diff --git a/.gitignore b/.gitignore index b86152e6..486b0ee7 100644 --- a/.gitignore +++ b/.gitignore @@ -7,4 +7,4 @@ result # Materialized helm subchart deps (regenerated by helmfile) -charts/*/charts/ +k8s/charts/*/charts/ diff --git a/.justfile b/.justfile index 59d1d292..db87d014 100644 --- a/.justfile +++ b/.justfile @@ -89,31 +89,6 @@ update-caddy-tailscale: deploy jobs='': nynx --operation switch {{ if jobs == "" { "" } else { "--jobs " + jobs } }} -# Pull latest aly.codes OCI on solaceon. -[group('servers')] -update-alycodes: - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-alycodes.yml - -# Pull latest morsels OCI on eterna. -[group('servers')] -update-morsels: - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-morsels.yml - -# Pull latest myAtmosphere OCI on solaceon. -[group('servers')] -update-myatmosphere: - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-myatmosphere.yml - -# Pull latest atbbs OCI on eterna. -[group('servers')] -update-atbbs: - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-atbbs.yml - -# Pull latest watsup OCI on solaceon. -[group('servers')] -update-watsup: - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-watsup.yml - # Reboot all servers. [group('servers')] reboot: @@ -176,13 +151,13 @@ sops-edit FILE: # ############################################################################ -# Scaffold a new app chart under charts/. After running, edit the -# values.yaml and add a release block to helmfile.yaml. See charts/README.md. +# Scaffold a new app chart under k8s/charts/. After running, edit the +# values.yaml and add a release block to k8s/helmfile.yaml. See k8s/charts/README.md. [group('kubes')] new-app NAME: #!/usr/bin/env bash set -euo pipefail - DIR="charts/{{ NAME }}" + DIR="k8s/charts/{{ NAME }}" if [[ -e "$DIR" ]]; then echo "$DIR already exists; aborting." >&2 exit 1 @@ -240,4 +215,4 @@ new-app NAME: echo '{{{{- include "common.'"$kind"'" . }}}}' > "$DIR/templates/$kind.yaml" done helm dependency update "$DIR" >/dev/null - echo "scaffolded $DIR. next: edit values.yaml and add a release to helmfile.yaml." + echo "scaffolded $DIR. next: edit values.yaml and add a release to k8s/helmfile.yaml." diff --git a/.prettierignore b/.prettierignore index 96af64e0..3d859bfe 100644 --- a/.prettierignore +++ b/.prettierignore @@ -1,3 +1,3 @@ .github flake.lock -charts/*/templates +k8s/charts/*/templates diff --git a/README.md b/README.md index f763d284..f27cc9d2 100644 --- a/README.md +++ b/README.md @@ -26,14 +26,18 @@ This repository contains NixOS and home-manager configurations, along with whate ```plaintext . ├── flake.nix # Flake entry point -├── helmfile.yaml # k3s release graph (helmfile + helm + vals) ├── homes/ # home-manager configurations ├── hosts/ # NixOS host configurations ├── modules/ # NixOS / home-manager / flake modules ├── overlays/ # Custom Nixpkgs overlays -├── charts/ # In-tree helm charts (see charts/README.md) -├── values/ # Per-chart vals refs into secrets/ (see values/README.md) +├── k8s/ # k3s: helmfile + in-tree charts + vals overlays +│ ├── helmfile.yaml # release graph (helmfile + helm + vals) +│ ├── charts/ # In-tree helm charts (see k8s/charts/README.md) +│ └── values/ # Per-chart vals refs into ../secrets/ ├── secrets/ # SOPS-encrypted yaml (multi-recipient age) +├── publicKeys/ # Per-host + per-user age recipients +├── terraform/ # Cloudflare DNS, etc. +├── ansible/ # Server playbooks (deploy-offline, reboots) └── BACKUPS.md # B2 backup + restore runbook (CNPG + Longhorn) ``` diff --git a/ansible/playbooks/restart-alycodes.yml