mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-10-15 19:56:15 +00:00
vhaudiquet
ae8a4ddb27
Flux HelmRelease of the saggar hub (chart saggar-hub >=0.2.0-0, CI-published on the gitea saggar org, appVersion pinned to the image commit) with the web UI. Engine on api.saggar.dev for the CLI and the docker/apt registries, UI on saggar.dev — new cert, caddy route and dns A record for the api host, TLS terminating at Caddy as usual. Login via the home Gitea as an OIDC provider; private registry and helm repo auth share one packages token.
89 lines
4.7 KiB
YAML
89 lines
4.7 KiB
YAML
# Hub mode (the chart default): intake + registries + web UI, with
|
|
# artifacts in the release's embedded Garage store (chart default in
|
|
# hub mode, longhorn-backed). Builds happen on runners from the
|
|
# saggar-worker chart, to be paired against this hub once it is up.
|
|
image:
|
|
repository: git.vhaudiquet.fr/saggar/saggar
|
|
# Empty: follows the chart's appVersion — the commit SHA CI stamped
|
|
# on the pushed images.
|
|
tag: ""
|
|
# Private Gitea registry: the chart renders an imagePullSecret from
|
|
# these. Same access token as packages-auth-secret.yaml (the
|
|
# pre-commit sops hook encrypts this file).
|
|
imageCredentials:
|
|
create: true
|
|
registry: git.vhaudiquet.fr
|
|
username: ENC[AES256_GCM,data:/BEuQFoDxyFVzQ==,iv:O4X+Q3DhkCItIHABBrHYRI842vI86NTmAx1jEtIrOrw=,tag:+H6KUFV4H+uDAyBxEbsj6g==,type:str]
|
|
password: ENC[AES256_GCM,data:S88PWTFhnBeDK+ofX9AOJLeuM+YN1tnd2IL453Mv4gk0Rbr4ttTgcQ==,iv:7UFDQn1VZG7e/z/Su1lOJeMgnNzWYevv9PoCOPSA810=,tag:eyFF74hIY4Tj6zoBpvhJ+w==,type:str]
|
|
# Login via the home Gitea: the engine is the confidential client of
|
|
# the provider and runs every code exchange, so its discovery drives
|
|
# the endpoints (issuer verified live). Credentials live in
|
|
# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
|
|
# id in too), so nothing sensitive renders into the ConfigMap. The UI
|
|
# needs nothing: it discovers the provider from the engine's open
|
|
# /auth/methods.
|
|
auth:
|
|
providers:
|
|
- name: gitea
|
|
issuer: https://git.vhaudiquet.fr
|
|
existingSecret: ENC[AES256_GCM,data:QU4XxTO9yYTtAD1DIVrHeHs=,iv:R63SB9qZqCoI2VThliV1jobCMmGYJw+GKwfRp0CSMz0=,tag:TjFWZdjsfm0AgqPRbv5uBQ==,type:str]
|
|
clientIdKey: client-id
|
|
clientSecretKey: ENC[AES256_GCM,data:NCzGSzyzi1sK0L2AFA==,iv:t9JRUnHCEMedeW/+IXWKY4XDCweJIi7MDYI5EBtpvQE=,tag:uSX2qj8ZoQbW9Iww1Y3NNQ==,type:str]
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
# The engine host: CLI intake + the docker/apt registry front-ends.
|
|
host: api.saggar.dev
|
|
# The chart's default annotations are nginx-specific (SSE
|
|
# buffering); traefik streams unbuffered by default, so clear them.
|
|
annotations: {}
|
|
# TLS terminates at Caddy with the cert-manager saggar.dev certs;
|
|
# Caddy proxies to Traefik by host, so no tls block here (same as
|
|
# pkgatlas's ingress).
|
|
tls:
|
|
enabled: false
|
|
ui:
|
|
# Sign-in redirect base — the UI's own public origin.
|
|
publicBaseUrl: https://saggar.dev
|
|
# The engine's public origin for the docker pull / apt usage lines.
|
|
# Set explicitly: the chart derives it from the hub ingress, whose
|
|
# tls is off here (Caddy terminates) — that would render http://.
|
|
apiPublicOrigin: https://api.saggar.dev
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
# The UI lives on its own host: the engine mounts its API and
|
|
# registry surfaces at root (/v2, /apt, /nodes), paths the UI
|
|
# pages also use.
|
|
host: saggar.dev
|
|
annotations: {}
|
|
tls:
|
|
enabled: false
|
|
sops:
|
|
lastmodified: "2026-09-30T20:30:47Z"
|
|
mac: ENC[AES256_GCM,data:jo02sAVCmt1qO+2DUOjWSAXo47OzviRvz/GEX7hU/g4U1CyhKP/zHxoAIeCAOVnL4DJ+w0ayYuU16Im/iFa2tVnvpRVhVpnUgDgin11EukeLizUodAbm9mmsdBqlivrRxjf7yj8Czg6VOHHtcUMLQcXIgwTZ2GoSotXN7EBp+FM=,iv:149oaU4BK7gjgb0mZPMrB62L4KxbeQyVtW0r8Ox7BKg=,tag:hnVG7Wg/zGiGl1KjO8olCA==,type:str]
|
|
pgp:
|
|
- created_at: "2026-09-30T20:30:47Z"
|
|
enc: |-
|
|
-----BEGIN PGP MESSAGE-----
|
|
|
|
hQIMA7uy4qQr71wiARAAnlK3L9KylJuKOT8XrUI7L7ax+K2XEqQh3bXtByc1y1ns
|
|
ka5iGUuuMT00T88y0J1DuOiGj51WiZtKyr1pOVmqsS/uVYXE7FruR2A/KWrZEVG0
|
|
wb8UuPP/TWbo8vc3uvq/ivTv70CnfjGI43uv12r51EsIbCvnSikI6p5tAzX8bwoI
|
|
Ei/wQexFlz82Vc0qZ0Dmw6aa1pkDBrN5jIW47WPRUnFwpejdA5ZsvdeBxeeiPJXh
|
|
iXMbqp9R2A5615WdZaVoSzSTacRk4LU3zcDhGWkr7ja37+BYer9ZBbNrh/tA4GH5
|
|
EjmbNkmR6A5Ra3TII8/B4ycqwhShuyjSV6bj+TCV2J8VGCvI+20PIcDP8SGIBhLg
|
|
JHmpGTwc2pjRD4Ekgt6rrOoKYLpP16ooEbqdxHmzhWHfKCI8v6yinSaU3Lz9vXL5
|
|
TeRCZ9fIZB5zXE1nEeAFCGHfOV/HQCP9Z1/x8EsflH0SYosx/jjOUFSP8Q+AsJ/+
|
|
ompNtICXVliM1jsebhGNwBdadfe/8T1M/zwdof/XY+6myKGNxhxFNbq/B92Ppwo9
|
|
KYYCImMgLRUKjQLgBqJrzL6jkqWUwGpCfcgdsZQyFLzGzUIkbCITPCNLiMb195PS
|
|
ruJ2NJZA4YCZ8OapzBRI7KFAH+s00ipE25wK85zsS3f41RwZKHG0XE09l/bJFDTS
|
|
XAEA78VEJxsCtdMHtSX2cGvDOc5PGT8qDwvn5O8ubDjPN11u1rL24yYdzEsHEzbL
|
|
F0TT5R7s5FQk1YOCzXVaFOKFEnpU4STRm9uYKP7SUYJUyT/TzzNu5iYaachA
|
|
=Y1SN
|
|
-----END PGP MESSAGE-----
|
|
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
|
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
|
mac_only_encrypted: true
|
|
version: 3.10.2
|