docs(adr) — stockage objet MinIO : qui déclare quoi, et qui détient quoi

Trois questions indépendantes, tranchées lors du branchement de Kadans sur MinIO (2026-07-26) : qui déclare les buckets d'une app, qui détient les identifiants capables de les créer, et comment l'app lit les siens. La décision de fond est du fondateur : CHACUN SON PÉRIMÈTRE. Une application déclare ses buckets depuis son propre dépôt ; `tools` fournit le serveur, un module de standardisation et un compte de provisionnement — pas la liste. Une première version faisait tout porter par l'infra partagée : à ce rythme, chaque bucket de chaque app devenait une PR sur le dépôt commun. L'ADR consigne aussi les trois identités et leurs portées (root / provisionneur / compte de service), pourquoi la lecture des identifiants est une propriété inconditionnelle de la plateforme plutôt qu'une déclaration par app, et pourquoi les octets ne transitent pas par l'API — avec les conséquences que ça impose (endpoint public, CORS aux origines exactes, pas de basic-auth sur l'ingress S3). Les alternatives écartées sont listées avec leur motif, dont deux que j'avais moi-même proposées et qui étaient plus faibles. Deux limites assumées y figurent : le provisionneur est un secret PARTAGÉ entre rôles CI (sa compromission permet de créer des buckets, pas de lire des objets), et les noms d'actions d'administration MinIO n'ont pas été éprouvés contre le serveur au moment d'écrire. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01CoafGWmRVESaWX819USUUA
2026-07-26 10:21:04 +02:00
11 changed files with 0 additions and 1213 deletions
@@ -1,20 +0,0 @@
 # This file is maintained automatically by "tofu init".
 # Manual edits may be lost in future updates.
 provider "registry.opentofu.org/hashicorp/vault" {
  version     = "4.4.0"
  constraints = "4.4.0"
  hashes = [
    "h1:IhKDv0pTgpy89K3QYmDX872H75Wl7kZKR2scUQynuiA=",
    "zh:0309ea8f81386e17ab13c06c5991ca959708c55c815b0cfba2bbcd865e0d606e",
    "zh:40e56199ccd266bffa216e8ebbcdc2e29b6ef5145b39377be766e763cac759c8",
    "zh:6fad1f073bd2e53e34736e000f98db581137e153ac80bbb5c4f1a1e38b46a1d2",
    "zh:74564fd4759decccf7f3c952aa2feba1012f103a66ec354aa3b3292a2f1b2412",
    "zh:7aae012c1a43e6e5dae6f608ec0f08cdb3f95fa121a32e413fe7ee37cb99947f",
    "zh:7c83f508e164844b1dd9bafe9de0fe60c7be7b55a02e704a6e2f50cff38b7d96",
    "zh:873a42322b68d9fba4a38217b97ee04a1eb617e811d7f9954016f5c3eb6cb0bc",
    "zh:9db2b13472cf91a5f18f0a7c6ae532277c05b0980d87f492341426b981679f7b",
    "zh:ac1cbd2926265db80efe3f1814bed82901f7d8a7d4e5b1e22592e1eef234b1c7",
    "zh:f465a955cc96f640e7426a648ba672c169a4a2959bad6146fe61583d67642561",
  ]
 }
@@ -1,66 +0,0 @@
 # minio-values.yaml - Configuration MinIO pour k3s
 # À placer dans factory/argocd/apps/minio/
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: minio
  namespace: argocd
 spec:
  project: default
  source:
    repoURL: https://charts.bitnami.com/bitnami
    chart: minio
    targetRevision: 12.13.0
    helm:
      values: |
        global:
          storageClass: longhorn
        auth:
          rootUser: kadans-admin
          rootPassword: "${MINIO_PASSWORD}"  # À définir dans Vault
        mode: standalone
        persistence:
          enabled: true
          size: 50Gi
          storageClass: longhorn
        resources:
          requests:
            memory: 512Mi
            cpu: 250m
          limits:
            memory: 1Gi
            cpu: 500m
        service:
          type: ClusterIP
          port: 9000
        ingress:
          enabled: true
          hostname: minio.arcodange.lab
          annotations:
            traefik.ingress.kubernetes.io/router.entrypoints: websecure
            traefik.ingress.kubernetes.io/router.tls: "true"
          tls: true
        buckets:
          - name: kadans-videos
            policy: none
            purge: false
          - name: kadans-thumbnails
            policy: none
            purge: false
  destination:
    server: https://kubernetes.default.svc
    namespace: storage
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
@@ -1,160 +0,0 @@
 # ADR 20260407: CI/CD Architecture with ArgoCD, Gitea, and Vault
 ## Status
 Proposed
 ## Context
 The home lab requires a secure and automated CI/CD pipeline to deploy applications to the k3s cluster. The pipeline must integrate with:
 - **Gitea**: For Git repository management and CI runners.
 - **ArgoCD**: For GitOps-based continuous deployment.
 - **Vault**: For secrets management and OIDC authentication.
 - **Gitea Act Runner**: For executing CI jobs.
 ## Decision
 We will implement a **GitOps-driven CI/CD pipeline** with the following components:
 ### 1. Gitea OIDC Authentication with Vault
 - Gitea is registered as an OIDC application in Vault.
 - Vault issues short-lived tokens for Gitea users.
 - The `gitea_oidc_auth.yml` playbook automates this setup using Playwright and OpenTofu.
 - **OIDC Workflow**:
  1. The `oidc_jwt_token.sh` script (base64-encoded in `secrets.vault_oauth__sh_b64`) handles the OIDC flow.
  2. Gitea Act Runner executes the script to obtain an ID token from Gitea.
  3. The ID token is used to authenticate with Vault and retrieve secrets.
 ### 2. Gitea Act Runner
 - Deployed on `pi1` and `pi3` (not on the Gitea host, which is `pi2`).
 - Uses Docker-in-Docker for job execution.
 - **Custom Runner Image (`ubuntu-latest-ca`)**: Required due to the self-signed `.lab` domain. The custom image includes the local CA certificate to trust the Gitea instance (`gitea.arcodange.lab`).
 - Managed via Docker Compose (`03_cicd.yml`).
 ### 3. ArgoCD
 - Deployed on the k3s cluster (via HelmChart in `/var/lib/rancher/k3s/server/manifests/argocd.yaml`).
 - Uses Gitea as the source of truth for GitOps.
 - Synchronizes the `factory` repository to deploy applications.
 - Configured with Traefik for TLS termination.
 ### 4. Vault Secrets Operator
 - Deployed in the `tools` namespace.
 - Manages secrets for applications deployed via ArgoCD.
 - Integrates with Gitea OIDC for authentication.
 - **Helm Chart Integration**:
  - `VaultAuth`: Authenticates with Vault using Kubernetes service accounts.