b/ansible/playbooks/restart-alycodes.yml deleted file mode 100644 index 2336b4a3..00000000 --- a/ansible/playbooks/restart-alycodes.yml +++ /dev/null @@ -1,8 +0,0 @@ -- hosts: solaceon - remote_user: root - - tasks: - - name: Restart podman-alycodes - ansible.builtin.systemd_service: - name: podman-alycodes - state: restarted diff --git a/ansible/playbooks/restart-atbbs.yml b/ansible/playbooks/restart-atbbs.yml deleted file mode 100644 index a5d1ee28..00000000 --- a/ansible/playbooks/restart-atbbs.yml +++ /dev/null @@ -1,11 +0,0 @@ -- hosts: eterna - remote_user: root - - tasks: - - name: Restart podman-atbbs - ansible.builtin.systemd_service: - name: "{{ item }}" - state: restarted - loop: - - podman-atbbs - - podman-atbbs-telnet diff --git a/ansible/playbooks/restart-morsels.yml b/ansible/playbooks/restart-morsels.yml deleted file mode 100644 index ef6d2b0a..00000000 --- a/ansible/playbooks/restart-morsels.yml +++ /dev/null @@ -1,8 +0,0 @@ -- hosts: eterna - remote_user: root - - tasks: - - name: Restart podman-morsels - ansible.builtin.systemd_service: - name: podman-morsels - state: restarted diff --git a/ansible/playbooks/restart-myatmosphere.yml b/ansible/playbooks/restart-myatmosphere.yml deleted file mode 100644 index 85c88089..00000000 --- a/ansible/playbooks/restart-myatmosphere.yml +++ /dev/null @@ -1,8 +0,0 @@ -- hosts: solaceon - remote_user: root - - tasks: - - name: Restart podman-myaymosphere - ansible.builtin.systemd_service: - name: podman-myatmosphere - state: restarted diff --git a/ansible/playbooks/restart-watsup.yml b/ansible/playbooks/restart-watsup.yml deleted file mode 100644 index 33044799..00000000 --- a/ansible/playbooks/restart-watsup.yml +++ /dev/null @@ -1,8 +0,0 @@ -- hosts: solaceon - remote_user: root - - tasks: - - name: Restart podman-watsup - ansible.builtin.systemd_service: - name: podman-watsup - state: restarted diff --git a/charts/README.md b/k8s/charts/README.md similarity index 95% rename from charts/README.md rename to k8s/charts/README.md index 695fc38f..2ac60468 100644 --- a/charts/README.md +++ b/k8s/charts/README.md @@ -69,8 +69,8 @@ Then: ``` 3. If the app needs secrets: - `just sops-edit .yaml` — write the encrypted file - - Create `values/.yaml` with `ref+sops://secrets/.yaml#/...` - refs for each key + - Create `values/.yaml` with `ref+sops://../secrets/.yaml#/...` + refs for each key (path is relative to `k8s/`, where helmfile runs) - Add `values: [values/.yaml]` to the helmfile release 4. `helmfile -l name= apply` diff --git a/charts/aly-codes/Chart.lock b/k8s/charts/aly-codes/Chart.lock similarity index 100% rename from charts/aly-codes/Chart.lock rename to k8s/charts/aly-codes/Chart.lock diff --git a/charts/aly-codes/Chart.yaml b/k8s/charts/aly-codes/Chart.yaml similarity index 100% rename from charts/aly-codes/Chart.yaml rename to k8s/charts/aly-codes/Chart.yaml diff --git a/charts/aly-codes/templates/deployment.yaml b/k8s/charts/aly-codes/templates/deployment.yaml similarity index 100% rename from charts/aly-codes/templates/deployment.yaml rename to k8s/charts/aly-codes/templates/deployment.yaml diff --git a/charts/aly-codes/templates/ingress.yaml b/k8s/charts/aly-codes/templates/ingress.yaml similarity index 100% rename from charts/aly-codes/templates/ingress.yaml rename to k8s/charts/aly-codes/templates/ingress.yaml diff --git a/charts/aly-codes/templates/service.yaml b/k8s/charts/aly-codes/templates/service.yaml similarity index 100% rename from charts/aly-codes/templates/service.yaml rename to k8s/charts/aly-codes/templates/service.yaml diff --git