chore: initial commit 🚀

2026-09-16 22:21:59 +03:00
parent e502e0ff76
commit 3d5f56f099
91 changed files with 2055 additions and 0 deletions
@@ -481,6 +481,7 @@ url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-aar
 url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322597"

 [tools.taplo."platforms.linux-x64"]
+checksum = "blake3:4871fab0e60275a1eb46e7190726e144f56c9a9527f59b0d1da5a042baead8e2"
 url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz"
 url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600"

@@ -0,0 +1,12 @@
+---
+creation_rules:
+  - path_regex: talos/.*\.sops\.ya?ml
+    mac_only_encrypted: true
+    age: "age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6"
+  - path_regex: (bootstrap|kubernetes)/.*\.sops\.ya?ml
+    encrypted_regex: "^(data|stringData)$"
+    mac_only_encrypted: true
+    age: "age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6"
+stores:
+  yaml:
+    indent: 2
@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: deploy-key
+  namespace: flux-system
+stringData:
+  identity: ENC[AES256_GCM,data:8w3RUSbeP0Pnu0YrQXcAkoe49MsEk2kWyHAJ03j9n5MCFAP7BvHeFmAzrqit5dWO3GTdl8lTpkVfANhq4yXn/zVa8XMUf1k/8fBJSyN41ZvyQ/Kop0pnJpb9VJsUMHuA8fDhqDRp/cNtc10iLEoTa3I13mMsAnImibTWGX8OCskHCvSLvhkEmakt1A28DT9NpEYSrf0OfKqbRio29azjsxdfDKRyRUwhRUoYNgic4FGIKYDGKyoMmRGIfLTCV3kntD9Sy/Jc7DV+hpYFVvvsfYuMkcCDFSOfltAnCi93VjBYniY5NqRN00aAgYZmAHeORdIH251Ck6S+krfxQ3lQVnd38Esy/7nzKtLYXY6z5xB/pVTWzQNOz2rYwpkfZLxQzRhIo8SOUpBNCleA6VnA1q30IVogKZU1czDT2tbSL16c35409XjsqfUGPn5h7vGdYCJSqClftqp5RTzd2tdjfoYybLDhQo6PvOPY8ADHBTpfa3kGMOXxiSRcgdQiQIXQtPoRBvxKnJskeEqdfmKd,iv:+BRQJbSoHOt6Wysjv2nW2Me38uAdG66nu0Ov+xTSSTg=,tag:EN4U8gAdqXg0GzrEPUITYA==,type:str]
+  known_hosts: ENC[AES256_GCM,data:PA8ph6GG2A5NwwUwckxfKYyv58mme0CsYmv1i7jgGzIVDqBxmrN8SdDTm4I2xasBmmGzpjir63W9NpLVpmQ6qjzmor/KwP9CpYQO/cDKvHyzkIX4dSeb5orWmDvUuYLmzwV/R2v/HA5BB4IVSVwguwKt8Z36G8y669LK6mfkbxoVwCH0Z6iTUjPC2TDslfRyQNOAucRfPeagZS7sHAuqT+AP4WYW1EHeHvrvx0xAxabX4kAoRx+h5mcx43Rzpcf+TE3vFaBS1Ttr/zUFmVX5xq1wl9v4u4qYge2zpDTohnvtvAg8dQ/aVI+2AglQqUtGmMFG2T/4cZIFdneAFg83R6MG/6qvUA1zBihqVRytYBjdAIhwe4Z+3Ob7KTJ+k8FfFOHdjCvgp4Lv8tgWBBX0VN4r5HfgBCnhX/vfX2ojbfq//5vpHquBe95M9fbA1ab7C7Ixs8hC8kKNYwGkhaO7cVLrMKvlQOltxmocsEUA5+MTTDAJ+GO4lTwPiGyEPJXDcupyAbNSOduICdeDGNpdlGv+lToFOCizHeY25scVOH1lhxD8NgMagQWmIQ9QeqWPwvdXLDL5hpf9QBI/wiwIr0hFdqnbHc/oFTEzg9vZE30TE6zH1WoHWbTe225LrPqOrrPbSLAp6rrmmckzmMn7kp/RIyPpupZZWEzmkiyK2oxuMs1NZ0UU4fh1kIj/P9Da4oFaclcKpEkYidjFd7sdBk6Y/F3x6mlt1nwNt44vRbvbS3EHdCw1B1qrIqwwSir0wsn+UvWjMDqUzRHVTR8DIKcg6MxANuRmtpqny51UPpTSkHVJfkKoVptHJHnpqcsJQoqTrXzFvtTGJT0gwMnvJRx9lYFO0snkbVCoEn2FygsmcgEBj7yNJIcdDZfFOYrn7Zhkutk9SU9N2ic79ndVRfefk65sjk+oRPv0JZnuldg2xFF8WXN0kQhgnINdgfCSNvBXei+kekqRvKBiqXpe53ckTrbmotX4boqQawDaoXGgJUDMx6mzg2U0r8RSFSaDHT9q+XcWlNVrS6G2Fl//GtNsbLDrjF3Dj60DoyDa1MZsa9XcqiSqsngJ/WMkQRajN4BMr03vW15P4CCU58EAxS9PuQs4jKEvhDt2z2aZ2t6i1aREm+rBIr4KebQNZMc8929E7xh5kH4uKGlacHeL2P3GNqSDRzHpHTzRDkrXqvgnQi2yiM0Bnb3EEfyjaYSKPsLJq3fnv4LWoq1yVBaAEEGhm/X8diHq+maV6X0HGtJ2J8X9Jx7z/78ktA9qZKexhRmaea1WVL1g7xpAigZSogK696suMDJFR/FmrdfFthQYPj4X1jA9njQrb8ZHey/h0Xy1W1IEccWsKm1u7LUtPkkkfe0F1tAQDcTnHjPH9GVeygZXXGR6LJyLl5IPV3ft6ymZqjN2uZyLi6EGsiWFs+AJrU0WNwhDfvQnVTaP+wU068QHZq94I0NvY17TjgI5A1Q7PZcYevqc8gWqXT5NE5GKxeToS8uv1WuPN+vYCUU4H6emy9M7/MtVlJxBAkQ/9ZMAwzmgyddgDq88Cyn2laU1jVvYweHIvavjmimJ5belykgXqF5YS5E3FJy5gZHJECYk8IcTp/8Ununjjkj3wBcyga3clSoKrYvkNnbok8d6rII0Uel3StBBxp721CrjUFgi/XTpffk55MBQTTW8kn8cxOWODx5nRkBexrvFL8LWI8M4NBBudfEF6Ban1XbPPOIQem3gN8+/i1PyCrzAl/ai5UJsGYRC8ij3JdJc2gRh7MzLKiwdCpRAY6XbAscKu2tErBTH0VHImx75zsjLwqQ23dlfPcd7DF1qLUdqGdoevopBLLfipau9CNrI4+uMWhYuood+0CHWhGlWTetnAalRDSgL93f5Q0hqptqIBCUdnxj+A1GHVG1kJPrtxr4YFmDzGdq7UOmDG6ZsLBvg+Ip6aUS+7HAam2SFsWYCE7RthZtuNJTvdYOYlueZX32UuK5uHSKhAiaeUgwomRwUHDfuqh+yEmL4dvGWmcr04eOlG0QaRzOh2TMZwwGZe+PIUEde5BSpN/uGuYXwlU9bgpTwnvgtX4A8JuD98eFznU/d71u9Kf5qLMf4YkH76ViqzDqj+joVGUbeci28/yf+MNqkTWUuUu2cGw81vieHbtwU90S+9JHz2Dki9/jD+wBwdHF7prR40YkDe41HB0L0b01G3XZ3xnOH8c8Kg+2HvInaAgwAPxumzYyZqI6eoxIYr3bhYwP2DgW1IDE0u07C9LGFNy/un7lWDXBlV5EgpfdosP7rLWBSi4KbVNJgvC47aZUyz+NdiUpzHM6AISipKMnm2sv9XScExMcQVRXd8+upcHLEfbTABvWyPa6KsFCFJrv6bb3epQpp6BU+7c4/QQLcaMTNrXytHlwMJ5A8LqowXhsj+v7IlfrCjk8lI12LWu7mPzrSOkwpmwXo6Eu/pmheVyhe5SQpAW1Y4Im+l+Eg5LEQxKxUaDjhKnhPLdNCHRuA3M3fY65Mrlj76VfO2RU+SGusiLFGWeQvB8D5VB1JTeZxmIi9QVa1W0x8VqMHfCMgf7H1uxJaBDgW+vOpsOHViFe6DE54zyhEOQqU5FA2waJvKsJomltaBqZjsLUnKEpclDEwBHvXU1CWQdAIQhA3Vg75g55V0XNyOQfaV5YdWhH38bZR5P5gZpOa9HYaxex2r1lDpE3aFDeeqPdl4F059uwdV6F2xGO1rYz3Z4drcPJEjBjUBYhz0wUQSDWPnUhqkJK/8IWCns1xXBGfENBdcUah6ZSXWwhNrBfV/lai2tTL8ra6RBmwhMDNRvYFsFp6bl2lJQmqQlXrMm968husrVLZ7QrockoXAPK0Jeralw==,iv:EaIrKf6XalfWt6LLhGWetmVuV0zDQaLvFdia0Wm4AG4=,tag:0riZDzFfQZBQoWPQhfIHJQ==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IGwrN1ZFQVow
+        YXZMcnlaRUY5azk3RG1rRFpmTHhicjlKWG9RMGRRd216aHU5d0NLSy9MUnNLdDZk
+        M0dkUHJnc3lYb0xHbTZIL1RKRE1zYkI4Y0JxVnBGdUlmdkJnR0gxWlVXWTV3Uitj
+        dkREbW95bi9mNEpyY0RRRjN0N0o0bGgxVnNKaU9Ca3VYV1lVUytjZTRLc0c4RWg1
+        T1hNdmtZa0xaN3JqaE1KRHZYRkNEYWdIdHdYYWp4Z3JGeFZNMVRzQUtHZXE2NTYv
+        WjhaQzdpY0FndGpVQmlUN2haQ3dJOGlnRjZWc1gxQThKUGNkMjk0UmMrTElZbTY0
+        akZ6V0FETm1WdWFmSW9EYmNyZG5qZTZqRnhxMjh4ZjY0YjZzeHRPZGhPQ2RneGlZ
+        SDRVblR2R2tjemM2UGl0SW4xWmt1bm9nOURiSHFRZXRxMjdDK0JqT29pNm5vMzNi
+        VFZKMGJ3WStIWHVuazR3aG4vaU14dFZWZzB1cG1oQXRYZysrS1dQWTRid1pRdjRJ
+        SWpBaVFLL3VkZ0dzcVo0TFJJMkpvM3VUaUZZU3RFcXVteDk4eGF4UysxUmZHU3dr
+        TEhlRUxYNi9WWmtDdnI5QytIcDZiZk4vTVY0djA3T2lhUXpJSnFtY0FQMFQ4cjZV
+        ajZjM1dsT1FISjBhSjlaSW5SN09GQU9IUUpWTVJKbmtsUXdwNUwvM3luNmRDcW9m
+        dUdvSS9jcmoyWE13dGlYVXhiTmhpSm82Y1hJVFVaL0lRVTcyYzNKMWR3ZGZscWls
+        OWJxNitkN2Iza1dXVUdaSVZXaWxFRDY3a1ZsV0VCUFJieVRvODN2V29WeGwxUWpK
+        cERWNDhLODdBYU5pTFNidGQwSmpEcTNyczdzWEJhdngvZUlFdFRBeWFUVzNKMzEr
+        QlpxVDNjcmUwaUFMbFlhTEpUQ05HVnBJc1ExNXNCbmxvNW1zdHJ6dGNXSWdoaDlI
+        TDhabUZlMndPZ3RlWUpXSENLbG5tMmFKekhtUkNKeUtUTnVkeFR2SjRsSzRDMlhi
+        Q1IyNzRZTU9zNXdBQjQwcEcrTE5hbGVuZHF2elFrRWo5ZGpicXF5eDc3RHN1Vjdt
+        Y3I0UHFOSnRDNXZ5ZVpSZXJqeTlaWHdVbjVBaXAzaXVBckN4OUp1MldsSWViNEk1
+        Z3dIOVRhRW1zb1BTNGo1czYxdThXYjlYTkdqOE43cmdXSWFGeTMxbi9hOWpTOEo4
+        N0FIb3hCd3laV2t5RVpGQ3FqRUF0Mk0wUlZIcEVQcGN1YSsvUGdLdkQvQXVTV09h
+        TEhyZHNzRjJkU3RqZTJGR1h6RkM5dmVuL2pPOGxGRzhDc2h3bXhLd2wrS0NEZXNm
+        NU1NeTZuQmYrUFpJQ3ZIZmxVMG52NHY2bHJhNnQvTklHQXFRaGt6S1g3TGpiajU0
+        ZUxiTGhMc1Q2dUlmVkFYZTNzU0xRV3JnQ2grOFhLeDFiaXZ6UUlubzRsNk8zNXl6
+        RjQwa295aUxLR0JyRDRTR3BiY3BNdDZ3eHZYRTNscnFRaXpkSW4zajRXSmlUaXBL
+        SW5FdnFKc3J1K0hDYmxTMnJGN3V6UVl3NGhGMmNidldDSUMxZThsL2QwNmFpd1VK
+        Q3pFRlpOKytrYlZFRThZRHBrZHVBT3Q0bkZuYmQ4S1lXU3JENUZTeDZiZ2l5UmlE
+        VlpMTW14OVlDT1VWWU1rbHoxSGw5ZTZaR0xFM2dkS3JubnRPMys1N3hiem9menpp
+        eU1CaUxhWTVjYU0xVXZRdXBFN3NrTklQSFJzcXZwRmV4Qm5ORWNPTldoZ1FhUFZr
+        MXZJVG8xeWVhRzBtdXRRREU2WktUM1lsNmJKT2tEblZKZVBLb2prVXJiZHBhamtN
+        VTZ1ck9hS1c3Zkx1ajQyYTVsOGt4dGIzekk0bkhabTBjcy94dWQ3ZERpTTkyTWZ6
+        SlZuUUlLVEh0c2NtNWpYZEZzMGZSaUVZdDlJSHkwYllmaHFkQ2NjOXJTV1RCUQpI
+        SmVxc3pZYjFheTBOdnhsZHFHNTlsenZjTnowZUFFQklVQ2FUN1p3WStJCi0tLSBE
+        N0cvem1zY051dG05WldSeXNpTExWQnFVMXpUd0s0ZGRFRjNYSGJacVlVCqVCVxE2
+        Id8s8etDCJ0J+jVJfjjCaBNyqXq6dzej+cak3+0x6wbQomqbF9+J2X9RiF/RlBw/
+        WTLJ3rqEHh07Tf8=
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
+  encrypted_regex: ^(data|stringData)$
+  lastmodified: "2026-09-16T19:18:39Z"
+  mac: ENC[AES256_GCM,data:1vITCxz9DIk/0wV+cfjqJa2SQjBsxIGXEBGiR7dP/9oXQaklSqJHAX876HvVJh+YxAUDRAIMZCP7p8e3y03IYIOuarNOqlwtS5YytB6MImC4gGomF4yfBHIDw3fT9fbMk1zvI8gyFn9tbO72K4mHLpTgsU8En21okdjuiaBAQ/Q=,iv:uQdxqkLtiwQfvfsSFFXK3scz9D1lVeTT4/qw3wpvP44=,tag:wOM+lUJI+epdIypMneVgNw==,type:str]
+  mac_only_encrypted: true
+  version: 3.13.3
@@ -0,0 +1,54 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/helmfile
+
+# Bootstraps core applications that provide a minimal runtime base for the
+# cluster. These releases are installed first so the cluster has the resources
+# Flux needs before its own reconciliation begins.
+#
+# After this bootstrap phase, Flux is ready to take over management of the
+# application stack and continue reconciling downstream state.
