feat!: add mandatory cloudflare tunnel support (#716)

Co-authored-by: Devin Buhl <onedr0p@users.noreply.github.com>

tmpl/.sops.yaml

@@ -9,7 +9,3 @@ creation_rules:
     key_groups:
       - age:
           - ${BOOTSTRAP_AGE_PUBLIC_KEY}
-  - path_regex: terraform/.*\.sops\.ya?ml
-    key_groups:
-      - age:
-          - ${BOOTSTRAP_AGE_PUBLIC_KEY}

tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-ddns-secret
-  namespace: networking
-type: Opaque
-stringData:
-  CLOUDFLARE_EMAIL: "${BOOTSTRAP_CLOUDFLARE_EMAIL}"
-  CLOUDFLARE_APIKEY: "${BOOTSTRAP_CLOUDFLARE_APIKEY}"
-  CLOUDFLARE_RECORD_NAME: "ipv4.${BOOTSTRAP_CLOUDFLARE_DOMAIN}"

tmpl/kubernetes/cloudflared-secret.sops.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflared-secret
+  namespace: networking
+data:
+  TUNNEL_ID: "${BOOTSTRAP_CLOUDFLARE_TUNNEL_ID}"
+  credentials.json: |
+    {
+      "AccountTag": "${BOOTSTRAP_CLOUDFLARE_ACCOUNT_TAG}",
+      "TunnelSecret": "${BOOTSTRAP_CLOUDFLARE_TUNNEL_SECRET}",
+      "TunnelID": "${BOOTSTRAP_CLOUDFLARE_TUNNEL_ID}"
+    }

tmpl/kubernetes/cluster-secrets.sops.yaml

@@ -7,3 +7,4 @@ metadata:
 stringData:
   SECRET_DOMAIN: "${BOOTSTRAP_CLOUDFLARE_DOMAIN}"
   SECRET_CLOUDFLARE_EMAIL: "${BOOTSTRAP_CLOUDFLARE_EMAIL}"
+  SECRET_CLOUDFLARE_TUNNEL_ID: "${BOOTSTRAP_CLOUDFLARE_TUNNEL_ID}"

tmpl/terraform/secret.sops.yaml

@@ -1,3 +0,0 @@
-cloudflare_email: "${BOOTSTRAP_CLOUDFLARE_EMAIL}"
-cloudflare_apikey: "${BOOTSTRAP_CLOUDFLARE_APIKEY}"
-cloudflare_domain: "${BOOTSTRAP_CLOUDFLARE_DOMAIN}"