a/charts/aly-codes/values.yaml b/k8s/charts/aly-codes/values.yaml similarity index 100% rename from charts/aly-codes/values.yaml rename to k8s/charts/aly-codes/values.yaml diff --git a/charts/bluesky-pds/Chart.lock b/k8s/charts/bluesky-pds/Chart.lock similarity index 100% rename from charts/bluesky-pds/Chart.lock rename to k8s/charts/bluesky-pds/Chart.lock diff --git a/charts/bluesky-pds/Chart.yaml b/k8s/charts/bluesky-pds/Chart.yaml similarity index 100% rename from charts/bluesky-pds/Chart.yaml rename to k8s/charts/bluesky-pds/Chart.yaml diff --git a/charts/bluesky-pds/templates/deployment.yaml b/k8s/charts/bluesky-pds/templates/deployment.yaml similarity index 100% rename from charts/bluesky-pds/templates/deployment.yaml rename to k8s/charts/bluesky-pds/templates/deployment.yaml diff --git a/charts/bluesky-pds/templates/ingress.yaml b/k8s/charts/bluesky-pds/templates/ingress.yaml similarity index 100% rename from charts/bluesky-pds/templates/ingress.yaml rename to k8s/charts/bluesky-pds/templates/ingress.yaml diff --git a/charts/bluesky-pds/templates/pvc.yaml b/k8s/charts/bluesky-pds/templates/pvc.yaml similarity index 100% rename from charts/bluesky-pds/templates/pvc.yaml rename to k8s/charts/bluesky-pds/templates/pvc.yaml diff --git a/charts/bluesky-pds/templates/secret.yaml b/k8s/charts/bluesky-pds/templates/secret.yaml similarity index 100% rename from charts/bluesky-pds/templates/secret.yaml rename to k8s/charts/bluesky-pds/templates/secret.yaml diff --git a/charts/bluesky-pds/templates/service.yaml b/k8s/charts/bluesky-pds/templates/service.yaml similarity index 100% rename from charts/bluesky-pds/templates/service.yaml rename to k8s/charts/bluesky-pds/templates/service.yaml diff --git a/charts/bluesky-pds/values.yaml b/k8s/charts/bluesky-pds/values.yaml similarity index 100% rename from charts/bluesky-pds/values.yaml rename to k8s/charts/bluesky-pds/values.yaml diff --git a/charts/cluster-tls/Chart.yaml b/k8s/charts/cluster-tls/Chart.yaml similarity index 100% rename from charts/cluster-tls/Chart.yaml rename to k8s/charts/cluster-tls/Chart.yaml diff --git a/charts/cluster-tls/templates/secrets.yaml b/k8s/charts/cluster-tls/templates/secrets.yaml similarity index 100% rename from charts/cluster-tls/templates/secrets.yaml rename to k8s/charts/cluster-tls/templates/secrets.yaml diff --git a/charts/cluster-tls/values.yaml b/k8s/charts/cluster-tls/values.yaml similarity index 100% rename from charts/cluster-tls/values.yaml rename to k8s/charts/cluster-tls/values.yaml diff --git a/charts/common/Chart.yaml b/k8s/charts/common/Chart.yaml similarity index 100% rename from charts/common/Chart.yaml rename to k8s/charts/common/Chart.yaml diff --git a/charts/common/README.md b/k8s/charts/common/README.md similarity index 100% rename from charts/common/README.md rename to k8s/charts/common/README.md diff --git a/charts/common/templates/_deployment.tpl b/k8s/charts/common/templates/_deployment.tpl similarity index 100% rename from charts/common/templates/_deployment.tpl rename to k8s/charts/common/templates/_deployment.tpl diff --git a/charts/common/templates/_ingress.tpl b/k8s/charts/common/templates/_ingress.tpl similarity index 100% rename from charts/common/templates/_ingress.tpl rename to k8s/charts/common/templates/_ingress.tpl diff --git a/charts/common/templates/_pvc.tpl b/k8s/charts/common/templates/_pvc.tpl similarity index 100% rename from charts/common/templates/_pvc.tpl rename to k8s/charts/common/templates/_pvc.tpl diff --git a/charts/common/templates/_secret.tpl b/k8s/charts/common/templates/_secret.tpl