Added monitoring with Prometheus Kube stack and instructions for setting it up with Helm; WIP - need to create targeted SOPS encrypt/decrypt scripts to prevent all files showing as modified in Git history when I decrypt/encrypt the entire directory

2025-06-29 22:34:46 +01:00
parent 71bd447b78
commit c130157f2f
72 changed files with 18264 additions and 13543 deletions
@@ -5,11 +5,11 @@ metadata:
    namespace: home-stuff
 spec:
    accessModes:
-        - ENC[AES256_GCM,data:b60W42vH/VOZCnwNtg==,iv:xXJP90tbODDF0oqa8TFqsnKgCbYtlFtoCKNSm1GvoEY=,tag:H7SvEakfNNxXLNSzsNGCEQ==,type:str]
-    storageClassName: ENC[AES256_GCM,data:xFkr91hQjXoizQ==,iv:GoJaEEfHgSjXZDHNMlAc5WJzwgnwsnfuTabuIgFphmI=,tag:cDTEMZNqas8KwPwrPl590w==,type:str]
+        - ENC[AES256_GCM,data:1w6P1K7MilOK0RmDbw==,iv:49N4Vk2ngMGEZkzZ0tHmSmR7/zUXn57p820vGhbtFvo=,tag:DRAFZ5KhNCCzbDSRfHaYoA==,type:str]
+    storageClassName: ENC[AES256_GCM,data:KGnF//PUfEOe8A==,iv:NhBBcRbJUMI5Hvteh/fkKC7V9SIwPHbhp0X1POMUimA=,tag:g+1xCluYVGlKZOaFMQknjg==,type:str]
    resources:
        requests:
-            storage: ENC[AES256_GCM,data:70LA,iv:cJ5KzHYf0L7u5lKpiJI1RseC3ZZ+H0pw68paGhaGvXs=,tag:D2gN1/d/0Fn1B7ycm7oplw==,type:str]
+            storage: ENC[AES256_GCM,data:l1sR,iv:/ZjK7m/tnjTdqJa3tU8sdJ6dTA3Dh9HXFzxcuODx6n4=,tag:tNfS2q7qlqQK5ldYsLjp8g==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -19,14 +19,14 @@ sops:
        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNGhtRWRwYXNCSkxrbldP
-            MzAvOFhsS0RZSGFrLzk5Z1RTV2szOW5qMGpzCllrUDN3ejR0bXJlK0R5S0VGTEVR
-            UWpMYVJtQWdHMkVhL1orZDZ6OE1JaU0KLS0tIHFQSFlkU2lCQ3JlQklyS1RPdmZT
-            ZmRMOVZ0alZnYVJKb3dzbTZ6TFVHSXcKkyVVddO/r+twHJewXGzG/rxgONoqhSkR
-            ceX4xOyoB2PqMJ5RC9apgPpZJYTvCu1pZWIWOa/JtAb48vHQzXqqyA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlSHpzdlhqRXBEaFp4c0Z6
+            NzM3dHJpaW1EajZYS1ZjcURFc3FJZDMxMlZJCmYvUlZ1NU5jdHJGczRSUXNKOFZt
+            bjAzMHNVck1tRXQyaU5kdHEwRkRBOGsKLS0tIERtU0dRb2c3WFhqZTVuY0swQU1Q
+            Z0J6RlVBcmt4M1hYKzQ4Q2ZleGhyL28KmeedIYmNnb2c62iz31iuZgmh5JdnYcpd
+            hQVq7FGVG0Vif9GANwgwq7I637TF9O0RYgp6daXPBwY4jLCwNGsoJA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:12Z"
-    mac: ENC[AES256_GCM,data:75Odm5iB2G+CNKKGfaLCDPs4yaA3QzvXB3VwoJRh3KC+WGMwVUXKqpqXKju7ldaMjJinOS89h1SIuFneE1o7lIVcf4lqIwbJwX7PVEfvKUUByYrjMdT/TW/t6avOrAInqZ1FrvkFb56kNjBnwM8LQ/ptjThlHffDEAusTwf4f0c=,iv:BKoSGzQucM2n4akJhnWL6wHAS/SzJ3EscyNxy+kPC7g=,tag:yBy7PeOn3HjnFCS20Z2wmA==,type:str]
