fix(argocd): clone the public GitHub seed anonymously over HTTPS and delete the SSH deploy-key Secret — its private half had been committed in plaintext to a public remote, and a public repo needs no credential at all

bootstrap.sh

@@ -12,16 +12,15 @@
 #   - Talos cluster up; kubectl context points at it
 #   - helm 3, kubectl
 #   - SOPS age key at $SOPS_KEY (for the ArgoCD SOPS CMP plugin)
-#   - GitHub read-only deploy key private half at $DEPLOY_KEY (public half added
-#     to the GitHub repo's Deploy keys)
+#
+# The GitHub seed repo is public, so it is cloned anonymously over HTTPS — no
+# deploy key, no repository Secret, one less thing to bootstrap before ArgoCD.
 #
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BOOT="$SCRIPT_DIR/k8s/bootstrap"
 SOPS_KEY="${SOPS_KEY:-$HOME/.sops/key.txt}"
-DEPLOY_KEY="${DEPLOY_KEY:-$HOME/.ssh/argocd_seed}"
-GITHUB_SSH="[email protected]:Riotpiaole/riotpiao.homelab.com.git"
 
 log()  { echo "[$(date +%H:%M:%S)] $*"; }
 die()  { echo "ERROR: $*" >&2; exit 1; }
@@ -39,7 +38,6 @@ preflight() {
   kubectl cluster-info >/dev/null || die "kubectl not configured / cluster unreachable"
   command -v helm >/dev/null || die "helm 3 not found"
   [[ -f "$SOPS_KEY" ]]   || die "SOPS age key missing at $SOPS_KEY"
-  [[ -f "$DEPLOY_KEY" ]] || die "GitHub deploy key missing at $DEPLOY_KEY (see phase4-argocd/seed-repo-secret.example.yaml)"
   log "✅ preflight ok"
 }
 
@@ -194,13 +192,10 @@ p3_forgejo() {
 p4_argocd() {
   phase "PHASE 4: ArgoCD (seeded from GitHub)"
   
-  # Always ensure namespace + repository secret (idempotent)
+  # Always ensure namespace (idempotent). The seed repo is public — ArgoCD clones
+  # it anonymously over HTTPS, so there is no repository Secret to create.
   kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
-  kubectl -n argocd create secret generic seed-github-repo \
-    --from-literal=type=git --from-literal=url="$GITHUB_SSH" \
-    --from-file=sshPrivateKey="$DEPLOY_KEY" --dry-run=client -o yaml | kubectl apply -f -
-  kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository --overwrite 2>/dev/null || true
-  
+
   # Decrypt and apply any encrypted secrets from bootstrap dir (local SOPS)
   if command -v sops &> /dev/null; then
     export SOPS_AGE_KEY_FILE="$SOPS_KEY"