chore: initial commit 🚀

bootstrap/deploy-key.sops.yaml

@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: deploy-key
+  namespace: flux-system
+stringData:
+  identity: ENC[AES256_GCM,data:8w3RUSbeP0Pnu0YrQXcAkoe49MsEk2kWyHAJ03j9n5MCFAP7BvHeFmAzrqit5dWO3GTdl8lTpkVfANhq4yXn/zVa8XMUf1k/8fBJSyN41ZvyQ/Kop0pnJpb9VJsUMHuA8fDhqDRp/cNtc10iLEoTa3I13mMsAnImibTWGX8OCskHCvSLvhkEmakt1A28DT9NpEYSrf0OfKqbRio29azjsxdfDKRyRUwhRUoYNgic4FGIKYDGKyoMmRGIfLTCV3kntD9Sy/Jc7DV+hpYFVvvsfYuMkcCDFSOfltAnCi93VjBYniY5NqRN00aAgYZmAHeORdIH251Ck6S+krfxQ3lQVnd38Esy/7nzKtLYXY6z5xB/pVTWzQNOz2rYwpkfZLxQzRhIo8SOUpBNCleA6VnA1q30IVogKZU1czDT2tbSL16c35409XjsqfUGPn5h7vGdYCJSqClftqp5RTzd2tdjfoYybLDhQo6PvOPY8ADHBTpfa3kGMOXxiSRcgdQiQIXQtPoRBvxKnJskeEqdfmKd,iv:+BRQJbSoHOt6Wysjv2nW2Me38uAdG66nu0Ov+xTSSTg=,tag:EN4U8gAdqXg0GzrEPUITYA==,type:str]
+  known_hosts: ENC[AES256_GCM,data:PA8ph6GG2A5NwwUwckxfKYyv58mme0CsYmv1i7jgGzIVDqBxmrN8SdDTm4I2xasBmmGzpjir63W9NpLVpmQ6qjzmor/KwP9CpYQO/cDKvHyzkIX4dSeb5orWmDvUuYLmzwV/R2v/HA5BB4IVSVwguwKt8Z36G8y669LK6mfkbxoVwCH0Z6iTUjPC2TDslfRyQNOAucRfPeagZS7sHAuqT+AP4WYW1EHeHvrvx0xAxabX4kAoRx+h5mcx43Rzpcf+TE3vFaBS1Ttr/zUFmVX5xq1wl9v4u4qYge2zpDTohnvtvAg8dQ/aVI+2AglQqUtGmMFG2T/4cZIFdneAFg83R6MG/6qvUA1zBihqVRytYBjdAIhwe4Z+3Ob7KTJ+k8FfFOHdjCvgp4Lv8tgWBBX0VN4r5HfgBCnhX/vfX2ojbfq//5vpHquBe95M9fbA1ab7C7Ixs8hC8kKNYwGkhaO7cVLrMKvlQOltxmocsEUA5+MTTDAJ+GO4lTwPiGyEPJXDcupyAbNSOduICdeDGNpdlGv+lToFOCizHeY25scVOH1lhxD8NgMagQWmIQ9QeqWPwvdXLDL5hpf9QBI/wiwIr0hFdqnbHc/oFTEzg9vZE30TE6zH1WoHWbTe225LrPqOrrPbSLAp6rrmmckzmMn7kp/RIyPpupZZWEzmkiyK2oxuMs1NZ0UU4fh1kIj/P9Da4oFaclcKpEkYidjFd7sdBk6Y/F3x6mlt1nwNt44vRbvbS3EHdCw1B1qrIqwwSir0wsn+UvWjMDqUzRHVTR8DIKcg6MxANuRmtpqny51UPpTSkHVJfkKoVptHJHnpqcsJQoqTrXzFvtTGJT0gwMnvJRx9lYFO0snkbVCoEn2FygsmcgEBj7yNJIcdDZfFOYrn7Zhkutk9SU9N2ic79ndVRfefk65sjk+oRPv0JZnuldg2xFF8WXN0kQhgnINdgfCSNvBXei+kekqRvKBiqXpe53ckTrbmotX4boqQawDaoXGgJUDMx6mzg2U0r8RSFSaDHT9q+XcWlNVrS6G2Fl//GtNsbLDrjF3Dj60DoyDa1MZsa9XcqiSqsngJ/WMkQRajN4BMr03vW15P4CCU58EAxS9PuQs4jKEvhDt2z2aZ2t6i1aREm+rBIr4KebQNZMc8929E7xh5kH4uKGlacHeL2P3GNqSDRzHpHTzRDkrXqvgnQi2yiM0Bnb3EEfyjaYSKPsLJq3fnv4LWoq1yVBaAEEGhm/X8diHq+maV6X0HGtJ2J8X9Jx7z/78ktA9qZKexhRmaea1WVL1g7xpAigZSogK696suMDJFR/FmrdfFthQYPj4X1jA9njQrb8ZHey/h0Xy1W1IEccWsKm1u7LUtPkkkfe0F1tAQDcTnHjPH9GVeygZXXGR6LJyLl5IPV3ft6ymZqjN2uZyLi6EGsiWFs+AJrU0WNwhDfvQnVTaP+wU068QHZq94I0NvY17TjgI5A1Q7PZcYevqc8gWqXT5NE5GKxeToS8uv1WuPN+vYCUU4H6emy9M7/MtVlJxBAkQ/9ZMAwzmgyddgDq88Cyn2laU1jVvYweHIvavjmimJ5belykgXqF5YS5E3FJy5gZHJECYk8IcTp/8Ununjjkj3wBcyga3clSoKrYvkNnbok8d6rII0Uel3StBBxp721CrjUFgi/XTpffk55MBQTTW8kn8cxOWODx5nRkBexrvFL8LWI8M4NBBudfEF6Ban1XbPPOIQem3gN8+/i1PyCrzAl/ai5UJsGYRC8ij3JdJc2gRh7MzLKiwdCpRAY6XbAscKu2tErBTH0VHImx75zsjLwqQ23dlfPcd7DF1qLUdqGdoevopBLLfipau9CNrI4+uMWhYuood+0CHWhGlWTetnAalRDSgL93f5Q0hqptqIBCUdnxj+A1GHVG1kJPrtxr4YFmDzGdq7UOmDG6ZsLBvg+Ip6aUS+7HAam2SFsWYCE7RthZtuNJTvdYOYlueZX32UuK5uHSKhAiaeUgwomRwUHDfuqh+yEmL4dvGWmcr04eOlG0QaRzOh2TMZwwGZe+PIUEde5BSpN/uGuYXwlU9bgpTwnvgtX4A8JuD98eFznU/d71u9Kf5qLMf4YkH76ViqzDqj+joVGUbeci28/yf+MNqkTWUuUu2cGw81vieHbtwU90S+9JHz2Dki9/jD+wBwdHF7prR40YkDe41HB0L0b01G3XZ3xnOH8c8Kg+2HvInaAgwAPxumzYyZqI6eoxIYr3bhYwP2DgW1IDE0u07C9LGFNy/un7lWDXBlV5EgpfdosP7rLWBSi4KbVNJgvC47aZUyz+NdiUpzHM6AISipKMnm2sv9XScExMcQVRXd8+upcHLEfbTABvWyPa6KsFCFJrv6bb3epQpp6BU+7c4/QQLcaMTNrXytHlwMJ5A8LqowXhsj+v7IlfrCjk8lI12LWu7mPzrSOkwpmwXo6Eu/pmheVyhe5SQpAW1Y4Im+l+Eg5LEQxKxUaDjhKnhPLdNCHRuA3M3fY65Mrlj76VfO2RU+SGusiLFGWeQvB8D5VB1JTeZxmIi9QVa1W0x8VqMHfCMgf7H1uxJaBDgW+vOpsOHViFe6DE54zyhEOQqU5FA2waJvKsJomltaBqZjsLUnKEpclDEwBHvXU1CWQdAIQhA3Vg75g55V0XNyOQfaV5YdWhH38bZR5P5gZpOa9HYaxex2r1lDpE3aFDeeqPdl4F059uwdV6F2xGO1rYz3Z4drcPJEjBjUBYhz0wUQSDWPnUhqkJK/8IWCns1xXBGfENBdcUah6ZSXWwhNrBfV/lai2tTL8ra6RBmwhMDNRvYFsFp6bl2lJQmqQlXrMm968husrVLZ7QrockoXAPK0Jeralw==,iv:EaIrKf6XalfWt6LLhGWetmVuV0zDQaLvFdia0Wm4AG4=,tag:0riZDzFfQZBQoWPQhfIHJQ==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IGwrN1ZFQVow
+        YXZMcnlaRUY5azk3RG1rRFpmTHhicjlKWG9RMGRRd216aHU5d0NLSy9MUnNLdDZk
+        M0dkUHJnc3lYb0xHbTZIL1RKRE1zYkI4Y0JxVnBGdUlmdkJnR0gxWlVXWTV3Uitj
+        dkREbW95bi9mNEpyY0RRRjN0N0o0bGgxVnNKaU9Ca3VYV1lVUytjZTRLc0c4RWg1
+        T1hNdmtZa0xaN3JqaE1KRHZYRkNEYWdIdHdYYWp4Z3JGeFZNMVRzQUtHZXE2NTYv
+        WjhaQzdpY0FndGpVQmlUN2haQ3dJOGlnRjZWc1gxQThKUGNkMjk0UmMrTElZbTY0
+        akZ6V0FETm1WdWFmSW9EYmNyZG5qZTZqRnhxMjh4ZjY0YjZzeHRPZGhPQ2RneGlZ
+        SDRVblR2R2tjemM2UGl0SW4xWmt1bm9nOURiSHFRZXRxMjdDK0JqT29pNm5vMzNi
+        VFZKMGJ3WStIWHVuazR3aG4vaU14dFZWZzB1cG1oQXRYZysrS1dQWTRid1pRdjRJ
+        SWpBaVFLL3VkZ0dzcVo0TFJJMkpvM3VUaUZZU3RFcXVteDk4eGF4UysxUmZHU3dr
+        TEhlRUxYNi9WWmtDdnI5QytIcDZiZk4vTVY0djA3T2lhUXpJSnFtY0FQMFQ4cjZV
