# Caddy Edge Proxy
replicaCount: 2
# Listen on standard HTTP port
listenPort: 80
# Enable HTTPS
https:
    enabled: true
    port: 443
image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
    tag: 2.11.2
service:
    type: LoadBalancer
    externalTrafficPolicy: Local
# Disable ingress - Caddy IS the edge proxy
ingress:
    enabled: false
resources:
    requests:
        cpu: 100m
        memory: 128Mi
    limits:
        cpu: 500m
        memory: 256Mi
# Caddy needs root to bind to ports 80/443 and write runtime data
# Using restrictive security context causes "operation not permitted"
podSecurityContext: {}
securityContext: {}
health:
    path: /
    port: 9999
# Extra volumes: TLS certificates from cert-manager + external routes ConfigMap
volumes:
    - name: vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:VQPfRq0dCtIN5nnubua5o34=,iv:TMieVEMpFldPMT4YJnEd6ecvOC9PWhpWpCe4u30Rg2E=,tag:7ZMIryVzEtGBZTzLj5a76g==,type:str]
        optional: ENC[AES256_GCM,data:EPxqBw==,iv:HYAyOFMAMMXPLFCcmgqC5XNTqenL5A/ZqK7Td/x81mg=,tag:uRdyTRPjbP1bUreP9cwj2w==,type:bool]
    - name: wildcard-vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:ohWn2gmc4WkRV59KTd9sRsbbHQqwiIMLpl0=,iv:hmLbftvEF7kDz2ZqrPCUhwD2QV/S34QQVcCKyYcSR0U=,tag:Ok8enop6KDGqwCpoCS+52Q==,type:str]
        optional: ENC[AES256_GCM,data:6W/i/Q==,iv:zcVzTOGfC4ki4ZfY3PkMyhNC0u1t39QG1Uoxb07QrWo=,tag:I6pcotOaeaTErrQBu8itdw==,type:bool]
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:w5YPfljvWgH0V5tkKw==,iv:atxebg81R2BztmDPORRFs/HJRNHIejvdL+wPz/NoRFU=,tag:VJynVAHGoh/yQmibnz4CDA==,type:str]
        optional: ENC[AES256_GCM,data:U+HoTA==,iv:I6lUk9k1eL5U4OYeZW96CLPdGmHZ1TJVaPGesMH623g=,tag:8IIpdcPoD65vDPy40utJIQ==,type:bool]
    - name: wildcard-semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:lD0v/r4YvzPN+Xa617BEjjwDQfZARQ==,iv:ByAUmmfli9pU1on7I3h2cbATaHqXGIEzDS79zoCxyU4=,tag:6+ZSzIwhaD2XVJbn4/iEcg==,type:str]
        optional: ENC[AES256_GCM,data:J5m77g==,iv:dqGRx5zVtr2IbR4fruHuJ+9lX4N2RUqDXFbFqJcL7I4=,tag:vc5pCXQzqmJxOadRa5OetQ==,type:bool]
    - name: buildpath-win-tls
      secret:
        secretName: ENC[AES256_GCM,data:ylwpc1mncHCXEoucDxVJanM=,iv:+vzMspw9NPcT6LGvLJv+5CPSmKmMsUgl0usMHTAOoGo=,tag:mvdt+ty2+LdANic5Mk7avA==,type:str]
        optional: ENC[AES256_GCM,data:B/DGpQ==,iv:2h1FOz4onqxRUyDVTXdTKGphUnHNKDDEF6IPPnze24g=,tag:AINZfLh8wen4ClUeGejdxg==,type:bool]
    - name: routes
      configMap:
        name: caddy-routes
# Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key
volumeMounts:
    - name: vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/vhaudiquet-fr
      readOnly: true
    - name: wildcard-vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr
      readOnly: true
    - name: semery-fr-tls
