feat(secrets): add initial configuration for FluxCD, including sealed secrets and Helm releases

2026-05-30 13:23:19 +02:00
parent cc038fbb27
commit dcdcaff3b0
31 changed files with 730 additions and 0 deletions
@@ -108,3 +108,4 @@ fabric.properties
 # All secrets are SealedSecrets — safe to commit
 # kustomization.yaml and *.yaml are tracked; raw *.yml files are not
 secrets/**/*.yml
+/scripts/sealed-secrets-key-backup.yaml
@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-ca
+spec:
+  selfSigned: {}
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cert-issuer.yaml
@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: argo-rollouts
+  namespace: kube-system
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: argo-rollouts
+      version: "2.40.10"
+      sourceRef:
+        kind: HelmRepository
+        name: argo
+        namespace: flux-system
+  values:
+    installCRDs: true
+    clusterInstall: true
+    controller:
+      replicas: 1
+    dashboard:
+      enabled: false
@@ -0,0 +1,35 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: cert-manager
+      version: "1.20.2"
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager
+        namespace: flux-system
+  values:
+    crds:
+      enabled: true
+---
+# ClusterIssuer is applied after cert-manager CRDs exist; FluxCD retries on failure
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-issuer
+  namespace: flux-system
+spec:
+  interval: 2m
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./cert-manager/htwg-1
+  prune: true
+  timeout: 2m
@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: gitops
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: ssh://git@git.janis-eccarius.de/NowChess/GitOps.git
+  ref:
+    branch: main
+  secretRef:
+    name: gitops-ssh
@@ -0,0 +1,20 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: ingress-nginx
+      version: "4.15.1"
+      sourceRef:
+        kind: HelmRepository
+        name: ingress-nginx
+        namespace: flux-system
+  values:
+    controller:
+      service:
+        type: LoadBalancer
+        externalTrafficPolicy: Cluster
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gitrepository.yaml
+  - namespaces.yaml
+  - sources.yaml
+  - cert-manager.yaml
+  - ingress-nginx.yaml
+  - sealed-secrets.yaml
+  - metrics-server.yaml
+  - redis.yaml
+  - argo-rollouts.yaml
+  - nowchess.yaml
+  - postgres-tunnel.yaml
+  - secrets.yaml
@@ -0,0 +1,27 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: metrics-server
+  namespace: kube-system
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: metrics-server
+      version: "3.13.0"
+      sourceRef:
+        kind: HelmRepository
+        name: metrics-server
+        namespace: flux-system
+  values:
+    resources:
+      requests:
+        cpu: 50m
+        memory: 64Mi
+      limits:
+        cpu: 100m
+        memory: 128Mi
+    metrics:
+      enabled: true
+    serviceMonitor:
+      enabled: false
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nowchess
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: redis
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres-tunnel
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nowchess
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./nowchess/htwg-1-prod
+  prune: true
+  targetNamespace: nowchess
+  timeout: 5m
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: postgres-tunnel
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./postgres-tunnel/htwg-1
+  prune: true
+  timeout: 3m
@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: redis
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: redis
+      version: "20.x"
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  values:
+    architecture: standalone
+    auth:
+      enabled: false
+    image:
+      registry: docker.io
+      repository: redis
+      tag: "8.6.2-trixie"
+    master:
+      resources:
+        requests:
+          cpu: 50m
+          memory: 64Mi
+        limits:
+          cpu: 200m
+          memory: 128Mi
+      persistence:
+        enabled: false
@@ -0,0 +1,17 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: sealed-secrets
+      version: "2.16.1"
+      sourceRef:
+        kind: HelmRepository
+        name: sealed-secrets
+        namespace: flux-system
+  values:
+    fullnameOverride: sealed-secrets
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./secrets/htwg-1
+  prune: true
+  timeout: 3m
@@ -0,0 +1,53 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://charts.jetstack.io
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ingress-nginx
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://kubernetes.github.io/ingress-nginx
