update to production certs

kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml

@@ -3,7 +3,7 @@ kind: Secret
 metadata:
     name: cert-manager-secret
 stringData:
-    api-token: ENC[AES256_GCM,data:YhezUrMEaUxcpbX+VaE9x/32HZGHpCajDxjAAnxrduYko/24nuo4NA==,iv:pxt4O+3Xifc4galSt8a56jsn+x01vY+k9xMQ7IZCbOI=,tag:A8hQOHd5pLSInxm4b5Z6nw==,type:str]
+    api-token: ENC[AES256_GCM,data:hxn4WpbqH9oZg4ZyW4ZHoCZFfC7pPgh6NizlDz2UTSjDlZF33vmvWw==,iv:5u1KHt6DGnyQgTIpWLFcU0V0o4xXNLatETs/uELfIbU=,tag:1bb8uJsW2Tdmzsk/vnQ74A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -13,14 +13,14 @@ sops:
         - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjQ0h2MTRDTEprcy9RbjU5
-            VlFQMzBVTlljTlJvQTB5YzNPLzRiL1pqUkNRCk1zMlhuUnZmZG1tcVFyUUVNUzRy
-            T3J1UHN5bUxGOWU1MU9NcFU3dFRJZXMKLS0tIHJpZkJabHZ2RFdQMHk1QmpDZkxn
-            eWZoRlZDcWU0Z0V1SlBiT1Vkdm1pOW8KXIv9umMu41qw6F8e7Tr43uOA1vELJ5dR
-            tvfONCoUikzSetp4O6KdwGVFe6LtVRrtWLLEH3N0meBbfIkLZ45Buw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZFdoWnFuWDZQZzBwWGM5
+            VWpoUzlwMTF0MDJsNzJHUE12T2NwQ0JqUTJBClFySXcvTERTNVVRWW5qZFFES292
+            OUVkZnJGNW1oeVhRTWtzNk1IT0xoYWcKLS0tIHAxR2lqeEJydGdFR2RaY3Fmd212
+            dURIUWdKbnNEK3N4MDZSVTdJcnQwM1EKZuzgUjc0EUhwLNb9Aq/08Kq2SJZpcy5k
+            +QlOf/OzjQ8fZinQ7YStN1FrouBoD6eOvrQ9LKmd49den+9JQw3uAg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-05T23:02:05Z"
-    mac: ENC[AES256_GCM,data:8DUXsgwppf3QTtA+b9FaXdx8EMvFuajzHyzeLcN/uhY17zJMRrvw30rom1N9K9yeR/VsTv/hGj9xi1w2H62+9hSsx1sm298toq2drtwziSqH5YAvFFuBuo5SCGTb0f2TdNZF1vIdp3RgVaWyzrZggsAaWcqxWWbw7MYsAN3KSF0=,iv:ku3NPHIHqOfcJF1mpQA9TgPKjC9927Vl2v0MqpNJWOU=,tag:X0uaBYMc+qQ5B3/eZiH0Xg==,type:str]
+    lastmodified: "2024-11-07T06:29:43Z"
+    mac: ENC[AES256_GCM,data:KGoF46Eh22sDxQlLqaU1cNguMWSx71BpmdClVZX/cPMZWsIZHqh32CsfH7hNFMJIUSZiaI+UarKFbmhWd4P9wSMcqzj/zmSJ3DGtd722oToT6kUE3dJhmIk+f8gJd4STXjeQ1NM1UmxwasEJZ0fnSW4+NLwTURLpi8fvNXOlUic=,iv:jO0aMeYCSWthERI181XyS+2VDXxTUKdq2rV6rlTwjXc=,tag:K0J9mTIBayDiLB5QTPa2ig==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.1

kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml

@@ -3,7 +3,7 @@ kind: Secret
 metadata:
     name: github-webhook-token-secret
 stringData:
-    token: ENC[AES256_GCM,data:UVEO/z4vJtqHDga4UlTmMvSDai5AydTsSHc4rm0k840=,iv:kQMVSClPg3MbnFutNB/Ae3vvMpoCpIFHZJwV1vjJKus=,tag:1Yd9SrcG4nOv45+X7JQqpg==,type:str]
+    token: ENC[AES256_GCM,data:mq8ZPkayUvV4+EKJaj0EMCweaiC8SPuYz7m4smXlW74=,iv:j6Pr1+1XBvHWeZrrH6eKJ+bPXc2dJlghi6GCJ6lH1rE=,tag:fmo0zJJiaTcDwoVne0CX2A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -13,14 +13,14 @@ sops:
         - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaitRYXpRKy82YnhqNyt3
-            RmJtQU40SS9CL1hjRzNhaFlOcUtTZlZXWHlvCitMVzRQTXpPQmZYaXhQckN5RDhI
-            WGFlMTV5STk5Nmx0U1NoT2pWMW5QKzQKLS0tIHZyZ2lORkJmUTVHNFA0a2Z6UTdl
-            Q2tzakNrOUVNZGdBODJxMnRjWGlQNWsKQoJ9lhtJX/gtb540UdVP+Z7tP8Arok+X
-            tIsa/jWxNkGs+TKGRI0BfxS9R5575R12Lj+aCBF0aMCp4fkpcrugFw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMTVGMkV5K1lXY3RvZ1dI
+            OWhJV1BkaTdGTXZVY21SMExBMnQ4SThLQ0dvCk1NLzhXY1AvRHhqTGo2akxiZTA3
+            SHBZRWVja0ZZejNqSVVkMEhjSG1SOUUKLS0tIENXR0l6bGdnSit2RkRucW5HYWNW
+            Rk1scEUvOUZISWpyUlJIanZ3ZWVmY00KSD1tXiEZeFVyOX6zeu97Be4Ak1Tp4vLX
+            gqO9Oa0SpvP+YOCbm9t4A8VICYAR+7bmrSqIqfZ7WaLJvRWkl+TBDA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-05T23:02:05Z"
-    mac: ENC[AES256_GCM,data:+nbOFWowlBlyy5MPShoq/U853iHGJo9Gi53G8lxtBQcu+Gp0t4+Td+EzjNVMpkjcE3YyoVDoOfzWSLE1OKmAnvqfaJHC0Y09x22MUcAL1Kjisc116iNCrFJ36Pc19Fdo0Jpn8gwbF3r9VuIdlbepMRwnB33t823Ij2Aa8kNwcQQ=,iv:6ZzNzGuc3MXQ/vf8nbIl2bUp6uGNYnUEDI6it8oljqo=,tag:sPvM2TCpUAOEWAq5xpMtMA==,type:str]
+    lastmodified: "2024-11-07T06:29:43Z"
+    mac: ENC[AES256_GCM,data:GAORHFhuCMZ5su6KNnh0HC2al1ezHe6hLBiYsSrGDID3fGT16ZRxMYEVXo/0n1xcZLjxgAckBXFA6HL9viepVsnX0STvB9mbdd8C8qYW0oGwcnmhLavrdABV0Kp6oaRW9agIODQF0mQbX49x3lirRWJxbmU2XBPUVjngJt/yUKU=,iv:rfCSCO1CmEU17Be85qRoYjsBzEfLv0J2j/pq0AiBTgE=,tag:z0qDturLxU3HwF1XWw6BmA==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.1