similarity index 100% rename from charts/common/templates/_secret.tpl rename to k8s/charts/common/templates/_secret.tpl diff --git a/charts/common/templates/_service.tpl b/k8s/charts/common/templates/_service.tpl similarity index 100% rename from charts/common/templates/_service.tpl rename to k8s/charts/common/templates/_service.tpl diff --git a/charts/external-routes/Chart.yaml b/k8s/charts/external-routes/Chart.yaml similarity index 100% rename from charts/external-routes/Chart.yaml rename to k8s/charts/external-routes/Chart.yaml diff --git a/charts/external-routes/templates/routes.yaml b/k8s/charts/external-routes/templates/routes.yaml similarity index 100% rename from charts/external-routes/templates/routes.yaml rename to k8s/charts/external-routes/templates/routes.yaml diff --git a/charts/external-routes/values.yaml b/k8s/charts/external-routes/values.yaml similarity index 100% rename from charts/external-routes/values.yaml rename to k8s/charts/external-routes/values.yaml diff --git a/charts/forgejo/Chart.lock b/k8s/charts/forgejo/Chart.lock similarity index 100% rename from charts/forgejo/Chart.lock rename to k8s/charts/forgejo/Chart.lock diff --git a/charts/forgejo/Chart.yaml b/k8s/charts/forgejo/Chart.yaml similarity index 100% rename from charts/forgejo/Chart.yaml rename to k8s/charts/forgejo/Chart.yaml diff --git a/charts/forgejo/templates/deployment.yaml b/k8s/charts/forgejo/templates/deployment.yaml similarity index 100% rename from charts/forgejo/templates/deployment.yaml rename to k8s/charts/forgejo/templates/deployment.yaml diff --git a/charts/forgejo/templates/ingress.yaml b/k8s/charts/forgejo/templates/ingress.yaml similarity index 100% rename from charts/forgejo/templates/ingress.yaml rename to k8s/charts/forgejo/templates/ingress.yaml diff --git a/charts/forgejo/templates/pvc.yaml b/k8s/charts/forgejo/templates/pvc.yaml similarity index 100% rename from charts/forgejo/templates/pvc.yaml rename to k8s/charts/forgejo/templates/pvc.yaml diff --git a/charts/forgejo/templates/service.yaml b/k8s/charts/forgejo/templates/service.yaml similarity index 100% rename from charts/forgejo/templates/service.yaml rename to k8s/charts/forgejo/templates/service.yaml diff --git a/charts/forgejo/values.yaml b/k8s/charts/forgejo/values.yaml similarity index 100% rename from charts/forgejo/values.yaml rename to k8s/charts/forgejo/values.yaml diff --git a/charts/longhorn-creds/Chart.yaml b/k8s/charts/longhorn-creds/Chart.yaml similarity index 100% rename from charts/longhorn-creds/Chart.yaml rename to k8s/charts/longhorn-creds/Chart.yaml diff --git a/charts/longhorn-creds/templates/recurring-job.yaml b/k8s/charts/longhorn-creds/templates/recurring-job.yaml similarity index 100% rename from charts/longhorn-creds/templates/recurring-job.yaml rename to k8s/charts/longhorn-creds/templates/recurring-job.yaml diff --git a/charts/longhorn-creds/templates/secret.yaml b/k8s/charts/longhorn-creds/templates/secret.yaml similarity index 100% rename from charts/longhorn-creds/templates/secret.yaml rename to k8s/charts/longhorn-creds/templates/secret.yaml diff --git a/charts/longhorn-creds/templates/ui-ingress.yaml b/k8s/charts/longhorn-creds/templates/ui-ingress.yaml similarity index 100% rename from charts/longhorn-creds/templates/ui-ingress.yaml rename to k8s/charts/longhorn-creds/templates/ui-ingress.yaml diff --git a/charts/longhorn-creds/values.yaml b/k8s/charts/longhorn-creds/values.yaml similarity index 100% rename from charts/longhorn-creds/values.yaml rename to k8s/charts/longhorn-creds/values.yaml diff --git