Initial commit 🚀

.sops.yaml

@@ -0,0 +1,11 @@
+---
+creation_rules:
+  - path_regex: kubernetes/.*\.sops\.ya?ml
+    encrypted_regex: "^(data|stringData)$"
+    key_groups:
+      - age:
+          - age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+  - path_regex: ansible/.*\.sops\.ya?ml
+    key_groups:
+      - age:
+          - age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r

ansible/inventory/group_vars/kubernetes/kube-vip.yml

@@ -0,0 +1,3 @@
+---
+# (string) The ARP address kube-vip broadcasts
+kubevip_address: "192.168.100.100"

ansible/inventory/host_vars/cn4.lan.sops.yml

@@ -0,0 +1,23 @@
+kind: ENC[AES256_GCM,data:b2YP92P4,iv:dgFTaN9zZJkxDlPGAdgJePpZlZh/XdwLG1gEHARD44M=,tag:wGuOHdTZQqc7T8MgHfSFxg==,type:str]
+ansible_user: ENC[AES256_GCM,data:qBlYelZV,iv:D3xZTOXn5r2EyPHqYSGucOyCnnDk48Esq4errgJv++4=,tag:fif468HJkkdE8EdKRoBEBA==,type:str]
+ansible_become_pass: ENC[AES256_GCM,data:WZFyjhL+G936gg==,iv:AQrPjU/ACXLtAy0jAExCOMn0jv4KK+ZDXoaEC6DARj8=,tag:edtQOe/BTtmjJrqlSLy3IA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2TXpzd20zT1pEMSs0eGpm
+            cUNOZndENkhTeFRKUktwUUhoQnhCdzJaUURRCmdvYkUwY2xjT0JveXpLSFRJT1hD
+            cnhIWEFHVXJHQURzNnJUbUJoY29qQzgKLS0tIFM2SEpuUEh1NnJPUThNVUNZazJZ
+            UWQyYXNpMG5HaXVSYTlaVnFZMkVYY2sKZ5hhuDJqaoeUPDV8dxu4IvqCoeMgZ+NX
+            vlSYyHiaPZ2bk8pCrnCbTWGHCrQHiMO9GpJUnXbalTfDIzP8hCYhuQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:rXgL2Jr1AUDJyRiVDBpWUJhNseprQFzA6kIl4RVzypAkX7mY4aDCwwYsMfaCye1gM36YWB8rrl3s3wI/DGxv3LZV6qoSeyxHJZZZGMfcdkeg47nnnIPAizIvif5nYpc6UQOrlNGwCNE8aRx2ZEu98uFPHSRnFSRLRI6izD+IRB0=,iv:a9WIb7VPP023SVHhs/pF6dnf85/dVmF6KAuJmEDl+as=,tag:4vsFY5rJ+sOWnuldDFWckw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3

ansible/inventory/host_vars/cn5.lan.sops.yml

@@ -0,0 +1,23 @@
+kind: ENC[AES256_GCM,data:f4/N5rK1,iv:zoVHB9LJw2NDxOc/z2sBaQ8joX47xCKP37l0rLuKcxc=,tag:9VRaKJNnPucANQzg78X+Qw==,type:str]
+ansible_user: ENC[AES256_GCM,data:6NYdhtLn,iv:OnyPj0ZyGzfuhQh+AraCSMMajbAk0aloadaNBytqyT0=,tag:DvMOmdPoBpZYzzlTenZ8Rw==,type:str]
+ansible_become_pass: ENC[AES256_GCM,data:6TZYFvzyEpxBZg==,iv:NEgWsJDmJ6oXj0rJcVYcVqQnW82D1hCgVd6+FdfJOTE=,tag:vi9Ye5UEor1gOmTOjZFMJw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTR203cE9zcGc3ZlRocW9Y
+            VTFoUzM4UmJNN1h0WDZYZXFCOEY3dDJZWGp3Ci9ycDlHSDJISmxDZFAxSzZBTjVq
+            OGZXS0J5aUtEeXVzbUFmQVRXOUIxUVUKLS0tIEhpaW5yK0pkTWdnSUlmbm9jUlNI
+            UVlCRThDVmhOWkpHV0lTNFo2TVZpZEUKyfZ8t5bAR0CW5kRHJlFcEi5ata4AJZVH
+            /cUaG1lH7Bw3cDxH9OVZW0tPWiVK4cuHu+Q3HjCfq6VPSxSs9K3dsw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:YtUQXCfKWBsN5ZPhL4YpqnZSf2RY8PbN7clcuxde1ulL27+0gZE+9SM61D0Vfzxt8bukErJAMkuFB4JVb4U5i0UGs5hvxcgKPVh9006LtawMaoDAO05dV2olMXqzWhIb9onJgapLlHqU9zaO6yD7Jltpg1/sW/emvtNBdX/5CHQ=,iv:YK94DuKgaxK8ojQnTPrg2Ai7nKyHp+BNwEkdOv6VA2k=,tag:vIe9iLRD+f56xY+ItaZ5zg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3

