Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
2026-09-09 16:47:20 +00:00
commit 88a02ababa
418 changed files with 50579 additions and 0 deletions
@@ -0,0 +1,43 @@
+# The one store every namespace reads from.
+#
+# Cluster-scoped on purpose: authelia, gitea and cloudflared all consume it, and a
+# per-namespace SecretStore would mean duplicating the OpenBao connection details
+# three times.
+#
+# AUTH: no credential is stored anywhere. ESO presents its own ServiceAccount JWT,
+# OpenBao validates it against the cluster's TokenReview API, and hands back a
+# short-lived token scoped by the `external-secrets` role. The reviewer JWT that
+# makes that possible lives on the bao host, configured by
+# ../../infrastructure/openbao/ansible/roles/openbao_bootstrap/tasks/auth_kubernetes.yml — it is key
+# material, which is why Ansible owns it and Terraform does not.
+#
+# TLS: bao presents a Let's Encrypt cert for bao.ad.ddupan.top, so no caBundle or
+# caProvider is needed — verified from inside a pod (HTTP 200, ssl_verify_result 0).
+# ⚠ Address it by HOSTNAME, never 192.168.10.8: the cert carries a DNS SAN only,
+# so connecting by IP fails verification. Same trap as dc1's LDAPS cert.
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao
+spec:
+  provider:
+    vault:
+      # OpenBao is Vault-API compatible; ESO's vault provider drives it unchanged.
+      server: 'https://bao.ad.ddupan.top:8200'
+      # Mount path of the KV engine, from ../../infrastructure/openbao/terraform/mounts.tf.
+      path: 'kv'
+      version: 'v2'
+      auth:
+        kubernetes:
+          mountPath: 'kubernetes'
+          role: 'external-secrets'
+          serviceAccountRef:
+            name: 'external-secrets'
+            # namespace is MANDATORY on a ClusterSecretStore (it has no namespace
+            # of its own to resolve the reference against).
+            namespace: 'external-secrets'
+            # NOTE: Vault 1.21+ requires an `audiences: ['vault']` entry here, and
+            # the bao role must declare a matching audience. OpenBao 2.6.1 does not,
+            # so it is omitted — if auth ever starts failing with an audience
+            # mismatch after an upgrade, this is the first thing to add.