  - `VaultStaticSecret`: Retrieves static secrets (e.g., `kvv2/webapp/config`).
  - `VaultDynamicSecret`: Generates dynamic secrets (e.g., PostgreSQL credentials).
 ### 5. Security
 - **TLS**: Traefik terminates TLS using Let's Encrypt.
 - **OIDC**: Gitea authentication via Vault.
 - **Secrets**: Stored in Vault, injected via the Vault Secrets Operator.
 ## Architecture Diagram
 ```mermaid
 %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#333333', 'edgeLabelBackground':'#f0f0f0', 'tertiaryColor': '#e67e22'}}}%%
 graph TD
    %% Styles
    classDef gitea fill:#ffcc99,stroke:#cc9966,color:#333;
    classDef argocd fill:#99ffcc,stroke:#66cc99,color:#333;
    classDef vault fill:#ccccff,stroke:#6666cc,color:#333;
    classDef k3s fill:#ff9999,stroke:#cc0000,color:#333;
    classDef runner fill:#ffff99,stroke:#cccc00,color:#333;
    %% Components
    Gitea["Gitea (pi2)"]:::gitea
    ArgoCD["ArgoCD (k3s)"]:::argocd
    Vault["Vault (k3s/tools)"]:::vault
    Runner1["Gitea Act Runner (pi1)"]:::runner
    Runner2["Gitea Act Runner (pi3)"]:::runner
    VaultOperator["Vault Secrets Operator (k3s/tools)"]:::vault
    k3s["k3s Cluster"]:::k3s
    %% Workflow
    Gitea -->|OIDC Auth| Vault
    Gitea -->|Trigger CI| Runner1
    Gitea -->|Trigger CI| Runner2
    Runner1 -->|Deploy to| k3s
    Runner2 -->|Deploy to| k3s
    ArgoCD -->|GitOps Sync| Gitea
    ArgoCD -->|Deploy Apps| k3s
    VaultOperator -->|Inject Secrets| k3s
    Vault -->|Secrets| VaultOperator
    %% Annotations
    linkStyle 0,1,2,3,4,5,6,7 stroke:#999,stroke-width:1px;
 ```
 ## Consequences
 ### Positive
 - **Automated Deployments**: ArgoCD ensures the cluster state matches Git.
 - **Secure Secrets**: Vault centralizes secret management.
 - **Scalable CI**: Gitea Act Runners can be added to any host.
 - **OIDC Integration**: Secure authentication via Vault.
 ### Negative
 - **Complexity**: Multiple moving parts (Gitea, ArgoCD, Vault).
 - **Dependency on Vault**: If Vault fails, CI/CD may be disrupted.
 - **Learning Curve**: Requires familiarity with GitOps and Vault.
 ## Alternatives Considered
 ### Alternative 1: GitHub Actions
 - **Rejected**: Self-hosted Gitea aligns better with the home lab's privacy goals.
 ### Alternative 2: Jenkins
 - **Rejected**: ArgoCD + Gitea Act Runner is lighter and more GitOps-native.
 ### Alternative 3: No CI/CD
 - **Rejected**: Manual deployments are error-prone and unscalable.
 ## Sequence Diagrams
 ### 1. CI/CD Workflow for OpenTofu/Terraform
 ```mermaid
 sequenceDiagram
    participant Gitea
    participant Runner as Gitea Act Runner (pi1/pi3)
    participant Vault
    participant WebApp as WebApp (k3s)
    Gitea->>Runner: Trigger vault.yaml workflow
    Runner->>Gitea: Execute vault_oauth__sh_b64 (OIDC)
    Gitea-->>Runner: Return ID Token
    Runner->>Vault: Authenticate with ID Token
    Vault-->>Runner: Return Vault Token
    Runner->>Runner: Run OpenTofu/Terraform
    Runner->>Vault: Fetch Secrets (via Vault Action)
    Vault-->>Runner: Return Secrets
    Runner->>WebApp: Deploy Changes
 ```
 ### 2. Vault Secrets Operator Workflow
 ```mermaid
 sequenceDiagram
    participant ArgoCD
    participant WebApp as WebApp (k3s)
    participant VaultOperator as Vault Secrets Operator
    participant Vault
    ArgoCD->>WebApp: Deploy Helm Chart
    WebApp->>VaultOperator: Create VaultAuth (K8s Auth)
    VaultOperator->>Vault: Authenticate (K8s Service Account)
    Vault-->>VaultOperator: Return Vault Token
    WebApp->>VaultOperator: Create VaultStaticSecret (kvv2/webapp/config)
    VaultOperator->>Vault: Fetch Static Secret
    Vault-->>VaultOperator: Return Secret
    VaultOperator->>WebApp: Inject Secret (secretkv)
    WebApp->>VaultOperator: Create VaultDynamicSecret (postgres/creds/webapp)
    VaultOperator->>Vault: Generate Dynamic Secret
    Vault-->>VaultOperator: Return Credentials
    VaultOperator->>WebApp: Inject Credentials (vso-db-credentials)
    WebApp->>WebApp: Restart Pods (Rollout)
 ```
 ## Success Metrics
 - Gitea Act Runners successfully execute CI jobs.
 - ArgoCD synchronizes the `factory` repository without errors.
 - Vault Secrets Operator injects secrets into deployed applications.
@@ -1,334 +0,0 @@
 # ADR 20260407: Network Architecture
 ## Status
 Proposed
 ## Context
 The home lab requires a secure and resilient network architecture to support:
 - Internal services (`.lab` domain).
 - External services (`.arcodange.fr` domain).
 - DNS resolution and ad-blocking (Pi-hole).
 - TLS certificate management (Step CA).
 - Ingress routing (Traefik).
 - CDN and DDoS protection (Cloudflare).
 ## Decision
 We will implement a **multi-layered network architecture** with the following components:
 ### 1. External Layer (Internet)
 - **Cloudflare**: CDN, DDoS protection, and DNS for `.arcodange.fr`.
 - **DuckDNS**: Dynamic DNS for external access.
 - **Livebox**: ISP-provided gateway (NAT, DHCP, firewall).
 ### 2. Internal Layer (Home Lab)
 - **Pi-hole (pi1, pi3)**: DNS sinkhole for ad-blocking and internal DNS resolution.
 - **Step CA (pi1)**: Internal certificate authority for `.lab` domain.
 - **Traefik (k3s)**: Ingress controller with TLS termination.
 - **k3s Cluster**: Hosts internal services with Longhorn storage.
 ### 3. DNS Architecture
 - **Pi-hole**: Primary DNS for internal clients.
  - Forwards `.lab` queries to Step CA.
  - Forwards external queries to Cloudflare (1.1.1.1).
 - **Step CA**: Issues certificates for `.lab` services.
