mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-10-15 19:56:15 +00:00
vhaudiquet
b8879b2025
The chart's docs book (static nginx) was up in-cluster only: give its ingress a host, with the same edge path as the api host — dns A record, cert-manager certificate and caddy route.
97 lines
5.0 KiB
YAML
97 lines
5.0 KiB
YAML
# Hub mode (the chart default): intake + registries + web UI, with
|
|
# artifacts in the release's embedded Garage store (chart default in
|
|
# hub mode, longhorn-backed). Builds happen on runners from the
|
|
# saggar-worker chart, to be paired against this hub once it is up.
|
|
image:
|
|
repository: git.vhaudiquet.fr/saggar/saggar
|
|
# Empty: follows the chart's appVersion — the commit SHA CI stamped
|
|
# on the pushed images.
|
|
tag: ""
|
|
# Private Gitea registry: the chart renders an imagePullSecret from
|
|
# these. Same access token as packages-auth-secret.yaml (the
|
|
# pre-commit sops hook encrypts this file).
|
|
imageCredentials:
|
|
create: true
|
|
registry: git.vhaudiquet.fr
|
|
username: ENC[AES256_GCM,data:QijNVgCz8hF0Kg==,iv:eredumkfDLZ6AKM8nCcZwl14EyRRnBvXLL52Yaau0d0=,tag:P/miR7dyjGaMxqM/g7r0ow==,type:str]
|
|
password: ENC[AES256_GCM,data:SY3i9j6rBFh5RfehxBQX+ljVe11cGL1cRNkiFqcNbBlNkF9uqMC9hQ==,iv:qpHKDwzQDr8uTJN9e7OgUr/JN2O+EGJylbH/R+EU9tc=,tag:2DbOvUUTsrNfhIzhjirz/Q==,type:str]
|
|
# Login via the home Gitea: the engine is the confidential client of
|
|
# the provider and runs every code exchange, so its discovery drives
|
|
# the endpoints (issuer verified live). Credentials live in
|
|
# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
|
|
# id in too), so nothing sensitive renders into the ConfigMap. The UI
|
|
# needs nothing: it discovers the provider from the engine's open
|
|
# /auth/methods.
|
|
auth:
|
|
providers:
|
|
- name: gitea
|
|
issuer: https://git.vhaudiquet.fr
|
|
existingSecret: ENC[AES256_GCM,data:lvGugwt7hGbPGF9JSn88B1c=,iv:1Zqze/jXv8kuVNdGdJB9PwvMFHWBihIsEX9jJo7DQvg=,tag:gSgFdyI7HfAj8dwoGd2kbg==,type:str]
|
|
clientIdKey: client-id
|
|
clientSecretKey: ENC[AES256_GCM,data:6vvWWtiomj1TpNJ41g==,iv:xb9HfW2MQNs9vLmPxujUV8us8Tce08L3si1Qd/CCwWk=,tag:LQdV0f79n9NqKBOrh6DDTg==,type:str]
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
# The engine host: CLI intake + the docker/apt registry front-ends.
|
|
host: api.saggar.dev
|
|
# The chart's default annotations are nginx-specific (SSE
|
|
# buffering); traefik streams unbuffered by default, so clear them.
|
|
annotations: {}
|
|
# TLS terminates at Caddy with the cert-manager saggar.dev certs;
|
|
# Caddy proxies to Traefik by host, so no tls block here (same as
|
|
# pkgatlas's ingress).
|
|
tls:
|
|
enabled: false
|
|
ui:
|
|
# Sign-in redirect base — the UI's own public origin.
|
|
publicBaseUrl: https://saggar.dev
|
|
# The engine's public origin for the docker pull / apt usage lines.
|
|
# Set explicitly: the chart derives it from the hub ingress, whose
|
|
# tls is off here (Caddy terminates) — that would render http://.
|
|
apiPublicOrigin: https://api.saggar.dev
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
# The UI lives on its own host: the engine mounts its API and
|
|
# registry surfaces at root (/v2, /apt, /nodes), paths the UI
|
|
# pages also use.
|
|
host: saggar.dev
|
|
annotations: {}
|
|
tls:
|
|
enabled: false
|
|
docs:
|
|
# The chart deploys the book by default; the ingress renders as
|
|
# soon as a host is set (no enabled knob).
|
|
ingress:
|
|
className: traefik
|
|
host: docs.saggar.dev
|
|
tls:
|
|
enabled: false
|
|
sops:
|
|
lastmodified: "2026-10-01T17:39:26Z"
|
|
mac: ENC[AES256_GCM,data:1pn1rHaCx8eYYR6NPt6hgUEwDxRYQQtgkklSu6FroH92gUq2jhX3420lzboTMvvpuBF/vqjbuw1sIR60YfZZ8R5ahw7CCcv8L5sfz9DhUU/vMBYF6r3HDY70AnXkPK3+rPw6ZofB8h+Y/DQEBpPe/LeDEPCOGQjIml349yAvMIk=,iv:A6/PeL8JuFtzS0hMAiP2/dvbXq7Ob3o9VaA0pE2IWEU=,tag:GV2pspKqmaQjafkp4HUwSw==,type:str]
|
|
pgp:
|
|
- created_at: "2026-10-01T17:39:26Z"
|
|
enc: |-
|
|
-----BEGIN PGP MESSAGE-----
|
|
|
|
hQIMA7uy4qQr71wiAQ/+PFcuCPKb5Mpej7uym38cwwVgjaJoaeLrKpfWBw4CEy3v
|
|
PbJgTS7kNKyjHqoeHQcLZZwmms1//b7XQfX2kPnNJIo/06cAgYv5AJ4etMNJ3hys
|
|
ShuiTMmMayKg2U8TdMhzwKFgymhQ5PUzGU1Xg2D9J1hUgW/rRVOb5wHKsBgYkOIx
|
|
ufuQpPhNm9j1xOqWtnf6xCRbZ1HRlE6mAX+4TvRJk/x3U1YW1gI2neyEtFiuCsCj
|
|
PSO9W+5WovDLQlCmGRmCweUwODShpdVqBEoXSS3wjGihz9xKH3lS+NnPZVMoeurE
|
|
kzHjTxQgv4ZLDo9OuXcZz5mlXju9tmvkpLpqP1oHnN+es6Ks0jIpZcvXaZvvF4W5
|
|
CLsC9dDplvAA3IpiF6+vpdDL0/QHpxo61V4jLLqO6o84x2jD1odR+zSkmxUxaQ94
|
|
hxlPY+DGTrvHV0qOWlWLLZO6ddwOqeUC6ntBiZu3FG3UwTwPv9YXvi+ApP4Lylov
|
|
BNKaCxKLalD37BKcPrpaJBwucME56Ny9p0WbHUaBNv74UGIKqPl6BI+9z7oObsrT
|
|
YfmcB0Wlpz8N6SHntYJDhLJktJ27csy6BTPjQsFEK/dHbGyR5X4CiBSehqGd400s
|
|
bomyLdR7m3g4fFG7Qq9Wzh8MA2WC6Fx+ExUXz91xrsejEJhckUl9N0sQDdCO3trS
|
|
UQFWjDQEh9LAJ3U/nQ0SWjaNnJ25U0qJ9qMZYyDDR2aiMqRAwcOZc315S+S/FrGE
|
|
lMkMngLiKqznm9GSsgcBgRIcqovbJr1gCJS/b2+4abjQtw==
|
|
=gAn1
|
|
-----END PGP MESSAGE-----
|
|
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
|
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
|
mac_only_encrypted: true
|
|
version: 3.10.2
|