homeprod/kubernetes/infrastructure/caddy/values.yaml

# Caddy Edge Proxy
replicaCount: 2
# Listen on standard HTTP port
listenPort: 80
# Enable HTTPS
https:
    enabled: true
    port: 443
image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
    tag: 2.11.7
service:
    type: LoadBalancer
    # Cluster (not Local) so any node can forward to pods on any other node.
    externalTrafficPolicy: Cluster
# Disable ingress - Caddy IS the edge proxy
ingress:
    enabled: false
resources:
    requests:
        cpu: 100m
        memory: 128Mi
    limits:
        cpu: 500m
        memory: 256Mi
# Caddy needs root to bind to ports 80/443 and write runtime data
# Using restrictive security context causes "operation not permitted"
podSecurityContext: {}
securityContext: {}
health:
    path: /
    port: 9999
# Extra volumes: TLS certificates from cert-manager + external routes ConfigMap
volumes:
    - name: vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:D2xWOtTHFXl7bTLlsNFjEro=,iv:i3vheop7ASLCyF1ZIeh59ViCnrvQU/5e7Gy8Fsfc4E0=,tag:FQ+D8OLi0kMjhvYgPBgHwg==,type:str]
        optional: ENC[AES256_GCM,data:xLVbSQ==,iv:rLbyZVz2r3O4n7BYIKQE10RMbKDB1pF4UV3O2dzErU4=,tag:GOLUMif6wNICBQAHPhKfKg==,type:bool]
    - name: wildcard-vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:OdqKNJjbvmKVxgMrTZ7hbzh/NAS3y9SBv1A=,iv:MLBUkpW05IK+/dGuDogx9zOjmHYTMFz2H0QW6dTTl0M=,tag:npbS+ZqBDwdrSiTEVNH6Jw==,type:str]
        optional: ENC[AES256_GCM,data:SyvgEA==,iv:TPm9h2WO428rsauBosgbVvAMgHAb9wEkxBVtITwFBfY=,tag:kVshZCShC7/Mc2CROqHfaQ==,type:bool]
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:bvSLNmf5Og+W3A0lfA==,iv:i7k0xLKOnhPI+vtuRBQtej8NVIlCgxt8TgQXi9ARzUY=,tag:/GSbsAcEMOVGYg81oZUasg==,type:str]
        optional: ENC[AES256_GCM,data:Zip/dQ==,iv:nEc6ykKhmIuinWmfesEPWIeou/5lhHHvr4pJ4oqltiI=,tag:wKeOuUV7UepXRl/6+ynr8A==,type:bool]
    - name: wildcard-semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:VSNpS7a5hA3hgT75QChkcfejZM3u2Q==,iv:pHayamRJo2/McSWAMpQGGMayS0+gqwHVBoq2HYOO4mg=,tag:CFI70/UmYU0hDkGg6TKQlQ==,type:str]
        optional: ENC[AES256_GCM,data:ohcOzQ==,iv:Mx874e2brtx3mw3nyBRDNvHlN/TNkX3KeuR1IGv4SNI=,tag:hoFf1pIBUZcbdZtScrLYUA==,type:bool]
    - name: buildpath-win-tls
      secret:
        secretName: ENC[AES256_GCM,data:CayRdTe/1SeKMD2/zUKI7Rg=,iv:90+63nKSMYR6CvcQlkrFVYVUXCDbAjxgCvCGJ9saMNI=,tag:uEThP8zDAuR8GphhBfqQCA==,type:str]
        optional: ENC[AES256_GCM,data:H4Hvlg==,iv:gLz3SHoQeuwi7PtRHVvY+sx9WvjkRXjBqAJoMmk9xlo=,tag:0uwNn7dvfMSRedOGCTyazg==,type:bool]
    # saggar.dev cert from cert-manager (Porkbun DNS-01)
    - name: saggar-dev-tls
      secret:
        secretName: ENC[AES256_GCM,data:YPdpVHK/LiE4paOigTQ=,iv:qm4BTynQw4W8VL0dfBOZfIX5dvHqcMlj2zjJG8m1kDo=,tag:KGjXYivQIMliYDHu9Wj+Aw==,type:str]
        optional: ENC[AES256_GCM,data:CBphCg==,iv:RraJZATt6Ibc4OMTeD4sabxVM9Di7S4j/o75S9i+iOA=,tag:JpQ2yJQGe7yRy4ug3pA1WQ==,type:bool]
    - name: api-saggar-dev-tls
      secret:
        secretName: ENC[AES256_GCM,data:sXYq4C2KbOXI9T+/zmHmShwa,iv:qcBBCS8g0Jaq9ha8OWJO4nHO/GdqWmTar0fdx15Fazc=,tag:lVleMYZGjox/B20Ujrtw6w==,type:str]
        optional: ENC[AES256_GCM,data:BtPsSg==,iv:ViKdh5qK1DZDcc1xCHDNx4xxXGv9QpyORaCMjxRHMR8=,tag:ZiaYVvxhrpZ+Kh9BaF+fpw==,type:bool]