      mountPath: /etc/caddy/certs/semery-fr
      readOnly: true
    - name: wildcard-semery-fr-tls
      mountPath: /etc/caddy/certs/wildcard-semery-fr
      readOnly: true
    - name: buildpath-win-tls
      mountPath: /etc/caddy/certs/buildpath-win
      readOnly: true
    - name: routes
      mountPath: /etc/caddy/routes
      readOnly: true
# Caddy configuration
config:
    debug: false
    # Global options (goes inside the global {} block)
    global: |
        auto_https off
    # The main Caddyfile content - imports routes from external ConfigMap
    # This keeps routes in a separate, easily editable file
    caddyFile: |
        :80 {
            redir https://{host}{uri} permanent
        }

        import /etc/caddy/routes/Caddyfile
affinity:
    podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                    matchLabels:
                        app.kubernetes.io/name: caddy
                topologyKey: kubernetes.io/hostname
tolerations:
    - key: ENC[AES256_GCM,data:huw9H7nWgpK2,iv:mLMip5c1ubS8ZnipsDIBpmy6qdP5viG73Dn9dBJJbLo=,tag:MAFiUjJX/1updYbzpSCS8w==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:6ScxT0nUuKU=,iv:skaDlzXbBXGQHjk/SnKrNCvHVe3JovnWMtpA6zhqlFo=,tag:LAW6xol1cASA/tYwab7AVQ==,type:str]
      effect: NoSchedule
sops:
    lastmodified: "2026-07-22T15:24:50Z"
    mac: ENC[AES256_GCM,data:K3c6hp9KPe9s992kaGJ60jCLN2FAvKnTLA44EQ0IG7FPHL5FFMbWNBxukQmI2q5E0U6oLzO7JlmOh4ZGRScIi2Z2gRz9td6DTYNBYvgO45kLFJrRAe7D0V5cb28WW44w1OhN+4ETw7VuU24kwKGHYergn5eBo1JtNLnty96ToLY=,iv:X2MkW15mPps4gVR4Pscx72t78wsLWlcRrxZJVKTMC1I=,tag:8ku82p8BIasJ3a/pkDSZTw==,type:str]
    pgp:
        - created_at: "2026-07-22T15:24:50Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiARAAsoEMSw07cHFenSUrbW+prBls/qB4YT0vkZ4Pjpp2zyzw
            UTTASjXSYXYGutOkQgO42vtKE5HkEh+FB2qhWnLy9on4xPR/epFJox0Y+EFWPLQJ
            fu7Q+C+aG9JqoFgsBX+7JAPMHcH/afT4SGvvfOMTC3+aOLiFFyicbqZtkumw9bCr
            jD7VLRvPALTLokPdoer3cmY99bIQ9+51ms/cc1/SNXv8qxR+CKG1wnqtYBSdhUtY
            vTIuEY3uIrYfxJlKlsyCRQj1RPj6o64+IsLcwXTNV5WHuy7srrsSMf7qFsD9f4ZV
            7a17K/6JaRom62YqPn73HoyktBf71oPePwl8xeHqs3En/VS1T8MRa7dQjD7Qb4Xo
            00eLRGTOqTJlVmtMOg6ZqQiROmAS9W9X0ZOv4uxLK2fDG48WrDIcZMuBzI4OQaY+
            prSeVvkcZm9cTrNHj8ZWxgWHp04qPBFWg0tqXSyXnr0cXjLUI/cOqis5+segHeSt
            B8n8E/rLZqhvBrB58/3PaWvSRWVEAD2L1zBbNrfCleDsHIN+SgfPkPdvzEv4JYk8
            bVauG9wZh6Z3fgoT0NgzG8XtquIShviw2q5EOE3VEh1X1O90aLOpvQH4YJddgSBB
            i8VjACMnq+NPODJVIJCzqI5bHyhq1K666/HpMTR2H9eWCCmfB6HVhpJ37tdA/S/S
            XgHwqbomlaxeU6e5pkUXHaxO336ObSA6/75/UZQSdQUqwZVkFOzQDE6CADE+p/qG
            mYahltV1nQRdkLa8bNC6oLtPteeKP9DhmYV60LaB1ZYE5qE5CAypl7YLy2+Ql0Y=
            =oRLO
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
    version: 3.10.2