rock
227a67a8c1
The tunnel was remotely managed from the Zero Trust dashboard: the Deployment ran 'run --token' and ignored the ConfigMap that already existed in the tree. Switch to a locally-managed tunnel so the ingress routing table lives in git. - deployment: mount cloudflared-config (config.yml) and the cloudflared-credentials Secret; drop TUNNEL_TOKEN env - configmap.yaml: per-hostname ingress rules to ingress-nginx via the CoreDNS rewrite, plus a 404 catch-all - secret-generator: register the SOPS-encrypted credentials file - homelab-ca: add the cloudflared namespace copy so the connector trusts the ingress certificate (force-ssl-redirect makes plaintext impossible) Credentials were extracted from the live cloudflared-token Secret and re-encrypted with SOPS; no plaintext secret is committed.
47 lines
1.5 KiB
YAML
47 lines
1.5 KiB
YAML
apiVersion: viaduct.ai/v1
|
|
kind: ksops
|
|
metadata:
|
|
name: sops-secret-generator
|
|
annotations:
|
|
config.kubernetes.io/function: |
|
|
exec:
|
|
path: ksops
|
|
files:
|
|
- agent-pod-models.enc.yaml
|
|
- agent-pod-ssh-key.enc.yaml
|
|
- authentik-secrets.enc.yaml
|
|
- cloudflare-secrets.enc.yaml
|
|
- cloudflared-credentials.enc.yaml
|
|
- forgejo-registry-pat-api.enc.yaml
|
|
- forgejo-registry-pull.enc.yaml
|
|
- forgejo-runner-token.enc.yaml
|
|
- forgejo-secrets.enc.yaml
|
|
- grafana-oidc-secrets.enc.yaml
|
|
- grafana-secrets.enc.yaml
|
|
- homarr-auth-oidc.enc.yaml
|
|
- homarr-db-encryption.enc.yaml
|
|
- homarr-secrets.enc.yaml
|
|
- homelab-ca-secrets.enc.yaml
|
|
- loki-secrets.enc.yaml
|
|
- minio-secrets.enc.yaml
|
|
- paperless-secrets.enc.yaml
|
|
- vault-secrets.enc.yaml
|
|
- vault-unseal-keys.enc.yaml
|
|
- portfolio-secrets.enc.yaml
|
|
- gotify-admin-secrets.enc.yaml
|
|
- gotify-tokens-secrets.enc.yaml
|
|
- gotify-smtp-secrets.enc.yaml
|
|
- forgejo-smtp-secrets.enc.yaml
|
|
- paperless-ai-secrets.enc.yaml
|
|
- memory-agent-oidc.enc.yaml
|
|
- oauth2-credentials.enc.yaml
|
|
- forgejo-registry-token.enc.yaml
|
|
- pi-sandbox-secrets.enc.yaml
|
|
- etcd-defrag-creds.enc.yaml
|
|
- zitadel-masterkey.enc.yaml
|
|
# Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
|
|
# owns it. Without this, the chart re-generates the keypair on every render,
|
|
# which changes checksum/secret-login-service-key and leaves both Zitadel
|
|
# Deployments permanently OutOfSync.
|
|
- zitadel-login-service-key.enc.yaml
|