+    lastmodified: "2025-06-29T21:31:01Z"
+    mac: ENC[AES256_GCM,data:8Tgpnd+1x4o9I0UwnvCwwqwjj/VmhTgVbF27XHGJJjHsi94xNy3JonmNed1V2JhCZ5YtvYjDoQUriyxAtUjPNgj5IotTfB59ttbxVF54KpLoNre2GTtRwGSGnfVaVcfoigCSljPLS7l8vrCAlE4Er8twuijZ5iv/haJPyd4DoNY=,iv:hErOQ8efQXa4sM1+PT7tlAyGgH9QAjeKZ0VmXIUFdrw=,tag:Seof0uyzM2HfHxD+BhW+6g==,type:str]
    pgp: []
    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
    version: 3.9.1
@@ -38,11 +38,11 @@ metadata:
    namespace: home-stuff
 spec:
    selector:
-        app: ENC[AES256_GCM,data:mG/6P2s8areuOJx3Yjo=,iv:xLxx5nhTV6R+5BY/GkBblNXRKSUFGTe3L8YJpnKxREE=,tag:naKtBHX29PYIDwjbKEifnA==,type:str]
+        app: ENC[AES256_GCM,data:KS1FOmYgzrSJGw3OGG8=,iv:lelgm8JzA0gJva+KE6/jxykgHScI3vtoEZFbq1Dn74o=,tag:7RXu+QjD/3Pz5dic9Aw3Jw==,type:str]
    ports:
-        - port: ENC[AES256_GCM,data:07wh,iv:l5TQDXfrTVZoM60T4QMm0c1AsNHQWh7fnkQn8+hVpRI=,tag:sePSWJFiT2xZoKY5O9Ipvw==,type:int]
-          protocol: ENC[AES256_GCM,data:A0Sj,iv:O0mv5EjzbZ4l48goEnIXkjakZG5Zo3ybf9p2J0ovWW0=,tag:cW9cXgtf5Z7QMWkvpWGJkA==,type:str]
-          targetPort: ENC[AES256_GCM,data:WMWC5g==,iv:HuT71XKfydh78VlZIrJXsjpDmONzKktDh8psWwgELf8=,tag:NacdbxYVVmHJZIe6+6WaGA==,type:int]
+        - port: ENC[AES256_GCM,data:q4n0,iv:xg09DubFz1ZD8mpOdX0gM9CrUoXNHVETuiEPNDQU9UU=,tag:g+Dc4/nfD3lzwOex4z5a9A==,type:int]
+          protocol: ENC[AES256_GCM,data:Njxh,iv:bG1irsDENwIImvOoP5EJSiH4fsESQG0JiqcUERTUq8Y=,tag:8zYZaH/LGGBldwejNQMLHQ==,type:str]
+          targetPort: ENC[AES256_GCM,data:XhjGPA==,iv:kFCryhaKK1z5xbo9HjdtRQuaGEwkb/uQD8WFrzwd3p8=,tag:m5YZmBhPNVuOp4NEmy/zZQ==,type:int]
    type: ClusterIP
 sops:
    kms: []
@@ -53,14 +53,14 @@ sops:
        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNGhtRWRwYXNCSkxrbldP
-            MzAvOFhsS0RZSGFrLzk5Z1RTV2szOW5qMGpzCllrUDN3ejR0bXJlK0R5S0VGTEVR
-            UWpMYVJtQWdHMkVhL1orZDZ6OE1JaU0KLS0tIHFQSFlkU2lCQ3JlQklyS1RPdmZT
-            ZmRMOVZ0alZnYVJKb3dzbTZ6TFVHSXcKkyVVddO/r+twHJewXGzG/rxgONoqhSkR
-            ceX4xOyoB2PqMJ5RC9apgPpZJYTvCu1pZWIWOa/JtAb48vHQzXqqyA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlSHpzdlhqRXBEaFp4c0Z6
+            NzM3dHJpaW1EajZYS1ZjcURFc3FJZDMxMlZJCmYvUlZ1NU5jdHJGczRSUXNKOFZt
+            bjAzMHNVck1tRXQyaU5kdHEwRkRBOGsKLS0tIERtU0dRb2c3WFhqZTVuY0swQU1Q
