# Caddy Edge Proxy
replicaCount: 2
# Listen on standard HTTP port
listenPort: 80
# Enable HTTPS
https:
    enabled: true
    port: 443
image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
    tag: 2.11.2
service:
    type: LoadBalancer
    externalTrafficPolicy: Local
# Disable ingress - Caddy IS the edge proxy
ingress:
    enabled: false
resources:
    requests:
        cpu: 100m
        memory: 128Mi
    limits:
        cpu: 500m
        memory: 256Mi
# Caddy needs root to bind to ports 80/443 and write runtime data
# Using restrictive security context causes "operation not permitted"
podSecurityContext: {}
securityContext: {}
health:
    path: /
    port: 9999
# Extra volumes: TLS certificates from cert-manager + external routes ConfigMap
volumes:
    - name: vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:8yVGk/GzrpbiCqJ9UTw0oDc=,iv:Ohjd+HCq3MFmtKbm+pBQiKlmFNP4JkFc+AONIC/PHqs=,tag:1XODR5Iql8qUv46XYa2dqA==,type:str]
        optional: ENC[AES256_GCM,data:VpA7hg==,iv:ULFkbNhBVk+PocEJuA92WHbN7FEFo9fB0gmYIFX2Z2g=,tag:wlFERzZBd+feEzFa1h5XuA==,type:bool]
    - name: wildcard-vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:nQro2bZ6YsXwZrMOsy0hTuMKZIsKb6+SScs=,iv:Q2berXQ9SK+5tbieVVPlQKJXL3WyiUdeF6k6JkVELkI=,tag:yikVTPmw9bvYFL8x24ukDw==,type:str]
        optional: ENC[AES256_GCM,data:89Leqg==,iv:msFKdGUVrS3JNbXrEhZVytAUP9n4Zn7vRKi+CGlAskg=,tag:EvkFKSp5IoN0wwjlVgTRdw==,type:bool]
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:mPCCdQWSaNqggoUd4w==,iv:BPRWpefGUqvU3cB0EizGHU1YeDrW/hpIpoZGGVLp1J8=,tag:ha62KjKlvHLz67wS8DcMTw==,type:str]
        optional: ENC[AES256_GCM,data:RSuCFA==,iv:peeRvBgETj1CF2ztAWYc2XB4Ax1mNhHORJTXALq8mPI=,tag:FdciCmDVuMRAtuTBQSPkgQ==,type:bool]
    - name: wildcard-semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:Fr1/La6TFi5g2bla5K2hmkws64ERKg==,iv:z1GhdRlwhZ8sSCuErhlY0oUKjmWi6ebQVGJMrCXKpyI=,tag:FYRkF4ytPpY35MulSH4vow==,type:str]
        optional: ENC[AES256_GCM,data:tk2L/g==,iv:8JRVWyg1V85cIuY5PMbbHbV/O9JchU4gQujUCuH7XP8=,tag:adjCjpsfdhO+j19eli6iQQ==,type:bool]
    - name: buildpath-win-tls
      secret:
        secretName: ENC[AES256_GCM,data:SuAPkjrpmTrLYSnzlA/XXaE=,iv:B18X9kXLBUu/z+a4Pm9PpF7KlDMDSq1D5+TiDdQqVBc=,tag:0rmiKeyMLoU2p2/AE+0g3w==,type:str]
        optional: ENC[AES256_GCM,data:lbJgJA==,iv:UQaPXizf31afW+RpH6an6KrGlnzbWW4O6OOepDrlgcY=,tag:xo7k3bwTj1im5SuY/BvZlQ==,type:bool]
    - name: routes
      configMap:
        name: caddy-routes
# Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key
volumeMounts:
    - name: vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/vhaudiquet-fr
      readOnly: true
    - name: wildcard-vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr
      readOnly: true
    - name: semery-fr-tls
      mountPath: /etc/caddy/certs/semery-fr
      readOnly: true
    - name: wildcard-semery-fr-tls
      mountPath: /etc/caddy/certs/wildcard-semery-fr
