Update helm chart external-secrets to v2

Single-pod sqlite install (simplest path for a home git host). HTTPS-only,
no SSH listener for now. Wired into the Hetzner tunnel like the other
rubenhensen.nl services.

First visitor to git.rubenhensen.nl can register; Gitea auto-promotes the
first user to admin.

actual-budget/helm-actual-budget.yaml

@@ -12,14 +12,14 @@ spec:
   project: default
   source:
     repoURL: https://community-charts.github.io/helm-charts
-    targetRevision: 1.8.7
+    targetRevision: 1.8.9
     chart: actualbudget
     helm:
       values: |
         # Actual Budget configuration
 
         image:
-          tag: "26.3.0"
+          tag: "26.6.0"
 
         # Authentication configuration
         login:

apps/templates/external-secrets-helm.yaml

@@ -15,7 +15,7 @@ spec:
   sources:
     - chart: external-secrets
       repoURL: https://charts.external-secrets.io
-      targetRevision: 2.5.0
+      targetRevision: 2.6.0
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets

apps/templates/gitea-folder.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gitea
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/rubenhensen/k8scd.git
+    targetRevision: HEAD
+    path: gitea
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: gitea
+  syncPolicy:
+    syncOptions:
+    - CreateNamespace=true
+    automated:
+      selfHeal: true

apps/templates/mbgwp-official-helm.yaml

@@ -41,6 +41,11 @@ spec:
               secretKeyRef:
                 name: mbgwp-mariadb-credentials
                 key: password
+          - name: WF_ENCRYPTION_KEY
+            valueFrom:
+              secretKeyRef:
+                name: wordpress-credentials
+                key: wf-encryption-key
 
         # WordPress specific settings
         settings:

dns/domains/rubenhensen.nl.yaml

@@ -10,51 +10,55 @@ records:
   - name: "phocaslustrum"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "62.41.86.27"
   - name: "ynab"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "authentik"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "ldap"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "62.41.86.27"
   - name: "argocd"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "vault"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "rss"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "ha"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "longhorn"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "lingo"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "blog"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
   - name: "serpbear"
     expire: 300
     type: A
-    content: "62.41.87.114"
+    content: "46.224.26.65"
+  - name: "git"
+    expire: 300
+    type: A
+    content: "46.224.26.65"
   - name: "@"
     expire: 300
     type: MX

gitea/gitea-data-persistentvolumeclaim.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

gitea/gitea-deployment.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea
+  labels:
+    app: gitea
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: gitea
+  template:
+    metadata:
+      labels:
+        app: gitea
+    spec:
+      securityContext:
+        fsGroup: 1000
+      containers:
+        - name: gitea
+          image: gitea/gitea:1
+          env:
+            - name: USER_UID
+              value: "1000"
+            - name: USER_GID
+              value: "1000"
+            - name: TZ
+              value: Europe/Amsterdam
+            - name: GITEA__server__ROOT_URL
+              value: https://git.rubenhensen.nl/
+            - name: GITEA__server__DOMAIN
+              value: git.rubenhensen.nl
+            - name: GITEA__server__PROTOCOL
+              value: http
+            - name: GITEA__server__HTTP_PORT
+              value: "3000"
+            - name: GITEA__server__DISABLE_SSH
+              value: "true"
+            - name: GITEA__database__DB_TYPE
+              value: sqlite3
+            - name: GITEA__database__PATH
+              value: /data/gitea/gitea.db
+            - name: GITEA__security__INSTALL_LOCK
+              value: "true"
+            - name: GITEA__log__MODE
+              value: console
+          ports:
+            - containerPort: 3000
+              name: http
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /data
+              name: data
+      restartPolicy: Always
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: gitea-data

gitea/gitea-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea
+  labels:
+    app: gitea
+spec:
+  selector:
+    app: gitea
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000

gitea/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: prod-cluster-issuer
+    nginx.ingress.kubernetes.io/proxy-body-size: "1g"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: git.rubenhensen.nl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitea
+                port:
+                  number: 3000
+  tls:
+    - secretName: letsencrypt-prod
+      hosts:
+        - git.rubenhensen.nl

mbgwp/default-pw-es.yaml

@@ -20,3 +20,7 @@ spec:
       remoteRef:
         key: kv/mbgwp
         property: smtp-password
+    - secretKey: wf-encryption-key
+      remoteRef:
+        key: kv/mbgwp
+        property: wf-encryption-key

