---
# WireGuard remote-access VPN (north-south INGRESS). Reconciled by its OWN non-gating post-platform
# Flux Kustomization (clusters/base/vpn-ingress.yaml, dependsOn platform-config, wait:false) — the
# same placement as crafty/headlamp/homepage/runbooks, for the same reason: a leaf whose pod can be
# legitimately unhealthy must never sit in the gating `platform` tier, where one component's
# unhealth stalls platform-config and every apps wave behind it (DECISIONS-LOG: "Headlamp gating
# stall"). That rationale is unusually concrete here: until the operator creates the `wg-server-key`
# Secret (runbooks/vpn-remote-access.md step 1) this DaemonSet CANNOT start, so putting it in the
# gating tier would have taken the whole platform down on merge.
#
# NOT in platform/kustomization.yaml — see clusters/base/vpn-ingress.yaml.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - namespace.yaml
  # The peer register: which devices may dial in. PLAINTEXT and reviewable on purpose (see the file).
  - peers.yaml
  # The listener itself: hostNetwork DaemonSet, udp/51820 on every node.
  - daemonset.yaml
  # Namespace default-deny baseline. NOTE: does NOT constrain the hostNetwork DaemonSet — the file
  # says so at length rather than implying a protection it cannot provide.
  - networkpolicy.yaml
#
# DELIBERATELY ABSENT: a Secret. The server's private key (`wg-server-key`) is created out of band
# by the operator and referenced BY NAME from daemonset.yaml. There is no `*.sops.yaml` here, so
# this component needs NO SOPS decryption stanza in clusters/dev or clusters/prod — unlike
# crafty/headlamp/velero. If that key is ever migrated into SOPS, BOTH halves must land together:
# the file here, and a `decryption:` patch naming the `vpn-ingress` Kustomization in each overlay.
# Without the patch, kustomize hands Flux the raw ciphertext and the pod mounts a key full of
# ENC[...] — which applies cleanly and fails only at handshake time.