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: sealed-secrets
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://bitnami-labs.github.io/sealed-secrets
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: metrics-server
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://kubernetes-sigs.github.io/metrics-server/
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: bitnami
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://charts.bitnami.com/bitnami
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: argo
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://argoproj.github.io/argo-helm
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# gotk-components.yaml is generated by: flux install --export > gotk-components.yaml
+resources:
+  - gotk-components.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-apps
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: gitops
+    namespace: flux-system
+  path: ./htwg-1/flux-apps
+  prune: true
+  wait: true
+  timeout: 5m
@@ -0,0 +1,62 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nowchess-ingress
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - http:
+        paths:
+          - path: /api/board/game/[A-Za-z0-9]{8}/ws
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: nowchess-ws-active
+                port:
+                  number: 8084
+          - path: /api/user/ws
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: nowchess-ws-active
+                port:
+                  number: 8084
+          - path: /api/account
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-account-active
+                port:
+                  number: 8083
+          - path: /api/challenge
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-account-active
+                port:
+                  number: 8083
+          - path: /api/store
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-store-active
+                port:
+                  number: 8085
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-core-active
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nowchess-frontend-active
+                port:
+                  number: 80
@@ -0,0 +1,53 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: nowchess
+resources:
+  - ../base
+  - ingress.yaml
+patches:
+  - patch: |-
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: nowchess-env-config
+      data:
+        QUARKUS_PROFILE: deployed
+        CORS_ORIGINS: http://141.37.74.142
+        NOWCHESS_COORDINATOR_ENABLED: "false"
+        REDIS_PREFIX: nowchess
+        QUARKUS_LOG_LEVEL: "WARN"
+    target:
+      kind: ConfigMap
+      name: nowchess-env-config
+  - patch: |-
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: nowchess-frontend-env-config
+      data:
+        API_URL: "http://141.37.74.142"
+        WEBSOCKET_URL: "ws://141.37.74.142"
+    target:
+      kind: ConfigMap
+      name: nowchess-frontend-env-config
+images:
+  - name: ghcr.io/now-chess/now-chess-systems/account
+    newTag: 0.18.0
+  - name: ghcr.io/now-chess/now-chess-systems/bot-platform
+    newTag: 0.11.0
+  - name: ghcr.io/now-chess/now-chess-systems/coordinator
+    newTag: 0.32.0
+  - name: ghcr.io/now-chess/now-chess-systems/core
+    newTag: 0.45.0
+  - name: ghcr.io/now-chess/now-chess-systems/frontend
+    newTag: 0.2.4
+  - name: ghcr.io/now-chess/now-chess-systems/io
+    newTag: 0.22.0
+  - name: ghcr.io/now-chess/now-chess-systems/official-bots
+    newTag: 0.13.0
+  - name: ghcr.io/now-chess/now-chess-systems/rule
+    newTag: 0.18.0
+  - name: ghcr.io/now-chess/now-chess-systems/store
+    newTag: 0.22.0
+  - name: ghcr.io/now-chess/now-chess-systems/ws
+    newTag: 0.14.0
@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../eu-central-1
+# Patch SSH_HOST if the postgres server is different for htwg-1:
+# patches:
+#   - patch: |-
+#       apiVersion: v1
+#       kind: ConfigMap
+#       metadata:
+#         name: postgres-tunnel-config
+#         namespace: postgres-tunnel
+#       data:
+#         SSH_HOST: "<htwg-1-postgres-host>"
+#     target:
+#       kind: ConfigMap
+#       name: postgres-tunnel-config
@@ -0,0 +1,164 @@
+#!/usr/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(dirname "$SCRIPT_DIR")"
+
+# ----
+
+generate_flux_manifests() {
+  clear
+  echo "----------------------------------------"
+  echo " ⌛ Generate FluxCD manifests"
+  echo " ⌛ Install FluxCD controllers"
+  echo " ⌛ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  GOTK="$REPO_ROOT/htwg-1/flux-system/gotk-components.yaml"
+  if [[ -f "$GOTK" ]]; then
+    echo "✅ gotk-components.yaml already exists, skipping generation."