+            Z0J6RlVBcmt4M1hYKzQ4Q2ZleGhyL28KmeedIYmNnb2c62iz31iuZgmh5JdnYcpd
+            hQVq7FGVG0Vif9GANwgwq7I637TF9O0RYgp6daXPBwY4jLCwNGsoJA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:12Z"
-    mac: ENC[AES256_GCM,data:75Odm5iB2G+CNKKGfaLCDPs4yaA3QzvXB3VwoJRh3KC+WGMwVUXKqpqXKju7ldaMjJinOS89h1SIuFneE1o7lIVcf4lqIwbJwX7PVEfvKUUByYrjMdT/TW/t6avOrAInqZ1FrvkFb56kNjBnwM8LQ/ptjThlHffDEAusTwf4f0c=,iv:BKoSGzQucM2n4akJhnWL6wHAS/SzJ3EscyNxy+kPC7g=,tag:yBy7PeOn3HjnFCS20Z2wmA==,type:str]
+    lastmodified: "2025-06-29T21:31:01Z"
+    mac: ENC[AES256_GCM,data:8Tgpnd+1x4o9I0UwnvCwwqwjj/VmhTgVbF27XHGJJjHsi94xNy3JonmNed1V2JhCZ5YtvYjDoQUriyxAtUjPNgj5IotTfB59ttbxVF54KpLoNre2GTtRwGSGnfVaVcfoigCSljPLS7l8vrCAlE4Er8twuijZ5iv/haJPyd4DoNY=,iv:hErOQ8efQXa4sM1+PT7tlAyGgH9QAjeKZ0VmXIUFdrw=,tag:Seof0uyzM2HfHxD+BhW+6g==,type:str]
    pgp: []
    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
    version: 3.9.1
@@ -78,25 +78,25 @@ metadata:
 spec:
    tls:
        - hosts:
-            - ENC[AES256_GCM,data:IaBYG0xvgmF3OsjOS5sdq5Q7IAUfvh4bMQ==,iv:mw5GCOov8bo2hq+qtpw8vhpyNUItm+WZsq0/6rzXHXc=,tag:ylqDicUePxEOUuuWLG/ejw==,type:comment]
-            - ENC[AES256_GCM,data:0BcqqweLBrXI4/rm,iv:NPQdk2NdG6kvjCaDuLK5Xbg+1ufMhqup8o8ZgE0e9WI=,tag:LY6HhDPsnXrPf068disPUA==,type:str]
-          #ENC[AES256_GCM,data:5j2CfeDAFMl4dL4byEe9O78qnjBJJISSF0d9Lm5YPYtddkNnpxQWR4TE/d71PsNVOgmyDLyAtLhA,iv:CKH493jI5NNoKWRF8D415v8fx00OwSpJR4svJSiKv3c=,tag:EQVckzfLylwBIz/LY4jItA==,type:comment]
-          secretName: ENC[AES256_GCM,data:bPjsJ/fL,iv:oHjD54QC8wgjwrHUKrFzBhAP7aO395cjMSutG+VfMb4=,tag:DtvhkpoKKpqgWY/vfw4EQQ==,type:str]
+            - ENC[AES256_GCM,data:LduYiXX20Jg/P0+hT+x9HfRJlYiE3FrEyQ==,iv:9Jh+Kcc3chCOEb+qvnzmLVypeKdW+L+pxwPZ5sz2A+g=,tag:GQmdLuEV9QJCI+harwwSjQ==,type:comment]
+            - ENC[AES256_GCM,data:gnFLSHlbv72wV4/Z,iv:MjmMyKm9H9oP7Gbu+lRD4uvthrX9sJ3Cw54i+a6CBXo=,tag:XXMDnodCMDs5quJjIyhaUg==,type:str]
+          #ENC[AES256_GCM,data:7hjdQ/Mp+84+o1gM1wAu1jm2xkAqVgYcagvSC/dHUS/UTW/mjyQZqd/yQe8Q5Ti+rBAcTDKJ/sOt,iv:a6MRYPlqzlH6zISB8W3686oU/JsB2e0SC0uBfXeGVk0=,tag:3znVhjKesQoRHtiWW6EqTA==,type:comment]
+          secretName: ENC[AES256_GCM,data:QZ881xgY,iv:jgEshjkWr8U0MKzA93L45Gb3jUrHceHi2NK/vYYkJDo=,tag:7CRHENgO2rBclguWNT/6Xw==,type:str]
    rules:
-        - ENC[AES256_GCM,data:C+Aq9jifEdLc2MkZyJkz15+eE/dLksW3MQ==,iv:3+9oZai/HY31BsU0uf1KskEMNzdP7h9Z/neFHjYEqBk=,tag:EPOO6nj0AFG8cuUUU2vuMQ==,type:comment]