 - **Cloudflare**: Manages `.arcodange.fr` DNS records.
 ### 4. Ingress and TLS
 - **Traefik**: Terminates TLS for both `.lab` and `.arcodange.fr` domains.
  - Uses Let's Encrypt for `.arcodange.fr`.
  - Uses Step CA for `.lab`.
 - **Helm Chart Annotations**:
  - `traefik.ingress.kubernetes.io/router.entrypoints: websecure`
  - `traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt`
  - `traefik.ingress.kubernetes.io/router.middlewares: localIp@file`
 ### 5. Security
 - **Cloudflare Tunnel**: Securely exposes internal services without port forwarding.
 - **CrowdSec**: Intrusion detection and banning.
 - **Traefik Middlewares**: IP filtering, rate limiting, and authentication.
 - **Cloudflare Turnstile**: CAPTCHA protection for public-facing services.
 ## Architecture Diagrams
 ### 0. High-Level Network Architecture (Architecture Beta)
 ```mermaid
 %%{init: {'theme': 'neutral', 'themeVariables': { 
  'primaryColor': '#f0f0f0', 
  'primaryBorderColor': '#333333', 
  'primaryTextColor': '#333333', 
  'lineColor': '#333333', 
  'tertiaryColor': '#e67e22'
 }}}%%
 architectureBeta
    %% External Layer
    box "Internet" #f9f9f9
        component Cloudflare["Cloudflare\n(CDN/DNS)"] #f9f9f9
        component DuckDNS["DuckDNS\n(DDNS)"] #f9f9f9
    end
    %% External Gateway
    box "External Gateway" #e6e6e6
        component Livebox["Livebox\n(NAT/Firewall)"] #e6e6e6
    end
    %% Internal Layer
    box "Internal Network\n(192.168.1.0/24)" #d4d4d4
        %% DNS Layer
        box "DNS" #ffff99
            component PiHole1["Pi-hole\n(pi1)"] #ffff99
            component PiHole3["Pi-hole\n(pi3)"] #ffff99
            component StepCA["Step CA\n(pi1)"] #ccccff
        end
        %% k3s Layer
        box "k3s Cluster" #ff9999
            component Traefik["Traefik\n(Ingress)"] #ff9999
            component CrowdSec["CrowdSec\n(Security)"] #ff9999
            component Gitea["Gitea\n(pi2)"] #ffcc99
            component Vault["Vault\n(Secrets)"] #ccccff
        end
    end
    %% Connections
    Cloudflare --> Livebox : "DNS"
    DuckDNS --> Livebox : "DDNS"
    Livebox --> PiHole1 : "NAT"
    Livebox --> PiHole3 : "NAT"
    Livebox --> Traefik : "NAT"
    PiHole1 --> StepCA : "Forward .lab"
    PiHole1 --> Cloudflare : "Forward External"
    PiHole3 --> StepCA : "Forward .lab"
    PiHole3 --> Cloudflare : "Forward External"
    Traefik --> Cloudflare : "TLS (Let's Encrypt)"
    Traefik --> StepCA : "TLS (Step CA)"
    CrowdSec --> Traefik : "Ban IPs"
    Traefik --> Gitea : "Route"
    Traefik --> Vault : "Route"
 ```
 ### 1. High-Level Network Architecture
 ```mermaid
 %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#333333', 'edgeLabelBackground':'#f0f0f0', 'tertiaryColor': '#f89136'}}}%%
 graph TD
    %% Styles
    classDef internet fill:#f9f9f9,stroke:#999,color:#333;
    classDef external fill:#e6e6e6,stroke:#555,color:#333;
    classDef internal fill:#d4d4d4,stroke:#777,color:#333;
    classDef security fill:#ff9999,stroke:#cc0000,color:#333;
    classDef dns fill:#ffff99,stroke:#cccc00,color:#333;
    classDef ca fill:#ccccff,stroke:#6666cc,color:#333;
    %% Internet
    subgraph "Internet"
        Cloudflare["Cloudflare (CDN/DNS)"]:::internet
        DuckDNS["DuckDNS (DDNS)"]:::internet
    end
    %% External Gateway
    subgraph "External Gateway"
        Livebox["Livebox (NAT/Firewall)"]:::external
    end
    %% Internal Network
    subgraph "Internal Network (192.168.1.0/24)"
        %% Pi-hole DNS
        PiHole1["Pi-hole (pi1)"]:::dns
        PiHole3["Pi-hole (pi3)"]:::dns
        %% Step CA
        StepCA["Step CA (pi1)"]:::ca
        %% k3s Cluster
        k3s["k3s Cluster"]:::internal
        Traefik["Traefik (k3s)"]:::internal
        CrowdSec["CrowdSec (k3s)"]:::security
        %% Services
        Gitea["Gitea (pi2)"]:::internal
        Vault["Vault (k3s)"]:::internal
    end
    %% Connections
    Cloudflare -->|DNS| Livebox
    DuckDNS -->|DDNS| Livebox
    Livebox -->|NAT| PiHole1
    Livebox -->|NAT| PiHole3
    Livebox -->|NAT| k3s
    %% Internal DNS
    PiHole1 -->|Forward .lab| StepCA
    PiHole1 -->|Forward External| Cloudflare
    PiHole3 -->|Forward .lab| StepCA
    PiHole3 -->|Forward External| Cloudflare
    %% Ingress
    Traefik -->|"TLS (Let's Encrypt)"| Cloudflare
    Traefik -->|"TLS (Step CA)"| StepCA
    CrowdSec -->|Ban IPs| Traefik
    %% Service Access
    Traefik -->|Route| Gitea
    Traefik -->|Route| Vault
 ```
 ### 2. DNS Resolution Flow
 ```mermaid
 sequenceDiagram
    participant Client
    participant PiHole
    participant StepCA
    participant Cloudflare
    participant ExternalDNS
    Client->>PiHole: Query example.lab
    PiHole->>StepCA: Forward .lab query
    StepCA-->>PiHole: Return A record
    PiHole-->>Client: Return response
    Client->>PiHole: Query example.com
    PiHole->>Cloudflare: Forward to 1.1.1.1
    Cloudflare->>ExternalDNS: Resolve externally
    ExternalDNS-->>Cloudflare: Return response
    Cloudflare-->>PiHole: Return response
    PiHole-->>Client: Return response
 ```
 ### 3. Ingress and TLS Flow
 ```mermaid
 sequenceDiagram
    participant User
    participant Cloudflare
    participant Traefik
    participant StepCA
    participant Service
    User->>Cloudflare: HTTPS Request (webapp.arcodange.fr)
    Cloudflare->>Traefik: Forward to internal IP
    Traefik->>Let's Encrypt: Request Certificate
    Let's Encrypt-->>Traefik: Issue Certificate
    Traefik->>Service: Route request
    Service-->>Traefik: Return response
    Traefik-->>Cloudflare: Return HTTPS response
    Cloudflare-->>User: Return response
    User->>Traefik: HTTPS Request (webapp.arcodange.lab)
    Traefik->>StepCA: Request Certificate
    StepCA-->>Traefik: Issue Certificate
    Traefik->>Service: Route request
    Service-->>Traefik: Return response
    Traefik-->>User: Return HTTPS response
 ```
 ### 4. Security Flow (CrowdSec + Traefik)
 ```mermaid
 sequenceDiagram
    participant Attacker
    participant Traefik
    participant CrowdSec
    participant BannedIPs
    Attacker->>Traefik: Malicious Request
    Traefik->>CrowdSec: Log suspicious activity
    CrowdSec->>BannedIPs: Add IP to ban list
    BannedIPs-->>Traefik: Update middleware
    Traefik-->>Attacker: Block request (403)
 ```
 ## Playbook and Role Analysis
 ### 1. Pi-hole Deployment
 - **Playbook**: `playbooks/system/pihole.yml`
 - **Role**: `arcodange.factory.pihole`
 - **Configuration**:
  - Upstream DNS: Cloudflare (1.1.1.1) and Step CA for `.lab`.