      readOnly: true
    - name: buildpath-win-tls
      mountPath: /etc/caddy/certs/buildpath-win
      readOnly: true
    - name: routes
      mountPath: /etc/caddy/routes
      readOnly: true
# Caddy configuration
config:
    debug: false
    # Global options (goes inside the global {} block)
    global: |
        auto_https off
    # The main Caddyfile content - imports routes from external ConfigMap
    # This keeps routes in a separate, easily editable file
    caddyFile: |
        :80 {
            redir https://{host}{uri} permanent
        }

        import /etc/caddy/routes/Caddyfile
affinity:
    podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                    matchLabels:
                        app.kubernetes.io/name: caddy
                topologyKey: kubernetes.io/hostname
tolerations:
    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
    - key: ENC[AES256_GCM,data:NRDaGFsisFgI,iv:omVIeFSVOwPcw7KNWg/4QXzlAP9w4+kD5OJ8yPiYVh8=,tag:/j1a+M+fMJ+atgY/1mq5Jg==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:H1pBkT7SQIY=,iv:KJBPkp87bLZTxp77cGxIt5BDohOoQhHR1J7sJaQ5T0U=,tag:iJP0ZLD2WyomZKLfBb/6aw==,type:str]
      effect: NoSchedule
    - key: ENC[AES256_GCM,data:F8rnzC8iAPEzW6fqpB9QPbd/TrzsbCkmMY4FNqWJlzgN74BJhw==,iv:2jF4voeRd+4ebyZGcwjGXpbPuqZWsflVDh6PQh+MR8k=,tag:jxfSUHxjo/kCA/2JVIBklA==,type:str]
      operator: Exists
      effect: NoSchedule
sops:
    lastmodified: "2026-07-25T08:12:52Z"
    mac: ENC[AES256_GCM,data:1xu02X8h8ws1W2lMyJyOchWKtz+4zuaddoyDnjkEFYdwoe6IkSBHUpEchQTocpkQHltdCyOHVG0n/MYTDcWPe5NoTTnZPZqYFKo09ppwjH8QdVQIaq4P/braXt5aWUkXpsANliphh56yH42SHwBTbsMETtgngqFwafgfhKlH7i0=,iv:oHXPqmVpnCotn3Tx6rdZZAI/ia7ullE9a8g/RRDxPWI=,tag:bSEWo8vz4ZwAwukVpJ+awQ==,type:str]
    pgp:
        - created_at: "2026-07-25T08:12:52Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiARAAhdj84mRfiKoTwMUeVydsrYVo6CFtccsY2cwGlCEyU9tb
            mqmh/K+TQlCvr7xpKT2txZAL5OLEuTjrKkcyXJ8JDLD8a0B5yvoHac2qNvgGdfKw
            icYf+jt5WF4nzS9efhTIJ2/0X8m5X37VNP4qFZ5I1XXH+qdZQS2i/i8wNmspPW7e
            6wYVIWg88ntqRbFtM4nUNtZp3weCou9wpfvJXV7R9U+dQlP+nHYac2usyGwoE9Pw
            yHEbNnVXV+ewPHy98NEjbWNfnKoneN2IyDkKbYAAR7wL0qEo2huYadH/TQY4VHD2
            m0H4JNzr6VtmlLpt7Licyi90/JDB7UYIGqfZhjBzdxEKoG0RtwK2noOJhlsjsnL/
            kNlB48NSi8Kq9Z02czLQyAJe5nyYZjS0qRVLCfUF2gHWQX7hGlRjGLZ7GaDYheai
            JHY3tRxoEEq0dKGObcphF0qQIbD3kb2d/eCpz7ssKKIiXnA3aRdXiB8Ey/w8DCSA
            lx8au5Tv7vSpjkwO6fx/GXATsAFS82z1yd06KaqGpiK7plyk69GPqiFQairlbX2s
            Y9AoGRCtMPuB68vP7WsVfhpzt9Na8Af6XLhTIOgEpiac5qXs5N2u9Xf6tGxr+zBg
            JOI2JnFPZh5K7eZjw0nB9Kdn71FkNhji5zmVU9gmvfsE1sVI0dJ1hgctKSDE6ufS
            XgENHpB+cmsxQqLoWFibd0zaLC0ELNUBu15HmQx/16rpCvDFAIVXgRDUBXexfsRT
            P1acwrGZv6OsoR1YQV5bDUlvrNhOvI9PEiQjVIiod465FYffz6ek0qXCV7e1Kzo=
            =gG3R
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
    version: 3.10.2