The WAN is on DHCP with no DDNS anywhere, so a lease change would break
public DNS silently -- certs, Plex and Gitea SSH all resolve through
aleshym.co. cert-manager's Cloudflare token only ever writes the
_acme-challenge TXT records and never touches the A record.
Reuses that same token, resealed for this namespace: its Zone:DNS:Edit
scope already covers A records (verified against the live API).
The updater only PATCHes when the record is actually stale, and PATCHes
content alone so the proxied flag and TTL stay as configured. It exits
non-zero on any failure so a broken run surfaces as a Failed job rather
than dying quietly -- silent failure is the thing this exists to prevent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pins a single sealing key (--key-renew-period=0). Upstream rotates every 30d and
kubeseal seals with the newest key, which would silently invalidate the off-cluster
key backup for secrets sealed after a rotation. Includes DR runbook.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Converts cloudflare-api-token, argocd repo creds, nightscout, and the three
solitaire secrets to SealedSecrets (adopted in place; values verified unchanged
by before/after data hash). Controller-generated secrets (cert-manager webhook CA,
LE account key, argocd internals) intentionally left alone.
Verified post-seal: argocd repository label and dockerconfigjson type preserved,
letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Secrets are now committed encrypted (sealed-secrets v0.38.4) instead of
hand-applied out-of-band, closing the config-DR gap the backups intentionally
don't cover. Existing Secret adopted via the managed annotation (values verified
unchanged). Controller private key backed up GPG-encrypted off-cluster.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
funman300