+        ajZjM1dsT1FISjBhSjlaSW5SN09GQU9IUUpWTVJKbmtsUXdwNUwvM3luNmRDcW9m
+        dUdvSS9jcmoyWE13dGlYVXhiTmhpSm82Y1hJVFVaL0lRVTcyYzNKMWR3ZGZscWls
+        OWJxNitkN2Iza1dXVUdaSVZXaWxFRDY3a1ZsV0VCUFJieVRvODN2V29WeGwxUWpK
+        cERWNDhLODdBYU5pTFNidGQwSmpEcTNyczdzWEJhdngvZUlFdFRBeWFUVzNKMzEr
+        QlpxVDNjcmUwaUFMbFlhTEpUQ05HVnBJc1ExNXNCbmxvNW1zdHJ6dGNXSWdoaDlI
+        TDhabUZlMndPZ3RlWUpXSENLbG5tMmFKekhtUkNKeUtUTnVkeFR2SjRsSzRDMlhi
+        Q1IyNzRZTU9zNXdBQjQwcEcrTE5hbGVuZHF2elFrRWo5ZGpicXF5eDc3RHN1Vjdt
+        Y3I0UHFOSnRDNXZ5ZVpSZXJqeTlaWHdVbjVBaXAzaXVBckN4OUp1MldsSWViNEk1
+        Z3dIOVRhRW1zb1BTNGo1czYxdThXYjlYTkdqOE43cmdXSWFGeTMxbi9hOWpTOEo4
+        N0FIb3hCd3laV2t5RVpGQ3FqRUF0Mk0wUlZIcEVQcGN1YSsvUGdLdkQvQXVTV09h
+        TEhyZHNzRjJkU3RqZTJGR1h6RkM5dmVuL2pPOGxGRzhDc2h3bXhLd2wrS0NEZXNm
+        NU1NeTZuQmYrUFpJQ3ZIZmxVMG52NHY2bHJhNnQvTklHQXFRaGt6S1g3TGpiajU0
+        ZUxiTGhMc1Q2dUlmVkFYZTNzU0xRV3JnQ2grOFhLeDFiaXZ6UUlubzRsNk8zNXl6
+        RjQwa295aUxLR0JyRDRTR3BiY3BNdDZ3eHZYRTNscnFRaXpkSW4zajRXSmlUaXBL
+        SW5FdnFKc3J1K0hDYmxTMnJGN3V6UVl3NGhGMmNidldDSUMxZThsL2QwNmFpd1VK
+        Q3pFRlpOKytrYlZFRThZRHBrZHVBT3Q0bkZuYmQ4S1lXU3JENUZTeDZiZ2l5UmlE
+        VlpMTW14OVlDT1VWWU1rbHoxSGw5ZTZaR0xFM2dkS3JubnRPMys1N3hiem9menpp
+        eU1CaUxhWTVjYU0xVXZRdXBFN3NrTklQSFJzcXZwRmV4Qm5ORWNPTldoZ1FhUFZr
+        MXZJVG8xeWVhRzBtdXRRREU2WktUM1lsNmJKT2tEblZKZVBLb2prVXJiZHBhamtN
+        VTZ1ck9hS1c3Zkx1ajQyYTVsOGt4dGIzekk0bkhabTBjcy94dWQ3ZERpTTkyTWZ6
+        SlZuUUlLVEh0c2NtNWpYZEZzMGZSaUVZdDlJSHkwYllmaHFkQ2NjOXJTV1RCUQpI
+        SmVxc3pZYjFheTBOdnhsZHFHNTlsenZjTnowZUFFQklVQ2FUN1p3WStJCi0tLSBE
+        N0cvem1zY051dG05WldSeXNpTExWQnFVMXpUd0s0ZGRFRjNYSGJacVlVCqVCVxE2
+        Id8s8etDCJ0J+jVJfjjCaBNyqXq6dzej+cak3+0x6wbQomqbF9+J2X9RiF/RlBw/
+        WTLJ3rqEHh07Tf8=
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
+  encrypted_regex: ^(data|stringData)$
+  lastmodified: "2026-09-16T19:18:39Z"
+  mac: ENC[AES256_GCM,data:1vITCxz9DIk/0wV+cfjqJa2SQjBsxIGXEBGiR7dP/9oXQaklSqJHAX876HvVJh+YxAUDRAIMZCP7p8e3y03IYIOuarNOqlwtS5YytB6MImC4gGomF4yfBHIDw3fT9fbMk1zvI8gyFn9tbO72K4mHLpTgsU8En21okdjuiaBAQ/Q=,iv:uQdxqkLtiwQfvfsSFFXK3scz9D1lVeTT4/qw3wpvP44=,tag:wOM+lUJI+epdIypMneVgNw==,type:str]
+  mac_only_encrypted: true
+  version: 3.13.3

