZtRNqfWZLT1lSd/N9MGwKrRiTtKDBUBZUR1LUy00G40=,tag:f55oMGmPHQB8zMNWtChp+w==,type:str]
+sops:
+    lastmodified: "2026-10-04T21:14:09Z"
+    mac: ENC[AES256_GCM,data:pbOlIPfHMwbwyBHlwkTYwWSeWD2jxud2zlNYMDyYJmKRpUuf0/erqRUusTrVGUnOG1t7omu+hQycPC3im6v8mi0vECBlkVG3knQa46bnVH9m1qa7lVChuP53TLYZogrOA8Ol9omrLsUsdcPNJfwXTYS/HHkY+ujECnjCWiVoXUs=,iv:Al2lU2xt1Hvv1BokoOx5e1gOlJhxzMJNyyCosmlGDV0=,tag:OxMxotEvYI06Fjjwst++gA==,type:str]
+    pgp:
+        - created_at: "2026-10-04T21:14:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAgsXy5zMBbREVADgr2VVGgev6fHJUXq6DKCRhQdH1nsrI
+            xbSN1HZ2UbQjCYCjZl8NdVo3KGhJJ1uQGABAq6ZE+C4ZaMWvfjEO0/CnHmui8LkL
+            YXvJWWKvP/DDcmLXYxgwP8u/EWtn1bgXN7HeHxYb9JtGEf7XBlS9a6InWDmreabF
+            lSGkl79NgWDIngNQwTvby76uVARSAj3TkIxO6f4cVx+2f/c7KvWvX9D5vjrz8dpk
+            tPFdIhsCHdQS2wf2G3fEp4Yb8WnTEgu/HQ/amYwBAplhv3aaFQ0WVxCB91amnJyw
+            4Hnkcim4e/ZTmlBms/iQMFo+NhcHebRYcganIid23U8j4RfptwbuxED/txDEAAbj
+            lrgpknUXDG9RRRFTZfViYVJ4KWNduuUmVX4URYtn9d42BEXlXwx+Cd7FV40mlM8F
+            aT87F8G3IVexcKqLV15RngswCaCNJOnIT1vNNz18hz6sz8qXCzDwKIsS02wzkchz
+            1E8pi4grh2UkJT/F+mHUnze3ADOIZu6c2+SUwswVi+zAQg566dgFMYfKWc7icbvz
+            AWJ0hatHKNC4utZ2C0sCrM/34M0J507UMjlGKY9FUQ7wnHubPMfrum/FBNH1X7jM
+            F+iWsZ4N+kBnpY1Vf64S+97/Nqg5NZ3IBHWyqaSsWmR/h9628XDAa7kUpIsPK2LS
+            XgEGwyBsqJOWaYa7pXhIuul+1iNTJJ5FhU9qFQci708gund3RSvGJLtUIGlwSLUn
+            qzSSfl8vWujLNj9Pb0FcegVTYAq4eA59rJFILjyRZ64TaIfPBYxdFSD8t4zcWQQ=
+            =oHWG
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/production/get-saggar/release.yaml

@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: get-saggar
+    namespace: get-saggar
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: saggar
+                namespace: get-saggar
+            chart: saggar-dist
+            # Same CI scheme as the other saggar charts: timestamped
+            # versions on main pushes, exact versions on v* tags.
+            version: '>=0.1.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: get-saggar-values

kubernetes/production/get-saggar/repository.yaml

@@ -0,0 +1,13 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: saggar
+    namespace: get-saggar
+spec:
+    interval: 1m
+    # The org-scoped chart repository CI publishes to — namespace-
+    # scoped like every app, so this release carries its own copy of
+    # the repo and its auth secret.
+    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
+    secretRef:
+        name: saggar-packages-auth