  - Blocklists: Ad-blocking and malware domains.
 ### 2. Step CA Deployment
 - **Playbook**: `playbooks/ssl/ssl.yml`
 - **Role**: `step_ca`
 - **Configuration**:
  - Internal CA for `.lab` domain.
  - Short-lived certificates (default: 24h).
 ### 3. Traefik Deployment
 - **Playbook**: `playbooks/system/system_k3s.yml` (via k3s)
 - **Helm Chart**: `traefik` (installed via k3s)
 - **Key Annotations**:
  ```yaml
  traefik.ingress.kubernetes.io/router.entrypoints: websecure
  traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
  traefik.ingress.kubernetes.io/router.middlewares: localIp@file
  ```
 ### 4. CrowdSec Deployment
 - **Playbook**: `playbooks/tools/crowdsec.yml`
 - **Role**: `arcodange.factory.crowdsec`
 - **Configuration**:
  - Bouncer integration with Traefik.
  - Custom scenarios for brute-force and bot detection.
 ## Consequences
 ### Positive
 - **Resilient DNS**: Pi-hole provides ad-blocking and internal DNS resolution.
 - **Secure TLS**: Step CA for internal services, Let's Encrypt for external.
 - **DDoS Protection**: Cloudflare absorbs external attacks.
 - **Intrusion Detection**: CrowdSec bans malicious IPs automatically.
 ### Negative
 - **Complexity**: Multiple layers require careful configuration.
 - **Single Point of Failure**: Pi-hole is critical for internal DNS.
 - **Certificate Management**: Step CA requires maintenance for `.lab` domain.
 ## Alternatives Considered
 ### Alternative 1: Public DNS for `.lab`
 - **Rejected**: Exposing internal domains is a security risk.
 ### Alternative 2: No Ad-Blocking
 - **Rejected**: Pi-hole provides essential security and privacy.
 ### Alternative 3: Self-Signed Certificates
 - **Rejected**: Step CA provides better usability with short-lived certs.
 ### 5. Cloudflare Turnstile + CrowdSec Flow
 ```mermaid
 sequenceDiagram
    participant User
    participant Cloudflare
    participant Turnstile
    participant Traefik
    participant CrowdSec
    participant BannedIPs
    User->>Cloudflare: Request protected endpoint
    Cloudflare->>Turnstile: Challenge (CAPTCHA)
    Turnstile-->>Cloudflare: Return token
    Cloudflare->>Traefik: Forward request with token
    alt Valid Token
        Traefik->>Service: Route request
        Service-->>Traefik: Return response
        Traefik-->>Cloudflare: Return response
        Cloudflare-->>User: Return success
    else Invalid Token
        Traefik->>CrowdSec: Log suspicious activity
        CrowdSec->>BannedIPs: Add IP to ban list
        BannedIPs-->>Traefik: Update middleware
        Traefik-->>Cloudflare: Block request (403)
        Cloudflare-->>User: Return "Access Denied"
    end
 ```
 ## Success Metrics
 - Pi-hole blocks >50% of ads and trackers.
 - Step CA issues certificates without downtime.
 - Traefik routes 100% of external traffic via Cloudflare.
 - CrowdSec bans >10 malicious IPs per day.
 - Cloudflare Turnstile blocks >90% of bot traffic.
@@ -1,77 +0,0 @@
 #!/bin/bash
 # Script pour générer un token Gitea et configurer Hermes
 # Usage: ./get_gitea_token.sh
 set -e
 echo "🔑 Génération d'un token Gitea pour Hermes..."
 # Créer l'inventaire
 cat > ~/Work/Arcodange/factory/inventory.ini << 'EOF'
 [gitea]
 gitea.arcodange.lab ansible_host=192.168.1.202 ansible_user=git
 [gitea:vars]
 ansible_ssh_private_key_file=~/.ssh/id_rsa_arcodange
 EOF
 # Créer le playbook
 cat > ~/Work/Arcodange/factory/get_token.yml << 'EOF'
 - name: Générer un token Gitea pour Hermes
  hosts: localhost
  connection: local
  gather_facts: true
  vars:
    gitea_user_name: arcodange
    gitea_token_name: hermes-{{ ansible_date_time.iso8601 }}
    gitea_token_scopes: "write:repository,write:user"
    gitea_token_fact_name: gitea_api_token
    gitea_base_url: "https://gitea.arcodange.lab"
  tasks:
    - name: Inclure le role gitea_token
      include_role:
        name: .claude/worktrees/focused-dirac-151213/ansible/arcodange/factory/roles/gitea_token
    - name: Afficher le token généré
      debug:
        var: gitea_api_token
      when: gitea_api_token is defined and gitea_api_token != 'deleted'
    - name: Sauvegarder le token dans un fichier temporaire
      copy:
        content: "{{ gitea_api_token }}"
        dest: /tmp/gitea_token.txt
      when: gitea_api_token is defined and gitea_api_token != 'deleted'
 EOF
 # Exécuter le playbook
 echo "📜 Exécution du playbook Ansible..."
 cd ~/Work/Arcodange/factory
 ansible-playbook -i inventory.ini get_token.yml
 # Récupérer le token depuis le fichier temporaire
 if [ -f /tmp/gitea_token.txt ]; then
    TOKEN=$(cat /tmp/gitea_token.txt)
    echo "✅ Token généré avec succès !"