bootstrap/helmfile/apps.yaml

@@ -0,0 +1,54 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/helmfile
+
+# Bootstraps core applications that provide a minimal runtime base for the
+# cluster. These releases are installed first so the cluster has the resources
+# Flux needs before its own reconciliation begins.
+#
+# After this bootstrap phase, Flux is ready to take over management of the
+# application stack and continue reconciling downstream state.
+
+helmDefaults:
+  cleanupOnFail: true
+  forceConflicts: true
+  wait: true
+  waitForJobs: true
+
+bases:
+  - default.yaml
+
+releases:
+  - name: cilium
+    namespace: kube-system
+    inherit:
+      - template: default
+
+  - name: coredns
+    namespace: kube-system
+    inherit:
+      - template: default
+    needs: ["kube-system/cilium"]
+
+  - name: spegel
+    namespace: kube-system
+    inherit:
+      - template: default
+    needs: ["kube-system/coredns"]
+
+  - name: cert-manager
+    namespace: cert-manager
+    inherit:
+      - template: default
+    needs: ["kube-system/spegel"]
+
+  - name: flux-operator
+    namespace: flux-system
+    inherit:
+      - template: default
+    needs: ["cert-manager/cert-manager"]
+
+  - name: flux-instance
+    namespace: flux-system
+    inherit:
+      - template: default
+    needs: ["flux-system/flux-operator"]

bootstrap/helmfile/crds.yaml

@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/helmfile
+
+# Bootstraps cluster-wide Custom Resource Definitions (CRDs) by extracting them
+# from upstream Helm charts and applying them directly with kubectl. The releases
+# below are never reconciled with helmfile apply or helmfile sync — only their
+# CRDs are rendered (via --include-crds) and piped to the cluster.
+#
+# Installing CRDs out-of-band ensures they exist before Flux begins reconciling
+# workloads that reference them, avoiding the need for dependsOn chains on nearly
+# every Kustomization that consumes a CRD-backed resource.
+
+helmDefaults:
+  args:
+    - --include-crds
+    - --no-hooks
+
+bases:
+  - default.yaml
+
+releases:
+  - name: envoy-gateway
+    namespace: network
+    inherit:
+      - template: default
+
+  - name: prometheus-operator-crds
+    namespace: observability
+    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
+    version: 29.0.0

