mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Sonnet 5
d0c5563671
Single-node Vault (raft storage, standalone mode) plus a restore CronJob that pulls the latest raft snapshot from the VPS's own local MinIO (already receiving snapshots every 6h from home) and restores it every 6h, offset 30 minutes after the home-side snapshot job. Not an independent root of trust: raft snapshot restore replaces the entire storage backend including the keyring, so after every restore this Vault is sealed with HOME's actual keyring - unsealing it needs a copy of home's real unseal key, stored directly on the VPS cluster (kubectl, not git, same pattern as vps-minio-root-secret). First-run bootstrap uses a throwaway single-Shamir-key init just to get through the very first restore, then is irrelevant from then on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
34 lines
935 B
YAML
34 lines
935 B
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: vps-vault
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "2" # after vps-minio (wave 1) - restore job needs it
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: vps-standby
|
|
sources:
|
|
- repoURL: https://helm.releases.hashicorp.com
|
|
chart: vault
|
|
targetRevision: 0.32.0
|
|
helm:
|
|
valueFiles:
|
|
- $values/infrastructure/vps-standby/vault/values.yaml
|
|
- repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
|
|
targetRevision: main
|
|
ref: values
|
|
- repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
|
|
targetRevision: main
|
|
path: infrastructure/vps-standby/vault/manifests
|
|
destination:
|
|
name: vps-standby
|
|
namespace: vault
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|