a/charts/morsels/Chart.lock b/k8s/charts/morsels/Chart.lock similarity index 100% rename from charts/morsels/Chart.lock rename to k8s/charts/morsels/Chart.lock diff --git a/charts/morsels/Chart.yaml b/k8s/charts/morsels/Chart.yaml similarity index 100% rename from charts/morsels/Chart.yaml rename to k8s/charts/morsels/Chart.yaml diff --git a/charts/morsels/templates/deployment.yaml b/k8s/charts/morsels/templates/deployment.yaml similarity index 100% rename from charts/morsels/templates/deployment.yaml rename to k8s/charts/morsels/templates/deployment.yaml diff --git a/charts/morsels/templates/ingress.yaml b/k8s/charts/morsels/templates/ingress.yaml similarity index 100% rename from charts/morsels/templates/ingress.yaml rename to k8s/charts/morsels/templates/ingress.yaml diff --git a/charts/morsels/templates/pvc.yaml b/k8s/charts/morsels/templates/pvc.yaml similarity index 100% rename from charts/morsels/templates/pvc.yaml rename to k8s/charts/morsels/templates/pvc.yaml diff --git a/charts/morsels/templates/service.yaml b/k8s/charts/morsels/templates/service.yaml similarity index 100% rename from charts/morsels/templates/service.yaml rename to k8s/charts/morsels/templates/service.yaml diff --git a/charts/morsels/values.yaml b/k8s/charts/morsels/values.yaml similarity index 100% rename from charts/morsels/values.yaml rename to k8s/charts/morsels/values.yaml diff --git a/charts/pg-shared/Chart.yaml b/k8s/charts/pg-shared/Chart.yaml similarity index 100% rename from charts/pg-shared/Chart.yaml rename to k8s/charts/pg-shared/Chart.yaml diff --git a/charts/pg-shared/templates/b2-creds.yaml b/k8s/charts/pg-shared/templates/b2-creds.yaml similarity index 100% rename from charts/pg-shared/templates/b2-creds.yaml rename to k8s/charts/pg-shared/templates/b2-creds.yaml diff --git a/charts/pg-shared/templates/cluster.yaml b/k8s/charts/pg-shared/templates/cluster.yaml similarity index 100% rename from charts/pg-shared/templates/cluster.yaml rename to k8s/charts/pg-shared/templates/cluster.yaml diff --git a/charts/pg-shared/templates/scheduled-backup.yaml b/k8s/charts/pg-shared/templates/scheduled-backup.yaml similarity index 100% rename from charts/pg-shared/templates/scheduled-backup.yaml rename to k8s/charts/pg-shared/templates/scheduled-backup.yaml diff --git a/charts/pg-shared/templates/storageclass.yaml b/k8s/charts/pg-shared/templates/storageclass.yaml similarity index 100% rename from charts/pg-shared/templates/storageclass.yaml rename to k8s/charts/pg-shared/templates/storageclass.yaml diff --git a/charts/pg-shared/values.yaml b/k8s/charts/pg-shared/values.yaml similarity index 100% rename from charts/pg-shared/values.yaml rename to k8s/charts/pg-shared/values.yaml diff --git a/charts/uptime-kuma/Chart.lock b/k8s/charts/uptime-kuma/Chart.lock similarity index 100% rename from charts/uptime-kuma/Chart.lock rename to k8s/charts/uptime-kuma/Chart.lock diff --git a/charts/uptime-kuma/Chart.yaml b/k8s/charts/uptime-kuma/Chart.yaml similarity index 100% rename from charts/uptime-kuma/Chart.yaml rename to k8s/charts/uptime-kuma/Chart.yaml diff --git a/charts/uptime-kuma/templates/deployment.yaml b/k8s/charts/uptime-kuma/templates/deployment.yaml similarity index 100% rename from charts/uptime-kuma/templates/deployment.yaml rename to k8s/charts/uptime-kuma/templates/deployment.yaml diff --git a/charts/uptime-kuma/templates/ingress.yaml b/k8s/charts/uptime-kuma/templates/ingress.yaml similarity index 100% rename from charts/uptime-kuma/templates/ingress.yaml rename to k8s/charts/uptime-kuma/templates/ingress.yaml diff --git