bootstrap/helmfile/default.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/helmfile
+templates:
+  default:
+    chart: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).chart }}'
+    version: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).version }}'
+    values:
+      - ./templates/values.yaml.gotmpl

bootstrap/helmfile/templates/release.yaml.gotmpl

@@ -0,0 +1,3 @@
+{{- $oci := fromYaml (readFile (printf "../../kubernetes/apps/%s/%s/app/ocirepository.yaml" .Release.Namespace .Release.Name)) -}}
+chart: {{ $oci.spec.url }}
+version: {{ $oci.spec.ref.tag }}

bootstrap/helmfile/templates/values.yaml.gotmpl

@@ -0,0 +1 @@
+{{ (fromYaml (readFile (printf "../../../kubernetes/apps/%s/%s/app/helmrelease.yaml" .Release.Namespace .Release.Name))).spec.values | toYaml }}

bootstrap/mod.just

@@ -0,0 +1,105 @@
+set no-exit-message
+set quiet
+set shell := ['bash', '-euo', 'pipefail', '-c']
+set script-interpreter := ['bash', '-euo', 'pipefail']
+set default-list
+set default-script
+
+kubernetes_dir := justfile_dir() + '/kubernetes'
+
+[doc('Bootstrap the Talos cluster')]
+[group('bootstrap')]
+talos: talos-secret talos-apply talos-talosconfig talos-kubeconfig
+
+[doc('Bootstrap apps into the Talos cluster')]
+[group('bootstrap')]
+apps: apps-ready apps-namespaces apps-secrets apps-crds apps-helm
+    just log info "Cluster is bootstrapped — Flux will start syncing the Git repository"
+
+# No sops call or existence guard is needed: the bundle is stored already
+# encrypted with the repo's age recipient, and existing bundles are left
+# untouched.
+[private]
+[working-directory('../talos')]
+talos-secret:
+    just log info "Generating secrets" stage "{{ recipe_name() }}"
+    topf secrets --confirm=false > /dev/null
+
+[private]
+[working-directory('../talos')]
+talos-apply:
+    just log info "Applying talos config and bootstrapping" stage "{{ recipe_name() }}"
+    topf apply --auto-bootstrap --confirm=false
+
+[private]
+[working-directory('../talos')]
+talos-talosconfig:
+    just log info "Generating talosconfig" stage "{{ recipe_name() }}"
+    topf talosconfig > talosconfig
+
+# topf issues short-lived admin certs by default; 8760h keeps the
+# kubeconfig usable long-term.
+[private]
+[working-directory('../talos')]
+talos-kubeconfig:
+    just log info "Fetching kubeconfig" stage "{{ recipe_name() }}"
+    topf kubeconfig --validity 8760h > "{{ justfile_dir() }}/kubeconfig"
+
+[private]
+apps-crds:
+    just log info "Applying CRDs" stage "{{ recipe_name() }}"
+    if ! helmfile --file "{{ source_directory() }}/helmfile/crds.yaml" template --quiet | yq eval-all --exit-status 'select(.kind == "CustomResourceDefinition")' | kubectl apply --server-side --force-conflicts --filename -; then
+        just log fatal "Failed to apply crds"
+    fi
+
+[private]
+apps-helm:
+    just log info "Syncing helmfile" stage "{{ recipe_name() }}"
+    if ! helmfile --file "{{ source_directory() }}/helmfile/apps.yaml" sync --hide-notes; then
+        just log fatal "Failed to sync helmfile"
+    fi
+
+[private]
+apps-namespaces:
+    just log info "Applying namespaces for apps" stage "{{ recipe_name() }}"
+    for app in "{{ kubernetes_dir }}/apps"/*/; do
+        ns="$(basename "$app")"
+        if kubectl create namespace "$ns" --dry-run=client -o yaml \
+                | kubectl apply --server-side --filename - &>/dev/null; then
+            just log info "Namespace applied" namespace "$ns"
+        else
+            just log fatal "Failed to apply namespace" namespace "$ns"
+        fi
+    done
+
+[private]
+apps-secrets:
+    just log info "Applying secrets for apps" stage "{{ recipe_name() }}"
+    for secret in \
+        "{{ source_directory() }}/deploy-key.sops.yaml" \
+        "{{ source_directory() }}/sops-age.sops.yaml" \
+        "{{ kubernetes_dir }}/components/sops/cluster-secrets.sops.yaml"
+    do
+        name="$(basename "$secret" .sops.yaml)"
+        if sops decrypt "$secret" \
+                | kubectl --namespace flux-system apply --server-side --filename - &>/dev/null; then
+            just log info "Secret applied" resource "$name"
+        else
+            just log fatal "Failed to apply secret" resource "$name"
+        fi
+    done
+
+# Wait until nodes register as Ready=False. They only become Ready=True once the CNI is healthy.
+[private]
+apps-ready:
+    just log info "Waiting for nodes to register as Ready=False" stage "{{ recipe_name() }}"
+    if ! kubectl wait nodes --for=condition=Ready=True --all --timeout=10s &>/dev/null; then
+        deadline=$((SECONDS + 600))
+        until kubectl wait nodes --for=condition=Ready=False --all --timeout=10s &>/dev/null; do
+            if (( SECONDS >= deadline )); then
+                just log fatal "Timed out waiting for nodes to register"
+            fi
+            just log info "Nodes not available, waiting for nodes to be available. Retrying in 5 seconds..."
+            sleep 5
+        done
+    fi