+
+helmDefaults:
+  cleanupOnFail: true
+  forceConflicts: true
+  wait: true
+  waitForJobs: true
+
+bases:
+  - default.yaml
+
+releases:
+  - name: cilium
+    namespace: kube-system
+    inherit:
+      - template: default
+
+  - name: coredns
+    namespace: kube-system
+    inherit:
+      - template: default
+    needs: ["kube-system/cilium"]
+
+  - name: spegel
+    namespace: kube-system
+    inherit:
+      - template: default
+    needs: ["kube-system/coredns"]
+
+  - name: cert-manager
+    namespace: cert-manager
+    inherit:
+      - template: default
+    needs: ["kube-system/spegel"]
+
+  - name: flux-operator
+    namespace: flux-system
+    inherit:
+      - template: default
+    needs: ["cert-manager/cert-manager"]
+
+  - name: flux-instance
+    namespace: flux-system
+    inherit:
+      - template: default
+    needs: ["flux-system/flux-operator"]
@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/helmfile
+
+# Bootstraps cluster-wide Custom Resource Definitions (CRDs) by extracting them
+# from upstream Helm charts and applying them directly with kubectl. The releases
+# below are never reconciled with helmfile apply or helmfile sync — only their
+# CRDs are rendered (via --include-crds) and piped to the cluster.
+#
+# Installing CRDs out-of-band ensures they exist before Flux begins reconciling
+# workloads that reference them, avoiding the need for dependsOn chains on nearly
+# every Kustomization that consumes a CRD-backed resource.
+
+helmDefaults:
+  args:
+    - --include-crds
+    - --no-hooks
+
+bases:
+  - default.yaml
+
+releases:
+  - name: envoy-gateway
+    namespace: network
+    inherit:
+      - template: default
+
+  - name: prometheus-operator-crds
+    namespace: observability
+    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
+    version: 29.0.0
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/helmfile
+templates:
+  default:
+    chart: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).chart }}'
+    version: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).version }}'
+    values:
+      - ./templates/values.yaml.gotmpl
@@ -0,0 +1,3 @@
+{{- $oci := fromYaml (readFile (printf "../../kubernetes/apps/%s/%s/app/ocirepository.yaml" .Release.Namespace .Release.Name)) -}}
+chart: {{ $oci.spec.url }}
+version: {{ $oci.spec.ref.tag }}
@@ -0,0 +1 @@
+{{ (fromYaml (readFile (printf "../../../kubernetes/apps/%s/%s/app/helmrelease.yaml" .Release.Namespace .Release.Name))).spec.values | toYaml }}
@@ -0,0 +1,105 @@
+set no-exit-message
+set quiet
+set shell := ['bash', '-euo', 'pipefail', '-c']
+set script-interpreter := ['bash', '-euo', 'pipefail']
+set default-list
+set default-script
+
+kubernetes_dir := justfile_dir() + '/kubernetes'
+
+[doc('Bootstrap the Talos cluster')]
+[group('bootstrap')]
+talos: talos-secret talos-apply talos-talosconfig talos-kubeconfig
+
+[doc('Bootstrap apps into the Talos cluster')]
+[group('bootstrap')]
+apps: apps-ready apps-namespaces apps-secrets apps-crds apps-helm
+    just log info "Cluster is bootstrapped — Flux will start syncing the Git repository"
+
+# No sops call or existence guard is needed: the bundle is stored already
+# encrypted with the repo's age recipient, and existing bundles are left
+# untouched.
+[private]
+[working-directory('../talos')]
+talos-secret:
+    just log info "Generating secrets" stage "{{ recipe_name() }}"
+    topf secrets --confirm=false > /dev/null
+
+[private]
+[working-directory('../talos')]
+talos-apply:
+    just log info "Applying talos config and bootstrapping" stage "{{ recipe_name() }}"
+    topf apply --auto-bootstrap --confirm=false
+
+[private]
+[working-directory('../talos')]
+talos-talosconfig:
+    just log info "Generating talosconfig" stage "{{ recipe_name() }}"
+    topf talosconfig > talosconfig
+
+# topf issues short-lived admin certs by default; 8760h keeps the
+# kubeconfig usable long-term.
+[private]
+[working-directory('../talos')]
+talos-kubeconfig:
+    just log info "Fetching kubeconfig" stage "{{ recipe_name() }}"
+    topf kubeconfig --validity 8760h > "{{ justfile_dir() }}/kubeconfig"
+
+[private]
+apps-crds:
+    just log info "Applying CRDs" stage "{{ recipe_name() }}"
+    if ! helmfile --file "{{ source_directory() }}/helmfile/crds.yaml" template --quiet | yq eval-all --exit-status 'select(.kind == "CustomResourceDefinition")' | kubectl apply --server-side --force-conflicts --filename -; then
+        just log fatal "Failed to apply crds"
+    fi
+
+[private]
+apps-helm:
+    just log info "Syncing helmfile" stage "{{ recipe_name() }}"
+    if ! helmfile --file "{{ source_directory() }}/helmfile/apps.yaml" sync --hide-notes; then
+        just log fatal "Failed to sync helmfile"
+    fi
+
+[private]
+apps-namespaces:
+    just log info "Applying namespaces for apps" stage "{{ recipe_name() }}"
+    for app in "{{ kubernetes_dir }}/apps"/*/; do
+        ns="$(basename "$app")"
+        if kubectl create namespace "$ns" --dry-run=client -o yaml \
+                | kubectl apply --server-side --filename - &>/dev/null; then
+            just log info "Namespace applied" namespace "$ns"
+        else
+            just log fatal "Failed to apply namespace" namespace "$ns"
+        fi
+    done
+
+[private]
+apps-secrets:
+    just log info "Applying secrets for apps" stage "{{ recipe_name() }}"
+    for secret in \
+        "{{ source_directory() }}/deploy-key.sops.yaml" \
+        "{{ source_directory() }}/sops-age.sops.yaml" \
+        "{{ kubernetes_dir }}/components/sops/cluster-secrets.sops.yaml"
+    do
+        name="$(basename "$secret" .sops.yaml)"
+        if sops decrypt "$secret" \
+                | kubectl --namespace flux-system apply --server-side --filename - &>/dev/null; then
+            just log info "Secret applied" resource "$name"
+        else
+            just log fatal "Failed to apply secret" resource "$name"
+        fi
+    done
+
+# Wait until nodes register as Ready=False. They only become Ready=True once the CNI is healthy.
+[private]
+apps-ready:
+    just log info "Waiting for nodes to register as Ready=False" stage "{{ recipe_name() }}"
+    if ! kubectl wait nodes --for=condition=Ready=True --all --timeout=10s &>/dev/null; then
+        deadline=$((SECONDS + 600))
+        until kubectl wait nodes --for=condition=Ready=False --all --timeout=10s &>/dev/null; do
+            if (( SECONDS >= deadline )); then
+                just log fatal "Timed out waiting for nodes to register"
+            fi
+            just log info "Nodes not available, waiting for nodes to be available. Retrying in 5 seconds..."