ansible/inventory/host_vars/cn6.lan.sops.yml

@@ -0,0 +1,23 @@
+kind: ENC[AES256_GCM,data:1OyVSwmJ,iv:VRyY6vQqB8nf5+3vkotH59gPN6l5SSkHiHoK7aQgsNY=,tag:3A0wl2WSYKor94HM4CcorQ==,type:str]
+ansible_user: ENC[AES256_GCM,data:clACluq/,iv:YRe04ipvYI1kxkrjRA/feN/vqRLC3jE71p/T/0pGNNk=,tag:uCBhksVX3Pntt6jQZ4HbdA==,type:str]
+ansible_become_pass: ENC[AES256_GCM,data:Bvb/1+tg50qyVQ==,iv:pEmsfN9I3VBVjQH+WN6hYKDH84LRtxEd6DKaWJJEvmQ=,tag:MuLjSALPkKGGh/mawEKqFw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnaDBLVWMydnNweXk0TlNU
+            QTU0YS92L1FGdWNFam9VZ1VTWHBNOWxpUUhnCnR5WmZLbVFmaWtWOWZKc1U0akRv
+            MWpkU0VNTnBMM2dzazMrRzl3N1d5aUEKLS0tIDNCeStFRHV5aUJ1YkJUZ1pPd0VJ
+            RkJlNFFYWFM1UDZFbDBiSXNaeWs3eDgKsW9wsCcenVxgZFyEqIq+feKOyogvr9YQ
+            CLIx0bwNJNKFpZ04TU9qu0Y8+rmVWsN+wGIaRfkx5k2Oqmpq/SkpMA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:yVEPFsE5VUHq38l6uFyYP4OKIrQQpbGyl5kyMusg0AZ/yKrguXeGh+g24S3yGlokMUcBik1gg0L9xBOZbXzhztjSCsEHeyxi74RId3O+LwCRnkBSr0eYffXmExRMEKJOF3lgaXSl6RlMJcnjTMIGEZ/VE1ueO0UY/gxTOLC6Nww=,iv:Ljvv5aNVrzjvw0HV9inFzT/OGcBGBmMlX5xMY1idPm0=,tag:/LhFdrc1fEswO8TUTGFC7A==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.7.3

ansible/inventory/hosts.yml

@@ -0,0 +1,11 @@
+---
+kubernetes:
+  children:
+    master:
+      hosts:
+        cn5.lan:
+          ansible_host: 192.168.100.105
+        cn6.lan:
+          ansible_host: 192.168.100.106
+        cn4.lan:
+          ansible_host: 192.168.100.104

kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cert-manager-secret
+    namespace: cert-manager
+stringData:
+    api-key: ENC[AES256_GCM,data:XfUnR/vJz+bCl5n2n/hxLxo07AItvcegLcvFZ89NQvzPYplKVw==,iv:PzZJ/jFsqv0cHrrhX7pRrLF2gWbfvfkbVSG7TxscoKQ=,tag:pJKxbqoIHf+dO+E4WRUJ3w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsYWpJMm9jR250TVR0bExs
+            NEZFRmFDZ3VSWmJrVWJGQWlXT2NXM3p3Z25jCnhOMWgrVlN2YXV6QUFCVUc3dnFE
+            c2ZZaEg4MFYvQTBHT3lRVi9Ka3hOekEKLS0tIHhZSGRydXcrYllVcVRCaUNqcUFv
+            ZzBBanJJaXRlMnFRRU1PNHc1QUxaNUEKBZmjbnFdnOmiiGv0bjx98fE1m5vgf0GO
+            RnxSBouH/86aHsRngbg4eTPH4mm8A0jWdpd0bXGiBmhOYMNhQZGQmg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:XOkT41BzsS/EBb0KrQJZJXsYb+EQMF4kN8SZr9b2veWk4XgL8zgrzbj55XFDWWy2ENUg3mqVCtolWDtFxrYZIQIMasfEea7T7fKv+ujUHgHeSiXztTrmRIZg1a75vJzwO+cNeAz643O8Xxove9X8xH1NP2ZbQKBk3gqUtkByMaY=,iv:Bd6P3G2tPH1HeRGLZ4/vKFQ2qZsWKPtFS3DBE6OlRsQ=,tag:C2Inyr7ECbRf2GNhTZGR2A==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: github-webhook-token-secret
+    namespace: flux-system
+stringData:
+    token: ENC[AES256_GCM,data:VxiUf30qxG9RnGaB+nCnp0pa2snttOSZUE++GjSGbWV2umhK2KpuJA==,iv:RTcQ1eIMU8z6262/cw0ibCvXV8xgSkIKZjG5sde2/r4=,tag:Uoy4tF0duQDAlKp5c9DzKw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5VnYvdEhBTWNsR3lySDZM
+            czhFSnpOcFppbkhpdXpJbEpTK3NJZU1SdUI4Cm5OQlZHMGEycWZ2MXdPWjJLVTJt
+            ZFd3djF3UExBZDl1Y09YYzdmdHEyVm8KLS0tIDZxL1FjSnVHRndyZWMvYitZbjl6
+            cTQ2VTRoZ0NDSW1Deng3b0R6dXBxSXMKMNRaMeBhGswMEZMLyj7tqSwI2xPuTVch
+            vRUxqYl8gXuaVDt1U/KYz4PToRvnc0mJvMQENIT48lLhzwUnJ4WR2A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:Ea5fSY+EfRpyu91njRO7pO0dp2tMbVYRXiWWWgGGaROpN9DBSnDXdFye1OXF1nkpF4Z0eIS22Yl9a3twdnaN7+7upizKx8UlQIqrxpb+fDPl52wtEEXf9sm0nN6JvUG9ZUy1XgfZx44VXdFRSdQ1NUvYeM3+LHXxrWQ2HnkVXZo=,iv:V9P1etpfC0qSYqC+sLzqsGrZNDBXaNykIzQtcf82CGI=,tag:+Bw6vVzyLOm0OpmOHGAO9A==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: weave-gitops-secret
+    namespace: flux-system
+type: Opaque
+stringData:
+    adminPassword: ENC[AES256_GCM,data:kieS6KRN1NFl3WCxWwwKPV24APnjX6ROOLDJ6Gd9YbQeB0TLzkU50HjAUxfJRqqhq8pF1UyVz2q8lBrt,iv:DwHXqD8KM9NGwZFUHvCRNQqDuu+BNpZZy3zcPYjwjuE=,tag:lR0WkzyLJkKPjlge1fo/UQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VDM0NVRYTnd6eDlacGVs
+            em9LTzBrU2dFbEZadkVLamFETmttOHlBL25FCmZaSXBFSW00b0FSOS9qbE8rcWt1
+            NkxZNW4zaXlUK2hXTWFtUlhhdXlqMmsKLS0tIEY2RVM1L0xSL3Fzd1BTRDZ2cTI2
+            S2FjdHdKbTVDTFZOejh4MnFGZDM3RUUKAUtYDiwxwNkXLc8j9byA9kKd2FBTtP0J
