A lowly tech priest's attempt to please Mars
feat: add atproto domains to the gateway
+44
-15
+1
-1
kubernetes/apps/observability/gatus/resources/config.yaml
+1
-1
kubernetes/apps/observability/gatus/resources/config.yaml
+1
-1
kubernetes/apps/office/nextcloud/nextcloud/helmrelease.yaml
+1
-1
kubernetes/apps/office/nextcloud/nextcloud/helmrelease.yaml
+1
-1
kubernetes/system/certs/desec-webhook/helmrelease.yaml
+1
-1
kubernetes/system/certs/desec-webhook/helmrelease.yaml
+3
-3
kubernetes/system/certs/issuers/letsencrypt.yaml
+3
-3
kubernetes/system/certs/issuers/letsencrypt.yaml
···
12
12
solvers:
13
13
- dns01:
14
14
webhook:
15
-
groupName: ${SECRET_DNS_ZONE}
15
+
groupName: ${DNS_ZONE}
16
16
solverName: desec-http
17
17
config:
18
18
apiUrl: https://desec.io/api/v1
19
-
domainName: ${SECRET_DNS_ZONE}
19
+
domainName: ${DNS_ZONE}
20
20
secretName: desec-token
21
21
secretKeyName: desec-token
22
22
selector:
23
23
dnsZones:
24
-
- ${SECRET_DNS_ZONE}
24
+
- ${DNS_ZONE}
+14
kubernetes/system/network/ingress/certificate.yaml
+14
kubernetes/system/network/ingress/certificate.yaml
···
11
11
dnsNames:
12
12
- '${SECRET_HOST}'
13
13
- '*.${SECRET_HOST}'
14
+
---
15
+
apiVersion: cert-manager.io/v1
16
+
kind: Certificate
17
+
metadata:
18
+
name: at-ingress-certitifcate
19
+
spec:
20
+
secretName: at-ingress-certitifcate
21
+
issuerRef:
22
+
name: letsencrypt
23
+
kind: ClusterIssuer
24
+
commonName: '${ATPROTO_HOST}'
25
+
dnsNames:
26
+
- '${ATPROTO_HOST}'
27
+
- '*.${ATPROTO_HOST}'
+19
-5
kubernetes/system/network/ingress/gateway.yaml
+19
-5
kubernetes/system/network/ingress/gateway.yaml
···
14
14
hostname: "*.${SECRET_HOST}"
15
15
port: 443
16
16
protocol: HTTPS
17
-
allowedRoutes:
17
+
allowedRoutes: &routes-allow-from-all
18
18
namespaces:
19
19
from: All
20
20
tls:
21
21
mode: Terminate
22
22
certificateRefs:
23
23
- name: ingress-certitifcate
24
+
- name: atproto-https
25
+
hostname: "*.${ATPROTO_HOST}"
26
+
port: 443
27
+
protocol: HTTPS
28
+
allowedRoutes:
29
+
namespaces:
30
+
from: Selector
31
+
selector:
32
+
matchLabels:
33
+
kubernetes.io/metadata.name: at
34
+
tls:
35
+
mode: Terminate
36
+
certificateRefs:
37
+
- name: at-ingress-certitifcate
38
+
24
39
- name: http
25
-
hostname: "*.${SECRET_HOST}"
40
+
hostname: "*.${DNS_ZONE}"
26
41