+            sleep 5
+        done
+    fi
@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sops-age
+  namespace: flux-system
+stringData:
+  age.agekey: ENC[AES256_GCM,data:YRjc3lHz4Y1vwUVqVeqjwIygXc0ifZdj73cv/paYsFndC4/dEToRY3oZk92ZquUACIa5k85iOPCBTeR9V632QCcjhwDsbXxE36IKFKs=,iv:h7Y2WIyG2zkvIIwC1WOPbGfCWN324qExyszqdePwS4A=,tag:U50t2W5lTt/ebt2GIgJWNw==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IFVwZlZaeFc1
+        M0plcDcvMmVPd3VSbkZVMWgya1ZwUXlZck9qMDBybWorYWVwVFBTVjhiaHVOWkho
+        SVpuN1UwUVRqeXZyY0JXMEFjRG13bmRPYXF3ZGM2d1BOQ2xvcTBma1dDTk9udjkv
+        MVNIZ2VHWnVzamo0UnE0MXdkRXRBOHppb3JhMHhWNXR0d3lvaTRlUzNxaHBhSWw1
+        N2tCVUNPRkFSODRlaWd2TEdDbCt4em1QMm5iSTFwUUNldllZcGJ5K0tRNXUvdHFt
+        Wld5MnVGeUx2eFBRZ3Q0R25CZEpEQVB3dFpZNWZKL3FNZW5kMFV6VzU5SldyaWVv
+        elIvRklMVEFtNFF4elZxclc5ZHd0cVZFQVp2Q3cvYWptSjIrOHNNRDFMUHNmQmtz
+        Tzk5Q1FKelo1MEpqcUE2Sy9ucjZFeWNwQnIzcDNvWC9hcW9RSXVvT3ljWWJGVFVG
+        SXk0Sncva1hjYVFQOVVtRlpOK2EzU1Y1OGJJdmQ3NWEzbjF5UmNJYm41cUxvb0xm
+        dXRFU0Jqd3FxM25HcDQxM0ZKWUUreS9SVmsyVHpJS3JLeDhXdWU0K3NYTytUcjJa
+        eWNaYXRURVFpb3BleGMxMWl1NGJJZ3U0OTV0dklENFA0YUVGYWRSQ0NWTmVGT0xh
+        ak13SmxNTEk2ZCtwajh1WjFDeG52RklRWkJ4S1Vza2hMQ0JpRG5aYm9ra3pZZExR
+        dXEyUDBHL1kwOVVPbkw3Nk0wV2xiU2IwVU8rdmR5dTZSUmYwenc4ZEFYTEFEK0ZZ
+        bnhaNGl6REpFZmhuejluMVNFTDlPbkJSUUM1WWpJUXUvSFRNOUFiUzlMVG9ZUUhU
+        Vi9CVVdxbktRYjA0M2pPZllNVHZuMFo0TVlzU2dHcHZObnFYZXJyODBDUm5KZXFi
+        Y21KN2x0RmJFTEEzeVBDbDFkZHhFSm1YaWNQcjlOQ0N1OFZOQ2ZvOWRZdnFEbDIz
+        dmlQOVc3cnhiM2RBSDV4emh0dk43R0s0MUlUVDUvYTRsQ3VuVXJLYUF2ZGUzUjBP
+        YnlzSVB6dHBnQm1SSVpYdnNRWlJQMzErMG9mcFdBMWdEcnZXM0RmV2t0SEoxcS9Q
+        bnpoMUtpczU2V2g0SUxueWlVYmtONWdsdlNyMTNvNDNhd0YvSzllYW5MV3J4WVhW
+        bktPT2xrQTJKTWFFWEZGQUowSkU5SzNMd2FaZ3RjQjU1STlOaUdWTTB0Z2xJQkVx
+        a3BTT2R5bm95amd1Sjd5RkZwSVJmeVBsemtVdStRck81K2pRSzFkaFUxN1gwSGlX
+        Ky9ydjI5QWs4akRFUkY1SG5QNUtYT0pOVFBWNHE1ZUpFdThqT1pzdFFZMVBmOWJB
+        ZnBaQU1UNHU5MWs1V2J2VmlCZlo3bTErMXNQbUwyczU1YTZtWDA0dU9oemU1alcv
+        a3JyYjZwWUEwM1Y4Y1RyelVjd2RDemZmRXFibzltSlhuNFdqYjNya3dxSFMvajJt
+        bkdjZDIwdGpmTTIrbG0ySFBob2hoZnUyRmVUbG1CUTNxR2V0a1h6VHF3Unk1Umc1
+        algyVEczT3J0WGhQeTBzYk1QT0hwbHg4MDR4WkRsY0ZubUxjWFpCcHdxWEtxb2tp
+        Si9IYzBSQU1EUkl5YXJzU0VCKzVaRks0dzBMWVNtZW1mYWVTdmVMb1QzSFB1bGor
+        aitIU2dRYXQybG5DaDZwdHJhNnJtNkNtM3NSV2hqaUU5WE52ald6b0dmZFU4WFJp
+        aThqeGx5OWMvQ0N3SHhYR3EzRnlTWHdTT1FtQTZDUnVyNEg3VVl6Wml0dlpVYVl5
+        Vk5kNm1zZU5CR2s1dDRpSTYrdDVBV2pHcTEvamNwQjFXeHl1NGMvYVBmT3lDRTRt
+        NVE3M3hWa1VTRGNSczNxWnBUcCtPNGVPYi92UGZxc0dyMzFFYUVaVWVBOExlTDcv
+        eDZ4YUt1Mk5pN2c0Wm9RZk9TK1RkUWh0VVg3MmpJYW1MODhBUUk1Tm1KNDJDUQpS
+        alJlRWw2Z0Rrcy9tRVhKRVF5eWNJMlBwKytsNnRwNG4yL2RBSjlhTkw0Ci0tLSAx
+        KzhwMXF5bWowbS9TTEh1bzZCOFFZMFNQQ0lJV2RTT0l6azFEcW1waitrCtC57Bhf
+        GZ0O6k6RkMeIX7smJFeAPpFUSlVEnOOIXdth3ylzbYlaAUP/br3oTWILxc+NOY+x
+        bKhVMF4VxCBsdN4=
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
+  encrypted_regex: ^(data|stringData)$
+  lastmodified: "2026-09-16T19:18:39Z"
+  mac: ENC[AES256_GCM,data:ghV8V2IExENuntQlcnirocvhdaJabhPxDzk4x4EmVSbAIYw6PdSckGzy/KF0vhNxOpBMJhF3lqAwkqZQEVLXP0P9Reh4gWi7tp9Vsk8OUbAChoGykbHhthKKcOeysiSl8jZwL/wBVkbLG/9n6ItIIPb5qOiwgVXOObS477vUufY=,iv:Lb/qCGxrdbLs00HKjQUIiRGPRsVMzThYuZ6zX6dvdNs=,tag:jDMo8sd/F6d0zrss6hBAxA==,type:str]
+  mac_only_encrypted: true
+  version: 3.13.3
@@ -0,0 +1,30 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-ca
+spec:
+  isCA: true
+  commonName: internal-ca
+  secretName: internal-ca
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: internal-ca
+spec:
+  ca:
+    secretName: internal-ca
@@ -0,0 +1,20 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: cert-manager
+  interval: 1h
+  values:
+    crds:
+      enabled: true
+    replicaCount: 2
+    dns01RecursiveNameservers: https://1.1.1.1:443/dns-query,https://1.0.0.1:443/dns-query
+    dns01RecursiveNameserversOnly: true
+    prometheus:
+      enabled: true
+      servicemonitor:
+        enabled: true
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./clusterissuer.yaml
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: cert-manager
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: v1.21.2
+  url: oci://quay.io/jetstack/charts/cert-manager
@@ -0,0 +1,30 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+spec:
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: cert-manager
+      namespace: cert-manager
+    - apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      name: internal-ca
+  healthCheckExprs:
+    - apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      current: status.conditions.exists(e, e.type == 'Ready' && e.status == 'True')
+  interval: 1h
+  path: ./kubernetes/apps/cert-manager/cert-manager/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: cert-manager
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+
+components:
+  - ../../components/sops
+
+resources:
+  - ./namespace.yaml
+  - ./cert-manager/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,31 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: echo
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: echo
+  interval: 1h
+  values:
+    replicaCount: 2
+    config:
+      kubernetes: true
+      trustedProxies:
+        - "10.42.0.0/16"
+    httpRoute:
+      enabled: true
+      hostnames:
+        - "{{ .Release.Name }}.${SECRET_DOMAIN}"
+      parentRefs:
+        - name: envoy-internal
+          namespace: network
+    monitoring:
+      serviceMonitor:
+        enabled: true
+    resources:
+      requests:
+        cpu: 10m
+      limits:
+        memory: 64Mi
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: echo
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 0.2.5
+  url: oci://ghcr.io/home-operations/charts/echo
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: echo
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/default/echo/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: default
+  wait: false
@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+
+components:
+  - ../../components/sops
+
+resources:
+  - ./namespace.yaml
+  - ./echo/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,133 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: flux-instance
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: flux-instance
+  interval: 1h
+  values:
+    commonAnnotations:
+      fluxcd.controlplane.io/reconcileArtifactEvery: 1h
+    instance:
+      cluster:
+        networkPolicy: false
+      components:
+        - source-controller
+        - kustomize-controller
+        - helm-controller
+        - notification-controller
+      sync:
+        kind: GitRepository
+        url: "https://git.grachevko.ru/grachevko/home-ops.git"
+        ref: "refs/heads/main"
+        path: kubernetes/flux/cluster
+      commonMetadata:
+        labels:
+          app.kubernetes.io/name: flux
+      kustomize:
+        patches:
+          - # Increase the number of workers
+            patch: |
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --concurrent=10
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --requeue-dependency=5s
+            target:
+              kind: Deployment
+              name: (kustomize-controller|helm-controller|source-controller)
+          - # Increase the memory limits
+            patch: |
+              apiVersion: apps/v1
+              kind: Deployment