    # docs.saggar.dev cert — the saggar book (static nginx)
    - name: docs-saggar-dev-tls
      secret:
        secretName: ENC[AES256_GCM,data:Fn83SsnhrEt9+PbvSMG/OOJLlw==,iv:8J4crsxgxGfD/YaYRx132gt1xfIxmmu9neZwhcw4dbg=,tag:ZpDy9xlViZCrYNu2ymK/kA==,type:str]
        optional: ENC[AES256_GCM,data:FXd+lw==,iv:tqo5qFN64wZMO4kga1GNl68uzMABfpt28zrsMmIflEg=,tag:uRlNysTQWrz3lpJu22SsFA==,type:bool]
    # get.saggar.dev cert — the saggar distribution host (garage web)
    - name: get-saggar-dev-tls
      secret:
        secretName: ENC[AES256_GCM,data:Mdov3JsgNSIjvqakpIHlHiSL,iv:UxIkAyfaMpeXAC4glfD1+91WWAQzkV6VuHuEJ5zY1+o=,tag:sS1V+o78+IIk7KlIapaPmg==,type:str]
        optional: ENC[AES256_GCM,data:OQoedg==,iv:3/h1ECjUEoQ1tjxFtvmKcsfTketSQ46rMKVhah3MVmo=,tag:mNTlm3VBw7X9GLR5zYRuRQ==,type:bool]
    # rhema.rs certs from cert-manager (Cloudflare DNS-01)
    - name: rhema-rs-tls
      secret:
        secretName: ENC[AES256_GCM,data:79n7ikzaDj402klW,iv:TO79LTmYcuOOKM1PqdV0PkW+v3q9AfLqGMFK5PMSxlw=,tag:jozhhq2EEr9+Lw25+T3RYg==,type:str]
        optional: ENC[AES256_GCM,data:udjVWg==,iv:StyNicpFRx1ly3puiZasmTe5QSBSkBGkDck0gcbGgyQ=,tag:KNxAIcVzDqRoGJklnwxiaw==,type:bool]
    - name: www-rhema-rs-tls
      secret:
        secretName: ENC[AES256_GCM,data:sAGCq1p0l/dC1CP9/Fvosg==,iv:vwqMJC+26i6dRTMEAEC4BVcEFh37Rt1Fbu1Fv/sQ6S0=,tag:fkyF57/gbkRN0C7Y+S6lVw==,type:str]
        optional: ENC[AES256_GCM,data:p+B6hA==,iv:vai/Nnq8xjW0jJiUjLCfVTvhz1yOTHm4AymgjBFXhyQ=,tag:fK4h7ORopnH1gLDTdmhTPw==,type:bool]
    - name: get-rhema-rs-tls
      secret:
        secretName: ENC[AES256_GCM,data:2FtFXFWg+xSMsaRaLX2zEw==,iv:zW4Eo5r4/bMvKGAuWm/TV8j08UotUP7xiQrcnt4jfL8=,tag:Pl5n5xFdFE5bVQqFU7L8aw==,type:str]
        optional: ENC[AES256_GCM,data:eV29uQ==,iv:NuAEbtzcMH5J4EiSmaes3O21PZW4DizPpzCfokElqnk=,tag:CBY/ZGvKUvFqDvnX9mMEWw==,type:bool]
    - name: routes
      configMap:
        name: caddy-routes
# Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key
volumeMounts:
    - name: vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/vhaudiquet-fr
      readOnly: true
    - name: wildcard-vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr
      readOnly: true
    - name: semery-fr-tls
      mountPath: /etc/caddy/certs/semery-fr
      readOnly: true
    - name: wildcard-semery-fr-tls
      mountPath: /etc/caddy/certs/wildcard-semery-fr
      readOnly: true
    - name: buildpath-win-tls
      mountPath: /etc/caddy/certs/buildpath-win
      readOnly: true
    - name: saggar-dev-tls
      mountPath: /etc/caddy/certs/saggar-dev
      readOnly: true
    - name: api-saggar-dev-tls
      mountPath: /etc/caddy/certs/api-saggar-dev
      readOnly: true
    - name: docs-saggar-dev-tls
      mountPath: /etc/caddy/certs/docs-saggar-dev
      readOnly: true
    - name: get-saggar-dev-tls
      mountPath: /etc/caddy/certs/get-saggar-dev
      readOnly: true
    - name: rhema-rs-tls
      mountPath: /etc/caddy/certs/rhema-rs
      readOnly: true
    - name: www-rhema-rs-tls
      mountPath: /etc/caddy/certs/www-rhema-rs
      readOnly: true
    - name: get-rhema-rs-tls
      mountPath: /etc/caddy/certs/get-rhema-rs
      readOnly: true