a/charts/uptime-kuma/templates/pvc.yaml b/k8s/charts/uptime-kuma/templates/pvc.yaml similarity index 100% rename from charts/uptime-kuma/templates/pvc.yaml rename to k8s/charts/uptime-kuma/templates/pvc.yaml diff --git a/charts/uptime-kuma/templates/service.yaml b/k8s/charts/uptime-kuma/templates/service.yaml similarity index 100% rename from charts/uptime-kuma/templates/service.yaml rename to k8s/charts/uptime-kuma/templates/service.yaml diff --git a/charts/uptime-kuma/values.yaml b/k8s/charts/uptime-kuma/values.yaml similarity index 100% rename from charts/uptime-kuma/values.yaml rename to k8s/charts/uptime-kuma/values.yaml diff --git a/charts/vaultwarden/Chart.lock b/k8s/charts/vaultwarden/Chart.lock similarity index 100% rename from charts/vaultwarden/Chart.lock rename to k8s/charts/vaultwarden/Chart.lock diff --git a/charts/vaultwarden/Chart.yaml b/k8s/charts/vaultwarden/Chart.yaml similarity index 100% rename from charts/vaultwarden/Chart.yaml rename to k8s/charts/vaultwarden/Chart.yaml diff --git a/charts/vaultwarden/templates/deployment.yaml b/k8s/charts/vaultwarden/templates/deployment.yaml similarity index 100% rename from charts/vaultwarden/templates/deployment.yaml rename to k8s/charts/vaultwarden/templates/deployment.yaml diff --git a/charts/vaultwarden/templates/ingress.yaml b/k8s/charts/vaultwarden/templates/ingress.yaml similarity index 100% rename from charts/vaultwarden/templates/ingress.yaml rename to k8s/charts/vaultwarden/templates/ingress.yaml diff --git a/charts/vaultwarden/templates/pvc.yaml b/k8s/charts/vaultwarden/templates/pvc.yaml similarity index 100% rename from charts/vaultwarden/templates/pvc.yaml rename to k8s/charts/vaultwarden/templates/pvc.yaml diff --git a/charts/vaultwarden/templates/secret.yaml b/k8s/charts/vaultwarden/templates/secret.yaml similarity index 100% rename from charts/vaultwarden/templates/secret.yaml rename to k8s/charts/vaultwarden/templates/secret.yaml diff --git a/charts/vaultwarden/templates/service.yaml b/k8s/charts/vaultwarden/templates/service.yaml similarity index 100% rename from charts/vaultwarden/templates/service.yaml rename to k8s/charts/vaultwarden/templates/service.yaml diff --git a/charts/vaultwarden/values.yaml b/k8s/charts/vaultwarden/values.yaml similarity index 100% rename from charts/vaultwarden/values.yaml rename to k8s/charts/vaultwarden/values.yaml diff --git a/charts/watsup/Chart.lock b/k8s/charts/watsup/Chart.lock similarity index 100% rename from charts/watsup/Chart.lock rename to k8s/charts/watsup/Chart.lock diff --git a/charts/watsup/Chart.yaml b/k8s/charts/watsup/Chart.yaml similarity index 100% rename from charts/watsup/Chart.yaml rename to k8s/charts/watsup/Chart.yaml diff --git a/charts/watsup/templates/deployment.yaml b/k8s/charts/watsup/templates/deployment.yaml similarity index 100% rename from charts/watsup/templates/deployment.yaml rename to k8s/charts/watsup/templates/deployment.yaml diff --git a/charts/watsup/templates/ingress.yaml b/k8s/charts/watsup/templates/ingress.yaml similarity index 100% rename from charts/watsup/templates/ingress.yaml rename to k8s/charts/watsup/templates/ingress.yaml diff --git a/charts/watsup/templates/service.yaml b/k8s/charts/watsup/templates/service.yaml similarity index 100% rename from charts/watsup/templates/service.yaml rename to k8s/charts/watsup/templates/service.yaml diff --git a/charts/watsup/values.yaml b/k8s/charts/watsup/values.yaml similarity index 100% rename from charts/watsup/values.yaml rename to k8s/charts/watsup/values.yaml diff --git a/helmfile.yaml b/k8s/helmfile.yaml similarity