bootstrap/sops-age.sops.yaml

@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: sops-age
+  namespace: flux-system
+stringData:
+  age.agekey: ENC[AES256_GCM,data:YRjc3lHz4Y1vwUVqVeqjwIygXc0ifZdj73cv/paYsFndC4/dEToRY3oZk92ZquUACIa5k85iOPCBTeR9V632QCcjhwDsbXxE36IKFKs=,iv:h7Y2WIyG2zkvIIwC1WOPbGfCWN324qExyszqdePwS4A=,tag:U50t2W5lTt/ebt2GIgJWNw==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IFVwZlZaeFc1
+        M0plcDcvMmVPd3VSbkZVMWgya1ZwUXlZck9qMDBybWorYWVwVFBTVjhiaHVOWkho
+        SVpuN1UwUVRqeXZyY0JXMEFjRG13bmRPYXF3ZGM2d1BOQ2xvcTBma1dDTk9udjkv
+        MVNIZ2VHWnVzamo0UnE0MXdkRXRBOHppb3JhMHhWNXR0d3lvaTRlUzNxaHBhSWw1
+        N2tCVUNPRkFSODRlaWd2TEdDbCt4em1QMm5iSTFwUUNldllZcGJ5K0tRNXUvdHFt
+        Wld5MnVGeUx2eFBRZ3Q0R25CZEpEQVB3dFpZNWZKL3FNZW5kMFV6VzU5SldyaWVv
+        elIvRklMVEFtNFF4elZxclc5ZHd0cVZFQVp2Q3cvYWptSjIrOHNNRDFMUHNmQmtz
+        Tzk5Q1FKelo1MEpqcUE2Sy9ucjZFeWNwQnIzcDNvWC9hcW9RSXVvT3ljWWJGVFVG
+        SXk0Sncva1hjYVFQOVVtRlpOK2EzU1Y1OGJJdmQ3NWEzbjF5UmNJYm41cUxvb0xm
+        dXRFU0Jqd3FxM25HcDQxM0ZKWUUreS9SVmsyVHpJS3JLeDhXdWU0K3NYTytUcjJa
+        eWNaYXRURVFpb3BleGMxMWl1NGJJZ3U0OTV0dklENFA0YUVGYWRSQ0NWTmVGT0xh
+        ak13SmxNTEk2ZCtwajh1WjFDeG52RklRWkJ4S1Vza2hMQ0JpRG5aYm9ra3pZZExR
+        dXEyUDBHL1kwOVVPbkw3Nk0wV2xiU2IwVU8rdmR5dTZSUmYwenc4ZEFYTEFEK0ZZ
+        bnhaNGl6REpFZmhuejluMVNFTDlPbkJSUUM1WWpJUXUvSFRNOUFiUzlMVG9ZUUhU
+        Vi9CVVdxbktRYjA0M2pPZllNVHZuMFo0TVlzU2dHcHZObnFYZXJyODBDUm5KZXFi
+        Y21KN2x0RmJFTEEzeVBDbDFkZHhFSm1YaWNQcjlOQ0N1OFZOQ2ZvOWRZdnFEbDIz
+        dmlQOVc3cnhiM2RBSDV4emh0dk43R0s0MUlUVDUvYTRsQ3VuVXJLYUF2ZGUzUjBP
+        YnlzSVB6dHBnQm1SSVpYdnNRWlJQMzErMG9mcFdBMWdEcnZXM0RmV2t0SEoxcS9Q
+        bnpoMUtpczU2V2g0SUxueWlVYmtONWdsdlNyMTNvNDNhd0YvSzllYW5MV3J4WVhW
