4 Commits

Include renames

Author	SHA1	Message	Date
Story Crater BotandClaude Haiku 4.5	d282ae1aa0	feat(argocd): deploy SOPS CMP plugin for secret decryption — Stage 0 grafana ... Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts *.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets. Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates grafana-values.yaml to wire admin.existingSecret (chart-native support). CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik. Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4 (loki/authentik/forgejo/temporal) extend plugin script incrementally after verification. Co-Authored-By: Claude Haiku 4.5 <[email protected]>	2026-07-20 11:30:06 -07:00
Story Crater Bot	063308308f	feat(cloudflared): wire tunnel token secret and document bootstrap ... - Create SOPS-encrypted cloudflared-secrets.enc.yaml with tunnel token - Add Cloudflare vars to .env.example (CLOUDFLARE_CONNECTOR_TOKEN, ACCOUNT_ID, TUNNEL_ID, API_TOKEN) - Document Phase 0 cloudflared-token Secret creation in BOOTSTRAP.md (manual step until CMP plugin wires it) - Note: Cloudflare-side TCP routing (cp1.homelab -> 192.168.1.213:6443, etc.) must be configured manually in Zero Trust dashboard Tunnel already deployed as ArgoCD Application in k8s/argocd/apps/60-applications.yaml (wave 8); this closes the missing Secret gap and documents the bootstrap path.	2026-07-20 10:50:20 -07:00
Story Crater Bot	c759481ea6	refactor(argocd): replace wave/layer/phase schemes with two-phase bootstrap + app-of-apps and document both CD scopes — fixes self-hosted-git chicken-egg and stale paths	2026-07-20 08:22:53 -07:00
Story Crater Bot	15b1ec6ad4	feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs	2026-07-20 08:22:53 -07:00