move all certs to automatic issuer

apps/actual/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: actual
   namespace: actual
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"

apps/authentik/release.yaml

@@ -25,6 +25,7 @@ spec:
         enabled: true
         ingressClassName: traefik
         annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
           external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
           external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
           traefik.ingress.kubernetes.io/router.tls: "true"
@@ -32,7 +33,7 @@ spec:
         hosts:
           - authentik.michaelthomson.dev
         tls:
-          - secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          - secretName: authentik-tls
             hosts:
               - authentik.michaelthomson.dev
       volumes:

apps/baikal/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: baikal
   namespace: baikal
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - baikal.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: baikal-tls

apps/booklore/release.yaml

@@ -24,6 +24,7 @@ spec:
     ingress:
       enabled: true
       annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
         external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
         external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -36,7 +37,7 @@ spec:
       tls:
         - hosts:
             - booklore.michaelthomson.dev
-          secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          secretName: booklore-tls
 
     # If you want to bring your own persistence (such as a hostPath),
     # disable these and do so in extraVolumes/extraVolumeMounts

apps/gitea/release.yaml

@@ -31,6 +31,7 @@ spec:
       enabled: true
       className: traefik
       annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
         external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
         external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -43,7 +44,7 @@ spec:
       tls:
         - hosts:
             - gitea.michaelthomson.dev
-          secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          secretName: gitea-tls
 
     persistence:
       claimName: gitea-shared-storage

apps/homeassistant/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: homeassistant
   namespace: homeassistant
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
@@ -21,4 +22,4 @@ spec:
   tls:
     - hosts:
         - ha.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: homeassistant-tls

apps/immich/release.yaml

@@ -63,6 +63,7 @@ spec:
         main:
           enabled: true
           annotations:
+            cert-manager.io/cluster-issuer: "letsencrypt-prod"
             external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
             external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
             traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -74,7 +75,7 @@ spec:
           tls:
             - hosts:
                 - immich.michaelthomson.dev
-              secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+              secretName: immich-tls
 
     machine-learning:
       enabled: true

apps/karakeep/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: karakeep-web-ingress
   namespace: karakeep
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - karakeep.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: karakeep-web-ingress-tls

apps/kube-prometheus-stack/release.yaml

@@ -18,25 +18,27 @@ spec:
       ingress:
         enabled: true
         annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
           traefik.ingress.kubernetes.io/router.tls: "true"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
         - grafana.michaelthomson.dev
         path: /
         tls:
-          - secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          - secretName: grafana-tls
             hosts:
               - grafana.michaelthomson.dev
     prometheus:
       ingress:
         enabled: true
         annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
           traefik.ingress.kubernetes.io/router.tls: "true"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
         - prometheus.michaelthomson.dev
         path: /
         tls:
-          - secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          - secretName: prometheus-tls
             hosts:
               - prometheus.michaelthomson.dev

apps/media/bazarr/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: bazarr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     # traefik.ingress.kubernetes.io/router.middlewares: authentik-bazarr@kubernetescrd
@@ -22,4 +23,4 @@ spec:
   tls:
     - hosts:
         - bazarr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: bazarr-tls

apps/media/jellyfin/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: jellyfin
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - jellyfin.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: jellyfin-tls

apps/media/jellyseerr/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: jellyseerr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - jellyseerr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: jellyseerr-tls

apps/media/prowlarr/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: prowlarr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     # traefik.ingress.kubernetes.io/router.middlewares: authentik-prowlarr@kubernetescrd
@@ -22,4 +23,4 @@ spec:
   tls:
     - hosts:
         - prowlarr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: prowlarr-tls

apps/media/radarr/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: radarr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     # traefik.ingress.kubernetes.io/router.middlewares: authentik-radarr@kubernetescrd
@@ -22,4 +23,4 @@ spec:
   tls:
     - hosts:
         - radarr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: radarr-tls