-        - host: ENC[AES256_GCM,data:UDUq0bv2jW3VvGJ9,iv:VgXuSH0wnr3/MKON42hg8Fd9/XmTZfjiv7JI0wYZayo=,tag:RkK/yN0MLT1jeKDzVaN2PA==,type:str]
+        - ENC[AES256_GCM,data:uL6m9varvgX0gavfX55A+kcQnEWpdrpDfQ==,iv:Uw0IUKvCgmN8UwFekK/aACDJlsA0BYCwe6nFnjFtddk=,tag:yebXq6Clpe8hQHHoPuEj9A==,type:comment]
+        - host: ENC[AES256_GCM,data:aoEMPfkm56zs7zWC,iv:wpek8F2HM7GOqkCdTIq3KePvW5sD0a8n21Tpw09DLe4=,tag:bdEkFcnsJlj7dpArRWYtFg==,type:str]
          http:
            paths:
-                - ENC[AES256_GCM,data:az+C+ZpL2HFlcCe0oQjE+hhcTxqaqkRRT4KrI4p81PwGATLDdE1lRiTqkz4s7vgCqCmFl1KQIKd8IpSCt72QDF3YgF4x,iv:BgUShl7pDrjbHK9I23+t+zWh0dQxjQxhm/2Ita8PhWs=,tag:AvDKKccBX89fNd4PdW7nZg==,type:comment]
-                - path: ENC[AES256_GCM,data:+w==,iv:xPw/yrDcwLv2XPoi4pQT5d/lL4fXm2l+/uhQCh4849g=,tag:sOBO9wf8pjraqq000LPETw==,type:str]
-                  pathType: ENC[AES256_GCM,data:E0nglDhN,iv:RHaSfVHM1XWE9777kbgLYGSCbi7ZmAfojkMu/m/k6N0=,tag:/a/ymwvaYacfiJ2ZNbfQSQ==,type:str]
+                - ENC[AES256_GCM,data:kYkYSIzAd9qjLAJGtqUWqBKEKMs5QVL4tL5o38P3l/3Fjz2zpKjg8SKEbMrT5+V6NocGSKW2UnGF/VNU6Nt8rPu4wteA,iv:YymFzVfQ60xDi3J+48tP8K9XVkBGk6zCLgOfK/c9k8k=,tag:aY3Bl8mXSP/S+rKVqA9NoQ==,type:comment]
+                - path: ENC[AES256_GCM,data:ZA==,iv:b4M6hpDTJEcHW70XYTnUCLnZ1uqZg0AkfZecsCMaGV0=,tag:gBGTUbDqvQNmH2n764uUrQ==,type:str]
+                  pathType: ENC[AES256_GCM,data:PUVnOcqZ,iv:p7tbMZsBSiU2EY7GhecvWkboDn3zT9DOCRIe8k43zvc=,tag:wmrCkT2P9JPy2ajp0hiVYA==,type:str]
                  backend:
                    service:
-                        #ENC[AES256_GCM,data:0qGoa1qSfrXtBzKYAFFlwdoKy9kAOqv2v3n/zdoUr57LskYPO69GyTRZI7ovIZRwGmsxGGrjdu57B01bsGjB,iv:6AFaYRza3fivWoeYio7ZzJfUhqvxESS2r3Mgw3fFulw=,tag:9ktSWtNtOGN2cxMzT5KCVw==,type:comment]
-                        name: ENC[AES256_GCM,data:idNMWrXnsvLaZYW873/j20IO,iv:k9R8CchAp4BQdIFWPOQMrPTrld7wG5o7x47aFDcivso=,tag:szyAfDmp3bUsk24nSWNlWA==,type:str]
+                        #ENC[AES256_GCM,data:KrQSn9U1beBCrL5wIzbx8eTT3IT44dtpm/NO1DriCLhdxdUBaLMAdFxsjAp36Pz/LaKEIRFcEfdUiebb3xeT,iv:iW8lXJsoOaT5Q5qQBo44nouG+lZh3ZtdTz5+nL45p3g=,tag:UvepEPpfAiqwXZuyyDfO/w==,type:comment]
+                        name: ENC[AES256_GCM,data:wSvj2Mvfw0vBNpMHc7L6nU0s,iv:/atEhKoONBGu2KWEUONdvmstZEAKNAuBXpi/EPyjT0Y=,tag:rnWAnYEJGH8iwHdLwBN83g==,type:str]
                        port:
