ermnvldmr.com/ci/k8s/apps/postgres/kustomization.yaml at 9200529bf01065f064ef9557fe77a7530b5951dd - ermnvldmr.com - Gitea: Git with a cup of tea

deytenit/ermnvldmr.com

0 Fork 0

Files

T

deytenit 502ef94bb2 feat(infra): update SOPS configuration, cloud-init templates, and secondary disk automation (#26 )

### Summary of Changes

This PR incorporates the final infrastructure optimizations following
the initial merge of PR #25:

1. **SOPS & Secrets Management**:
- Generated dedicated Age keypair
(`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and
updated `.sops.yaml`.
- Added SOPS-encrypted production secrets for PostgreSQL
(`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics
(`ci/k8s/apps/umami/secret.sops.yaml`).
   - Verified 100% clean round-trip decryption.

2. **Cloud-Init Template & Git Safety**:
- Converted `user-data.yaml` into `user-data.template.yaml` with clear
stubs for public SSH keys and private Age keys.
- Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent
accidental secret leaks.

3. **Persistent Secondary Storage**:
- Added automated detection, ext4 formatting, and mounting of secondary
persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with
`noatime` in `user-data.template.yaml`.

4. **Golden Image Naming & Workflows**:
- Updated image naming convention to include hyphenated UTC timestamps:
`com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`.
   - Verified successful CI golden image build and S3 upload.

2026-08-23 14:02:08 +03:00

10 lines

191 B

YAML

Raw Blame History

 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: com-ermnvldmr
 resources:
   - configmap.yaml
   - secret.sops.yaml
   - pvc.yaml
   - statefulset.yaml
   - service.yaml