Phase 1 (author-only): Flux + SOPS bootstrap + interface wiring (T-1.4)

bootstrap/sops (age-keygen refusing in-repo, .sops.yaml, install-age-key.sh glue installing the sops-age Secret) + bootstrap/flux (bootstrap.sh: flux install -> apply -k clusters/dev; decryption/url patches). PM wiring: place .sops.yaml at repo root (SOPS walks to root); inline the 3 flux patches into clusters/dev (avoids kustomize ../ load-restriction). clusters/dev builds with decryption enabled; full CI gate PASS. No key material; nothing executed. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 01:21:01 -05:00
1 parent 0e901f135c
commit 84a2d762f0
@@ -0,0 +1,21 @@
+---
+# Enable SOPS decryption on the `apps` Flux Kustomization (ADR-0007, R-SEC-01).
+#
+# REALISES the commented TODO in clusters/base/apps.yaml (same pattern as the platform patch).
+# Strategic-merge patch — adds the decryption stanza to the base `apps` Kustomization without
+# forking it (R-ENV-02). `sops-age` Secret referenced BY NAME ONLY (created out-of-band).
+#
+# WIRING (clusters owner / PM): add to clusters/dev/kustomization.yaml `patches:` alongside the
+# platform patch, e.g.
+#     patches:
+#       - path: ../../bootstrap/flux/patches/apps-sops-decryption.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: apps
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
@@ -0,0 +1,26 @@
+---
+# Set the reconciliation source URL on the `flux-system` GitRepository (R-GITOPS-01).
+#
+# clusters/base/flux-system.yaml ships a deliberate placeholder:
+#     url: https://REPLACE-ME.invalid/home-network-k3s-impl.git
+# because the bootstrap-source URL is environment-specific and unknown at authoring time (Phase 1
+# has no remote git host yet — spec docs/05 "Source-of-truth", CONTRIBUTING.md).
+#
+# This strategic-merge patch overrides that URL at bootstrap WITHOUT editing clusters/base
+# (R-ENV-02). Fill spec.url with the actual bootstrap source, then wire this file into
+# clusters/dev/kustomization.yaml `patches:` (clusters owner / PM). See ../README.md.
+#
+# PHASE 6 CUTOVER (WS-GITOPS): change this URL to
+#   https://gitea.home.keithjackson.dev/<org>/home-network-k3s-impl.git
+# and keep an off-cluster mirror (docs/05 "Circularity & DR").
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  # >>> REPLACE-ME <<< actual bootstrap source URL (how the local repo is served to the cluster:
+  # git-over-ssh, a git daemon on the workstation NAT gateway, etc. — set by WS-INFRA/operator).
+  url: https://REPLACE-ME.invalid/home-network-k3s-impl.git
+  ref:
+    branch: main
@@ -0,0 +1,29 @@
+---
+# Enable SOPS decryption on the `platform` Flux Kustomization (ADR-0007, R-SEC-01).
+#
+# This REALISES the commented TODO in clusters/base/platform.yaml:
+#     # decryption:
+#     #   provider: sops
+#     #   secretRef:
+#     #     name: sops-age
+# It is a strategic-merge patch (matched by apiVersion/kind/name/namespace) that ADDS the
+# decryption stanza to the existing base Kustomization WITHOUT forking it (R-ENV-02).
+#
+# The `sops-age` Secret is created out-of-band (../../sops/age-key-secret.md); it is referenced
+# BY NAME ONLY here — no key material in git.
+#
+# WIRING (clusters owner / PM — outside the security engineer's subtree): add this file to
+# clusters/dev/kustomization.yaml `patches:` (path-relative), e.g.
+#     patches:
+#       - path: ../../bootstrap/flux/patches/platform-sops-decryption.yaml
+# so the dev overlay reconciles platform manifests with decryption enabled. See ../README.md.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: platform
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age