+            60s6J7nVuaJxDO/51xw9NLiGm2+ZMaxdWx8wVu+MqoO+THiTD3Y9EQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:9RU+59SXUUBTFAEN83KKHlqIN01Sh1bFx1xlWYxkS5OxSgrpjzRI3itqdLXfCPLRDkx4oxWrtHTo0sNF6xX+9p9BRklrEVz9NOQZPoIjnagOUeobLThbj1VawjGqVD/T8ajbE/UXvvRn+VWGhUqb3OUG83dglaSf3yNKT+qS5RY=,iv:UKr1lPSjUmUQeP3FvRTWFi9I8KkWi5mFO961EaB2mvM=,tag:mSDCIjHHv8fNRQmjyZEPOQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/apps/networking/cloudflared/app/secret.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflared-secret
+    namespace: networking
+stringData:
+    TUNNEL_ID: ENC[AES256_GCM,data:VcBK+VYvRckGuCSg5QBzCiVzyru/8EckfVPJYa99YFC5EcFA,iv:ZR4hvuZ1e3Fpj917Gf99ObQTJJU+s2exlO9DXHsnnnc=,tag:BetP36TFj+6r07EWWsDszQ==,type:str]
+    credentials.json: ENC[AES256_GCM,data:jdrYVU1SyrRLzo/JpSINHd1Q8yk/KZVI11NynZz9Bt3mM9dAJHpb9HUCmtYiT1uqNlhRh0MhiW1QtHH46fX6dO2ajpn30gQWvbDEZdJWBbWAuEVDS0dOXLf9LksGRisKHYHUxIXvYlGpNMoNsagC0QOtXr+qTetb1BZtKH9a+6VsJiyRcdnXNMkA6sHWYWPKxJv4x22yTssU14ZYwIZSLNZ8/ehL7nRyvw8kRZ7nRg==,iv:fChEeHyg559EcVFaTZrgGOyBNjHjVXgq+2BH+KR8pu0=,tag:JBq7BHHNG7e50XpVcNYr6g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2R0FqOUhHb3NBYXVBRkxW
+            Rzd3dDkvclFXK0lRS3RGdWlleDM1QnIzV1NvClZhdFVpbnFIME84alJXQnBlOEhC
+            aXV2VWhmekZNWXlWb3FVTXFRb2Vsd2MKLS0tIHNUazAra0tFcTcvcG1NcloreU5N
+            bDZSWVFuZFovd2xpcDJEV2h5WnQ5K0UK9q9XJ7XlIEtei3wy+YnkTCyrMyieUPxV
+            xeCGvuqlqAojiefmqmVXOxmin134OeG+3piPCzvkK25d2ecsQJzCSA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:6BYf6BH3IWU/0wplExqAVFPrMnAmDmMqMvOcZiDmKb6J+rJ7xODF4xeM+nveGnXcKof8t3os697X+n4WUBeFN9II82tPhkYPts2kTrCUWxx6pLrBYSMARZI6Nq2Ae19PIVWVmMFyXs+fiTon6lUbmtIT2F9tzTFjrIwCaaQS8kw=,iv:Chv0XHZlOZY5qX9SK3WrEq0nDms78TU+NjTWgIa/zNk=,tag:Kr818b5Ov5eSpbKxbeosgA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/apps/networking/external-dns/app/secret.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: external-dns-secret
+    namespace: networking
+stringData:
+    email: ENC[AES256_GCM,data:TPxGc9kXf3Pr5Uw4HZnpxVQB+vjTWQGh/w==,iv:beFqPMRhmPWAChujgvI8EN6Pk/qbmaDPAfrXdXF+K5A=,tag:xVIiLpZcVrnZSI0VuF+VdQ==,type:str]
+    api-key: ENC[AES256_GCM,data:tTdzkm5m8FxyOnW23D7qIlsrtzXMObFoLl1AO1DUDB5Y11Sbaw==,iv:qAwGGrBp9OPJ+K+J9Kd0NpjUO4Y8OAwfQr5d2KmgjMs=,tag:6HZb5OyuD9lzjhkNm6ohhQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZHRNS3J1blFMMjlXMjB2
+            VE91YXF5MW50WWp4blVyRHdxK3N0Rk1UdkNzCnNXUFN5RGx3WHNqSWk1NEZYWHJ6
+            UDhLY01vUW44N3dHSk9uUWJ0R0RNSFkKLS0tIEVTcXptYTdpVHdDdVNxL2JBeDE0
+            WEprNDkrYm02b3BQc0UrbWRJUTgxZ28KaJ49WZnO6VywTksuSlT6SLGHc/oj0N+u