+  else
+    echo "🚀 Generating FluxCD controller manifests..."
+    flux install --export > "$GOTK"
+    echo "✅ Generated $GOTK"
+    echo "⚠️  Commit this file to the repository before continuing."
+    read -rp "Press Enter after committing gotk-components.yaml..."
+  fi
+}
+
+# ----
+
+install_flux() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ⌛ Install FluxCD controllers"
+  echo " ⌛ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🚀 Installing FluxCD controllers..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/flux-system/gotk-components.yaml"
+  echo "⏳ Waiting for FluxCD controllers to be ready..."
+  kubectl -n flux-system rollout status deployment/source-controller --timeout=120s
+  kubectl -n flux-system rollout status deployment/kustomize-controller --timeout=120s
+  kubectl -n flux-system rollout status deployment/helm-controller --timeout=120s
+  echo "✅ FluxCD controllers ready!"
+}
+
+# ----
+
+setup_sealed_secrets() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ✅ Install FluxCD controllers"
+  echo " ⌛ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🔑 Restoring sealed-secrets key..."
+  read -rp "Path to sealed-secrets key backup (leave blank to skip — new key will be generated): " KEY_FILE
+  if [[ -n "$KEY_FILE" ]]; then
+    "$SCRIPT_DIR/sealed-secrets-key.sh" import "$KEY_FILE"
+    echo "✅ Sealed-secrets key imported."
+  else
+    echo "⚠️  Skipped. New sealed-secrets key will be generated after controller deploys."
+    echo "⚠️  All secrets in secrets/nowchess/htwg-1-prod/ and secrets/flux/ must be re-sealed with the new key."
+  fi
+
+  # Install sealed-secrets now (before FluxCD bootstraps) so we can decrypt the gitops-ssh secret
+  echo "🚀 Installing sealed-secrets controller..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/sealed-secrets.yaml"
+  echo "⏳ Waiting for sealed-secrets controller to be ready (this may take a few minutes)..."
+  kubectl -n kube-system wait helmrelease/sealed-secrets \
+    --for=condition=ready --timeout=300s 2>/dev/null || \
+  kubectl -n kube-system rollout status deployment/sealed-secrets --timeout=300s
+  echo "✅ Sealed-secrets controller ready!"
+}
+
+# ----
+
+apply_git_source_secret() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ✅ Install FluxCD controllers"
+  echo " ✅ Setup Sealed Secrets"
+  echo " ⌛ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🔑 Applying gitops-ssh SealedSecret..."
+  GIT_SECRET="$REPO_ROOT/secrets/flux/gitops-ssh-htwg-1.yaml"
+
+  if grep -q "REPLACE_WITH_SEALED_VALUE" "$GIT_SECRET"; then
+    echo "❌ $GIT_SECRET is a placeholder — seal it first:"
+    echo ""
+    echo "  ssh-keygen -t ed25519 -f gitops-deploy-key -N \"\" -C \"flux-htwg-1\""
+    echo "  kubectl -n flux-system create secret generic gitops-ssh \\"
+    echo "    --from-file=identity=./gitops-deploy-key \\"
+    echo "    --from-literal=known_hosts=\"\$(ssh-keyscan -H git.janis-eccarius.de 2>/dev/null)\" \\"
+    echo "    --dry-run=client -o yaml \\"
+    echo "    | kubeseal --controller-namespace kube-system -o yaml > $GIT_SECRET"
+    echo ""
+    echo "  Then add gitops-deploy-key.pub as a deploy key in Gitea:"
+    echo "  https://git.janis-eccarius.de/NowChess/GitOps/settings/keys"
+    exit 1
+  fi
+
+  kubectl apply -f "$GIT_SECRET"
+  echo "✅ gitops-ssh secret applied and will be decrypted by sealed-secrets."
