fix(argocd): clone the public GitHub seed anonymously over HTTPS and delete the SSH deploy-key Secret — its private half had been committed in plaintext to a public remote, and a public repo needs no credential at all

bootstrap.sh

@@ -12,16 +12,15 @@
 #   - Talos cluster up; kubectl context points at it
 #   - helm 3, kubectl
 #   - SOPS age key at $SOPS_KEY (for the ArgoCD SOPS CMP plugin)
-#   - GitHub read-only deploy key private half at $DEPLOY_KEY (public half added
-#     to the GitHub repo's Deploy keys)
+#
+# The GitHub seed repo is public, so it is cloned anonymously over HTTPS — no
+# deploy key, no repository Secret, one less thing to bootstrap before ArgoCD.
 #
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BOOT="$SCRIPT_DIR/k8s/bootstrap"
 SOPS_KEY="${SOPS_KEY:-$HOME/.sops/key.txt}"
-DEPLOY_KEY="${DEPLOY_KEY:-$HOME/.ssh/argocd_seed}"
-GITHUB_SSH="[email protected]:Riotpiaole/riotpiao.homelab.com.git"
 
 log()  { echo "[$(date +%H:%M:%S)] $*"; }
 die()  { echo "ERROR: $*" >&2; exit 1; }
@@ -39,7 +38,6 @@ preflight() {
   kubectl cluster-info >/dev/null || die "kubectl not configured / cluster unreachable"
   command -v helm >/dev/null || die "helm 3 not found"
   [[ -f "$SOPS_KEY" ]]   || die "SOPS age key missing at $SOPS_KEY"
-  [[ -f "$DEPLOY_KEY" ]] || die "GitHub deploy key missing at $DEPLOY_KEY (see phase4-argocd/seed-repo-secret.example.yaml)"
   log "✅ preflight ok"
 }
 
@@ -194,13 +192,10 @@ p3_forgejo() {
 p4_argocd() {
   phase "PHASE 4: ArgoCD (seeded from GitHub)"
   
-  # Always ensure namespace + repository secret (idempotent)
+  # Always ensure namespace (idempotent). The seed repo is public — ArgoCD clones
+  # it anonymously over HTTPS, so there is no repository Secret to create.
   kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
-  kubectl -n argocd create secret generic seed-github-repo \
-    --from-literal=type=git --from-literal=url="$GITHUB_SSH" \
-    --from-file=sshPrivateKey="$DEPLOY_KEY" --dry-run=client -o yaml | kubectl apply -f -
-  kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository --overwrite 2>/dev/null || true
-  
+
   # Decrypt and apply any encrypted secrets from bootstrap dir (local SOPS)
   if command -v sops &> /dev/null; then
     export SOPS_AGE_KEY_FILE="$SOPS_KEY"

k8s/argocd/apps/00-secrets.yaml

@@ -17,7 +17,7 @@ spec:
     syncOptions:
       - CreateNamespace=true
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     # ksops decrypts every *.enc.yaml here at kustomize-build time (repo-server
     # runs `kustomize build --enable-alpha-plugins --enable-exec`). Replaces the

k8s/argocd/apps/00-substrate.yaml

@@ -21,7 +21,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/bootstrap/cert-manager/cert-manager-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -93,7 +93,7 @@ spec:
   project: homelab
   revisionHistoryLimit: 3
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     # A real kustomization.yaml (resources: the 3 issuer/CA files) renders these
     # deterministically. The previous directory.include with bare filenames
@@ -127,7 +127,7 @@ spec:
   project: homelab
   revisionHistoryLimit: 3
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/bootstrap/ingress
   destination:

k8s/argocd/apps/10-storage-observability.yaml

@@ -17,7 +17,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/minio/minio-operator-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -41,7 +41,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/infra/minio
   destination:
@@ -66,7 +66,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/infra/longhorn
   destination:
@@ -94,7 +94,7 @@ spec:
         skipCrds: true
         valueFiles:
           - $values/k8s/infra/monitoring/prometheus-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -144,7 +144,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/infra/monitoring/crds
   destination:
@@ -175,7 +175,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/infra/monitoring
   destination:
@@ -205,7 +205,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/monitoring/blackbox-exporter-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:

k8s/argocd/apps/20-logging.yaml

@@ -19,7 +19,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/logging/loki-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -53,7 +53,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/logging/grafana-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -87,7 +87,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/logging/promtail-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:

k8s/argocd/apps/30-security.yaml

@@ -17,7 +17,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/iam/vault-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -46,7 +46,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/iam/authentik-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -68,7 +68,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/infra/iam
   destination:
@@ -90,7 +90,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/infra/forgejo-runner
   destination:

k8s/argocd/apps/40-data.yaml

@@ -14,7 +14,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/infra/databases
   destination:

k8s/argocd/apps/50-messaging.yaml

@@ -68,7 +68,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/apps/messaging/kafka-cluster
   destination:
@@ -89,7 +89,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/apps/messaging/queue-crd
   destination:
@@ -110,7 +110,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/apps/messaging/management-service
   destination:

k8s/argocd/apps/55-api-gateway.yaml

@@ -28,13 +28,13 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/apps/api/kong-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
     # The nginx Ingress for api.riotpiao.com. Kept in this Application rather
     # than the central k8s/bootstrap/ingress/ingress.yaml because that one syncs
     # in wave 1, before namespace `api` exists.
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       path: k8s/apps/api
   destination:

k8s/argocd/apps/60-applications.yaml

@@ -19,7 +19,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/apps/temporal/temporal-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -48,7 +48,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/apps/portainer/portainer-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
   destination:
@@ -71,7 +71,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/apps/cloudflared
   destination:
@@ -104,7 +104,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/apps/sms
   destination:
@@ -133,10 +133,10 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/apps/homarr/homarr-values.yaml
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       ref: values
-    - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
   destination:

k8s/argocd/projects/homelab-project.yaml

@@ -11,7 +11,7 @@ metadata:
 spec:
   description: Homelab GitOps — single-repo, in-cluster destinations only
   sourceRepos:
-    - git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    - https://github.com/Riotpiaole/riotpiao.homelab.com.git
     # Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/*
     - https://cloudnative-pg.github.io/charts
     - https://dl.gitea.com/charts/

k8s/argocd/root/homelab-root.yaml

@@ -12,7 +12,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
     targetRevision: main
     path: k8s/argocd/apps
     directory:

k8s/bootstrap/phase4-argocd/root-app-github.yaml

@@ -3,8 +3,8 @@
 # GitHub seed so ArgoCD can deploy everything after the control plane. After
 # Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml.
 #
-# repoURL is the SSH form — must match the `url` in the seed-repo deploy-key Secret
-# (see seed-repo-secret.example.yaml). Apply that Secret before this.
+# repoURL is anonymous HTTPS — the seed repo is public, so no deploy key and no
+# repository Secret are needed. Nothing to apply before this.
 ---
 apiVersion: v1
 kind: Namespace
@@ -44,7 +44,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git   # GitHub seed (SSH)
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git   # GitHub seed (SSH)
     targetRevision: main
     path: k8s/argocd/apps
   destination:

k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml

@@ -1,28 +0,0 @@
-# ArgoCD repo credential for the PRIVATE GitHub seed — deploy key (read-only).
-# Apply at Phase 0 BEFORE root-app-github.yaml. This is a TEMPLATE: never commit
-# the real private key.
-#
-#   ssh-keygen -t ed25519 -C "argocd@homelab" -f argocd_seed -N ""
-#   # add argocd_seed.pub → GitHub repo → Settings → Deploy keys (Read-only, no write)
-#   kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
-#   kubectl -n argocd create secret generic seed-github-repo \
-#     --from-literal=type=git \
-#     [email protected]:Riotpiaole/riotpiao.homelab.com.git \
-#     --from-file=sshPrivateKey=argocd_seed
-#   kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository
-#
-# url MUST match root-app-github.yaml's repoURL (SSH form).
-apiVersion: v1
-kind: Secret
-metadata:
-  name: seed-github-repo
-  namespace: argocd
-  labels:
-    argocd.argoproj.io/secret-type: repository
-stringData:
-  type: git
-  url: [email protected]:Riotpiaole/riotpiao.homelab.com.git
-  sshPrivateKey: |
-    -----BEGIN OPENSSH PRIVATE KEY-----
-    REPLACE-WITH-READ-ONLY-DEPLOY-KEY-PRIVATE-HALF — DO NOT COMMIT THE REAL KEY
-    -----END OPENSSH PRIVATE KEY-----