+            KbiqwYp8helor6JxSpqHrSPM73u2FAFYIl/q5o8vr8upO/jpfiotMg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:ptX+1j8CQBXofpvms7A4RyYaSfB0KRGDIGuD+C263XMgX8V33eKesnOmU2PX5l4zKqqahNTM34ryGmlzunyRN1afVVUqmM8f4CAuXAW6mCIOOdStpmE82HyQBsUM3jCJeGw7m2CkMX0K7G+o6c5jkhFHuGWIMYkZpNg1anEildI=,iv:43itcYkyycDXrnyBeUtxVKwJGbIrOwZJFyIzPi5ZMc4=,tag:C2ALAdomDgNyK9KXeSvxGw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/flux/config/cluster.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: home-kubernetes
+  namespace: flux-system
+spec:
+  interval: 30m
+  ref:
+    branch: main
+  url: "https://github.com/thiagoalmeidasa/homelab"
+  ignore: |
+    # exclude all
+    /*
+    # include kubernetes directory
+    !/kubernetes
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster
+  namespace: flux-system
+spec:
+  interval: 30m
+  path: ./kubernetes/flux
+  prune: true
+  wait: false
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/flux/vars/cluster-secrets.sops.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cluster-secrets
+    namespace: flux-system
+stringData:
+    SECRET_DOMAIN: ENC[AES256_GCM,data:qTzy4aH/76csW/g/ttacjjE=,iv:s9P+sGZmrkKZwgvIKcr7BiBBE7qIJyD3VMiSgnjuByc=,tag:2bPVAMAInmMSJEm7AcVX7w==,type:str]
+    SECRET_CLOUDFLARE_EMAIL: ENC[AES256_GCM,data:c4ABW4RXEBZ70yRjbduurY9CPpwgxpWJxQ==,iv:PsEYIbjuHta2C93UoLmGvsJrte+ALpxKond3q6mG/1k=,tag:gFBqJBcdym5gBY+f+GLs1g==,type:str]
+    SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:botnMWJx1MAsFC+uCck219xU1XmxMbYxmqnq4GeL5alzb4K1,iv:5pEyviMvG9LauCTmDYDEXrCJvCJPmL0TXrQc8g9cGd4=,tag:C/2fklEFFtYTvyPRmAlRjw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkN3FrTFh0Y3FVRHZ3YUFZ
+            OU1ITy8yY0hMRVlsSE5xN010Z1R4Rm52NUNvCkNRS3FINFFVV00wNmhJWkFBZkww
+            UUZ2RTgrb2liclZ5YTR3bEQvZUYzTHcKLS0tIEpNZ2pXYjFLd0lsaCtBMzhNK29V
+            TmVvZGxENzZqL0s4NUxpc3ZXR1d4T28KawEhJ5eOMZg4s7aSRUKEgNxhL2+KPGIE
+            L8RrrVAamjfvCeH7BxTNil9pkrllQxrxcp+Dw3M9YRgxbuuLlYCY7w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-20T12:50:43Z"
+    mac: ENC[AES256_GCM,data:zDUxKkyeMJwYC8ZXpuy94fVArrC7w7bXN6vNEXjlaRcIKpJCz+dMNqE5oKdtL6nKxSVLEcHe3EzBbbrxOtnwfVat41167h9AcQm0/sB5VAt/7aIGgOitpjiJqcooQVVG7PHkP4kQYnLH86j2ogh9oResPa/EceDuc+IW3bpPyOk=,iv:1ZUYNPf6liJow+huG33L7jM5rlQHAD0/pBeHRl+Jks8=,tag:AhNn8yoIsnzGjO7XJTrbow==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

kubernetes/flux/vars/cluster-settings.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-settings
+  namespace: flux-system
+data:
+  TIMEZONE: "Europe/Stockholm"
+  KUBE_VIP_ADDR: "192.168.100.100"
+  METALLB_LB_RANGE: "192.168.1.220-192.168.1.230"
+  METALLB_K8S_GATEWAY_ADDR: "192.168.1.220"
+  METALLB_INGRESS_ADDR: "192.168.1.221"