# Caddy Edge Proxy replicaCount: 2 # Listen on standard HTTP port listenPort: 80 # Enable HTTPS https: enabled: true port: 443 image: repository: caddy pullPolicy: IfNotPresent tagSuffix: "" tag: 2.11.7 service: type: LoadBalancer # Cluster (not Local) so any node can forward to pods on any other node. externalTrafficPolicy: Cluster # Disable ingress - Caddy IS the edge proxy ingress: enabled: false resources: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 256Mi # Caddy needs root to bind to ports 80/443 and write runtime data # Using restrictive security context causes "operation not permitted" podSecurityContext: {} securityContext: {} health: path: / port: 9999 # Extra volumes: TLS certificates from cert-manager + external routes ConfigMap volumes: - name: vhaudiquet-fr-tls secret: secretName: ENC[AES256_GCM,data:D2xWOtTHFXl7bTLlsNFjEro=,iv:i3vheop7ASLCyF1ZIeh59ViCnrvQU/5e7Gy8Fsfc4E0=,tag:FQ+D8OLi0kMjhvYgPBgHwg==,type:str] optional: ENC[AES256_GCM,data:xLVbSQ==,iv:rLbyZVz2r3O4n7BYIKQE10RMbKDB1pF4UV3O2dzErU4=,tag:GOLUMif6wNICBQAHPhKfKg==,type:bool] - name: wildcard-vhaudiquet-fr-tls secret: secretName: ENC[AES256_GCM,data:OdqKNJjbvmKVxgMrTZ7hbzh/NAS3y9SBv1A=,iv:MLBUkpW05IK+/dGuDogx9zOjmHYTMFz2H0QW6dTTl0M=,tag:npbS+ZqBDwdrSiTEVNH6Jw==,type:str] optional: ENC[AES256_GCM,data:SyvgEA==,iv:TPm9h2WO428rsauBosgbVvAMgHAb9wEkxBVtITwFBfY=,tag:kVshZCShC7/Mc2CROqHfaQ==,type:bool] # semery.fr certs from cert-manager (OVH DNS-01) - name: semery-fr-tls secret: secretName: ENC[AES256_GCM,data:bvSLNmf5Og+W3A0lfA==,iv:i7k0xLKOnhPI+vtuRBQtej8NVIlCgxt8TgQXi9ARzUY=,tag:/GSbsAcEMOVGYg81oZUasg==,type:str] optional: ENC[AES256_GCM,data:Zip/dQ==,iv:nEc6ykKhmIuinWmfesEPWIeou/5lhHHvr4pJ4oqltiI=,tag:wKeOuUV7UepXRl/6+ynr8A==,type:bool] - name: wildcard-semery-fr-tls secret: secretName: ENC[AES256_GCM,data:VSNpS7a5hA3hgT75QChkcfejZM3u2Q==,iv:pHayamRJo2/McSWAMpQGGMayS0+gqwHVBoq2HYOO4mg=,tag:CFI70/UmYU0hDkGg6TKQlQ==,type:str] optional: ENC[AES256_GCM,data:ohcOzQ==,iv:Mx874e2brtx3mw3nyBRDNvHlN/TNkX3KeuR1IGv4SNI=,tag:hoFf1pIBUZcbdZtScrLYUA==,type:bool] - name: buildpath-win-tls secret: secretName: ENC[AES256_GCM,data:CayRdTe/1SeKMD2/zUKI7Rg=,iv:90+63nKSMYR6CvcQlkrFVYVUXCDbAjxgCvCGJ9saMNI=,tag:uEThP8zDAuR8GphhBfqQCA==,type:str] optional: ENC[AES256_GCM,data:H4Hvlg==,iv:gLz3SHoQeuwi7PtRHVvY+sx9WvjkRXjBqAJoMmk9xlo=,tag:0uwNn7dvfMSRedOGCTyazg==,type:bool] # saggar.dev cert from cert-manager (Porkbun DNS-01) - name: saggar-dev-tls secret: secretName: ENC[AES256_GCM,data:YPdpVHK/LiE4paOigTQ=,iv:qm4BTynQw4W8VL0dfBOZfIX5dvHqcMlj2zjJG8m1kDo=,tag:KGjXYivQIMliYDHu9Wj+Aw==,type:str] optional: ENC[AES256_GCM,data:CBphCg==,iv:RraJZATt6Ibc4OMTeD4sabxVM9Di7S4j/o75S9i+iOA=,tag:JpQ2yJQGe7yRy4ug3pA1WQ==,type:bool] - name: api-saggar-dev-tls secret: secretName: ENC[AES256_GCM,data:sXYq4C2KbOXI9T+/zmHmShwa,iv:qcBBCS8g0Jaq9ha8OWJO4nHO/GdqWmTar0fdx15Fazc=,tag:lVleMYZGjox/B20Ujrtw6w==,type:str] optional: ENC[AES256_GCM,data:BtPsSg==,iv:ViKdh5qK1DZDcc1xCHDNx4xxXGv9QpyORaCMjxRHMR8=,tag:ZiaYVvxhrpZ+Kh9BaF+fpw==,type:bool] # docs.saggar.dev cert — the saggar book (static nginx) - name: docs-saggar-dev-tls secret: secretName: ENC[AES256_GCM,data:Fn83SsnhrEt9+PbvSMG/OOJLlw==,iv:8J4crsxgxGfD/YaYRx132gt1xfIxmmu9neZwhcw4dbg=,tag:ZpDy9xlViZCrYNu2ymK/kA==,type:str] optional: ENC[AES256_GCM,data:FXd+lw==,iv:tqo5qFN64wZMO4kga1GNl68uzMABfpt28zrsMmIflEg=,tag:uRlNysTQWrz3lpJu22SsFA==,type:bool] # get.saggar.dev cert — the saggar distribution host (garage web) - name: get-saggar-dev-tls secret: secretName: ENC[AES256_GCM,data:Mdov3JsgNSIjvqakpIHlHiSL,iv:UxIkAyfaMpeXAC4glfD1+91WWAQzkV6VuHuEJ5zY1+o=,tag:sS1V+o78+IIk7KlIapaPmg==,type:str] optional: ENC[AES256_GCM,data:OQoedg==,iv:3/h1ECjUEoQ1tjxFtvmKcsfTketSQ46rMKVhah3MVmo=,tag:mNTlm3VBw7X9GLR5zYRuRQ==,type:bool] # rhema.rs certs from cert-manager (Cloudflare DNS-01) - name: rhema-rs-tls secret: secretName: ENC[AES256_GCM,data:79n7ikzaDj402klW,iv:TO79LTmYcuOOKM1PqdV0PkW+v3q9AfLqGMFK5PMSxlw=,tag:jozhhq2EEr9+Lw25+T3RYg==,type:str] optional: ENC[AES256_GCM,data:udjVWg==,iv:StyNicpFRx1ly3puiZasmTe5QSBSkBGkDck0gcbGgyQ=,tag:KNxAIcVzDqRoGJklnwxiaw==,type:bool] - name: www-rhema-rs-tls secret: secretName: ENC[AES256_GCM,data:sAGCq1p0l/dC1CP9/Fvosg==,iv:vwqMJC+26i6dRTMEAEC4BVcEFh37Rt1Fbu1Fv/sQ6S0=,tag:fkyF57/gbkRN0C7Y+S6lVw==,type:str] optional: ENC[AES256_GCM,data:p+B6hA==,iv:vai/Nnq8xjW0jJiUjLCfVTvhz1yOTHm4AymgjBFXhyQ=,tag:fK4h7ORopnH1gLDTdmhTPw==,type:bool] - name: get-rhema-rs-tls secret: secretName: ENC[AES256_GCM,data:2FtFXFWg+xSMsaRaLX2zEw==,iv:zW4Eo5r4/bMvKGAuWm/TV8j08UotUP7xiQrcnt4jfL8=,tag:Pl5n5xFdFE5bVQqFU7L8aw==,type:str] optional: ENC[AES256_GCM,data:eV29uQ==,iv:NuAEbtzcMH5J4EiSmaes3O21PZW4DizPpzCfokElqnk=,tag:CBY/ZGvKUvFqDvnX9mMEWw==,type:bool] - name: routes configMap: name: caddy-routes # Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key volumeMounts: - name: vhaudiquet-fr-tls mountPath: /etc/caddy/certs/vhaudiquet-fr readOnly: true - name: wildcard-vhaudiquet-fr-tls mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr readOnly: true - name: semery-fr-tls mountPath: /etc/caddy/certs/semery-fr readOnly: true - name: wildcard-semery-fr-tls mountPath: /etc/caddy/certs/wildcard-semery-fr readOnly: true - name: buildpath-win-tls mountPath: /etc/caddy/certs/buildpath-win readOnly: true - name: saggar-dev-tls mountPath: /etc/caddy/certs/saggar-dev readOnly: true - name: api-saggar-dev-tls mountPath: /etc/caddy/certs/api-saggar-dev readOnly: true - name: docs-saggar-dev-tls mountPath: /etc/caddy/certs/docs-saggar-dev readOnly: true - name: get-saggar-dev-tls mountPath: /etc/caddy/certs/get-saggar-dev readOnly: true - name: rhema-rs-tls mountPath: /etc/caddy/certs/rhema-rs readOnly: true - name: www-rhema-rs-tls mountPath: /etc/caddy/certs/www-rhema-rs readOnly: true - name: get-rhema-rs-tls mountPath: /etc/caddy/certs/get-rhema-rs readOnly: true - name: routes mountPath: /etc/caddy/routes readOnly: true # Caddy configuration config: debug: false # Global options (goes inside the global {} block) global: | auto_https off # The main Caddyfile content - imports routes from external ConfigMap # This keeps routes in a separate, easily editable file caddyFile: | :80 { redir https://{host}{uri} permanent } import /etc/caddy/routes/Caddyfile affinity: # Prefer non-failover nodes in normal operation nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 preference: matchExpressions: - key: ENC[AES256_GCM,data:2bVw/UmbXQWM5c+5dXHYh8gSQCo=,iv:zTx1jZ+gQaYJpNwAkGERkIoHMro75Q3D96nKl0cSyLg=,tag:EO5tZ0PWnDMH9zFi09chgQ==,type:str] operator: NotIn values: - "true" podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/name: caddy topologyKey: kubernetes.io/hostname tolerations: # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1). - key: ENC[AES256_GCM,data:O1bYTq27fBf6,iv:rZDYkdUJaO6dwzXUygXQUaawv/uLQzWYudjNQ0yGjic=,tag:ab0ke6BjcHvES8Da2VX/QQ==,type:str] operator: Equal value: ENC[AES256_GCM,data:TcvIJdr6Evg=,iv:tgh1FaG2PtJXzRY2iWPZX1g2d0KNOWTkk76hantu7aw=,tag:3X4CQBCt4u8Pojh2B2SUrA==,type:str] effect: NoSchedule - key: ENC[AES256_GCM,data:neIt7rxn+pXMCAQHGuIlq46lpAGmQDSFKmTpRO8d0zcKxKrD8Q==,iv:25kFrqcf1hwdoME8MFvMC6g56ILuokixy0xBKsNfJNo=,tag:/6aMf2K7YWHhcMzIo7faqw==,type:str] operator: Exists effect: NoSchedule sops: lastmodified: "2026-10-15T20:32:05Z" mac: ENC[AES256_GCM,data:sqj/1hitznnb+V5XCGBHqHcdLbJ/NzBcTAVPeXJqWKSYioEiQQYJCxVXeCtcLIUnSyihNpjDFweNX7T/MFkU7lfugn1SmRPRYbXp11HTDaaDbtzo509v1ysGHdJ7TDKhyf6egKs3WBlpWVrfcH6izU6zymV6A/w5nOGnLtgS2Q8=,iv:wQ72EMM05AvMhQDT798L6c53XSP4CXtwt4iEYletRDc=,tag:+zAnPBU8cjNh8rrgjsFlNA==,type:str] pgp: - created_at: "2026-10-15T20:32:05Z" enc: |- -----BEGIN PGP MESSAGE----- hQIMA7uy4qQr71wiARAAgaodPX6AX75xrUnhm0hNIXAQlpHkixvUop2rukqd2p1Q 1nP9ZshZx6yTEs7PYWofIeKG0kSKYE3qKwrNSwDXSUz2zshl3M/s0YXUHo2CFbAj 1SnDFTvPHIOGFTA4IK73G7efb0F5X9Plu4xc6Jzdl+G0mJ5d6lV13bkQJBJpXSNu fVqLqFLDBGI2c1JzG8Gh5Du2xSHPVcWm1bI5XN/W2SngP/xN18VNsl/2yI0lMWdd 4MMj16WZXuCzpKpcEtwYEEjbSdMxRp0D6WlVoQuhUMGKD1VOK6DjQ1h8H6Pn4XUR OLAQn3oauUa4eZ309pAwZyAtzi7CgfS1wrMUAWGfTv9B6KA7lyOYpjgpReMRTN2r e8k4bxJgr3Jj8NYqhwbSGYJ6r8zfC13G08fDaHqIqWjZF7uV/NX4pBqYBOfhkjxT 2BqlyB4AjpZV5UhJ+vHctOtt4VyeIVt4VFz319gC9BX+sv6EXMzbN64Q/zI3wd7H 3ZtU7mvLDnmW1kqjTQDbuSw3VJy4cttmzZmlWvNl1u8rmhbOf13AZIILY4f7eE6h lneK/Zbyq76h5khwu0mLhZV79Ru088iAIyhgnlgJA+4HzEEYCmJMHvuFtlzuaT4/ NDf7BTNKM8HBLU7j7Lr0n+rRwQQ+xwUP3iPkXVPsd1DFyRNwbki/zExAzxdKLJDS XgEIQ7sMMMxiuIfAUQQ2X+uVRbgldQA4vz5FRxH8rkg3Ig8bRglecGZkDP23ZnW0 8834GBJ6qJXnYRzrVWP0PA89+5R0UoTHLSr8AhYAYm8Bzpktf+6vdzv05vc+7dE= =Tv8G -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$ mac_only_encrypted: true version: 3.10.2