+              metadata:
+                name: all
+              spec:
+                template:
+                  spec:
+                    containers:
+                      - name: manager
+                        resources:
+                          limits:
+                            memory: 1Gi
+            target:
+              kind: Deployment
+              name: (kustomize-controller|helm-controller|source-controller)
+          - # Enable in-memory kustomize builds
+            patch: |
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --concurrent=20
+              - op: replace
+                path: /spec/template/spec/volumes/0
+                value:
+                  name: temp
+                  emptyDir:
+                    medium: Memory
+            target:
+              kind: Deployment
+              name: kustomize-controller
+          - # Enable Helm repositories caching
+            patch: |
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --helm-cache-max-size=10
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --helm-cache-ttl=60m
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --helm-cache-purge-interval=5m
+            target:
+              kind: Deployment
+              name: source-controller
+          - # Flux near OOM detection for Helm
+            patch: |
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --feature-gates=OOMWatch=true
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --oom-watch-memory-threshold=95
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --oom-watch-interval=500ms
+            target:
+              kind: Deployment
+              name: helm-controller
+          - # Disable chart digest tracking
+            patch: |
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --feature-gates=DisableChartDigestTracking=true
+            target:
+              kind: Deployment
+              name: helm-controller
+          - # Controller-level SOPS decryption
+            patch: |
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --sops-age-secret=sops-age
+            target:
+              kind: Deployment
+              name: kustomize-controller
+          - # Watch configmaps and secrets attached to HelmReleases and Kustomizations
+            patch: |-
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --watch-configs-label-selector=owner!=helm
+            target:
+              kind: Deployment
+              name: (helm-controller|kustomize-controller)
+          - # Cancel health checks on new Kustomizations revisions
+            patch: |-
+              - op: add
+                path: /spec/template/spec/containers/0/args/-
+                value: --feature-gates=CancelHealthCheckOnNewRevision=true
+            target:
+              kind: Deployment
+              name: kustomize-controller
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: flux-instance
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 0.60.0
+  url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance
@@ -0,0 +1,21 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-instance
+spec:
+  dependsOn:
+    - name: flux-operator
+  interval: 1h
+  path: ./kubernetes/apps/flux-system/flux-instance/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: flux-system
+  wait: false
@@ -0,0 +1,13 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: flux-operator
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: flux-operator
+  interval: 1h
+  values:
+    serviceMonitor:
+      create: true
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: flux-operator
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 0.60.0
+  url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-operator
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/flux-system/flux-operator/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: flux-system
+  wait: true
@@ -0,0 +1,12 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+
+components:
+  - ../../components/sops
+
+resources:
+  - ./namespace.yaml
+  - ./flux-instance/ks.yaml
+  - ./flux-operator/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flux-system
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,87 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: cilium
+  interval: 1h
+  values:
+    autoDirectNodeRoutes: true
+    bpf:
+      masquerade: true
+      # Ref: https://github.com/siderolabs/talos/issues/10002
+      hostLegacyRouting: true
+    cni:
+      # Required for pairing with Multus CNI
+      exclusive: false
+    cgroup:
+      automount:
+        enabled: false
+      hostRoot: /sys/fs/cgroup
+    # The stable bond name is defined in talos/all/20-network-links.yaml.tpl
+    devices: bond0+
+    dashboards:
+      enabled: true
+    endpointRoutes:
+      enabled: true
+    envoy:
+      enabled: false
+    gatewayAPI:
+      enabled: false
+    hubble:
+      enabled: false
+    ipam:
+      mode: kubernetes
+    ipv4NativeRoutingCIDR: "10.42.0.0/16"
+    k8sServiceHost: 127.0.0.1
+    k8sServicePort: 7445
+    kubeProxyReplacement: true
+    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
+    l2announcements:
+      enabled: true
+    loadBalancer:
+      algorithm: maglev
+      mode: "snat"
+    localRedirectPolicies:
+      enabled: true
+    operator:
+      dashboards:
+        enabled: true
+      prometheus:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+      replicas: 2
+      rollOutPods: true
+    prometheus:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        trustCRDsExist: true
+    rollOutCiliumPods: true
+    routingMode: native
+    securityContext:
+      capabilities:
+        ciliumAgent:
+          - CHOWN
+          - KILL
+          - NET_ADMIN
+          - NET_RAW
+          - IPC_LOCK
+          - SYS_ADMIN
+          - SYS_RESOURCE
+          - PERFMON
+          - BPF
+          - DAC_OVERRIDE
+          - FOWNER
+          - SETGID
+          - SETUID
+        cleanCiliumState:
+          - NET_ADMIN
+          - SYS_ADMIN
+          - SYS_RESOURCE
+    socketLB:
+      enabled: true
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
+  - ./networks.yaml
@@ -0,0 +1,23 @@
+---
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: pool
+spec:
+  allowFirstLastIPs: "No"
+  blocks:
+    - cidr: "192.168.40.0/24"
+---
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: l2-policy
+spec:
+  loadBalancerIPs: true
+  # NOTE: interfaces might need to be set if you have more than one active NIC on your hosts
+  # interfaces:
+  #   - ^eno[0-9]+
+  #   - ^eth[0-9]+
+  nodeSelector:
+    matchLabels:
+      kubernetes.io/os: linux
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: cilium
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 1.20.1
+  url: oci://quay.io/cilium/charts/cilium
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/kube-system/cilium/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: kube-system
+  wait: false
@@ -0,0 +1,69 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: coredns
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: coredns
+  interval: 1h
+  values:
+    fullnameOverride: coredns
+    image:
+      repository: mirror.gcr.io/coredns/coredns
+    k8sAppLabelOverride: kube-dns
+    serviceAccount:
+      create: true
+    service:
+      name: kube-dns
+      clusterIP: "10.43.0.10"
+    replicaCount: 2
+    priorityClassName: system-cluster-critical
+    servers:
+      - zones:
+          - zone: .