index 100% rename from helmfile.yaml rename to k8s/helmfile.yaml diff --git a/values/README.md b/k8s/values/README.md similarity index 77% rename from values/README.md rename to k8s/values/README.md index 83d069a0..106e5bf1 100644 --- a/values/README.md +++ b/k8s/values/README.md @@ -4,11 +4,11 @@ Helmfile-provided value overrides. ``` values/ -└── secrets/ # vals refs (ref+sops://) into ../secrets/ +└── secrets/ # vals refs (ref+sops://) into ../../secrets/ ``` Each file under `secrets/` is plain yaml containing only `vals` refs that -point into [`../secrets/`](../secrets/) for the actual encrypted values. +point into [`../../secrets/`](../../secrets/) for the actual encrypted values. helmfile passes these as `values:` to a release; `vals` resolves the refs at render time (SOPS-decrypts → splices into the values stream → helm renders). diff --git a/k8s/values/secrets/bluesky-pds.yaml b/k8s/values/secrets/bluesky-pds.yaml new file mode 100644 index 00000000..279dfe78 --- /dev/null +++ b/k8s/values/secrets/bluesky-pds.yaml @@ -0,0 +1,6 @@ +secret: + PDS_ADMIN_PASSWORD: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_ADMIN_PASSWORD + PDS_EMAIL_FROM_ADDRESS: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_FROM_ADDRESS + PDS_EMAIL_SMTP_URL: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_SMTP_URL + PDS_JWT_SECRET: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_JWT_SECRET + PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX diff --git a/k8s/values/secrets/cluster-tls.yaml b/k8s/values/secrets/cluster-tls.yaml new file mode 100644 index 00000000..13a8b8a8 --- /dev/null +++ b/k8s/values/secrets/cluster-tls.yaml @@ -0,0 +1,13 @@ +secret: + aly-codes: + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-codes/crt + key: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-codes/key + aly-social: + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-social/crt + key: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-social/key + cute-haus: + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/cute-haus/crt + key: ref+sops://../secrets/cluster-tls.yaml#/secret/cute-haus/key + morsels-blue: + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/morsels-blue/crt + key: ref+sops://../secrets/cluster-tls.yaml#/secret/morsels-blue/key diff --git a/k8s/values/secrets/longhorn-creds.yaml b/k8s/values/secrets/longhorn-creds.yaml new file mode 100644 index 00000000..27419074 --- /dev/null +++ b/k8s/values/secrets/longhorn-creds.yaml @@ -0,0 +1,3 @@ +secret: + keyId: ref+sops://../secrets/b2.yaml#/B2_KEY_ID + appKey: ref+sops://../secrets/b2.yaml#/B2_APP_KEY diff --git a/k8s/values/secrets/pg-shared.yaml b/k8s/values/secrets/pg-shared.yaml new file mode 100644 index 00000000..f4043b93 --- /dev/null +++ b/k8s/values/secrets/pg-shared.yaml @@ -0,0 +1,5 @@ +backup: + enabled: true + b2: + keyId: ref+sops://../secrets/b2.yaml#/B2_KEY_ID + appKey: ref+sops://../secrets/b2.yaml#/B2_APP_KEY diff --git a/k8s/values/secrets/tailscale-operator.yaml b/k8s/values/secrets/tailscale-operator.yaml new file mode 100644 index 00000000..d4531e2a --- /dev/null +++ b/k8s/values/secrets/tailscale-operator.yaml @@ -0,0 +1,7 @@ +oauth: + clientId: ref+sops://../secrets/tailscale-operator.yaml#/secret/CLIENT_ID + clientSecret: ref+sops://../secrets/tailscale-operator.yaml#/secret/CLIENT_SECRET + +operatorConfig: + defaultTags: + - tag:k8s diff --git a/k8s/values/secrets/vaultwarden.yaml b/k8s/values/secrets/vaultwarden.yaml new file mode 100644 index 00000000..5ff85839 --- /dev/null +++ b/k8s/values/secrets/vaultwarden.yaml @@ -0,0 +1,7 @@ +secret: + ADMIN_TOKEN: ref+sops://../secrets/vaultwarden.yaml#/secret/ADMIN_TOKEN + SMTP_FROM: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_FROM + SMTP_HOST: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_HOST + SMTP_PASSWORD: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_PASSWORD + SMTP_PORT: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_PORT + SMTP_USERNAME: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_USERNAME diff --git a/values/secrets/bluesky-pds.yaml b/values/secrets/bluesky-pds.yaml deleted file mode 100644 index 0633b56c..00000000 --- a/values/secrets/bluesky-pds.yaml +++ /dev/null @@ -1,6 +0,0 @@ -secret: - PDS_ADMIN_PASSWORD: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_ADMIN_PASSWORD - PDS_EMAIL_FROM_ADDRESS: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_FROM_ADDRESS - PDS_EMAIL_SMTP_URL: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_SMTP_URL - PDS_JWT_SECRET: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_JWT_SECRET - PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX diff --git a/values/secrets/cluster-tls.yaml b/values/secrets/cluster-tls.yaml deleted file mode 100644 index 6568d8b1..00000000 --- a/values/secrets/cluster-tls.yaml +++ /dev/null @@ -1,13 +0,0 @@ -secret: - aly-codes: - crt: ref+sops://secrets/cluster-tls.yaml#/secret/aly-codes/crt - key: ref+sops://secrets/cluster-tls.yaml#/secret/aly-codes/key - aly-social: - crt: ref+sops://secrets/cluster-tls.yaml#/secret/aly-social/crt - key: ref+sops://secrets/cluster-tls.yaml#/secret/aly-social/key - cute-haus: - crt: ref+sops://secrets/cluster-tls.yaml#/secret/cute-haus/crt - key: ref+sops://secrets/cluster-tls.yaml#/secret/cute-haus/key - morsels-blue: - crt: ref+sops://secrets/cluster-tls.yaml#/secret/morsels-blue/crt - key: ref+sops://secrets/cluster-tls.yaml#/secret/morsels-blue/key diff --git a/values/secrets/longhorn-creds.yaml b/values/secrets/longhorn-creds.yaml deleted file mode 100644 index 107f0225..00000000 --- a/values/secrets/longhorn-creds.yaml +++ /dev/null @@ -1,3 +0,0 @@ -secret: - keyId: ref+sops://secrets/b2.yaml#/B2_KEY_ID - appKey: ref+sops://secrets/b2.yaml#/B2_APP_KEY diff --git a/values/secrets/pg-shared.yaml b/values/secrets/pg-shared.yaml deleted file mode 100644 index 7820b23f..00000000 --- a/values/secrets/pg-shared.yaml +++ /dev/null @@ -1,5 +0,0 @@ -backup: - enabled: true - b2: - keyId: ref+sops://secrets/b2.yaml#/B2_KEY_ID - appKey: ref+sops://secrets/b2.yaml#/B2_APP_KEY diff --git a/values/secrets/tailscale-operator.yaml b/values/secrets/tailscale-operator.yaml deleted file mode 100644 index 91f686a0..00000000 --- a/values/secrets/tailscale-operator.yaml +++ /dev/null @@ -1,7 +0,0 @@ -oauth: - clientId: ref+sops://secrets/tailscale-operator.yaml#/secret/CLIENT_ID - clientSecret: ref+sops://secrets/tailscale-operator.yaml#/secret/CLIENT_SECRET - -operatorConfig: - defaultTags: - - tag:k8s diff --git a/values/secrets/vaultwarden.yaml b/values/secrets/vaultwarden.yaml deleted file mode 100644 index bc793d62..00000000 --- a/values/secrets/vaultwarden.yaml +++ /dev/null @@ -1,7 +0,0 @@ -secret: - ADMIN_TOKEN: ref+sops://secrets/vaultwarden.yaml#/secret/ADMIN_TOKEN - SMTP_FROM: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_FROM - SMTP_HOST: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_HOST - SMTP_PASSWORD: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_PASSWORD - SMTP_PORT: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_PORT - SMTP_USERNAME: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_USERNAME