-                            #ENC[AES256_GCM,data:Y7rnPAXpO9Q48zwHL9aEQJaoDEFbB30gI1n45v4rJsvYIj00Rewl3e+QeeqwD+VB1mPXQfebY8S978J4,iv:FLDlj6dX6lw2nwaQEYfXnk6ADlrd46lxVcewaME3JNQ=,tag:bIZvdny7CxvdhfxtFL6S8Q==,type:comment]
-                            number: ENC[AES256_GCM,data:JiqJ,iv:FZhM1WBqaSyRFHWVBxLF3PuEAoKUInjOCrrkxepLV5M=,tag:Zj2ZDht0S0jWOaWpeAwIog==,type:int]
+                            #ENC[AES256_GCM,data:TT+T+x9b/Le0A6S6LJONb6C2e4rlUZYQbsaADwqrVhtn12PI3G+Cf0aZsyTysUoxHBaX3ZzFiJ43aVo7,iv:YRmeoVuwdXCcWtG9ChrEYz4jjVQ42Ra/j47p4etRbnQ=,tag:n8zzgyoRoSA7bR9nHC0BHA==,type:comment]
+                            number: ENC[AES256_GCM,data:PBUe,iv:gcnWPd45SPpZjuAFY36xjQofcsezlA2Q3wK3tYq/nFQ=,tag:/ryN3k+Ouwtfxv2/M2qPcw==,type:int]
 sops:
    kms: []
    gcp_kms: []
@@ -106,14 +106,14 @@ sops:
        - recipient: age1u0mt3kmhsr9tz2jaw8n0ztu7s9hnlffkd2acxf85cvk6tysj4gsqqulfdq
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNGhtRWRwYXNCSkxrbldP
-            MzAvOFhsS0RZSGFrLzk5Z1RTV2szOW5qMGpzCllrUDN3ejR0bXJlK0R5S0VGTEVR
-            UWpMYVJtQWdHMkVhL1orZDZ6OE1JaU0KLS0tIHFQSFlkU2lCQ3JlQklyS1RPdmZT
-            ZmRMOVZ0alZnYVJKb3dzbTZ6TFVHSXcKkyVVddO/r+twHJewXGzG/rxgONoqhSkR
-            ceX4xOyoB2PqMJ5RC9apgPpZJYTvCu1pZWIWOa/JtAb48vHQzXqqyA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlSHpzdlhqRXBEaFp4c0Z6
+            NzM3dHJpaW1EajZYS1ZjcURFc3FJZDMxMlZJCmYvUlZ1NU5jdHJGczRSUXNKOFZt
+            bjAzMHNVck1tRXQyaU5kdHEwRkRBOGsKLS0tIERtU0dRb2c3WFhqZTVuY0swQU1Q
+            Z0J6RlVBcmt4M1hYKzQ4Q2ZleGhyL28KmeedIYmNnb2c62iz31iuZgmh5JdnYcpd
+            hQVq7FGVG0Vif9GANwgwq7I637TF9O0RYgp6daXPBwY4jLCwNGsoJA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-21T20:34:12Z"
-    mac: ENC[AES256_GCM,data:75Odm5iB2G+CNKKGfaLCDPs4yaA3QzvXB3VwoJRh3KC+WGMwVUXKqpqXKju7ldaMjJinOS89h1SIuFneE1o7lIVcf4lqIwbJwX7PVEfvKUUByYrjMdT/TW/t6avOrAInqZ1FrvkFb56kNjBnwM8LQ/ptjThlHffDEAusTwf4f0c=,iv:BKoSGzQucM2n4akJhnWL6wHAS/SzJ3EscyNxy+kPC7g=,tag:yBy7PeOn3HjnFCS20Z2wmA==,type:str]
+    lastmodified: "2025-06-29T21:31:01Z"
+    mac: ENC[AES256_GCM,data:8Tgpnd+1x4o9I0UwnvCwwqwjj/VmhTgVbF27XHGJJjHsi94xNy3JonmNed1V2JhCZ5YtvYjDoQUriyxAtUjPNgj5IotTfB59ttbxVF54KpLoNre2GTtRwGSGnfVaVcfoigCSljPLS7l8vrCAlE4Er8twuijZ5iv/haJPyd4DoNY=,iv:hErOQ8efQXa4sM1+PT7tlAyGgH9QAjeKZ0VmXIUFdrw=,tag:Seof0uyzM2HfHxD+BhW+6g==,type:str]
    pgp: []
    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
    version: 3.9.1