apps/media/sabnzbd/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: sabnzbd
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
@@ -21,4 +22,4 @@ spec:
   tls:
     - hosts:
         - sabnzbd.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: sabnzbd-tls

apps/media/sonarr/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: sonarr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
     # traefik.ingress.kubernetes.io/router.middlewares: authentik-sonarr@kubernetescrd
@@ -22,4 +23,4 @@ spec:
   tls:
     - hosts:
         - sonarr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: sonarr-tls

apps/nextcloud/release.yaml

@@ -21,6 +21,7 @@ spec:
       enabled: true
       className: traefik
       annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
         external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
         external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -28,7 +29,7 @@ spec:
       tls:
         - hosts:
             - nextcloud.michaelthomson.dev
-          secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          secretName: nextclout-tls
       labels: {}
       path: /
       pathType: Prefix
@@ -151,6 +152,7 @@ spec:
       ingress:
         enabled: true
         annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
           external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
           external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -163,7 +165,7 @@ spec:
         tls:
           - hosts:
               - collabora.michaelthomson.dev
-            secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+            secretName: collabora-tls
 
     cronjob:
       enabled: true

apps/ntfy/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: ntfy
   namespace: ntfy
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - ntfy.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: ntfy-tls

apps/pihole/release.yaml

@@ -31,6 +31,7 @@ spec:
 
       # -- Annotations for the ingress
       annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
         traefik.ingress.kubernetes.io/router.tls: "true"
       path: /
@@ -39,7 +40,7 @@ spec:
       tls:
         - hosts:
             - pihole.michaelthomson.dev
-          secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          secretName: pihole-tls
 
     # -- `spec.PersitentVolumeClaim` configuration
     persistentVolumeClaim:

apps/stirling-pdf/release.yaml

@@ -1,31 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: stirling-pdf
-  namespace: stirling-pdf
-spec:
-  chart:
-    spec:
-      chart: stirling-pdf-chart
-      version: 2.x
-      sourceRef:
-        kind: HelmRepository
-        name: stirling-pdf
-  interval: 15m
-  releaseName: stirling-pdf
-  values:
-    ingress:
-      enabled: true
-      annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-      hosts:
-        - host: pdf.michaelthomson.dev
-          paths:
-            - path: "/"
-              pathType: ImplementationSpecific
-      tls:
-        - hosts:
-            - pdf.michaelthomson.dev
-          secretName: letsencrypt-wildcard-cert-michaelthomson.dev
-      ingressClassName: traefik

apps/stirling-pdf/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: stirling-pdf
-  namespace: stirling-pdf
-spec:
-  interval: 15m
-  url: https://stirling-tools.github.io/Stirling-PDF-chart

apps/syncthing/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: syncthing
   namespace: syncthing
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - syncthing.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: syncthing-tls

apps/uptime-kuma/uptime-kuma-ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: uptime-kuma
   namespace: uptime-kuma
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - kuma.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: uptime-kuma-tls

apps/vaultwarden/release.yaml

@@ -43,6 +43,7 @@ spec:
       enabled: true
       class: "traefik"
       additionalAnnotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
         external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
         external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -50,4 +51,4 @@ spec:
       labels: {}
       tls: true
       hostname: "vaultwarden.michaelthomson.dev"
-      tlsSecret: "letsencrypt-wildcard-cert-michaelthomson.dev"
+      tlsSecret: vaultwarden-tls

apps/wg-easy/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: wg-easy
   namespace: wg-easy
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -23,4 +24,4 @@ spec:
   tls:
     - hosts:
         - wireguard.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: wg-easy-tls

bootstrap/apps/kustomization-stirling-pdf.yaml

@@ -1,19 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: stirling-pdf
-  namespace: flux-system
-spec:
-  interval: 15m
-  path: ./apps/stirling-pdf
-  prune: true # remove any elements later removed from the above path
-  wait: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  dependsOn:
-    - name: infra-configs

infrastructure/namespaces/namespace-stirling-pdf.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: stirling-pdf