feat(deploy): add scripts for k3d installation and SSH tunnel setup

htwg-1/flux-apps/gitrepository.yaml

@@ -5,8 +5,6 @@ metadata:
   namespace: flux-system
 spec:
   interval: 1m
-  url: ssh://git@git.janis-eccarius.de/NowChess/GitOps.git
+  url: https://git.janis-eccarius.de/NowChess/GitOps.git
   ref:
     branch: main
-  secretRef:
-    name: gitops-ssh

htwg-1/flux-apps/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - cert-manager.yaml
   - ingress-nginx.yaml
   - sealed-secrets.yaml
-  - metrics-server.yaml
   - redis.yaml
   - argo-rollouts.yaml
   - nowchess.yaml

htwg-1/flux-apps/namespaces.yaml

@@ -22,3 +22,8 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: ingress-nginx
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres

htwg-1/flux-apps/postgres-tunnel.yaml

@@ -1,15 +1,32 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Kustomization
+kind: HelmRelease
 metadata:
-  name: postgres-tunnel
+  name: postgres
-  namespace: flux-system
+  namespace: postgres
 spec:
-  interval: 10m
+  interval: 1h
-  retryInterval: 2m
+  chart:
-  sourceRef:
+    spec:
-    kind: GitRepository
+      chart: postgresql
-    name: gitops
+      version: "16.x"
-    namespace: flux-system
+      sourceRef:
-  path: ./postgres-tunnel/htwg-1
+        kind: HelmRepository
-  prune: true
+        name: bitnami
-  timeout: 3m
+        namespace: flux-system
+  values:
+    auth:
+      database: nowchess
+      existingSecret: postgres-credentials
+      secretKeys:
+        adminPasswordKey: postgres-password
+    primary:
+      persistence:
+        enabled: true
+        size: 5Gi
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          cpu: 500m
+          memory: 512Mi

htwg-1/flux-apps/sources.yaml

@@ -40,8 +40,9 @@ metadata:
   name: bitnami
   namespace: flux-system
 spec:
+  type: oci
   interval: 12h
-  url: https://charts.bitnami.com/bitnami
+  url: oci://registry-1.docker.io/bitnamicharts
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository

scripts/deploy-to-cluster-htwg-1.sh

@@ -12,7 +12,6 @@ generate_flux_manifests() {
   echo " ⌛ Generate FluxCD manifests"
   echo " ⌛ Install FluxCD controllers"
   echo " ⌛ Setup Sealed Secrets"
-  echo " ⌛ Apply Git source secret"
   echo " ⌛ Bootstrap FluxCD"
   echo "----------------------------------------"
 
@@ -39,7 +38,6 @@ install_flux() {
   echo " ✅ Generate FluxCD manifests"
   echo " ⌛ Install FluxCD controllers"
   echo " ⌛ Setup Sealed Secrets"
-  echo " ⌛ Apply Git source secret"
   echo " ⌛ Bootstrap FluxCD"
   echo "----------------------------------------"
 
@@ -60,7 +58,6 @@ setup_sealed_secrets() {
   echo " ✅ Generate FluxCD manifests"
   echo " ✅ Install FluxCD controllers"
   echo " ⌛ Setup Sealed Secrets"
-  echo " ⌛ Apply Git source secret"
   echo " ⌛ Bootstrap FluxCD"
   echo "----------------------------------------"
 
@@ -70,63 +67,26 @@ setup_sealed_secrets() {
     "$SCRIPT_DIR/sealed-secrets-key.sh" import "$KEY_FILE"
     echo "✅ Sealed-secrets key imported."
   else
-    echo "⚠️  Skipped. New sealed-secrets key will be generated after controller deploys."
+    echo "⚠️  Skipped. New key will be generated after controller deploys."
-    echo "⚠️  All secrets in secrets/nowchess/htwg-1-prod/ and secrets/flux/ must be re-sealed with the new key."
+    echo "⚠️  Re-seal all secrets in secrets/nowchess/htwg-1-prod/ with the new key."
   fi
 