    - name: routes
      mountPath: /etc/caddy/routes
      readOnly: true
# Caddy configuration
config:
    debug: false
    # Global options (goes inside the global {} block)
    global: |
        auto_https off
    # The main Caddyfile content - imports routes from external ConfigMap
    # This keeps routes in a separate, easily editable file
    caddyFile: |
        :80 {
            redir https://{host}{uri} permanent
        }

        import /etc/caddy/routes/Caddyfile
affinity:
    # Prefer non-failover nodes in normal operation
    nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                    - key: ENC[AES256_GCM,data:2bVw/UmbXQWM5c+5dXHYh8gSQCo=,iv:zTx1jZ+gQaYJpNwAkGERkIoHMro75Q3D96nKl0cSyLg=,tag:EO5tZ0PWnDMH9zFi09chgQ==,type:str]
                      operator: NotIn
                      values:
                        - "true"
    podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                    matchLabels:
                        app.kubernetes.io/name: caddy
                topologyKey: kubernetes.io/hostname
tolerations:
    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
    - key: ENC[AES256_GCM,data:O1bYTq27fBf6,iv:rZDYkdUJaO6dwzXUygXQUaawv/uLQzWYudjNQ0yGjic=,tag:ab0ke6BjcHvES8Da2VX/QQ==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:TcvIJdr6Evg=,iv:tgh1FaG2PtJXzRY2iWPZX1g2d0KNOWTkk76hantu7aw=,tag:3X4CQBCt4u8Pojh2B2SUrA==,type:str]
      effect: NoSchedule
    - key: ENC[AES256_GCM,data:neIt7rxn+pXMCAQHGuIlq46lpAGmQDSFKmTpRO8d0zcKxKrD8Q==,iv:25kFrqcf1hwdoME8MFvMC6g56ILuokixy0xBKsNfJNo=,tag:/6aMf2K7YWHhcMzIo7faqw==,type:str]
      operator: Exists
      effect: NoSchedule
sops:
    lastmodified: "2026-10-15T20:32:05Z"
    mac: ENC[AES256_GCM,data:sqj/1hitznnb+V5XCGBHqHcdLbJ/NzBcTAVPeXJqWKSYioEiQQYJCxVXeCtcLIUnSyihNpjDFweNX7T/MFkU7lfugn1SmRPRYbXp11HTDaaDbtzo509v1ysGHdJ7TDKhyf6egKs3WBlpWVrfcH6izU6zymV6A/w5nOGnLtgS2Q8=,iv:wQ72EMM05AvMhQDT798L6c53XSP4CXtwt4iEYletRDc=,tag:+zAnPBU8cjNh8rrgjsFlNA==,type:str]
    pgp:
        - created_at: "2026-10-15T20:32:05Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiARAAgaodPX6AX75xrUnhm0hNIXAQlpHkixvUop2rukqd2p1Q
            1nP9ZshZx6yTEs7PYWofIeKG0kSKYE3qKwrNSwDXSUz2zshl3M/s0YXUHo2CFbAj
            1SnDFTvPHIOGFTA4IK73G7efb0F5X9Plu4xc6Jzdl+G0mJ5d6lV13bkQJBJpXSNu
            fVqLqFLDBGI2c1JzG8Gh5Du2xSHPVcWm1bI5XN/W2SngP/xN18VNsl/2yI0lMWdd
            4MMj16WZXuCzpKpcEtwYEEjbSdMxRp0D6WlVoQuhUMGKD1VOK6DjQ1h8H6Pn4XUR
            OLAQn3oauUa4eZ309pAwZyAtzi7CgfS1wrMUAWGfTv9B6KA7lyOYpjgpReMRTN2r
            e8k4bxJgr3Jj8NYqhwbSGYJ6r8zfC13G08fDaHqIqWjZF7uV/NX4pBqYBOfhkjxT
            2BqlyB4AjpZV5UhJ+vHctOtt4VyeIVt4VFz319gC9BX+sv6EXMzbN64Q/zI3wd7H
            3ZtU7mvLDnmW1kqjTQDbuSw3VJy4cttmzZmlWvNl1u8rmhbOf13AZIILY4f7eE6h
            lneK/Zbyq76h5khwu0mLhZV79Ru088iAIyhgnlgJA+4HzEEYCmJMHvuFtlzuaT4/
            NDf7BTNKM8HBLU7j7Lr0n+rRwQQ+xwUP3iPkXVPsd1DFyRNwbki/zExAzxdKLJDS
            XgEIQ7sMMMxiuIfAUQQ2X+uVRbgldQA4vz5FRxH8rkg3Ig8bRglecGZkDP23ZnW0
            8834GBJ6qJXnYRzrVWP0PA89+5R0UoTHLSr8AhYAYm8Bzpktf+6vdzv05vc+7dE=
            =Tv8G
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
    mac_only_encrypted: true
    version: 3.10.2