🤖 Pull request created from `various-fixes` containing PageHead
breadcrumbs and navigation alignment fixes, Umami analytics proxy, and
infrastructure updates.
### Summary of Changes
1. **SOPS Secret Encryption Scope**:
- Configured `encrypted_regex: '^(data|stringData)$'` in `.sops.yaml`.
- Re-encrypted PostgreSQL and Umami secrets so `apiVersion`, `kind`, and
`metadata.name` remain in clean plaintext.
- Prevents Kustomize controller panic on encrypted metadata during Flux
GitOps reconciliation.
2. **Reliable DNS Fallback**:
- Added standard fallback DNS resolvers (`1.1.1.1`, `8.8.8.8`,
`77.88.8.8`) to `03-cleanup.sh` and `bootstrap-cluster.sh`.
### Summary of Changes
- Configured `/etc/cloud/ds-identify.cfg` with `policy: enabled` so
Debian's `ds-identify` generator never disables cloud-init.
- Installed `isc-dhcp-client` package.
- Explicitly enabled all 4 cloud-init systemd services in base system.
- Cleaned cloud-init seed and removed any disable flags in image
cleanup.
### Summary of Changes
- Added systemd drop-in override
`/etc/systemd/system/ssh.service.d/10-generate-host-keys.conf` with
`ExecStartPre=-/usr/bin/ssh-keygen -A` so `ssh.service` auto-generates
host keys if missing on startup.
- Added `ssh-keygen -A` to `03-cleanup.sh` and `bootstrap-cluster.sh` in
`user-data.template.yaml`.
### Summary of Changes
This PR incorporates the final infrastructure optimizations following
the initial merge of PR #25:
1. **SOPS & Secrets Management**:
- Generated dedicated Age keypair
(`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and
updated `.sops.yaml`.
- Added SOPS-encrypted production secrets for PostgreSQL
(`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics
(`ci/k8s/apps/umami/secret.sops.yaml`).
- Verified 100% clean round-trip decryption.
2. **Cloud-Init Template & Git Safety**:
- Converted `user-data.yaml` into `user-data.template.yaml` with clear
stubs for public SSH keys and private Age keys.
- Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent
accidental secret leaks.
3. **Persistent Secondary Storage**:
- Added automated detection, ext4 formatting, and mounting of secondary
persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with
`noatime` in `user-data.template.yaml`.
4. **Golden Image Naming & Workflows**:
- Updated image naming convention to include hyphenated UTC timestamps:
`com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`.
- Verified successful CI golden image build and S3 upload.
deytenit