+}
+
+# ----
+
+bootstrap_flux() {
+  clear
+  echo "----------------------------------------"
+  echo " ✅ Generate FluxCD manifests"
+  echo " ✅ Install FluxCD controllers"
+  echo " ✅ Setup Sealed Secrets"
+  echo " ✅ Apply Git source secret"
+  echo " ⌛ Bootstrap FluxCD"
+  echo "----------------------------------------"
+
+  echo "🚀 Applying GitRepository source..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/flux-apps/gitrepository.yaml"
+
+  echo "⏳ Waiting for GitRepository to be ready..."
+  kubectl -n flux-system wait gitrepository/gitops --for=condition=ready --timeout=120s
+
+  echo "🚀 Applying root Kustomization..."
+  kubectl apply -f "$REPO_ROOT/htwg-1/root-ks.yaml"
+
+  echo "✅ FluxCD bootstrap complete!"
+  echo ""
+  echo "FluxCD will now reconcile all components. Monitor with:"
+  echo "  flux get kustomizations -A"
+  echo "  flux get helmreleases -A"
+}
+
+# ----
+
+generate_flux_manifests
+install_flux
+setup_sealed_secrets
+apply_git_source_secret
+bootstrap_flux
+
+clear
+echo "----------------------------------------"
+echo " 🎉 htwg-1 cluster bootstrap complete!"
+echo " 🎉 Cluster IP: 141.37.74.142"
+echo " 🎉 NowChess: http://141.37.74.142"
+echo "----------------------------------------"
+echo ""
+echo "Next steps:"
+echo "  1. Seal secrets in secrets/nowchess/htwg-1-prod/ (if not done)"
+echo "  2. Monitor reconciliation: flux get all -A"
+echo "  3. Check NowChess pods: kubectl -n nowchess get pods"
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: gitops-ssh
+  namespace: flux-system
+spec:
+  encryptedData:
+    identity: AgAOzHL/nvgowOSUS8s8OooQSxNrFEBHDZYca7VzfOJLlF+nehigNUS4GSqofRQBJObgPL51TfSyTVYN+Sg5Ddvq8+JKtySkjNil4MpgiT1LPpiL/PylKF3AZKqhpmvwzDxh0TiJFHijljW/YqbnuTo4y3TFs/PKFErrE5WCO/WufG5fEO6izEFnC4YsmD2DVrMewqn9UEokdxsj7IyMtY3hHMBnGoaLsMHeH6HpwWZ/75Di/Cf7Uwl1sEYesMfz21QOR33uGpmQmguIrwrL5A/FQCzMtldZD3fhbad1biqs/uXqn3im5p8o+CCj42dvHnp2wSB3TC78iwdvGGArwVRxh8+GuNAy448JBzh/HveUsrCnzyLKgBwCON8k2w83ZNr0JjoNCmL8MiA/WhVPmF+rj5b7BoBfQ+UZgb1w/Yfn8vD0j8O4D1GINVs8Us2SYsjJ75maBOyU8nOEHzl9ytEUFzCA5yCPslp6Btr41njIVV2G7obTE9hqReea1oIl0K9XxRm9etEIhfnNbPynXTMaHlIvkf1ufRpNH4F/lNVGuwHPLD+y4LXoydu7tr/glL+vKBN+diDKR7R8ilnLbkCNYJ1GELZfGyjeMG5mc/bwXod2BbKNjMVxxZIdw/CtVBTnJE+vGagofNsn/VlbS4iVbwAdAfSazYdTK/HxgmypjxoRGxPNoIdPrFLRL25/M8CcY1o0SUZg6eUtET1dbcw2Vd0lxm29TvKD8RKVsPahque7EVw1aVh5fUYBthbAZ7gzlWpbq/nEXPBQwQSL+yt/4C3hIzbZOV1WRtYpPJK3BrWILfPF1HBrdvSiDwm4H75mms8qon2qbmmeJo6LYQIgG949quUXSeA2Cz4licAQxA3jjDwefW+hsfb7zy9pS6yZscxkpRNb+HjGuIcjZzqT06oRQhslBNqX5CmXqf5ZLg9gfG1Dgq695HjDG+gdFuSdGiY6H/sqbLp9BVwBGMLnwa+iMu+L86R9Y1nI8Hel/nwB/KoeQBzXdVWE4Hf1am4J0soyPgHDClNYwMQO60rxXcD+HurrgZnUOFq281ba6DEHIzY6ymg5soWWlYJ6veck7FS1jaj8Ihbg8ydlMzjUBnBWk4ZKs1nI7vdfvbgTgpA9lxTIrdQRIXxx+o3uUawL6DaTOubTZhyExtn3zhidfHn+cshGSipvA+OZctJ0J9aoBQdWLkhqecUdCJFiwwLmjVbIk5yBEaLQuQB//cw=
+    known_hosts: AgB+ku9oRGCXi2OCTd8gY0QZ5P36YKb7cKL7sItNEvT2hKrD8DtF3eQK2vx4TXRsj8iuBnCTRu0m5ID+Rbi7I+mDQq2CZodpnIyu1iKIwx04xQROFPiKXQ6EFaEl94by6r5jn9cyCrkgG7HifNDD3Z1jXNPgWn94msNH++lA4oXhqzhCzN3sgWrcvEFDv7CizRZ4A2ARaL5pY6tDw7JnqejSsz+dwg6Ar9WlLPtJYAE5ZMtOE5M4tCUZ326z2waisjed86VbnORAX2uu1ARpnxg+jhtNni3Ixk4xZokzknvJfV9Kyq9wc94c2WzVs1MQjhl6IPoyALpii2VdvPqmIsmpLefmLPT1/8/NyHGzgwf6E8BUINr/TN9y2WjIu7/Y4NXlqPV0GI8bES3Y4U1h4yV3Sp6KifFPCUavx7a/D64j0CDC/ZlQglke+qVo6nFTEzgnBDLkaqPnN2Inl1KvhwdAvVCT5eUC12tdbfZ2A9uQIhT0k/A7cn30zcIA+LGT5JtKu9B69aElhDtrrpRksyJsclSzC2YTOSzHlavnaoOPqHM0ywSN5w3l9XIPiHyjKQNzWjzaWVkOq3MQbrPU3yM2zq20KqzIv1eBYstVie/u8yi6CDgumWPEYVzg0gAXlN+RZtoLBhbwrn1Bvlz8bsSYfggmjlFj4RUGkkRGliMbZsLkNGq4zca/437bqSB84oAt6l8lm4RezAg3ZOl9l8pAfmPxKTzy5r6YjQKdQ8lo8DKcjad49M/92fg5xbSfw7MqXclu+L5vPp1DrObueAG8j32xeOBn798ebWTccGag7/h8mwyLmQ6wWQ2SIyozNLWKFGUybZj6tb6vYQ9qW/c+KMXcexvkSMcEGYs+Dtk5KMOkBk/EkWLvbHrg+w2krL5V81WAyjJ7bYPKtArdagpd9c1pvQ6tXqWmqpPwWlDqpj5YmO8xH5LVtXoYPKuvk5qFrZJq1PpTU6zSozGWjOtiA+tNunZZQNOqqe1Q6SM5ZW/7YLTJpP2O5a0dih0X8kjFBbAVLdGQ5aDjnUGLUzWGb4imsNM+vknD9cPUfXv/3x/MY/xb8ghoGby2W5a6dZJO1GHquIfNkTjgDVqdbJvRM4dJC1MsIrnUyeviId4FkIecSSZ7iq+fcKMHKGU6Ljrtz4kz599paL10S/a3Tk3UR/bhCDncr9koChudbKQWdUMwwletTSCCIw/F0qC+wsLS3ul55xYFU3nsKXIm5suF211lutPseOnDne+iizW56uePDpUOJjMlGDFVza/rBaKKtMftTseUM7bxOw/NDcmO3rRqbgPom5UPUifCTWPwKhAVDl7xVlSAK+ARdxOvWs8kOd3DEUzqp4FFl37e54QiihiowG/BYOYiJyFmKmbiMsMLUwH18wM90Xptow9XnZLxYt1Yo4DvOMrFN8qi+hTn/Ddmk8WvK70QSBz0dW04Q1ZleeheN1MKjcL6F3/4+bj80JkRotM6aGgpG9XsYiY0/p0MG6gVLWb2xKYD+3gb8d0y/HLi462XldO8nwlD18KiB24ECV6yw1p2uFrewYsa6qbtMP/yPZbd6mqtj1hrvp5ZtIGLQ+x89n9O4wWyF+4Bk3GEH8VqxVMQKISdrqpL4UJ7rvi9gcRjSHtMsF2H9VlXaPJAZ/02peJEZwGG4zH7+8g5/Zf/nz+i6o89hIvp6rYCCh7HtSPG3fEX7Y19x3C9OtG8harNF9BzDpcLDMnPsiQr9W7aaAc9EK1hR8nwpZf4n6B2B692rzXz9ovHivW/VtaTdRq8AEr898iJ7D9gu587kiyjI9RZwT6qqL+z5JV/pm5UZQV2R5VYbkNjZ5WdliJuWYo+TkE4YSpp7Ut+FJL7+GybhFVJvVTpF5F0VU1FxZJaZ3+9Isw5nk0U9uwIzz1ODePH3wZ8cjuNAkz+1zT8nCGU25oXDLv2GMKSv6cjuZfNvt6Or8bq5FxNm9g5Gdhy29R8VUPWN1kzKLElZE7Ydzsu5ImGFdQ2Fmso6xD42EVw9yL1q2E0kLopyK0ls1aqcdYZ12+o0kvtEn7uGYI/FmbJ5LM2LBpAuoXCRghgv8zGZ+WpDQYssJLija2NSopqV58o+fMmSehqUmccLS1Ng/ZMVnmHa3we2vHV2gDsszKPgTIqBRTBjQNrkpGfQ1bbeN/q+apkYUX0JZ+7tD6c8dcvYI2Qr0v6PQxGhhf+X5VwXm20t6hvlmKCiE2LGADXZNwW71rnQh9y
+  template:
+    metadata:
+      name: gitops-ssh
+      namespace: flux-system
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Seal each secret with the htwg-1 cluster key before uncommenting:
+#   kubectl -n nowchess create secret generic <name> ... --dry-run=client -o yaml \
+#     | kubeseal --controller-namespace kube-system -o yaml > secrets/nowchess/htwg-1-prod/<name>.yaml
+resources:
+  - ../nowchess/htwg-1-prod/ghcr-pull-secret.yaml
+  - ../nowchess/htwg-1-prod/ncs-jwt-keys.yaml
+  - ../nowchess/htwg-1-prod/ncs-db-secrets.yaml
+  - ../nowchess/htwg-1-prod/ncs-internal-secret.yaml
+  - ../nowchess/htwg-1-prod/remotek6-certs.yaml
+  - ../postgres-tunnel/secret.yaml
@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret docker-registry ghcr-pull-secret \
+#     --docker-server=ghcr.io --docker-username=<user> --docker-password=<token> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    .dockerconfigjson: REPLACE_WITH_SEALED_VALUE
+  template:
+    type: kubernetes.io/dockerconfigjson
+    metadata:
+      name: ghcr-pull-secret
+      namespace: nowchess
@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-db-secrets \
+#     --from-literal=ACCOUNT_DB_URL=... --from-literal=ACCOUNT_DB_PASSWORD=... \
+#     (add all other DB keys) \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-db-secrets
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-db-secrets
+      namespace: nowchess
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-internal-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-internal-secret
+      namespace: nowchess
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-jwt-keys
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-jwt-keys
+      namespace: nowchess
@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: remotek6-certs
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: remotek6-certs
+      namespace: nowchess