From 19eacd35f73f2c659f46056727a666d5e8948700 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Wed, 21 Oct 2026 11:49:28 +0200
Subject: [PATCH] Remove ip-updater

Every run has failed with "Permission denied (publickey)" on
root@46.224.26.65, the last successful job was 219 days ago, and one pod
had been hanging for 138 days. The home IP is pinned in
nix-infra-machine/nodes/node001.nix instead, so nothing used it.

It also ran alpine:3.19, which is EOL and still trusts the compromised
eMudhra intermediates.
---
 apps/templates/ip-updater-folder.yaml | 22 ---------------
 ip-updater/cronjob.yaml               | 39 ---------------------------
 ip-updater/external-secret.yaml       | 17 ------------
 3 files changed, 78 deletions(-)
 delete mode 100644 apps/templates/ip-updater-folder.yaml
 delete mode 100644 ip-updater/cronjob.yaml
 delete mode 100644 ip-updater/external-secret.yaml

diff --git a/apps/templates/ip-updater-folder.yaml b/apps/templates/ip-updater-folder.yaml
deleted file mode 100644
index 81c849a..0000000
--- a/apps/templates/ip-updater-folder.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ip-updater
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: ip-updater
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: ip-updater
-  syncPolicy:
-    syncOptions:
-    - CreateNamespace=true
-    automated:
-      selfHeal: true
-      prune: true
diff --git a/ip-updater/cronjob.yaml b/ip-updater/cronjob.yaml
deleted file mode 100644
index 1a010de..0000000
--- a/ip-updater/cronjob.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: ip-updater
-spec:
-  schedule: "*/5 * * * *"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          containers:
-            - name: ip-updater
-              image: alpine:3.19
-              command: ["/bin/sh", "-c"]
-              args:
-                - |
-                  apk add --no-cache openssh-client curl > /dev/null 2>&1
-                  cp /ssh-key/private_key /tmp/ssh_key
-                  chmod 600 /tmp/ssh_key
-                  IP=$(curl -s --max-time 10 https://api.ipify.org)
-                  if [ -z "$IP" ]; then
-                    echo "Failed to get external IP"
-                    exit 1
-                  fi
-                  echo "Current external IP: $IP"
-                  ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
-                    -i /tmp/ssh_key root@46.224.26.65 "$IP"
-              volumeMounts:
-                - name: ssh-key
-                  mountPath: /ssh-key
-                  readOnly: true
-          volumes:
-            - name: ssh-key
-              secret:
-                secretName: ip-updater-ssh-key
-                defaultMode: 0400
-          restartPolicy: OnFailure
diff --git a/ip-updater/external-secret.yaml b/ip-updater/external-secret.yaml
deleted file mode 100644
index 3edee99..0000000
--- a/ip-updater/external-secret.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ip-updater-ssh-key
-spec:
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  refreshInterval: 15m
-  target:
-    name: ip-updater-ssh-key
-    creationPolicy: Owner
-  data:
-    - secretKey: private_key
-      remoteRef:
-        key: kv/ip-updater
-        property: ssh_private_key