+            scheme: dns://
+            use_tcp: true
+        port: 53
+        plugins:
+          - name: errors
+          - name: health
+            configBlock: |-
+              lameduck 5s
+          - name: ready
+          - name: kubernetes
+            parameters: cluster.local in-addr.arpa ip6.arpa
+            configBlock: |-
+              pods verified
+              fallthrough in-addr.arpa ip6.arpa
+          - name: autopath
+            parameters: "@kubernetes"
+          - name: forward
+            parameters: . /etc/resolv.conf
+          - name: cache
+            configBlock: |-
+              prefetch 20
+              serve_stale
+              servfail 0
+          - name: loop
+          - name: reload
+          - name: loadbalance
+          - name: prometheus
+            parameters: 0.0.0.0:9153
+          - name: log
+            configBlock: |-
+              class error
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/control-plane
+                  operator: Exists
+    tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: coredns
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  url: oci://ghcr.io/coredns/charts/coredns
+  ref:
+    tag: 1.47.1
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: coredns
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/kube-system/coredns/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: kube-system
+  wait: false
@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+
+components:
+  - ../../components/sops
+
+resources:
+  - ./namespace.yaml
+  - ./cilium/ks.yaml
+  - ./coredns/ks.yaml
+  - ./metrics-server/ks.yaml
+  - ./reloader/ks.yaml
+  - ./spegel/ks.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: metrics-server
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: metrics-server
+  interval: 1h
+  values:
+    args:
+      - --kubelet-insecure-tls
+      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+      - --kubelet-use-node-status-port
+      - --metric-resolution=10s
+      - --kubelet-request-timeout=2s
+    metrics:
+      enabled: true
+    serviceMonitor:
+      enabled: true
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: metrics-server
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 3.14.0
+  url: oci://ghcr.io/home-operations/charts-mirror/metrics-server
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metrics-server
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/kube-system/metrics-server/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: kube-system
+  wait: false
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,17 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: reloader
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: reloader
+  interval: 1h
+  values:
+    fullnameOverride: reloader
+    reloader:
+      readOnlyRootFileSystem: true
+      podMonitor:
+        enabled: true
+        namespace: "{{ .Release.Namespace }}"
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: reloader
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 2.2.17
+  url: oci://ghcr.io/stakater/charts/reloader
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: reloader
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/kube-system/reloader/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: kube-system
+  wait: false
@@ -0,0 +1,19 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: spegel
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: spegel
+  interval: 1h
+  values:
+    spegel:
+      containerdSock: /run/containerd/containerd.sock
+      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
+    service:
+      registry:
+        hostPort: 29999
+    serviceMonitor:
+      enabled: true
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: spegel
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 0.7.4
+  url: oci://ghcr.io/spegel-org/helm-charts/spegel
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: spegel
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/kube-system/spegel/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: kube-system
+  wait: false
@@ -0,0 +1,18 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "${SECRET_DOMAIN/./-}-production"
+spec:
+  dnsNames:
+    - "${SECRET_DOMAIN}"
+    - "*.${SECRET_DOMAIN}"
+  duration: 160h
+  issuerRef:
+    name: internal-ca
+    kind: ClusterIssuer
+  privateKey:
+    algorithm: ECDSA
+  secretName: "${SECRET_DOMAIN/./-}-production-tls"
+  usages:
+    - digital signature
@@ -0,0 +1,137 @@
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: envoy
+spec:
+  logging:
+    level:
+      default: info
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        replicas: 2
+        container:
+          imageRepository: mirror.gcr.io/envoyproxy/envoy
+          resources:
+            requests:
+              cpu: 100m
+            limits:
+              memory: 1Gi
+      envoyService:
+        externalTrafficPolicy: Cluster
+  shutdown:
+    drainTimeout: 180s
+  telemetry:
+    metrics:
+      prometheus:
+        compression:
+          type: Zstd
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: envoy
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: envoy
+    namespace: network
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: envoy-internal
+  annotations:
+    external-dns.kubernetes.io/target: internal.${SECRET_DOMAIN}
+spec:
+  gatewayClassName: envoy
+  infrastructure:
+    annotations:
+      external-dns.kubernetes.io/hostname: internal.${SECRET_DOMAIN}
+      lbipam.cilium.io/ips: "192.168.40.11"
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: ${SECRET_DOMAIN/./-}-production-tls
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: envoy
+spec:
+  compressor:
+    - type: Zstd
+      zstd: {}
+    - type: Brotli
+      brotli: {}
+    - type: Gzip
+      gzip: {}
+  retry:
+    numRetries: 2
+    retryOn:
+      triggers:
+        - reset
+  targetSelectors:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+  tcpKeepalive: {}
+  timeout:
+    http:
+      requestTimeout: 0s
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: envoy
+spec:
+  clientIPDetection:
+    xForwardedFor:
+      trustedCIDRs:
+        - "10.42.0.0/16"
+  http2:
+    onInvalidMessage: TerminateStream
+  http3: {}
+  targetSelectors:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+  tcpKeepalive: {}
+  tls:
+    minVersion: "1.2"
+    alpnProtocols:
+      - h2
+      - http/1.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: https-redirect
+  annotations:
+    external-dns.kubernetes.io/controller: none
+spec:
+  parentRefs:
+    - name: envoy-internal
+      namespace: network
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
@@ -0,0 +1,20 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: envoy-gateway
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: envoy-gateway
+  interval: 1h
+  values:
+    global:
+      imageRegistry: mirror.gcr.io
+    config:
+      envoyGateway:
+        provider:
+          type: Kubernetes
+          kubernetes:
+            deploy:
+              type: GatewayNamespace
@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./certificate.yaml
+  - ./envoy.yaml
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
+  - ./podmonitor.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: envoy-gateway
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 1.9.1
+  url: oci://mirror.gcr.io/envoyproxy/gateway-helm
@@ -0,0 +1,18 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: envoy-proxy
+spec:
+  jobLabel: envoy-proxy
+  namespaceSelector:
+    matchNames:
+      - network
+  podMetricsEndpoints:
+    - port: metrics
+      path: /stats/prometheus
+      honorLabels: true
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/name: envoy
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: envoy-gateway
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/network/envoy-gateway/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: network
+  wait: false
@@ -0,0 +1,21 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: k8s-gateway
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: k8s-gateway
+  interval: 1h
+  values:
+    fullnameOverride: k8s-gateway
+    domain: "${SECRET_DOMAIN}"
+    ttl: 1
+    service:
+      type: LoadBalancer
+      port: 53
+      annotations:
+        lbipam.cilium.io/ips: "192.168.40.12"
+      externalTrafficPolicy: Cluster
+    watchedResources: ["HTTPRoute", "Service"]
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./ocirepository.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: k8s-gateway
+spec:
+  interval: 1h
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 3.7.3
+  url: oci://codeberg.org/k8s-gateway/charts/k8s-gateway
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: k8s-gateway
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/network/k8s-gateway/app
+  postBuild:
+    substituteFrom:
+      - name: cluster-secrets
+        kind: Secret
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: network
+  wait: false
@@ -0,0 +1,12 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: network
+
+components:
+  - ../../components/sops
+
+resources:
+  - ./namespace.yaml
+  - ./envoy-gateway/ks.yaml
+  - ./k8s-gateway/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: network
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cluster-secrets
+stringData:
+  SECRET_DOMAIN: ENC[AES256_GCM,data:c8E/5LHk3cCusf72,iv:R+rD3r0fMm9nipi5/GTYpUuEatjskr3sz9VMQS7cfgA=,tag:jrVmNafhpsj6P0wLbhzyKA==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IE5hYko2NW11
+        T2VVRlJlQ2RJdk5ZaWtlRk1NdUR5TGQ0YStlVmNRcHRTL21xL2FNNm5yVkZDT2d0
+        OUZnc29Jd0x6ZnduN1l3NUlIR3oyc1RIM0UzalQraHkySnVLdE9YbVAwVWZNOE5B
+        blE3VXUxL2JqTlo2M2hCK01kdFFaODdiTHQzdnNhUnRrck5obTIwNktZSENieDZk
+        ZERwSzVyY0x4YmpSeXhOdU5WdUx1VTFvQnpjekd1N3R2TURjamNZdXpsUVcyS1gr
+        MVFPcWdkT1Y0ZTNHMDd2d1d6YVR3Y1V2dEx2THhWbVdOZVlqZjBQVlFnZVR6a1lQ
+        ZVhBVkpabW9GZ0tsM2hWMVBkZVpOU29CQit6cnV4Z29KVzBkU3Rsa0huTC9BN2tY
+        NXF2MFlmZTMvZnQxRlZ4aVVtUXlGLytrZDBaR016VlpaTS9tek5DVU1tVWcvU0xV
+        KzJ4cGpZS01OMDdIVjQvSFkyUFNFMURFc0FLZENRWGpuOXVMRkFDekxuTjBMY3pD
+        dkRmMWViVzAxUWRuSUtFWG9vL2J6c2gvbG5PMFZNWjYrZHczYlA1ajBvQ3Vubk5r
+        YldmR1c2NXNsdVkvVUpTMTFlMisyaHd5eTZ6UWxhZXFZZ2hxOExMTmlZRDl2VjJX
+        bE9ORWRLV0hyL1g2Z00rblBYaHlyU2JIZG94THB5R2hEeENMbEo5c2ZRTkJJUEFi
+        WjdiNXFBNjh5Vkc1K3JBaThVK25iSFBJQmNCNURSc0x5bHR5S0V1UEljRUlyUlZt
+        dS9GNlNUWURnclFGZFhSc0JVRStscjMwYUJSVG9VSWdUYzhmTElwR3NhQyszQ2U3
+        KzZkTHRLcHAyazY5QTIrTXFpMkF0Vit0Sm1lMjUwVVJPVC9wV2RXdVdXcTJFY1hU
+        enMrL3JEa3Zsakl6MEkvc2srcEZmeHQrOWpRbTV3ZWlnMk1Qb0VUU0dZV3lxVC9a
+        QkFFbFU1WHNHRXRORFdtaGRqT3RkalBkQ3EzdkVvWE51c2ZCcHMyR0dOc0FBY2pP
+        czkxSkRJck96NzlkbVViRzNkVDhZaldkU2hmZkpjTUFLVGJhbHBHM29xQVpLTnEw
+        aXdsMHVpYjZTR09kbkNQU0pqajhWZ1R4bUkrUVZKdlBJeWFWMUE5MkdScFlWTWhj
+        dThIb2NKMFJMWG05N0FrTTRxMUJURU81eTNsWmU1OGtTMGM4NCs3RFlMTHhlUTdH
+        NzJiN2sxditzZ29pdVp1NlE5OXhnanF1ME1XcTVEMTJtUHhuaFY2enUwcGRURFhq
+        NTdVK0RWRlVvanF4Tk1zbnRHSzB3SVF4KzRQbFUybFJxZGtuenp0R0E2M2NacElT
+        QXNmZFYxOTRQbXdxUkRzKzFZMnNQTjlhQ2xNYlVOcVhxVm1WVUNpV0Uyajh6a2l2
+        QXpuVk1XZWVCTnhNWFlZRHdRaU5ENWp6bHZuZzFLTHNvWmg4K0xKckhUUlQ4UGR3
+        WTM2QWJqcXRXRlc2Y2R6RDQ2dkpVaXpZL09mRU1Rck44SjNMM2p3T1ZNd09pZmhN
+        UnNYdHRMR052bDU4dmNsay9NVWxabm1qMTBJbFYwcXc5WEgwc3pDSnFPVGxaMjhB
+        ejRrWUNzdGJXVnRiNWdYUTBrditVRlErUEMrbk96QjlJZTd0dzlVcEVuakVZQ295
+        WHNHVzhQb1ZiemZqWkJXcjlaMVJVK0pWZFhpdVhjSk5sajBDc3VOV3I0Y0tpOGkv
+        ZU0wUVRtQ1VRM0E5ZEN4UFk0RDE5NzBNQ0pUcUtrbkF4YlpMWlRqUWRTK2dzems4
+        cW5oTzNnUnFGb3YyRUFkY2lDOUdacG9ma2JtSC9MNnFhYUJBcGkyMmEyNUpJSi91
+        aVpyb0tMeTNTNkhsZUdmK2M4dXYvVkNvRjFxNGhhMG9mM2ZmcXRZbGNSeGdEOENN
+        VVdrYjRkTzhHcW1Ic3RNdHkyb0RkdWoveU5CVzdGQzVka2hrYVR0YmNrQlhRQQpj
+        a0FRNDRKbmZ3WTg2NXZDVU80b0p5TDM5Q3RBckk0R09WdER0L1VpNE44Ci0tLSBp
+        TnhPdFVObkVBVmtUSm5UNkQzdlhjaERtNEM3QVQyREw2V21CUklrV2ZnCnldYCm6
+        TPfysxZiJdVeDHctGGegEdbfruYd6XwN6vAg2CdtNQ10Ib8xqiCJd4ZRLe2PIa0B
+        08FxUeFAWX5IELU=
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
+  encrypted_regex: ^(data|stringData)$
+  lastmodified: "2026-09-16T19:18:39Z"
+  mac: ENC[AES256_GCM,data:39l4LWDBWzX4nHhGKbijAl+77eFEu72bplq6AWc9F6dR8aD3huNyZL5ZMsY/ABnGJD95Ef1s7b1m4+UTUb6ae40uXSyjr/qM5UeYW3LIlm9X9W4ln+d2+BZi5r3zmhN7Fg37S6d7Fg5dsBEkJ2e3MDs48nhF1IBGQJu08EijRWA=,iv:Bwdwgw4xjXAzn0zFjkSbYvYJbNCfMPhPlm3DhqGlqIg=,tag:Ye9FepwpYnsp1t4NPZlL+Q==,type:str]
+  mac_only_encrypted: true
+  version: 3.13.3
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - ./cluster-secrets.sops.yaml
@@ -0,0 +1,57 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+  deletionPolicy: WaitForTermination
+  interval: 1h
+  path: ./kubernetes/apps
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: false
+  patches:
+    - # Add Kustomization defaults for all child Kustomizations
+      patch: |-
+        apiVersion: kustomize.toolkit.fluxcd.io/v1
+        kind: Kustomization
+        metadata:
+          name: _
+        spec:
+          decryption:
+            provider: sops
+          deletionPolicy: WaitForTermination
+          patches:
+            - patch: |-
+                apiVersion: helm.toolkit.fluxcd.io/v2
+                kind: HelmRelease
+                metadata:
+                  name: _
+                spec:
+                  install:
+                    crds: CreateReplace
+                    strategy:
+                      name: RetryOnFailure
+                  rollback:
+                    cleanupOnFail: true
+                    recreate: true
+                  upgrade:
+                    cleanupOnFail: true
+                    crds: CreateReplace
+                    strategy:
+                      name: RemediateOnFailure
+                    remediation:
+                      remediateLastFailure: true
+                      retries: 2
+              target:
+                group: helm.toolkit.fluxcd.io
+                kind: HelmRelease
+      target:
+        group: kustomize.toolkit.fluxcd.io
+        kind: Kustomization
@@ -0,0 +1,10 @@
+set quiet
+set shell := ['bash', '-euo', 'pipefail', '-c']
+set script-interpreter := ['bash', '-euo', 'pipefail']
+set default-list
+set default-script
+
+[doc('Force Flux to pull in changes from your Git repository')]
+[group('kube')]
+reconcile:
+    flux --namespace flux-system reconcile kustomization flux-system --with-source
@@ -0,0 +1,20 @@
+# Talos Patching
+
+Machine configs are assembled by [topf](https://postfinance.github.io/topf/) from
+`topf.yaml` plus the strategic merge patches in this directory.
+
+<https://www.talos.dev/latest/talos-guides/configuration/patching/>
+
+## Patch Directories
+
+Patches merge in this order, alphabetically within each directory, with later
+patches taking precedence:
+
+- `all/`: applied to every node
+- `control-plane/`: applied to control-plane nodes
+- `worker/`: applied to worker nodes
+- `node/${hostname}/`: applied to the node with the specified name
+
+Files ending in `.yaml.tpl` are Go-templated per node; see the
+[topf configuration model](https://postfinance.github.io/topf/main/configuration-model/)
+for the available template variables.
@@ -0,0 +1,9 @@
+apiVersion: v1alpha1
+kind: UnattendedInstallConfig
+provisioning:
+  diskSelector:
+    {{- if .Node.Data.installDisk }}
+    match: disk.dev_path == "{{ .Node.Data.installDisk }}" || "{{ .Node.Data.installDisk }}" in disk.symlinks
+    {{- else }}
+    match: disk.serial == "{{ .Node.Data.installDiskSerial }}"
+    {{- end }}
@@ -0,0 +1,4 @@
+apiVersion: v1alpha1
+kind: HostnameConfig
+auto: "off"
+hostname: "{{ .Node.Host }}"
@@ -0,0 +1,9 @@
+machine:
+  certSANs:
+    - "127.0.0.1"
+    - "192.168.40.10"
+---
+apiVersion: v1alpha1
+kind: KubeNetworkConfig
+podSubnets: ["10.42.0.0/16"]
+serviceSubnets: ["10.43.0.0/16"]
@@ -0,0 +1,25 @@
+---
+apiVersion: v1alpha1
+kind: LinkAliasConfig
+name: ethSel0
+selector:
+  match: glob("{{ .Node.Data.macAddr }}", mac(link.hardware_addr))
+---
+apiVersion: v1alpha1
+kind: BondConfig
+name: bond0
+links:
+  - ethSel0
+bondMode: active-backup
+mtu: {{ .Node.Data.mtu }}
+addresses:
+  - address: "{{ .Node.IP }}/24"
+routes:
+  - gateway: "192.168.40.1"
+{{- if eq .Node.Role "control-plane" }}
+---
+apiVersion: v1alpha1
+kind: Layer2VIPConfig
+link: bond0
+name: "192.168.40.10"
+{{- end }}
@@ -0,0 +1,7 @@
+apiVersion: v1alpha1
+kind: ResolverConfig
+nameservers:
+  - address: 192.168.40.1
+  - address: 1.1.1.1
+searchDomains:
+  disableDefault: true
@@ -0,0 +1,6 @@
+apiVersion: v1alpha1
+kind: TimeSyncConfig
+ntp:
+  servers:
+    - 192.168.40.1
+    - 162.159.200.1
@@ -0,0 +1,16 @@
+apiVersion: v1alpha1
+kind: KubeletConfig
+config:
+  crashLoopBackOff:
+    maxContainerRestartPeriod: 60s
+  imageMaximumGCAge: 168h
+  maxParallelImagePulls: 3
+  serializeImagePulls: false
+  shutdownGracePeriod: 90s
+  shutdownGracePeriodCriticalPods: 60s
+---
+apiVersion: v1alpha1
+kind: KubeNodeConfig
+nodeIP:
+  validSubnets:
+    - 192.168.40.0/24
@@ -0,0 +1,12 @@
+apiVersion: v1alpha1
+kind: SysctlConfig
+params:
+  fs.inotify.max_user_watches: "1048576" # Watchdog
+  fs.inotify.max_user_instances: "8192" # Watchdog
+  net.core.rmem_max: "7500000" # Cloudflared | QUIC
+  net.core.wmem_max: "7500000" # Cloudflared | QUIC
+  net.ipv4.neigh.default.gc_thresh1: "4096" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh2: "8192" # Prevent ARP cache overflows
+  net.ipv4.neigh.default.gc_thresh3: "16384" # Prevent ARP cache overflows
+  net.ipv4.tcp_slow_start_after_idle: "0" # Preserve congestion window after idle
+  user.max_user_namespaces: "11255" # User Namespaces
@@ -0,0 +1,8 @@
+apiVersion: v1alpha1
+kind: CRICustomizationConfig
+name: containerd
+content: |
+  [plugins."io.containerd.cri.v1.images"]
+    discard_unpacked_layers = false
+  [plugins."io.containerd.cri.v1.runtime"]
+    device_ownership_from_security_context = true
@@ -0,0 +1,20 @@
+{{- if .Node.Data.encryptDisk }}
+# Encrypt system disk with TPM
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: STATE
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
+---
+apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+encryption:
+  provider: luks2
+  keys:
+    - slot: 0
+      tpm: {}
+{{- end }}
@@ -0,0 +1,6 @@
+{{- range .Node.Data.kernelModules }}
+---
+apiVersion: v1alpha1
+kind: KernelModuleConfig
+name: {{ . }}
+{{- end }}
@@ -0,0 +1,7 @@
+# Talos 1.14 defaults to running kubelet and pods in a sandboxed PID/mount
+# namespace, which breaks workloads that rely on hostPID or host mounts
+# (node-exporter, GPU plugins, in-tree iSCSI). Set to true to opt in; on
+# encrypted disks expect a second reboot the first time it is enabled.