nix-infra-machine/nodes/node001.nix

@@ -1,4 +1,43 @@
 { config, pkgs, lib, ... }:
+let
+  # Public IP of the home network where the k8s cluster ingress lives.
+  # Keep in sync with dns/domains/rubenhensen.nl.yaml.
+  homeIP = "62.41.86.27";
+
+  # Hosts tunneled to the home k8s cluster. Each entry gets:
+  #   * an SNI map entry for TCP passthrough on :443
+  #   * an HTTP vhost on :80 that reverse-proxies to the cluster
+  # The cluster's nginx-ingress terminates TLS with cert-manager.
+  tunneledHosts = [
+    "rss.rubenhensen.nl"
+    "authentik.rubenhensen.nl"
+    "vault.rubenhensen.nl"
+    "ynab.rubenhensen.nl"
+    "argocd.rubenhensen.nl"
+    "ha.rubenhensen.nl"
+    "longhorn.rubenhensen.nl"
+    "lingo.rubenhensen.nl"
+    "blog.rubenhensen.nl"
+    "serpbear.rubenhensen.nl"
+    "git.rubenhensen.nl"
+  ];
+
+  sniMapEntries =
+    lib.concatMapStringsSep "\n"
+      (h: "        ${h} ${homeIP}:443;")
+      tunneledHosts;
+
+  tunneledVhosts = lib.listToAttrs (map (h: {
+    name = h;
+    value = {
+      listen = [
+        { addr = "0.0.0.0"; port = 80; }
+        { addr = "[::]"; port = 80; }
+      ];
+      locations."/".proxyPass = "http://${homeIP}";
+    };
+  }) tunneledHosts);
+in
 {
   # ──────────────────────────────────────────────
   # Firewall
@@ -35,55 +74,67 @@
     "d /var/lib/acme/acme-challenge 0755 acme acme -"
   ];
 
-  # Serve ACME challenges via nginx on port 80
+  # Serve ACME challenges via nginx on port 80.
+  # Also reverse-proxy tunneled hosts to the home k8s cluster, and do
+  # SNI-based TCP passthrough on 443 so the cluster's cert-manager keeps
+  # owning the TLS certificate for those hosts.
   services.nginx = {
     enable = true;
-    virtualHosts."mail.rubenhensen.nl" = {
+    recommendedProxySettings = true;
+
+    # SNI passthrough on 443:
+    #   - mail.rubenhensen.nl (and anything else) → local stalwart on 8443
+    #   - tunneled hosts → home cluster ingress on 443
+    streamConfig = ''
+      map $ssl_preread_server_name $tunnel_upstream {
+${sniMapEntries}
+        default 127.0.0.1:8443;
+      }
+
+      server {
+        listen 443;
+        listen [::]:443;
+        proxy_pass $tunnel_upstream;
+        ssl_preread on;
+      }
+    '';
+
+    # Port 80: tunneled hosts reverse-proxy to the home cluster so its
+    # nginx-ingress handles HTTP→HTTPS redirects and cert-manager
+    # HTTP-01 ACME challenges. Mail-related hosts serve ACME challenges
+    # locally for stalwart's cert and redirect everything else to HTTPS.
+    virtualHosts = tunneledVhosts // {
+      "mail.rubenhensen.nl" = {
         listen = [
           { addr = "0.0.0.0"; port = 80; }
           { addr = "[::]"; port = 80; }
         ];
-      locations."/.well-known/acme-challenge/" = {
-        root = "/var/lib/acme/acme-challenge";
+        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+        locations."/".return = "301 https://$host$request_uri";
       };
-      locations."/" = {
-        return = "301 https://$host$request_uri";
-      };
-    };
-    virtualHosts."autoconfig.rubenhensen.nl" = {
+      "autoconfig.rubenhensen.nl" = {
         listen = [
           { addr = "0.0.0.0"; port = 80; }
           { addr = "[::]"; port = 80; }
         ];
-      locations."/.well-known/acme-challenge/" = {
-        root = "/var/lib/acme/acme-challenge";
+        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+        locations."/".return = "301 https://$host$request_uri";
       };
-      locations."/" = {
-        return = "301 https://$host$request_uri";
-      };
-    };
-    virtualHosts."autodiscover.rubenhensen.nl" = {
+      "autodiscover.rubenhensen.nl" = {
         listen = [
           { addr = "0.0.0.0"; port = 80; }
           { addr = "[::]"; port = 80; }
         ];
-      locations."/.well-known/acme-challenge/" = {
-        root = "/var/lib/acme/acme-challenge";
+        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+        locations."/".return = "301 https://$host$request_uri";
       };
-      locations."/" = {
-        return = "301 https://$host$request_uri";
-      };
-    };
-    virtualHosts."rubenhensen.nl" = {
+      "rubenhensen.nl" = {
         listen = [
           { addr = "0.0.0.0"; port = 80; }
           { addr = "[::]"; port = 80; }
         ];
-      locations."/.well-known/acme-challenge/" = {
-        root = "/var/lib/acme/acme-challenge";
-      };
-      locations."/" = {
-        return = "301 https://$host$request_uri";
+        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+        locations."/".return = "301 https://$host$request_uri";
       };
     };
   };
@@ -120,7 +171,9 @@
             protocol = "managesieve";
           };
           https = {
-            bind = "[::]:443";
+            # nginx owns the public :443 and does SNI passthrough to here
+            # for the mail.rubenhensen.nl SNI. Stalwart still terminates TLS.
+            bind = "127.0.0.1:8443";
             protocol = "http";
             tls.implicit = true;
           };