[FIX] Move substitute files into a tmpl folder

Cleans up `envsubst` command and allows command to be re-run

tmpl/.sops.yaml

@@ -0,0 +1,6 @@
+---
+creation_rules:
+- encrypted_regex: '((?i)(pass|secret($|[^N])|key|token|^data$|^stringData))'
+  pgp: >-
+    $FLUX_KEY_FP,
+    $PERSONAL_KEY_FP

tmpl/cluster-secrets.yaml

@@ -0,0 +1,10 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cluster-secrets
+    namespace: flux-system
+stringData:
+    SECRET_DOMAIN: $BOOTSTRAP_DOMAIN
+    SECRET_DOMAIN_CERT: $BOOTSTRAP_DOMAIN_CERT
+    SECRET_CLOUDFLARE_EMAIL: $BOOTSTRAP_CLOUDFLARE_EMAIL

tmpl/cluster-settings.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-settings
+  namespace: flux-system
+data:
+  METALLB_LB_RANGE: $BOOTSTRAP_METALLB_LB_RANGE
+  INGRESS_NGINX_LB: $BOOTSTRAP_INGRESS_NGINX_LB

tmpl/gotk-sync.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+  url: ssh://git@github.com/$BOOTSTRAP_GITHUB_REPOSITORY
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./cluster/base
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  validation: client
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg

tmpl/secret.enc.yaml

@@ -0,0 +1,8 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-token-secret
+    namespace: cert-manager
+stringData:
+    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}