    # Configurer Hermes
    echo "🛠 Configuration de Hermes..."
    hermes config set gitea.token "$TOKEN"
    hermes config set gitea.base_url "https://gitea.arcodange.lab"
    hermes config set gitea.username "arcodange"
    # Nettoyer
    rm -f /tmp/gitea_token.txt
    rm -f inventory.ini
    rm -f get_token.yml
    echo "✨ Configuration terminée !"
    echo "Token stocké dans la configuration Hermes."
 else
    echo "⚠️ Impossible de récupérer le token. Vérifie que :"
    echo "  1. Le serveur Gitea est accessible"
    echo "  2. La clé SSH est configurée (~/.ssh/id_rsa_arcodange)"
    echo "  3. L'utilisateur 'git' a les permissions nécessaires"
 fi
@@ -1,53 +0,0 @@
 #!/bin/bash
 # Script pour générer un token Gitea via API REST et configurer Hermes
 # Usage: ./get_gitea_token_rest.sh
 set -e
 echo "🔑 Génération d'un token Gitea via API REST..."
 # Demander les informations nécessaires
 read -p "Nom d'utilisateur Gitea (arcodange) : " GITEA_USER
 GITEA_USER=${GITEA_USER:-arcodange}
 read -s -p "Mot de passe Gitea : " GITEA_PASSWORD
 echo ""
 read -p "Nom du token (hermes-access) : " TOKEN_NAME
 TOKEN_NAME=${TOKEN_NAME:-hermes-access}
 read -p "Portées (write:repository,write:user) : " SCOPES
 SCOPES=${SCOPES:-write:repository,write:user}
 # Appeler l'API Gitea pour créer un token
 echo "📡 Appel à l'API Gitea..."
 RESPONSE=$(curl -s -X POST \
  "https://gitea.arcodange.lab/api/v1/users/${GITEA_USER}/tokens" \
  -H "Content-Type: application/json" \
  -u "${GITEA_USER}:${GITEA_PASSWORD}" \
  -d "{\"name\":\"${TOKEN_NAME}\",\"scopes\":[\"${SCOPES//,/\",\"}\"]}")
 # Extraire le token de la réponse
 TOKEN=$(echo "$RESPONSE" | jq -r '.sha1' 2>/dev/null)
 if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
    echo "❌ Échec de la création du token"
    echo "Réponse de l'API :"
    echo "$RESPONSE" | jq .
    exit 1
 fi
 echo "✅ Token généré avec succès !"
 echo "Token: $TOKEN"
 # Configurer Hermes
 echo "🛠 Configuration de Hermes..."
 hermes config set gitea.token "$TOKEN"
 hermes config set gitea.base_url "https://gitea.arcodange.lab"
 hermes config set gitea.username "$GITEA_USER"
 echo "✨ Configuration terminée !"
 echo "Token stocké dans la configuration Hermes."
 echo ""
 echo "Pour vérifier la configuration :"
 echo "  hermes config get gitea"
@@ -1,57 +0,0 @@
 #!/bin/bash
 # Script pour générer un token Gitea via API REST avec fichier temporaire
 # Usage: ./get_gitea_token_tmp.sh
 set -e
 echo "🔑 Génération d'un token Gitea via API REST..."
 # Utiliser le fichier temporaire existant
 PASS_FILE="/tmp/gitea_pass.txt"
 if [ ! -f "$PASS_FILE" ]; then
    echo "❌ Fichier de mot de passe introuvable : $PASS_FILE"
    echo "Créez-le avec : echo 'votre_mot_de_passe' > $PASS_FILE"
    exit 1
 fi
 # Variables
 GITEA_USER="arcodange"
 TOKEN_NAME="hermes-$(date +%Y%m%d-%H%M%S)"
 SCOPES="write:repository,write:user"
 # Appeler l'API Gitea pour créer un token
 echo "📡 Appel à l'API Gitea..."
 RESPONSE=$(curl -s -X POST \
  "https://gitea.arcodange.lab/api/v1/users/${GITEA_USER}/tokens" \
  -H "Content-Type: application/json" \
  -u "${GITEA_USER}:$(cat $PASS_FILE)" \
  -d "{\"name\":\"${TOKEN_NAME}\",\"scopes\":[\"${SCOPES//,/\",\"}\"]}")
 # Nettoyer le fichier temporaire
 rm -f "$PASS_FILE"
 # Extraire le token de la réponse
 TOKEN=$(echo "$RESPONSE" | jq -r '.sha1' 2>/dev/null)
 if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
    echo "❌ Échec de la création du token"
    echo "Réponse de l'API :"
    echo "$RESPONSE" | jq .
    exit 1
 fi
 echo "✅ Token généré avec succès !"
 echo "Token: $TOKEN"
 # Configurer Hermes
 echo "🛠 Configuration de Hermes..."
 hermes config set gitea.token "$TOKEN"
 hermes config set gitea.base_url "https://gitea.arcodange.lab"
 hermes config set gitea.username "$GITEA_USER"
 echo "✨ Configuration terminée !"
 echo "Token stocké dans la configuration Hermes."
 echo ""
 echo "Pour vérifier la configuration :"
 hermes config get gitea
@@ -1,27 +0,0 @@
 - name: Générer un token Gitea pour Hermes
  hosts: localhost
  connection: local
  gather_facts: true
  vars:
    gitea_user_name: arcodange
    gitea_token_name: hermes-{{ ansible_date_time.iso8601 }}
    gitea_token_scopes: "write:repository,write:user"
    gitea_token_fact_name: gitea_api_token
    gitea_base_url: "https://gitea.arcodange.lab"
  tasks:
    - name: Inclure le role gitea_token
      include_role:
        name: .claude/worktrees/focused-dirac-151213/ansible/arcodange/factory/roles/gitea_token
    - name: Afficher le token généré
      debug:
        var: gitea_api_token
      when: gitea_api_token is defined and gitea_api_token != 'deleted'
    - name: Sauvegarder le token dans un fichier temporaire
      copy:
        content: "{{ gitea_api_token }}"
        dest: /tmp/gitea_token.txt
      when: gitea_api_token is defined and gitea_api_token != 'deleted'
@@ -1,5 +0,0 @@
 [gitea]
 gitea.arcodange.lab ansible_host=192.168.1.202 ansible_user=git
 [gitea:vars]
