# get.rhema.rs, the rhema distribution (chart rhema-dist, repo
# vhaudiquet/rhema.rs). One single-node Garage, one bucket, the
# saggar-dist shape: the S3 API stays cluster-internal (chart default,
# s3.ingress.enabled=false — release uploads come from the in-cluster
# runners) and the bucket serves as a public read-only website.
# The host MUST be <bucket>.<root domain> — Garage resolves the bucket
# from the Host's first label — so bucket `get` on get.rhema.rs.
bucket: get
garage:
    # Single-node store: skip the hourly self-sync cycles — while a
    # full sync runs, S3 auth lookups transiently answer
    # InvalidAccessKeyId (see get-saggar). Weekly.
    fullSyncInterval: 604800
web:
    ingress:
        className: traefik
        host: get.rhema.rs
        # TLS terminates at Caddy with the cert-manager get.rhema.rs
        # cert; Caddy proxies to Traefik by host, so no tls block here.
        tls:
            enabled: false
# The write surface, public via Caddy: the release runners reach the
# S3 API by host (the in-cluster Service name does not resolve from
# them). TLS terminates at Caddy, like the web face.
s3:
    ingress:
        enabled: true
        className: traefik
        host: s3.rhema.rs
        tls:
            enabled: false
            secretName: ""
sops:
    lastmodified: "2026-10-16T06:56:14Z"
    mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str]
    pgp:
        - created_at: "2026-10-16T06:56:14Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe
            wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43
            FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36
            mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK
            SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB
            GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ
            0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF
            OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA
            tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N
            owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU
            byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS
            XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ
            AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0
            =1619
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2