Arcelia infrastructure

/etc/arcelia is the local source of truth for Acrab's K3s services.

Traefik is installed with Helm chart 41.0.2. It binds host ports 8080 and 8443; its values are in platform/traefik/values.yaml. The default TLS store uses the dedicated arcelia.space apex certificate, while the Forgejo Ingress uses the separate *.arcelia.space certificate.

Argo CD is installed internally with Helm chart 10.2.1. Its service is ClusterIP-only; access it through a temporary port-forward when needed.

Forgejo runs in K3s using /mnt/data/forgejo/data. The stopped Docker container is retained only for rollback and must never run at the same time as the K3s deployment.

Apply or reconcile Helm releases and manifests without sudo:

/etc/arcelia/scripts/apply

Show status:

/etc/arcelia/scripts/status

TLS certificate files are root-readable under platform/traefik/certificates/. Refresh both Kubernetes TLS Secrets after certificate renewal:

sudo /etc/arcelia/scripts/refresh-tls

Certificate files and private keys must never be committed to Git.

The arcelia-registry image pull secret in the arcelia namespace is managed by a SealedSecret (platform/sealed-secrets/arcelia-registry.yaml). The Sealed Secrets controller runs in kube-system (platform/sealed-secrets/controller.yaml) and decrypts the committed SealedSecret into a live Secret in-cluster. If the namespace is torn down, re-applying the kustomization recreates the Secret automatically.

To re-seal after a token rotation: update the live Secret, then re-seal it with kubeseal --controller-namespace=kube-system --format=yaml and commit the new SealedSecret. The controller's private key lives in kube-system; back it up if the cluster might be rebuilt, or all SealedSecrets become undecryptable.