-  # Install sealed-secrets now (before FluxCD bootstraps) so we can decrypt the gitops-ssh secret
   echo "🚀 Installing sealed-secrets controller..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/sources.yaml"
   kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/sealed-secrets.yaml"
   echo "⏳ Waiting for sealed-secrets controller to be ready (this may take a few minutes)..."
-  kubectl -n kube-system wait helmrelease/sealed-secrets \
-    --for=condition=ready --timeout=300s 2>/dev/null || \
   kubectl -n kube-system rollout status deployment/sealed-secrets --timeout=300s
   echo "✅ Sealed-secrets controller ready!"
 }
 
 # ----
 
-apply_git_source_secret() {
-  clear
-  echo "----------------------------------------"
-  echo " ✅ Generate FluxCD manifests"
-  echo " ✅ Install FluxCD controllers"
-  echo " ✅ Setup Sealed Secrets"
-  echo " ⌛ Apply Git source secret"
-  echo " ⌛ Bootstrap FluxCD"
-  echo "----------------------------------------"
-
-  echo "🔑 Applying gitops-ssh SealedSecret..."
-  GIT_SECRET="$REPO_ROOT/secrets/flux/gitops-ssh-htwg-1.yaml"
-
-  if grep -q "REPLACE_WITH_SEALED_VALUE" "$GIT_SECRET"; then
-    echo "❌ $GIT_SECRET is a placeholder — seal it first:"
-    echo ""
-    echo "  ssh-keygen -t ed25519 -f gitops-deploy-key -N \"\" -C \"flux-htwg-1\""
-    echo "  kubectl -n flux-system create secret generic gitops-ssh \\"
-    echo "    --from-file=identity=./gitops-deploy-key \\"
-    echo "    --from-literal=known_hosts=\"\$(ssh-keyscan -H git.janis-eccarius.de 2>/dev/null)\" \\"
-    echo "    --dry-run=client -o yaml \\"
-    echo "    | kubeseal --controller-namespace kube-system -o yaml > $GIT_SECRET"
-    echo ""
-    echo "  Then add gitops-deploy-key.pub as a deploy key in Gitea:"
-    echo "  https://git.janis-eccarius.de/NowChess/GitOps/settings/keys"
-    exit 1
-  fi
-
-  kubectl apply -f "$GIT_SECRET"
-  echo "✅ gitops-ssh secret applied and will be decrypted by sealed-secrets."
-}
-
-# ----
-
 bootstrap_flux() {
   clear
   echo "----------------------------------------"
   echo " ✅ Generate FluxCD manifests"
   echo " ✅ Install FluxCD controllers"
   echo " ✅ Setup Sealed Secrets"
-  echo " ✅ Apply Git source secret"
   echo " ⌛ Bootstrap FluxCD"
   echo "----------------------------------------"
 
@@ -151,7 +111,6 @@ bootstrap_flux() {
 generate_flux_manifests
 install_flux
 setup_sealed_secrets
-apply_git_source_secret
 bootstrap_flux
 
 clear

scripts/install-k3d-htwg-1.sh

@@ -68,7 +68,8 @@ create_cluster() {
     --port "80:80@loadbalancer" \
     --port "443:443@loadbalancer" \
     --k3s-arg "--disable=traefik@server:0" \
-    --k3s-arg "--disable=servicelb@server:0"
+    --k3s-arg "--disable=servicelb@server:0" \
+    --k3s-arg "--disable=metrics-server@server:0"
 
   echo "✅ Cluster '${CLUSTER_NAME}' created!"
 }

secrets/htwg-1/kustomization.yaml

@@ -9,4 +9,4 @@ resources:
   - ../nowchess/htwg-1-prod/ncs-db-secrets.yaml
   - ../nowchess/htwg-1-prod/ncs-internal-secret.yaml
   - ../nowchess/htwg-1-prod/remotek6-certs.yaml
-  - ../postgres-tunnel/secret.yaml
+  - ../postgres/credentials-htwg-1.yaml