kubernetes/apps/network/cloudflared/app/secret.sops.yaml

@@ -3,8 +3,8 @@ kind: Secret
 metadata:
     name: cloudflared-secret
 stringData:
-    TUNNEL_ID: ENC[AES256_GCM,data:mVtauze8Ikknlqdz7KXamxgaw+8MYLrqMZdEAXmoXmoMcBNp,iv:uUXTcN8ySbK08dEl9A726+qTDPqgjcqknjJjVNSrwIk=,tag:1pdGSTKxtch403gJfsdmKw==,type:str]
-    credentials.json: ENC[AES256_GCM,data:l+WXBRVamb7G1kmGORM10zf0iShHV8eGMHsNlZufSbb0m77iK1ChHzauXkZygW1Jwnu5rV/6NyjTOSDUAICMQR4AaL2Ogu2gnS0q4r/IM8Rs5iDvLNjTN9PLP4MmrK4sOvCJXNIKW12kq/TpsBRT/B7ZzoS/6zjfbPB8DrE0l+KJUgcDOR3wQLkIkDvx0ppa0mAEG/WuetblUuY28pWurknX1geP6tFLr4lOcPSwiw==,iv:YnYk6vCpHIIt4Tk/p8T/JFs2LhTq5TNjVHl2p81PaeA=,tag:tTm/xTA5cu8tnQETe1d10Q==,type:str]
+    TUNNEL_ID: ENC[AES256_GCM,data:mq3HZ6LMpTXqZ/BhNxPxzrgHjd+ms0iqhIxnFKhbv79LHaLZ,iv:38UDIILcKy4NCFWaCE62kBT1odK6DIFHYfIXpUGOJQs=,tag:5dCdF5FqRL4G+Y1VOuWKNA==,type:str]
+    credentials.json: ENC[AES256_GCM,data:Cnm5pftQzWBk8VFp5LOZ4xv0IfDb1rkGO+aoDd97ZDrl/3IzzccI/svGtGnmpRiMNh0nNnm20lNB3ILr8o/ns8p+1PpMhLS70cJxZGqDsKt0ylTk6JhQEjIVLBvU42Kko65Z+jw60+iwMEI9FwXMlfL9zx0XobI9+QUf7A/EYlmlZUuHIyE4P6ZPelHyPgFX2La/AeYetgKPjH27zo7gpl96/Z2FGvbGe30zSnc6EQ==,iv:lj/7lPlv8tnH7/9VeLOc3JC7FRIU9KEoTvYzJSw0FRg=,tag:T5cFLlDjWRhftC//ifDXUQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -14,14 +14,14 @@ sops:
         - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVFBGQmpQY09HWVRreTAz
-            azFuWXlZaW9hZzZvdDhIc3hUR2FLMkgweGlJCnJrMXZ1dnRUcmVEN29VdXVTenZZ
-            anczMmVYZmdZOHk3aTBhZW5rWDlNbEkKLS0tIEZNdjZoOHdLQk11VmlSdklrc3BJ
-            b0k0QzZTZ1NrL1d3dUJXanhHWERqVTAK5g0YmTPv+pvbqvqtdOTMbsHI9O4Tk19J
-            u0aOq/YA/6OpXTOoX+5BrfWsqRn9E8K1g0wPmLs4ETSrqzB9p67ePQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRWNGMWEyOHI4SmYwTmVT
+            bXE1dGpSZHlLVjZNNEVIYnVlam1ZMGF6d1Z3Ck1aRE1hc3RYTUo3aHAwU3gzdUJl
+            dDNCOWF2Tm5wK1h4MytTRVRzTmtaVlEKLS0tIENPVDVONTBxWlJzVkJlRkI4OVhy
+            Nis4WWZsclJHVWpyWnB1K0xZV1pvYlEKNBImgI3lFpy63zZyNOquGOUbaEQpLTaE
+            yVbe90RoDvua716CqzwxgxKkru5g2IF0xUqMeDwq48YRoSYc/f+QTw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-05T23:02:05Z"
-    mac: ENC[AES256_GCM,data:jvtIaoV5IciwQ0NtNejpEwlTQzl4GowsFIGJZ4gXe0za+nPSu/lX2HzmDSFYhFPvpO42peeJ22Sh3du225+cIcyVE2hcbJRZ9TJ95FHPKRRcbCHTc9DyTjPXn/UNukXhRpwDK3XxZhZgFdn9B/Fyxa4h0qsNy9svbbFw9hYM9R0=,iv:RMkiWppGFdyrvX1Fb8L3klUwfdsifXws/TodJWRFgT8=,tag:Q09r7v1W9cPabqeDtLknMA==,type:str]
+    lastmodified: "2024-11-07T06:29:43Z"
+    mac: ENC[AES256_GCM,data:YSDAdNdyduuT9S+FTeMrRIhX1wy5VYd6SeQVt9hUAacS5IxaiPR9aexGoe7XWnGsLbLVd2VjbCyIlGf9CM6y6FGjHbdpkZ6vrpOmU22Qzz+6KHmphvAbimOhffi6LG4LUHgaEsrQKBa81VIiOFCYVhyyNl3E6eRk+tZ7fyMDAy4=,iv:Z6bcBK2e549wL6AhFrMV9ekuCRR3fqbYpX7kXqqgiAY=,tag:C+vauyvc6NjYmaM1dzoVqw==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.1

kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml

@@ -59,6 +59,7 @@ spec:
         #   initialDelaySeconds: 10
         #   timeoutSeconds: 5
     extraArgs:
+      - --ingress-class=internal
       - --ignore-ingress-tls-spec
       - --crd-source-apiversion=externaldns.k8s.io/v1alpha1
       - --crd-source-kind=DNSEndpoint

kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml

@@ -3,3 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./staging.yaml
+  - ./production.yaml

kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml

@@ -67,7 +67,7 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
+        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
       resources:
         requests:
           cpu: 100m

kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml

@@ -64,7 +64,7 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
+        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
       resources:
         requests:
           cpu: 100m