+apiVersion: v1alpha1
+kind: SecurityProfileConfig
+workloadIsolation: false
@@ -0,0 +1,9 @@
+# Weekly online maintenance for XFS volumes: trim discards unused blocks
+# (SSDs, thin provisioning) and scrub checks filesystem metadata.
+apiVersion: v1alpha1
+kind: FilesystemTrimConfig
+interval: 168h0m0s
+---
+apiVersion: v1alpha1
+kind: FilesystemScrubConfig
+interval: 168h0m0s
@@ -0,0 +1,61 @@
+cluster:
+  etcd:
+    extraArgs:
+      listen-metrics-urls: http://0.0.0.0:2381
+    advertisedSubnets:
+      - 192.168.40.0/24
+---
+# Allow scheduling on control-plane nodes
+apiVersion: v1alpha1
+kind: KubeNodeConfig
+taints:
+  node-role.kubernetes.io/control-plane:
+    $patch: delete
+---
+apiVersion: v1alpha1
+kind: KubeAdmissionControlConfig
+name: PodSecurity
+$patch: delete
+---
+apiVersion: v1alpha1
+kind: KubeAPIServerConfig
+certExtraSANs:
+  - "127.0.0.1"
+  - "192.168.40.10"
+extraArgs:
+  # https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/
+  enable-aggregator-routing: "true"
+---
+apiVersion: v1alpha1
+kind: KubeControllerManagerConfig
+extraArgs:
+  bind-address: 0.0.0.0
+---
+apiVersion: v1alpha1
+kind: KubeCoreDNSConfig
+enabled: false
+---
+# Disable built-in CNI and kube-proxy to use Cilium
+apiVersion: v1alpha1
+kind: KubeFlannelCNIConfig
+$patch: delete
+---
+apiVersion: v1alpha1
+kind: KubeProxyConfig
+enabled: false
+---
+apiVersion: v1alpha1
+kind: KubeSchedulerConfig
+extraArgs:
+  bind-address: 0.0.0.0
+config:
+  profiles:
+    - schedulerName: default-scheduler
+      pluginConfig:
+        - name: PodTopologySpread
+          args:
+            defaultingType: List
+            defaultConstraints:
+              - maxSkew: 1
+                topologyKey: kubernetes.io/hostname
+                whenUnsatisfiable: ScheduleAnyway
@@ -0,0 +1,64 @@
+set quiet
+set shell := ['bash', '-euo', 'pipefail', '-c']
+set script-interpreter := ['bash', '-euo', 'pipefail']
+set default-list
+set default-script
+
+# Day-2 apply/upgrade recipes rely on topf's built-in diff-and-confirm
+# prompt; only the destructive reset recipes disable it in favour of just's
+# own confirmation.
+
+[doc('Apply Talos config to all nodes (shows a diff and asks first)')]
+[group('talos')]
+apply:
+    topf apply
+
+[arg('mode', pattern='auto|reboot|no-reboot|staged|try')]
+[doc('Apply Talos config to a node (shows a diff and asks first)')]
+[group('talos')]
+apply-node node mode='auto':
+    topf apply --nodes-filter "^{{ node }}$" --mode "{{ mode }}"
+
+[doc('Show pending config changes without applying them')]
+[group('talos')]
+diff:
+    topf apply --dry-run
+
+[doc('List all nodes and their current state')]
+[group('talos')]
+nodes:
+    topf nodes
+
+[doc('Render Talos machine configs to ./rendered')]
+[group('talos')]
+render:
+    topf render --output ./rendered
+
+[confirm("This will destroy your cluster and reset all nodes to maintenance mode — continue? [y/N]")]
+[doc('Reset all nodes back to maintenance mode (DESTRUCTIVE)')]
+[group('talos')]
+reset:
+    topf reset --confirm=false
+
+[confirm("This will reset node " + node + " to maintenance mode — continue? [y/N]")]
+[doc('Reset a single node back to maintenance mode (DESTRUCTIVE)')]
+[group('talos')]
+reset-node node:
+    topf reset --nodes-filter "^{{ node }}$" --confirm=false
+
+# topf intentionally does not manage Kubernetes upgrades
+[doc('Upgrade Kubernetes')]
+[group('talos')]
+upgrade-k8s:
+    talosctl --nodes "$(yq '[.nodes[] | select(.role == "control-plane")][0].ip' topf.yaml)" \
+        upgrade-k8s --to "$(yq '.kubernetesVersion' topf.yaml)"
+
+[doc('Upgrade Talos on all nodes, one at a time (asks first)')]
+[group('talos')]
+upgrade:
+    topf upgrade
+
+[doc('Upgrade Talos on a single node (asks first)')]
+[group('talos')]
+upgrade-node node:
+    topf upgrade --nodes-filter "^{{ node }}$"
@@ -0,0 +1,45 @@
+---
+clusterName: kubernetes
+clusterEndpoint: https://192.168.40.10:6443
+
+# renovate: datasource=github-releases depName=siderolabs/talos
+talosVersion: v1.14.0
+# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
+kubernetesVersion: v1.37.0
+
+secretsPath: secrets.sops.yaml
+
+nodes:
+  - host: "k8s-0"
+    ip: "192.168.40.20"
+    role: control-plane
+    schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
+    data:
+      installDisk: "/dev/sda"
+      installDiskSerial: ""
+      macAddr: "bc:24:11:00:00:20"
+      mtu: 1500
+      encryptDisk: false
+      kernelModules: []
+  - host: "k8s-1"
+    ip: "192.168.40.21"
+    role: control-plane
+    schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
+    data:
+      installDisk: "/dev/sda"
+      installDiskSerial: ""
+      macAddr: "bc:24:11:00:00:21"
+      mtu: 1500
+      encryptDisk: false
+      kernelModules: []
+  - host: "k8s-2"
+    ip: "192.168.40.22"
+    role: control-plane
+    schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
+    data:
+      installDisk: "/dev/sda"
+      installDiskSerial: ""
+      macAddr: "bc:24:11:00:00:22"
+      mtu: 1500
+      encryptDisk: false
+      kernelModules: []
				`@@ -0,0 +1 @@`
				`{{ (fromYaml (readFile (printf "../../../kubernetes/apps/%s/%s/app/helmrelease.yaml" .Release.Namespace .Release.Name))).spec.values \| toYaml }}`