mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-21 16:36:05 +00:00
kosmosandvhaudiquet
5bf07a2fff
Address review feedback on SOPS handling for encrypted values.yaml. - renovate.json: Renovate has NO preUpgradeTasks option (verified against the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks (which run after the tag bump, before the commit): decrypt the values.yaml, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values. Only **/values.yaml is re-encrypted; the docker-compose and Chart.yaml files are not SOPS-encrypted here. - kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob running the renovatebot/renovate image, with sops allowed as a postUpgradeTask command and the SOPS PGP key loaded to re-encrypt values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources. - Wire code/renovate into the root kubernetes kustomization.
51 lines
2.0 KiB
YAML
51 lines
2.0 KiB
YAML
# Root Kustomization for Flux
|
|
# Components managed by separate Flux Kustomizations (CRD dependency ordering):
|
|
# - longhorn: managed by Flux Kustomization (CRDs must be installed first)
|
|
# - longhorn-jobs: managed by Flux Kustomization (RecurringJob CRDs need longhorn)
|
|
# - cert-manager: managed by Flux Kustomization (CRDs must be installed first)
|
|
# - cert-manager-webhook-ovh: managed by Flux Kustomization (depends on cert-manager)
|
|
# - cert-manager-issuer: managed by Flux Kustomization (depends on cert-manager + webhook)
|
|
# - caddy-certificates: managed by Flux Kustomization (Certificate CRDs need cert-manager)
|
|
# - stalwart-certificates: managed by Flux Kustomization (Certificate CRDs need cert-manager)
|
|
# - openclaw-operator: managed by Flux Kustomization (operator CRDs must be installed first)
|
|
# - openclaw: managed by Flux Kustomization (OpenClawInstance CRD needs openclaw-operator)
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
# System components (kubernetes platform machinery)
|
|
- system/cilium # cilium IP pool is managed here
|
|
- system/coredns
|
|
- system/csi-driver-nfs
|
|
- system/external-dns
|
|
- system/flux
|
|
# Infrastructure (backbone services apps depend on)
|
|
- infrastructure/authentik
|
|
- infrastructure/mail/stalwart
|
|
- infrastructure/observability
|
|
- infrastructure/traefik
|
|
- infrastructure/caddy
|
|
- infrastructure/network/blocky
|
|
# Code (self-hosted dev tooling)
|
|
- code/renovate
|
|
# Dev (developer platform)
|
|
- dev/gitea
|
|
- dev/harbor
|
|
# Home (home automation)
|
|
- home/home-assistant
|
|
- home/zigbee2mqtt
|
|
# Personal (apps storing my own content, grouped by content type)
|
|
- personal/paperless
|
|
- personal/radicale
|
|
- personal/media/photoprism
|
|
- personal/notes/notesnook
|
|
- personal/notes/obsidian-livesync
|
|
# Utilities (generic content-agnostic tools)
|
|
- utilities/dashy
|
|
- utilities/glance
|
|
- utilities/open-webui
|
|
# Production (public-facing websites/apps)
|
|
- production/buildpath
|
|
- production/semery-fr
|
|
- production/umami
|
|
- production/vhaudiquet-fr
|