---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  - helmrepository.yaml
  - helmrelease.yaml
  # Volume policies for schedule (1)'s opt-out FSB: skip the external NFS bulk tier by SOURCE TYPE.
  # Must exist before the Schedule references it by name (same Kustomization, so one apply).
  - volume-policies.yaml
  # --- PER-ENVIRONMENT `cloud` INI credential (split 2026-09-07) -----------------------------------
  # BOTH Secrets are applied to BOTH clusters; the HelmRelease picks ONE by name via
  # `existingSecret: velero-cloud-credentials${BACKUP_CREDENTIALS_SUFFIX}` (cluster-vars: dev "",
  # prod "-prod"). They are separate objects so rotating one environment's key can never touch the
  # other's — the failure mode that made the split necessary (a single shared Secret carrying R2 keys
  # would have pointed dev's Velero at MinIO with credentials MinIO has never issued).
  #
  # dev  -> velero-cloud-credentials       : the scoped MinIO key for http://192.168.1.9:9000.
  #                                          Kept in sync with the staging source of truth
  #                                          platform/backup/minio-credentials.sops.yaml + the
  #                                          Proxmox host ansible-vault.
  # prod -> velero-cloud-credentials-prod  : the Cloudflare R2 token for k3s-prod-backup.
  #
  # Both are decrypted by the `velero` Flux Kustomization's SOPS stanza (clusters/dev + clusters/prod).
  - velero-cloud.sops.yaml
  - velero-cloud-prod.sops.yaml