 ansible_ssh_private_key_file=~/.ssh/id_rsa_arcodange
@@ -1,59 +0,0 @@
 # This file is maintained automatically by "tofu init".
 # Manual edits may be lost in future updates.
 provider "registry.opentofu.org/cyrilgdn/postgresql" {
  version     = "1.24.0"
  constraints = "1.24.0"
  hashes = [
    "h1:GDmie2p7Ii7BOPHeMUtM6bwSvr3YvsIWUQ30TsSc+5I=",
    "zh:023153dbb689296f3edbc34cb6d57355bbfa8af6faa3e20ab71a71a909c8ff56",
    "zh:0d222293c1c30b0af5b9ac9a662f7fd6bbbdca0859b02046527ad133838fafd8",
    "zh:1234c6ec6bd49d8a2afc80fecc748ebdd01555ac4f1b4618dc7fce670bf18858",
    "zh:18d047ffa30156da8281206b977d23dc9690e87137b0a9dd7049d2776e603ce6",
    "zh:2f009822960405a20f2d304f70187f77338bf3e633f522da35021f4b83bc6a8f",
    "zh:39e540af29165e9dc28712651d308fdf0fcac018850a0841f7c5380f58aafb64",
    "zh:4930ac482b2b0f06681228932d0ed91ac4f34555b15285787f048e33ffa72d39",
    "zh:4d33f4a9f449166a5cb495e764c8a09bf9710927162d30f5db46283a88023cad",
    "zh:55d6584517ebaf7b4ecefedbf600af0d12077a00834b777f884b4631f77b7e13",
    "zh:5f6ab45cbb3f2b62f82f0377c7f10d4aa0f35db7f426af7529915401097c252f",
    "zh:5fac6d4d676425d9491a42b992b166bdbae5ecd1fe6815bc75435f7c3024015b",
    "zh:a13f1a7cc763053da2317178c7ba1d57f5fddf14f9be282881da63fc28fd0e57",
    "zh:d566eaae8ba33542f7b290e8fa0f2eb7f2cfb51d5ae7cafaae261f76f3f3e422",
    "zh:ea4d50591767696b6f27d977c44b17390415d21b761e00f591d67c6248c18949",
  ]
 }
 provider "registry.opentofu.org/hashicorp/random" {
  version = "3.7.2"
  hashes = [
    "h1:cFGCdxTlsrteTiaOV/iOQdql7eJkD3F/vtJxenkj9IE=",
    "zh:2ffeb1058bd7b21a9e15a5301abb863053a2d42dffa3f6cf654a1667e10f4727",
    "zh:519319ed8f4312ed76519652ad6cd9f98bc75cf4ec7990a5684c072cf5dd0a5d",
    "zh:7371c2cc28c94deb9dba62fbac2685f7dde47f93019273a758dd5a2794f72919",
    "zh:9b0ac4c1d8e36a86b59ced94fa517ae9b015b1d044b3455465cc6f0eab70915d",
    "zh:c6336d7196f1318e1cbb120b3de8426ce43d4cacd2c75f45dba2dbdba666ce00",
    "zh:c71f18b0cb5d55a103ea81e346fb56db15b144459123f1be1b0209cffc1deb4e",
    "zh:d2dc49a6cac2d156e91b0506d6d756809e36bf390844a187f305094336d3e8d8",
    "zh:d5b5fc881ccc41b268f952dae303501d6ec9f9d24ee11fe2fa56eed7478e15d0",
    "zh:db9723eaca26d58c930e13fde221d93501529a5cd036b1f167ef8cff6f1a03cc",
    "zh:fe3359f733f3ab518c6f85f3a9cd89322a7143463263f30321de0973a52d4ad8",
  ]
 }
 provider "registry.opentofu.org/hashicorp/vault" {
  version     = "4.4.0"
  constraints = "4.4.0"
  hashes = [
    "h1:IhKDv0pTgpy89K3QYmDX872H75Wl7kZKR2scUQynuiA=",
    "zh:0309ea8f81386e17ab13c06c5991ca959708c55c815b0cfba2bbcd865e0d606e",
    "zh:40e56199ccd266bffa216e8ebbcdc2e29b6ef5145b39377be766e763cac759c8",
    "zh:6fad1f073bd2e53e34736e000f98db581137e153ac80bbb5c4f1a1e38b46a1d2",
    "zh:74564fd4759decccf7f3c952aa2feba1012f103a66ec354aa3b3292a2f1b2412",
    "zh:7aae012c1a43e6e5dae6f608ec0f08cdb3f95fa121a32e413fe7ee37cb99947f",
    "zh:7c83f508e164844b1dd9bafe9de0fe60c7be7b55a02e704a6e2f50cff38b7d96",
    "zh:873a42322b68d9fba4a38217b97ee04a1eb617e811d7f9954016f5c3eb6cb0bc",
    "zh:9db2b13472cf91a5f18f0a7c6ae532277c05b0980d87f492341426b981679f7b",
    "zh:ac1cbd2926265db80efe3f1814bed82901f7d8a7d4e5b1e22592e1eef234b1c7",
    "zh:f465a955cc96f640e7426a648ba672c169a4a2959bad6146fe61583d67642561",
  ]
 }
@@ -1,355 +0,0 @@
 # Home lab
 ```mermaid
 %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#333333', 'edgeLabelBackground':'#f0f0f0', 'tertiaryColor': '#e67e22'}}}%%
 graph LR
    %% Styles
    classDef internet fill:#f9f9f9,stroke:#999,color:#333,font-size:12px;
    classDef arcodange fill:#e6e6e6,stroke:#555,color:#333,font-size:12px;
    classDef cluster fill:#d4d4d4,stroke:#777,color:#333,font-size:12px;
    %% Internet
    subgraph "Internet / Le monde"
        direction TB
        DuckDNS["🌐 DuckDNS<br>(duckdns.org)"]:::internet
        GoogleCloud["☁️ Google Cloud<br>(cloud.google.com)"]:::internet
        Cloudflare["🛡️ Cloudflare<br>(cloudflare.com)"]:::internet
        OVHcloud["🖥️ OVHcloud<br>(ovhcloud.com)"]:::internet
        Zoho["📧 Zoho<br>(zoho.eu)"]:::internet
        CrowdSec["🔒 CrowdSec<br>(crowdsec.net)"]:::internet
    end
    %% Bureaux Arcodange
    subgraph "Bureaux Arcodange"
        direction TB
        Livebox["📡 Livebox<br>(gateway)"]:::arcodange
        MacBook["💻 MacBook Pro M4"]:::arcodange
        subgraph "Cluster Raspberry Pi"
            direction LR
            Pi1["🐧 pi1"]:::cluster
            Pi2["🐧 pi2"]:::cluster
            Pi3["🐧 pi3"]:::cluster
        end
    end
 ```
 ## Network
 ```mermaid
 %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#333333', 'edgeLabelBackground':'#f0f0f0', 'tertiaryColor': '#e67e22'}}}%%
 graph LR
    %% Styles
    classDef internet fill:#f9f9f9,stroke:#999,color:#333,font-size:12px;
    classDef arcodange fill:#e6e6e6,stroke:#555,color:#333,font-size:12px;
    classDef k3sServer fill:#ff9999,stroke:#cc0000,color:#333,font-size:12px;
    classDef k3sAgent fill:#99ff99,stroke:#00cc00,color:#333,font-size:12px;
    classDef traefik fill:#9999ff,stroke:#0000cc,color:#333,font-size:12px;
    classDef dns fill:#ffff99,stroke:#cccc00,color:#333,font-size:12px;
    classDef cloudflared fill:#ccccff,stroke:#6666cc,color:#333,font-size:12px;
    %% Internet
    subgraph "Internet / Le monde"
