mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-10-18 12:51:24 +00:00
vhaudiquet
9aeecee770
The release runners cannot resolve the in-cluster Service name, so the binary uploads died on DNS. s3.rhema.rs fronts the same Garage through Caddy and Traefik, with its own certificate, matching the web face's shape (Caddy terminates, Traefik routes, bucket by path).
59 lines
2.9 KiB
YAML
59 lines
2.9 KiB
YAML
# get.rhema.rs, the rhema distribution (chart rhema-dist, repo
|
|
# vhaudiquet/rhema.rs). One single-node Garage, one bucket, the
|
|
# saggar-dist shape: the S3 API stays cluster-internal (chart default,
|
|
# s3.ingress.enabled=false — release uploads come from the in-cluster
|
|
# runners) and the bucket serves as a public read-only website.
|
|
# The host MUST be <bucket>.<root domain> — Garage resolves the bucket
|
|
# from the Host's first label — so bucket `get` on get.rhema.rs.
|
|
bucket: get
|
|
garage:
|
|
# Single-node store: skip the hourly self-sync cycles — while a
|
|
# full sync runs, S3 auth lookups transiently answer
|
|
# InvalidAccessKeyId (see get-saggar). Weekly.
|
|
fullSyncInterval: 604800
|
|
web:
|
|
ingress:
|
|
className: traefik
|
|
host: get.rhema.rs
|
|
# TLS terminates at Caddy with the cert-manager get.rhema.rs
|
|
# cert; Caddy proxies to Traefik by host, so no tls block here.
|
|
tls:
|
|
enabled: false
|
|
# The write surface, public via Caddy: the release runners reach the
|
|
# S3 API by host (the in-cluster Service name does not resolve from
|
|
# them). TLS terminates at Caddy, like the web face.
|
|
s3:
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
host: s3.rhema.rs
|
|
tls:
|
|
enabled: false
|
|
secretName: ""
|
|
sops:
|
|
lastmodified: "2026-10-16T06:56:14Z"
|
|
mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str]
|
|
pgp:
|
|
- created_at: "2026-10-16T06:56:14Z"
|
|
enc: |-
|
|
-----BEGIN PGP MESSAGE-----
|
|
|
|
hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe
|
|
wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43
|
|
FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36
|
|
mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK
|
|
SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB
|
|
GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ
|
|
0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF
|
|
OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA
|
|
tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N
|
|
owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU
|
|
byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS
|
|
XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ
|
|
AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0
|
|
=1619
|
|
-----END PGP MESSAGE-----
|
|
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
|
encrypted_regex: ^(data|stringData|.*key|.*crt)$
|
|
version: 3.10.2
|