+        bktPT2xrQTJKTWFFWEZGQUowSkU5SzNMd2FaZ3RjQjU1STlOaUdWTTB0Z2xJQkVx
+        a3BTT2R5bm95amd1Sjd5RkZwSVJmeVBsemtVdStRck81K2pRSzFkaFUxN1gwSGlX
+        Ky9ydjI5QWs4akRFUkY1SG5QNUtYT0pOVFBWNHE1ZUpFdThqT1pzdFFZMVBmOWJB
+        ZnBaQU1UNHU5MWs1V2J2VmlCZlo3bTErMXNQbUwyczU1YTZtWDA0dU9oemU1alcv
+        a3JyYjZwWUEwM1Y4Y1RyelVjd2RDemZmRXFibzltSlhuNFdqYjNya3dxSFMvajJt
+        bkdjZDIwdGpmTTIrbG0ySFBob2hoZnUyRmVUbG1CUTNxR2V0a1h6VHF3Unk1Umc1
+        algyVEczT3J0WGhQeTBzYk1QT0hwbHg4MDR4WkRsY0ZubUxjWFpCcHdxWEtxb2tp
+        Si9IYzBSQU1EUkl5YXJzU0VCKzVaRks0dzBMWVNtZW1mYWVTdmVMb1QzSFB1bGor
+        aitIU2dRYXQybG5DaDZwdHJhNnJtNkNtM3NSV2hqaUU5WE52ald6b0dmZFU4WFJp
+        aThqeGx5OWMvQ0N3SHhYR3EzRnlTWHdTT1FtQTZDUnVyNEg3VVl6Wml0dlpVYVl5
+        Vk5kNm1zZU5CR2s1dDRpSTYrdDVBV2pHcTEvamNwQjFXeHl1NGMvYVBmT3lDRTRt
+        NVE3M3hWa1VTRGNSczNxWnBUcCtPNGVPYi92UGZxc0dyMzFFYUVaVWVBOExlTDcv
+        eDZ4YUt1Mk5pN2c0Wm9RZk9TK1RkUWh0VVg3MmpJYW1MODhBUUk1Tm1KNDJDUQpS
+        alJlRWw2Z0Rrcy9tRVhKRVF5eWNJMlBwKytsNnRwNG4yL2RBSjlhTkw0Ci0tLSAx
+        KzhwMXF5bWowbS9TTEh1bzZCOFFZMFNQQ0lJV2RTT0l6azFEcW1waitrCtC57Bhf
+        GZ0O6k6RkMeIX7smJFeAPpFUSlVEnOOIXdth3ylzbYlaAUP/br3oTWILxc+NOY+x
+        bKhVMF4VxCBsdN4=
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
+  encrypted_regex: ^(data|stringData)$
+  lastmodified: "2026-09-16T19:18:39Z"
+  mac: ENC[AES256_GCM,data:ghV8V2IExENuntQlcnirocvhdaJabhPxDzk4x4EmVSbAIYw6PdSckGzy/KF0vhNxOpBMJhF3lqAwkqZQEVLXP0P9Reh4gWi7tp9Vsk8OUbAChoGykbHhthKKcOeysiSl8jZwL/wBVkbLG/9n6ItIIPb5qOiwgVXOObS477vUufY=,iv:Lb/qCGxrdbLs00HKjQUIiRGPRsVMzThYuZ6zX6dvdNs=,tag:jDMo8sd/F6d0zrss6hBAxA==,type:str]
+  mac_only_encrypted: true
+  version: 3.13.3