        direction TB
        DuckDNS["🌐 DuckDNS<br>(duckdns.org)"]:::internet
        subgraph "Cloudflare"
            CloudflareService["🛡️ Cloudflare<br>(cloudflare.com)"]:::internet
            DNSNote@{ shape: text, label: "redirige *.arcodange.fr<br>→ Cloudflared Tunnel" }
        end
    end
    %% Bureaux Arcodange
    subgraph "Bureaux Arcodange"
        direction TB
        Livebox["📡 Livebox<br>(passerelle)"]:::arcodange
        MacBook["💻 MacBook Pro M4"]:::arcodange
        %% Cluster Raspberry Pi
        subgraph "Cluster Raspberry Pi"
            direction LR
            %% Noeud pi1
            subgraph "pi1"
                Pi1["🐧 pi1"]:::k3sServer
                subgraph "K3s (Server)"
                    Traefik["🚀 Traefik"]:::traefik
                    Cloudflared["☁️ Cloudflared Tunnel"]:::cloudflared
                end
                PiHole1["🧹 Pi-hole"]:::dns
                NS1@{ shape: text, label: "nameserver : pi3" }
                DNSArcodange@{ shape: text, label: ".arcodange.lab<br>→ Traefik", color:#cccc00 }
            end
            %% Noeud pi2
            subgraph "pi2"
                Pi2["🐧 pi2"]:::k3sAgent
            end
            %% Noeud pi3
            subgraph "pi3"
                Pi3["🐧 pi3"]:::k3sAgent
                PiHole3["🧹 Pi-hole"]:::dns
                NS3@{ shape: text, label: "nameserver : pi1" }
            end
        end
    end
    %% Connexions
    %% Pi-hole → Livebox (DNS)
    PiHole1 -.->|DNS| Livebox
    PiHole3 -.->|DNS| Livebox
    %% Cloudflare → Cloudflared Tunnel → Traefik
    CloudflareService -.-> Cloudflared
    Cloudflared --> Traefik
    %% Livebox → Traefik (HTTPS)
    Livebox -->|redirige HTTPS| Traefik
 ```
 ## with Gitea
 ```mermaid
 %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#333333', 'edgeLabelBackground':'#f0f0f0', 'tertiaryColor': '#e67e22'}}}%%
 graph LR
    %% Styles
    classDef internet fill:#f9f9f9,stroke:#999,color:#333,font-size:12px;
    classDef arcodange fill:#e6e6e6,stroke:#555,color:#333,font-size:12px;
    classDef k3sServer fill:#ff9999,stroke:#cc0000,color:#333,font-size:12px;
    classDef k3sAgent fill:#99ff99,stroke:#00cc00,color:#333,font-size:12px;
    classDef traefik fill:#9999ff,stroke:#0000cc,color:#333,font-size:12px;
    classDef dns fill:#ffff99,stroke:#cccc00,color:#333,font-size:12px;
    classDef cloudflared fill:#ccccff,stroke:#6666cc,color:#333,font-size:12px;
    classDef gitea fill:#ffcc99,stroke:#cc9966,color:#333,font-size:12px;
    classDef cms fill:#99ffcc,stroke:#66cc99,color:#333,font-size:12px;
    classDef domainFR fill:#99ccff,stroke:#0066cc,color:#333,font-size:12px;
    classDef domainLAB fill:#ccff99,stroke:#66cc66,color:#333,font-size:12px;
    %% Internet
    subgraph "Internet / Le monde"
        direction TB
        DuckDNS["🌐 DuckDNS<br>(duckdns.org)"]:::internet
        subgraph "Cloudflare"
            CloudflareService["🛡️ Cloudflare<br>(cloudflare.com)"]:::internet
            DNSNote@{ shape: text, label: "redirige *.arcodange.fr<br>→ Cloudflared Tunnel" }
        end
    end
    %% Bureaux Arcodange
    subgraph "Bureaux Arcodange"
        direction TB
        Livebox["📡 Livebox<br>(passerelle)"]:::arcodange
        MacBook["💻 MacBook Pro M4"]:::arcodange
        %% Cluster Raspberry Pi
        subgraph "Cluster Raspberry Pi"
            direction LR
            %% Noeud pi1
            subgraph "pi1"
                Pi1["🐧 pi1"]:::k3sServer
                subgraph "K3s (Server)"
                    Traefik["🚀 Traefik"]:::traefik
                    Cloudflared["☁️ Cloudflared Tunnel"]:::cloudflared
                end
                PiHole1["🧹 Pi-hole"]:::dns
                GiteaRunner1["🏃 Gitea Act Runner"]:::gitea
                NS1@{ shape: text, label: "nameserver : pi3" }
                DNSArcodange@{ shape: text, label: ".arcodange.lab<br>→ Traefik", color:#cccc00 }
            end
            %% Noeud pi2
            subgraph "pi2"
                Pi2["🐧 pi2"]:::k3sAgent
                Gitea["🦊 Gitea"]:::gitea
                subgraph "K3s (Agent)"
                    CMS["📝 CMS"]:::cms
                end
            end
            %% Noeud pi3
            subgraph "pi3"
                Pi3["🐧 pi3"]:::k3sAgent
                PiHole3["🧹 Pi-hole"]:::dns
                GiteaRunner3["🏃 Gitea Act Runner"]:::gitea
                NS3@{ shape: text, label: "nameserver : pi1" }
            end
        end
    end
    %% Connexions Pi-hole → Livebox (DNS)
    PiHole1 -.->|DNS| Livebox
    PiHole3 -.->|DNS| Livebox
    %% Cloudflare → Cloudflared Tunnel → Traefik
    CloudflareService -.-> Cloudflared
    Cloudflared --> Traefik
    %% Livebox → Traefik (HTTPS)
    Livebox -->|redirige HTTPS| Traefik
    %% Gitea Act Runner → Gitea
    GiteaRunner1 -.->|communication| Gitea
    GiteaRunner3 -.->|communication| Gitea
    %% Domains → CMS via Traefik
    Traefik -->|cms-rec.arcodange.fr| CMS:::domainFR
    Traefik -->|www.arcodange.lab| CMS:::domainLAB
 ```
 ### with security
 ```mermaid
 %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#333333', 'edgeLabelBackground':'#f0f0f0', 'tertiaryColor': '#05e2ff1c'}}}%%
 graph LR
    %% Styles
    classDef internet fill:#f9f9f9,stroke:#999,color:#333,font-size:12px;