kubernetes/production/get-saggar/values.yaml

@@ -0,0 +1,50 @@
+# Chart: https://git.vhaudiquet.fr/saggar/saggar (chart/saggar-dist).
+# One single-node Garage, one bucket: the S3 API stays cluster-
+# internal (chart default — the publish workflow uploads from the
+# in-cluster runners, s3.ingress.enabled=false) and the bucket serves
+# as a public read-only website. The host MUST be <bucket>.<root
+# domain> — Garage resolves the bucket from the Host's first label —
+# so bucket `get` on get.saggar.dev.
+bucket: get
+garage:
+    # Single-node store: skip the hourly self-sync cycles — while a
+    # full sync runs, S3 auth lookups transiently answer
+    # InvalidAccessKeyId, which is what kept failing the edge job's
+    # prune step. Weekly.
+    fullSyncInterval: 604800
+web:
+    ingress:
+        className: traefik
+        host: get.saggar.dev
+        # TLS terminates at Caddy with the cert-manager saggar.dev
+        # certs; Caddy proxies to Traefik by host, so no tls block
+        # here (same as the other saggar hosts).
+        tls:
+            enabled: false
+sops:
+    lastmodified: "2026-10-06T04:20:10Z"
+    mac: ENC[AES256_GCM,data:ncXYOdUYTaYikkKWVUzWinakZVV7tjja31QIo/xhibZ8Jc9L/dl9U8//xJ95Hlb9uuMJvUHvk78KmH2mYVQhfhyNwkNZXvK3o3azx+WWQYaZebEudRbXdHO6gyywcoywlEFuaVWjVsTpggz2VtlNwP/tqLCf41uTUJB4NZi12uU=,iv:uj13/y/iGeoyqgnx74wh1Pzb01NupeLW55qBhCBNleM=,tag:PGmmMZCw49wt8RmpJH1CzQ==,type:str]
+    pgp:
+        - created_at: "2026-10-06T04:20:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+MH/izXRcAzwF1Dp5mgQBthTFYX01sUpjU9y5Z9jeRnny
+            UgtCuURwaI41nG+ZOrv3yy2dSsgABMgr8nZZEju/Tb+jZ/qzkPR8JWTpiieXefH4
+            Q5lEy6l1rLVOJudsgx7BG07h6gqr0Mu89gcpFThkXiCo5eAV/hlY9Y6eG6ZybWZ/
+            K2bUv8JB09S8ZsuFsTqp87lZMogWFcIjO8JMirjWRxgd+1NZFoGmSIb+6KkLTD2+
+            eMjbLnGZ3HyWLSzJBRkF5bGgODNGA8qaHmKKMTT8/H9zD1Z++nKCrx7SQpoStQxw
+            xluXAyefTiwCqhEVT42C68Lhz5pH6AyHgJGmls/NWv6bvj/3AQwXlkO87Xkd8x3L
+            aEDHIc5rEso18IZuNzlI193AEhipT8mcMi8IFA4YbnVnkK86PSXQ7qWrbbc4BmkN
+            cU/vUlpBM1HeiYdTFZf8Dvfw55bNn/pMhPhoLWpHjAnAEDJdrVh33OTurdmtYTRW
+            nRK3q2WVHa+UGlkKfdpKr1ivZ9O4ulSfyIYKVsLI5sYAbkJ4o6ytlcQlK6E/7AEK
+            Ux/KAnTb5nXOLN8Vbq0xGlyjYei0GY+IZWkkWL80k59NFfrDLXtG/zCxE74ANplm
+            qx+dCbggjT2lNsM+homldhYU0VhDnvrWM1/9bRI3DUVUxfGUCKMTqUj2b97vLGDS
+            XgHGOTHKKTQjpEg7DnnSS/romTxglHrAEa/3Cu4S4uUVIK7aL8JIoHXYaHho6Jp1
+            9RpCscjyeMfE/wnyTbeR1OZ6wnIMuLXzVzma0fy0fbYqGhJllULpMgsZGe6bhpI=
+            =MIya
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/production/saggar/gitea-oidc-secret.yaml

@@ -0,0 +1,40 @@
+# Gitea OIDC client credentials for the saggar login provider — the
+# OAuth2 application registered on git.vhaudiquet.fr (Profile →
+# Applications → OAuth2), with redirect URI
+#   https://saggar.dev/auth/callback/gitea
+#
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-gitea-oidc
+    namespace: saggar
+type: Opaque
+stringData:
+    client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str]
+    client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str]
+sops:
+    lastmodified: "2026-09-30T20:30:47Z"
+    mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str]
+    pgp:
+        - created_at: "2026-09-30T20:30:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76
+            C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u
+            isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu
+            rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F
+            9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9
+            Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw
+            Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN
+            96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7
+            aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP
+            z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz
+            Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S
+            XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/
+            rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs=
+            =GpPh
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/production/saggar/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: saggar
+resources:
+  - namespace.yaml
+  - packages-auth-secret.yaml
+  - gitea-oidc-secret.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: saggar-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/production/saggar/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

kubernetes/production/saggar/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: saggar

kubernetes/production/saggar/packages-auth-secret.yaml

@@ -0,0 +1,38 @@
+# Basic auth for the private Gitea Helm repository (org `saggar`) —
+# the same access token also goes into values.yaml's imageCredentials
+# for the container pulls (the chart renders the imagePullSecret).
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-packages-auth
+    namespace: saggar
+type: Opaque
+stringData:
+    username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str]
+    password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str]
+sops:
+    lastmodified: "2026-09-30T20:30:48Z"
+    mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str]
+    pgp:
+        - created_at: "2026-09-30T20:30:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv
+            Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf
+            OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8
+            cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m
+            xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p
+            BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2
+            airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr
+            ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS
+            KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L
+            f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s
+            EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S
+            XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks
+            Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ=
+            =ZysC
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/production/saggar/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: saggar
+    namespace: saggar
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: saggar
+                namespace: saggar
+            chart: saggar-hub
+            version: '>=0.2.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: saggar-values

