homeprod/kubernetes/system/caddy/values.yaml

# Caddy Edge Proxy
replicaCount: 2
# Listen on standard HTTP port
listenPort: 80
# Enable HTTPS
https:
    enabled: true
    port: 443
image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
    tag: 2.11.2
service:
    type: LoadBalancer
    externalTrafficPolicy: Local
# Disable ingress - Caddy IS the edge proxy
ingress:
    enabled: false
resources:
    requests:
        cpu: 100m
        memory: 128Mi
    limits:
        cpu: 500m
        memory: 256Mi
# Caddy needs root to bind to ports 80/443 and write runtime data
# Using restrictive security context causes "operation not permitted"
podSecurityContext: {}
securityContext: {}
health:
    path: /
    port: 9999
# Extra volumes: TLS certificates from cert-manager + external routes ConfigMap
volumes:
    - name: vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:rcgSDJ+EX9hd3A3iDgMK81o=,iv:DKDz7STKJt8SsStOWggd85qMJTRLO6/5xeUu/0fkGF0=,tag:eHDV/OIxbsTcfNs8f7wAoQ==,type:str]
        optional: ENC[AES256_GCM,data:kCy1+w==,iv:9oFPPgCEq5t3iFrEzBM6wLlRcanyNY5Pk+/8jV8wj78=,tag:sFdgEa1LBcjpTzWD2QdTUg==,type:bool]
    - name: wildcard-vhaudiquet-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:b03gkJ43guNYdcbu6nxWCL0uROV2MPgv1z4=,iv:MUzHsrfyoAHvc46MG/24Z3ZD6HokySwJRmeAA3UuRoc=,tag:y1Gp32TYP0XiwBpvmbyydg==,type:str]
        optional: ENC[AES256_GCM,data:ys5mYQ==,iv:b79KRokcoRcGANWcOaoP3scVilnDgxTXSanfWV956l0=,tag:jOyJgrKo+oNb4iDS5aKjXA==,type:bool]
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:9PNhCQYMAZqJf0z5ig==,iv:3ccqLo3n80t1rCxQ3gympxWpKBbTWLSf/tnuXybZgnk=,tag:0aIWetuABijQkfcMFO3sfw==,type:str]
        optional: ENC[AES256_GCM,data:Rtf7pw==,iv:oce12WWAkp3MSvzxcaXbDjr7SbCqqoZRAbaza1H3kS8=,tag:JT4TEsutsG6mhVNNVue+EA==,type:bool]
    - name: wildcard-semery-fr-tls
      secret:
        secretName: ENC[AES256_GCM,data:XewtG6zwJ2K/pk20sXkFQ2bpAf9/lw==,iv:Tsm/H4vfnroytVzNDSm8MBkOxE44OIZfQ7aNA8THZUw=,tag:UmXqYGbxZCe3sm2vCJJnqw==,type:str]
        optional: ENC[AES256_GCM,data:bV0FLw==,iv:IBg34NAfXfXIo0CYoCI9gmmQjdTtj/wBwZwbXeb613o=,tag:5dCD5tZJLmZ2SM0PIzsz3Q==,type:bool]
    - name: buildpath-win-tls
      secret:
        secretName: ENC[AES256_GCM,data:+P7wWLfGk4SxdSBa2xCvzKk=,iv:wnpvM9hd+gz89jj2yI96x/eij0aOt6rBLWZIlaOWUKQ=,tag:Ao7218HksIJuP1N2/AmPEA==,type:str]
        optional: ENC[AES256_GCM,data:M7JWXg==,iv:eGXjv+2BfbbGXS9pX5Z2+d0YzmBS50GbTBAfE6lhh9g=,tag:qEbbjBVUTjDEIpRAdWHQdg==,type:bool]
    - name: routes
      configMap:
        name: caddy-routes
# Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key
volumeMounts:
    - name: vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/vhaudiquet-fr
      readOnly: true
    - name: wildcard-vhaudiquet-fr-tls
      mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr
      readOnly: true
    - name: semery-fr-tls
      mountPath: /etc/caddy/certs/semery-fr
      readOnly: true
    - name: wildcard-semery-fr-tls
      mountPath: /etc/caddy/certs/wildcard-semery-fr
      readOnly: true
    - name: buildpath-win-tls
      mountPath: /etc/caddy/certs/buildpath-win
      readOnly: true
    - name: routes
