---
# WireGuard remote-access VPN (north-south INGRESS). Reconciled by its OWN non-gating post-platform
# Flux Kustomization (clusters/base/vpn-ingress.yaml, dependsOn platform-config, wait:false) — the
# same placement as crafty/headlamp/homepage/runbooks, for the same reason: a leaf whose pod can be
# legitimately unhealthy must never sit in the gating `platform` tier, where one component's
# unhealth stalls platform-config and every apps wave behind it (DECISIONS-LOG: "Headlamp gating
# stall"). That rationale is unusually concrete here: until the operator replaces the `REPLACE-ME`
# placeholder in wg-server-key.sops.yaml (runbooks/vpn-remote-access.md step 2) this DaemonSet
# CANNOT start, so putting it in the gating tier would have taken the whole platform down on merge.
#
# NOT in platform/kustomization.yaml — see clusters/base/vpn-ingress.yaml.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  # The peer register: which devices may dial in. PLAINTEXT and reviewable on purpose (see the file).
  - peers.yaml
  # The listener itself: hostNetwork DaemonSet, udp/51820 on every node.
  - daemonset.yaml
  # Namespace default-deny baseline. NOTE: does NOT constrain the hostNetwork DaemonSet — the file
  # says so at length rather than implying a protection it cannot provide.
  - networkpolicy.yaml  # The server's WireGuard private key — the ONE secret here. SOPS-encrypted (R-SEC-01, spec
  # docs/07), decrypted per-env by the `vpn-ingress` Kustomization, referenced by name only from
  # daemonset.yaml (R-IDP-04). Its plaintext `.example` sibling carries the operator hand-off --
  # deliberately NOT named here: conformance/tests/l0-static/no-plaintext-secrets fails any
  # kustomization that mentions an unencrypted template, because naming one is how a plaintext
  # Secret gets applied by accident. (It matches comments too. That is correct, not overzealous.)
  #
  # SHIPS WITH A `REPLACE-ME` PLACEHOLDER, already encrypted. An agent must not
  # mint a long-lived private key (CLAUDE.md §6), and the init container validates the value with
  # `wg pubkey`, so the unfilled state is a loud CrashLoop naming this file, never a server that
  # quietly cannot handshake.
  - wg-server-key.sops.yaml
#
# THIS COMPONENT CARRIES AN ENCRYPTED SECRET, so BOTH overlays must patch the `vpn-ingress`
# Kustomization with a `decryption:` stanza — clusters/dev and clusters/prod both do, added by the
# same change as this file. That patch is as load-bearing as the file itself: without it kustomize
# hands Flux the raw ciphertext, the Secret APPLIES CLEANLY full of ENC[...], and nothing in any
# Flux condition looks wrong. The init container's `wg pubkey` guard exists partly to turn exactly
# that into a named error rather than a silently non-working tunnel.