kubernetes/production/saggar/repository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: saggar
+    namespace: saggar
+spec:
+    interval: 1m
+    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
+    secretRef:
+        name: saggar-packages-auth

kubernetes/production/saggar/values.yaml

@@ -0,0 +1,105 @@
+# Hub mode (the chart default): intake + registries + web UI, with
+# artifacts in the release's embedded Garage store (chart default in
+# hub mode, longhorn-backed). Builds happen on runners from the
+# saggar-worker chart, to be paired against this hub once it is up.
+image:
+    repository: git.vhaudiquet.fr/saggar/saggar
+    # Empty: follows the chart's appVersion — the commit SHA CI stamped
+    # on the pushed images.
+    tag: ""
+# Private Gitea registry: the chart renders an imagePullSecret from
+# these. Same access token as packages-auth-secret.yaml (the
+# pre-commit sops hook encrypts this file).
+imageCredentials:
+    create: true
+    registry: git.vhaudiquet.fr
+    username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str]
+    password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str]
+# Login via the home Gitea: the engine is the confidential client of
+# the provider and runs every code exchange, so its discovery drives
+# the endpoints (issuer verified live). Credentials live in
+# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
+# id in too), so nothing sensitive renders into the ConfigMap. The UI
+# needs nothing: it discovers the provider from the engine's open
+# /auth/methods.
+auth:
+    # The web origin the device login names: `saggar login` prints the
+    # confirmation page under it (saggar.dev/device).
+    uiUrl: https://saggar.dev
+    providers:
+        - name: gitea
+          issuer: https://git.vhaudiquet.fr
+          existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str]
+          clientIdKey: client-id
+          clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str]
+storage:
+    garage:
+        # Single-node store: skip the hourly self-sync cycles — while a
+        # full sync runs, S3 auth lookups transiently answer
+        # InvalidAccessKeyId. Weekly.
+        fullSyncInterval: 604800
+ingress:
+    enabled: true
+    className: traefik
+    # The engine host: CLI intake + the docker/apt registry front-ends.
+    host: api.saggar.dev
+    # The chart's default annotations are nginx-specific (SSE
+    # buffering); traefik streams unbuffered by default, so clear them.
+    annotations: {}
+    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
+    # Caddy proxies to Traefik by host, so no tls block here (same as
+    # pkgatlas's ingress).
+    tls:
+        enabled: false
+ui:
+    # Sign-in redirect base — the UI's own public origin.
+    publicBaseUrl: https://saggar.dev
+    # The engine's public origin for the docker pull / apt usage lines.
+    # Set explicitly: the chart derives it from the hub ingress, whose
+    # tls is off here (Caddy terminates) — that would render http://.
+    apiPublicOrigin: https://api.saggar.dev
+    ingress:
+        enabled: true
+        className: traefik
+        # The UI lives on its own host: the engine mounts its API and
+        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
+        # pages also use.
+        host: saggar.dev
+        annotations: {}
+        tls:
+            enabled: false
+docs:
+    # The chart deploys the book by default; the ingress renders as
+    # soon as a host is set (no enabled knob).
+    ingress:
+        className: traefik
+        host: docs.saggar.dev
+        tls:
+            enabled: false
+sops:
+    lastmodified: "2026-10-06T04:20:10Z"
+    mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str]
+    pgp:
+        - created_at: "2026-10-06T04:20:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK
+            3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer
+            z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn
+            9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF
+            9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH
+            h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0
+            4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg
+            HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf
+            Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR
+            NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD
+            ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS
+            XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns
+            MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk=
+            =3vCq
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/system/cilium/pool.yaml

@@ -8,3 +8,4 @@ spec:
   - cidr: "10.2.2.4/32"
   - cidr: "10.2.2.5/32"
   - cidr: "10.2.2.6/32"
+  - cidr: "10.2.2.7/32"

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -15,6 +15,7 @@ spec:
   dependsOn:
     - name: cert-manager
     - name: cert-manager-webhook-ovh
+    - name: cert-manager-webhook-porkbun
   decryption:
     provider: sops
     secretRef:

kubernetes/system/flux/cert-manager-webhook-porkbun.yaml

@@ -0,0 +1,20 @@
+# Flux Kustomization for cert-manager-webhook-porkbun
+# Depends on cert-manager being fully operational (CRDs installed)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
+  dependsOn:
+    - name: cert-manager
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - webhook.yaml
   - cert-manager.yaml
   - cert-manager-webhook-ovh.yaml
+  - cert-manager-webhook-porkbun.yaml
   - cert-manager-issuer.yaml
   - caddy-certificates.yaml
   - stalwart-certificates.yaml

kubernetes/system/kyverno/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: kyverno
         namespace: kyverno
       chart: kyverno
-      version: '3.9.0'
+      version: '3.9.1'
       interval: 5m
   # Minimal footprint for a single-node cluster:
   #  - admissionReports disabled (no extra Redis/Postgres)