mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-10-15 19:56:15 +00:00
vhaudiquet
8c7a905d39
Garage's hourly full-sync cycles were the InvalidAccessKeyId source: while a key-table sync runs, auth lookups transiently fail, and the edge job's prune step kept landing inside the window (one sync ran 87 minutes). Both embedded stores get a weekly interval.
106 lines
5.3 KiB
YAML
106 lines
5.3 KiB
YAML
# Hub mode (the chart default): intake + registries + web UI, with
|
|
# artifacts in the release's embedded Garage store (chart default in
|
|
# hub mode, longhorn-backed). Builds happen on runners from the
|
|
# saggar-worker chart, to be paired against this hub once it is up.
|
|
image:
|
|
repository: git.vhaudiquet.fr/saggar/saggar
|
|
# Empty: follows the chart's appVersion — the commit SHA CI stamped
|
|
# on the pushed images.
|
|
tag: ""
|
|
# Private Gitea registry: the chart renders an imagePullSecret from
|
|
# these. Same access token as packages-auth-secret.yaml (the
|
|
# pre-commit sops hook encrypts this file).
|
|
imageCredentials:
|
|
create: true
|
|
registry: git.vhaudiquet.fr
|
|
username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str]
|
|
password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str]
|
|
# Login via the home Gitea: the engine is the confidential client of
|
|
# the provider and runs every code exchange, so its discovery drives
|
|
# the endpoints (issuer verified live). Credentials live in
|
|
# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
|
|
# id in too), so nothing sensitive renders into the ConfigMap. The UI
|
|
# needs nothing: it discovers the provider from the engine's open
|
|
# /auth/methods.
|
|
auth:
|
|
# The web origin the device login names: `saggar login` prints the
|
|
# confirmation page under it (saggar.dev/device).
|
|
uiUrl: https://saggar.dev
|
|
providers:
|
|
- name: gitea
|
|
issuer: https://git.vhaudiquet.fr
|
|
existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str]
|
|
clientIdKey: client-id
|
|
clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str]
|
|
storage:
|
|
garage:
|
|
# Single-node store: skip the hourly self-sync cycles — while a
|
|
# full sync runs, S3 auth lookups transiently answer
|
|
# InvalidAccessKeyId. Weekly.
|
|
fullSyncInterval: 604800
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
# The engine host: CLI intake + the docker/apt registry front-ends.
|
|
host: api.saggar.dev
|
|
# The chart's default annotations are nginx-specific (SSE
|
|
# buffering); traefik streams unbuffered by default, so clear them.
|
|
annotations: {}
|
|
# TLS terminates at Caddy with the cert-manager saggar.dev certs;
|
|
# Caddy proxies to Traefik by host, so no tls block here (same as
|
|
# pkgatlas's ingress).
|
|
tls:
|
|
enabled: false
|
|
ui:
|
|
# Sign-in redirect base — the UI's own public origin.
|
|
publicBaseUrl: https://saggar.dev
|
|
# The engine's public origin for the docker pull / apt usage lines.
|
|
# Set explicitly: the chart derives it from the hub ingress, whose
|
|
# tls is off here (Caddy terminates) — that would render http://.
|
|
apiPublicOrigin: https://api.saggar.dev
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
# The UI lives on its own host: the engine mounts its API and
|
|
# registry surfaces at root (/v2, /apt, /nodes), paths the UI
|
|
# pages also use.
|
|
host: saggar.dev
|
|
annotations: {}
|
|
tls:
|
|
enabled: false
|
|
docs:
|
|
# The chart deploys the book by default; the ingress renders as
|
|
# soon as a host is set (no enabled knob).
|
|
ingress:
|
|
className: traefik
|
|
host: docs.saggar.dev
|
|
tls:
|
|
enabled: false
|
|
sops:
|
|
lastmodified: "2026-10-06T04:20:10Z"
|
|
mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str]
|
|
pgp:
|
|
- created_at: "2026-10-06T04:20:10Z"
|
|
enc: |-
|
|
-----BEGIN PGP MESSAGE-----
|
|
|
|
hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK
|
|
3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer
|
|
z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn
|
|
9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF
|
|
9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH
|
|
h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0
|
|
4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg
|
|
HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf
|
|
Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR
|
|
NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD
|
|
ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS
|
|
XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns
|
|
MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk=
|
|
=3vCq
|
|
-----END PGP MESSAGE-----
|
|
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
|
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
|
mac_only_encrypted: true
|
|
version: 3.10.2
|