    classDef arcodange fill:#e6e6e6,stroke:#555,color:#333,font-size:12px;
    classDef k3sServer fill:#ff9999,stroke:#cc0000,color:#333,font-size:12px;
    classDef k3sAgent fill:#99ff99,stroke:#00cc00,color:#333,font-size:12px;
    classDef traefik fill:#9999ff,stroke:#0000cc,color:#333,font-size:12px;
    classDef dns fill:#ffff99,stroke:#cccc00,color:#333,font-size:12px;
    classDef cloudflared fill:#ccccff,stroke:#6666cc,color:#333,font-size:12px;
    classDef gitea fill:#ffcc99,stroke:#cc9966,color:#333,font-size:12px;
    classDef cms fill:#99ffcc,stroke:#66cc99,color:#333,font-size:12px;
    classDef domainFR fill:#99ccff,stroke:#0066cc,color:#333,font-size:12px;
    classDef domainLAB fill:#ccff99,stroke:#66cc66,color:#333,font-size:12px;
    classDef crowdsec fill:#ff99cc,stroke:#cc6699,color:#333,font-size:12px;
    classDef security fill:#ffcccc,stroke:#cc9999,color:#333,font-size:12px;
    %% Internet
    subgraph "Internet / Le monde"
        direction TB
        subgraph "Cloudflare"
            CloudflareService["🛡️ Cloudflare<br>(cloudflare.com)"]:::internet
            DNSNote@{ shape: text, label: "redirige *.arcodange.fr<br>→ Cloudflared Tunnel" }
        end
    end
    %% Bureaux Arcodange
    subgraph "Bureaux Arcodange"
        direction TB
        Livebox["📡 Livebox<br>(passerelle)"]:::arcodange
        DNSArcodange@{ shape: text, label: ".arcodange.lab<br>→ Traefik" }
        %% Cluster Raspberry Pi
        subgraph "Cluster Raspberry Pi"
            direction LR
            %% Noeud pi1
            subgraph "pi1"
                Pi1["🐧 pi1"]:::k3sServer
                subgraph "K3s (Server)"
                    Traefik["🚀 Traefik"]:::traefik
                    Cloudflared["☁️ Cloudflared Tunnel"]:::cloudflared
                end
                PiHole1["🧹 Pi-hole"]:::dns
                GiteaRunner1["🏃 Gitea Act Runner"]:::gitea
                NS1@{ shape: text, label: "nameserver : pi3" }
            end
            %% Noeud pi2
            subgraph "pi2"
                Pi2["🐧 pi2"]:::k3sAgent
                Gitea["🦊 Gitea"]:::gitea
                subgraph "K3s (Agent)"
                    CMS["📝 CMS"]:::cms
                end
            end
            %% Noeud pi3
            subgraph "pi3"
                Pi3["🐧 pi3"]:::k3sAgent
                PiHole3["🧹 Pi-hole"]:::dns
                GiteaRunner3["🏃 Gitea Act Runner"]:::gitea
                subgraph "K3s (Agent)"
                    CrowdSec["🔒 CrowdSec"]:::crowdsec
                end
                NS3@{ shape: text, label: "nameserver : pi1" }
            end
        end
        %% Sécurité combinée
        subgraph "Sécurité"
            Turnstile["🛡️ Cloudflared Turnstile<br>(CAPTCHA)"]:::security
            BannedIPs["🚫 CrowdSec<br>(IP bannies)"]:::security
        end
    end
    %% Connexions Pi-hole → Livebox (DNS)
    PiHole1 -.->|DNS| Livebox
    PiHole3 -.->|DNS| Livebox
    %% Internet → Livebox
    CloudflareService --> Livebox
    %% Gitea Act Runner → Gitea
    GiteaRunner1 -.->|communication| Gitea
    GiteaRunner3 -.->|communication| Gitea
    %% Cloudflare → Cloudflared Tunnel → Sécurité → Traefik
    CloudflareService -.-> Cloudflared
    Cloudflared --> Turnstile
    Turnstile --> BannedIPs
    BannedIPs --> Traefik
    %% Livebox → Sécurité → Traefik
    Livebox --> Turnstile
    %% Domaines → Gitea/CMS via Traefik
    Traefik -->|gitea.arcodange.fr| Gitea:::domainFR
    Traefik -->|gitea.arcodange.lab| Gitea:::domainLAB
    Traefik -->|cms-rec.arcodange.fr| CMS:::domainFR
    Traefik -->|www.arcodange.lab| CMS:::domainLAB
 ```
 ## CI/CD Architecture
 ```mermaid
 %%{init: {'theme': 'base', 'themeVariables': { 'primaryColor': '#333333', 'edgeLabelBackground':'#f0f0f0', 'tertiaryColor': '#e67e22'}}}%%
 graph TD
    %% Styles
    classDef gitea fill:#ffcc99,stroke:#cc9966,color:#333;
    classDef argocd fill:#99ffcc,stroke:#66cc99,color:#333;
    classDef vault fill:#ccccff,stroke:#6666cc,color:#333;
    classDef k3s fill:#ff9999,stroke:#cc0000,color:#333;
    classDef runner fill:#ffff99,stroke:#cccc00,color:#333;
    %% Components
    Gitea["Gitea (pi2)"]:::gitea
    ArgoCD["ArgoCD (k3s)"]:::argocd
    Vault["Vault (k3s/tools)"]:::vault
    Runner1["Gitea Act Runner (pi1)"]:::runner
    Runner2["Gitea Act Runner (pi3)"]:::runner
    VaultOperator["Vault Secrets Operator (k3s/tools)"]:::vault
    k3s["k3s Cluster"]:::k3s
    WebApp["WebApp (k3s)"]:::k3s
    %% Workflow
    Gitea -->|OIDC Auth| Vault
    Gitea -->|Trigger CI| Runner1
    Gitea -->|Trigger CI| Runner2
    Runner1 -->|Deploy to| k3s
    Runner2 -->|Deploy to| k3s
    ArgoCD -->|GitOps Sync| Gitea
    ArgoCD -->|Deploy Apps| k3s
    VaultOperator -->|Inject Secrets| WebApp
    Vault -->|Secrets| VaultOperator
    WebApp -->|Uses| VaultOperator
    %% Annotations
    linkStyle 0,1,2,3,4,5,6,7 stroke:#999,stroke-width:1px;
    %% Notes
    note1["Custom runner image includes<br>.lab CA cert"]
    Runner1 --> note1
    Runner2 --> note1
    %% OIDC Workflow
    note2["OIDC Flow:<br>1. Runner executes vault_oauth__sh_b64<br>2. Obtains ID token from Gitea<br>3. Authenticates with Vault"]
    Runner1 --> note2
    Runner2 --> note2
 ```