forust 1e8479b853 feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs ...

CronJob adguard-cert-sync (daily 03:17) copies the public cert/key for
dns.forust.xyz from Traefik acme.json into Secret adguard-certs, which
AdGuard mounts for DNS-over-TLS on :853.

- least-privilege RBAC: read pods/exec in ns traefik, get/update/patch
  Secret adguard-certs and get/patch adguard-deployment in ns adguard
- script selects the PROD resolver entry only, matches main domain or
  SANs, compares sha256 hashes, patches the secret and restarts the
  deployment ONLY on change; exits non-zero and touches nothing when
  Traefik holds no cert yet (HTTP-01 currently cannot complete)

2026-09-23 13:39:38 +02:00

..

active

ci(deploy): split runtime by k8s/active marker

2026-09-06 20:39:12 +02:00

adguard.yaml

feat(adguard,traefik,cert-manager,reloader): foundation for adguard cert sync

2026-09-23 13:19:26 +02:00

cert-sync-rbac.yaml

feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs

2026-09-23 13:39:38 +02:00

cert-sync.yaml

feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs

2026-09-23 13:39:38 +02:00

ingress.yaml

chore(crowdsec): remove crowdsec bouncer from dns and headscale ingresses

2026-09-14 01:15:55 +02:00

namespace.yaml

lint: yaml spaces and tabs

2026-06-09 12:59:36 +02:00

secrets.yaml.example

feat(k8s): standardize IngressRoutes — LE prod certs, prod→local→dev order, Traefik values fix

2026-06-08 12:27:55 +02:00