port: 80
27
42
protocol: HTTP
28
-
allowedRoutes:
29
-
namespaces:
30
-
from: All
43
+
allowedRoutes: *routes-allow-from-all
44
+
31
45
# - name: tcp
32
46
# port: 22
33
47
# protocol: TCP
+5
-4
kubernetes/system/settings/cluster-secrets.yaml
+5
-4
kubernetes/system/settings/cluster-secrets.yaml
···
5
5
namespace: flux-system
6
6
stringData:
7
7
SECRET_HOST: ENC[AES256_GCM,data:rM0mkH1YS4T36EGiGg==,iv:I8JICgYy6hZ5AAPvvBsYgKE8nqP2M9sWfvbMUTHScG8=,tag:OVYfMxEg3/JhrviEu/+lyA==,type:str]
8
-
SECRET_DNS_ZONE: ENC[AES256_GCM,data:sKGxkzocaGM=,iv:qMNlE88s/+k82U0YIdUK1ZL/Jw037UXeWEj8DhSAcg4=,tag:zujiyY0e7kRjHBiIFIrq1Q==,type:str]
8
+
DNS_ZONE: ENC[AES256_GCM,data:eiHkFnndXGA=,iv:AQZbr2fTxXu7pf0LTNzXX8cItaiNAA2WdZGwB4McnMM=,tag:PqUHIdWCvqCwvwB+03yjlg==,type:str]
9
+
ATPROTO_HOST: ENC[AES256_GCM,data:HFlPZsWyG7e6SMA=,iv:KwMo1HrbLsQnPYRkgyE33sdXHCSZmej8LAXfAjqDGhM=,tag:dmT+F5HszflTSMeixR+8qA==,type:str]
9
10
S3_HOST: ENC[AES256_GCM,data:xnqvpCsb1S9YE0w8UWYJcXXzldf+cghbYddlk4zUAqD8hoc=,iv:8QCsVmMERR2mzGTE8K9RCCcXcLfwJETgsfFF2US/y50=,tag:0XXRP9txxaZJdb+7seAWCw==,type:str]
10
11
S3_HOSTNAME: ENC[AES256_GCM,data:3Qgl9tykuHgSavi1SLTAw8jaGFLu,iv:1x6RqmLC4d9fmdGevgdiJZv+Vh+Uz046LnmZQtjfrrw=,tag:JUJ/C5vMFvnL+k/7jCxJbQ==,type:str]
11
12
S3_PORT: ENC[AES256_GCM,data:WM0/7Q==,iv:o76Io50nk6mRbnRhkCcWzgXu1H2DhGhtN8mPvXvHpO8=,tag:JqE7SChRcjzmRu32YNnRkQ==,type:str]
···
43
44
YXhlaE42SThadFh0RCtkUlBOL3ZGWVEKTXnIyx6ZnpJX9MaFM0SrF3lpMHSTUhBE
44
45
jAhobm2IcZscdLCvhguYWAr5o6ZDxrQBsLdNNMT4HieGrUGEShXrYg==
45
46
-----END AGE ENCRYPTED FILE-----
46
-
lastmodified: "2025-10-28T21:51:36Z"
47
-
mac: ENC[AES256_GCM,data:kQvpe2jAzqNwoS8Bi/ZNENihmFoQWV0+v9pDbmDO+8YpRpsorHiyp2D/RAOfLUoc7TAjDdMH/kHY+RbvjFnuRi5mLXFVulUTXaAj1uBW+Tt9o/0/9Kiy/Galfc6emCOuCBg72uZUbZavdLM5GtPe7CGYOg4OvzPMeaPgR6/h50Q=,iv:VQ87Cx2mew9qcWt9LHfirZeW7cqNXqu+gGx8N3bFVl4=,tag:u7WQTWiYzzT7WvAlOPiKog==,type:str]
47
+
lastmodified: "2025-11-09T21:17:16Z"
48
+
mac: ENC[AES256_GCM,data:DNOphKj8M6lKGJk2rbPp8sZUvngGXAQRlTHky2ENDkoA/mJXEHfVS71O7J08KGW3aWpsHuZ6ipMfZ+UEc3VUdo/d7wbuscj5J09SZ7lsEr++oYregQqHIycCKoEddIWLtOeQw1elMrITcnoOlGXO7ZHtTpq/8jZ1Q+Sv8yGuVls=,iv:FICJ8vU4iJf/hfvLe6tzD3LxMsvX57+HHi4cGb/XyWE=,tag:q50xf/tuFAzMBTiWrnO1Rg==,type:str]
48
49
encrypted_regex: ^(data|stringData)$
49
-
version: 3.10.2
50
+
version: 3.11.0