      mountPath: /etc/caddy/routes
      readOnly: true
# Caddy configuration
config:
    debug: false
    # Global options (goes inside the global {} block)
    global: |
        auto_https off
    # The main Caddyfile content - imports routes from external ConfigMap
    # This keeps routes in a separate, easily editable file
    caddyFile: |
        :80 {
            redir https://{host}{uri} permanent
        }

        import /etc/caddy/routes/Caddyfile
affinity:
    # Prefer non-failover nodes in normal operation
    nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                    - key: ENC[AES256_GCM,data:4FH6bjD3Foh1eMKjK7u9SYKBVes=,iv:as1luIBK4tAMLlPbSrba5gP39ENPFnWy5Z2SPaoMS8k=,tag:HFJfUKnjVnYH0qjTNhF6Kg==,type:str]
                      operator: NotIn
                      values:
                        - "true"
    podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                    matchLabels:
                        app.kubernetes.io/name: caddy
                topologyKey: kubernetes.io/hostname
tolerations:
    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
    - key: ENC[AES256_GCM,data:ySkUzenN2JKy,iv:vjMMs+bqAt8RU4/ONcamXYzPEtzN5up6I/4dyQcczS8=,tag:3Pbg1NE6wrCxPbghmIbOtA==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:tPKG1cGFQ1g=,iv:oWqAoALXyCqsVe06B2ZE2Nbw32qk8Uipp4OMbBeYnkQ=,tag:WQ43ga2Vim6RkByg/aXciQ==,type:str]
      effect: NoSchedule
    - key: ENC[AES256_GCM,data:BTMlEem0728QJIYhfLFqcw+67CiszZZ4KaaOceoB0T9AFg42BQ==,iv:yIfcwyD597hc871n7gVJWPFhDEeCl4p71lgkJLJ9dhw=,tag:S471ZJdUmkv1x05fpWOwkg==,type:str]
      operator: Exists
      effect: NoSchedule
sops:
    lastmodified: "2026-07-25T08:22:16Z"
    mac: ENC[AES256_GCM,data:Fso99yltP0D5EUI5QdJrUlDnapLvBjYTCDwggi0Ugp4bhpzBDuSBTq/illntZd+OGZhxhq3AhQuYQUS9w6qhRuSZx9H8VQZyJqaiuRVuyTPm2+qaC0KQmr8htJe2Qy2GQOsOAixEk4Ap5qhOtD24afcysQOjLQjw1jNCpaivw4U=,iv:1ZSbPqkKJkItQcsPIBZ1ss+EcRG8sVWXsbt8CUHEVxQ=,tag:Aikj6PMIoXcOZYkN9p4zyg==,type:str]
    pgp:
        - created_at: "2026-07-25T08:22:16Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ/+PMP6p/zNkq2KLigchf4V3FvkKxGD+tpl4CL0RRliyweO
            dxvH2xZS+SSgA1vaOmdstD9xD+5POLsceAKWN9SUa/xUyJEyQovtFoxRQa54K0/G
            mcM4mZ7qvsEetWZzRLpjJ33x6neLPj1i6AgW3eNYGHtH6W+MRpgmPshFMOFrlgg3
            inu/MRYyG1gcOovnhOFc9tJSZtpGF7dv4R8eDzM5QDXxr1FdpNNJgMRKZyotNPLX
            erOEe8+78V8zxLixCIo4qQgvUnCocJfKrA/jHF3ZdyW9t7LOqJI9KRFwiawWZ5E/
            UsB8p7uG2zCCR4mRA5GBWqST8pW8joCxuw3dB2xYLqLxUM2t7yuEIKUo4SXm9Jhe
            pCNVBmsjI9DZk+COAZzC3DKtBDK1Tr998JYDQ+Qq5heXQj14mi6EaeIaQTqdOnEj
            Wyn6Rpd90b+GjSpnLIWoCS0M8Vp6Mal6OY+2NWeMuw5CNAOty8wWkPAFXz4Iupin
            JLyZedWQpkIfiw7Q9Gs4fY4hRYMXFo3vvkT46JFUO7WFBrLz6phaa3JBhih03qsZ
            56ZWHpC8Ag7glOwQOLDeclsQ3wT58QiPJCK7BpzpkNdkGxv5qJj5r/zW6aTuDvB5
            zJtHNjbI2cL11vnC0/4xI4EdfSe0LSphoGBgg7RpedpCfro6NU0Wr5vlIxFrLjLS
            XgHppBeR7vnfI+NNtswqzZd04GvddzzcesUaud3LqyXGwOKgtBoWkdvfccEcmt71
            nC+TezwV2Aq0R+FTBDxRy529cr8FXArk0wtDUr2e/XLr61160FOqGiw+bn5/q7g=
            =Yhwg
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
    version: 3.10.2