vibecarbon 0.1.0

package/carbon/k8s/base/traefik/network-policy.yaml

@@ -0,0 +1,92 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: traefik-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-traefik
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow external traffic on HTTP and HTTPS (from LB and direct)
+    - ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 443
+    # Allow health check probes on traefik port
+    - ports:
+        - protocol: TCP
+          port: 8080
+  egress:
+    # Allow connection to all pods in namespace (Traefik routes to app, kong, studio)
+    - to:
+        - podSelector: {}
+    # Allow DNS resolution
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # Kubernetes API egress for traefik's CRD/Ingress informers.
+    # Without these rules kube-router rejects outbound traffic from
+    # traefik to the apiserver, traefik loops on `connect: connection
+    # refused`, never loads IngressRoutes, and serves its default 404
+    # on every request. Surfaced in k8s-ha 2026-04-28 deploy run
+    # (verify-1df-1dg log) when the public probe got 404 even though
+    # the app pods + Service endpoints were healthy.
+    #
+    # CIDR coupling: the two ranges below are k3s defaults
+    # (--service-cidr 10.43.0.0/16, --cluster-cidr 10.42.0.0/16) that
+    # carbon/cloud-init/k3s/master-init.sh does NOT override. If you
+    # ever pass --service-cidr or --cluster-cidr there, also update
+    # both this file AND carbon/k8s/base/app/network-policy.yaml.
+    # k8s NetworkPolicy has no Service-name selector, so we have to
+    # name the CIDRs explicitly.
+    #
+    # 10.43.0.1:443 = kubernetes.default Service ClusterIP via kube-proxy
+    # DNAT (works on worker nodes).
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.1/32
+      ports:
+        - protocol: TCP
+          port: 443
+    # 0.0.0.0/0:6443 = the apiserver, dial-anywhere on apiserver-protocol
+    # port. Background: the kubernetes Service ClusterIP (10.43.0.1) DNATs
+    # at the OUTPUT chain BEFORE the CNI evaluates NetworkPolicy egress, so
+    # the policy sees the *post-NAT* destination — the master node IP from
+    # the EndpointSlice. With k3s installed via `--node-ip=<public>` and
+    # HCLOUD_NETWORK NOT set on the Hetzner CCM (the patch that would
+    # populate InternalIP=10.0.1.x was reverted in src/lib/deploy/k8s/k3s.js
+    # because it broke kubelet's TLS cert SAN — cert is generated for the
+    # public IP only, so kubectl logs/exec fail x509 verify when InternalIP
+    # changes post-startup), the master's reported IP is the public IP. So
+    # 10.0.0.0/8 doesn't match and 10.42.0.0/16 (pod CIDR) was never on the
+    # wire — both diagnostically wrong RCAs from earlier.
+    #
+    # The IP changes every deploy, so we can't list it. Allow any
+    # destination on 6443 — port 6443 is apiserver-protocol; the only
+    # listeners are k8s control planes. Deny-by-default is preserved on
+    # every other port.
+    #
+    # Repro chain:
+    # - k8s deploy fanout4 2026-04-30 e3: 10.42.0.0/16:6443 → connection refused
+    # - k8s-ha deploy fanout4b 2026-05-01: tightened to 10.0.0.0/8 + tried
+    #   CCM HCLOUD_NETWORK; reverted CCM (cert SAN) — left 10.0.0.0/8
+    # - k8s-ha restore fanout5 2026-05-01: same connection-refused on
+    #   redeploy because Endpoint resolved to public IP again. Final fix.
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - protocol: TCP
+          port: 6443

package/carbon/k8s/base/traefik/service.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  labels:
+    app: vibecarbon-traefik
+    component: ingress
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: web
+      protocol: TCP
+      name: web
+    - port: 443
+      targetPort: websecure
+      protocol: TCP
+      name: websecure
+  selector:
+    app: vibecarbon-traefik
+---
+# Internal service for dashboard access
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-dashboard
+  labels:
+    app: vibecarbon-traefik
+    component: ingress
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: traefik
+      protocol: TCP
+      name: traefik
+  selector:
+    app: vibecarbon-traefik

package/carbon/k8s/flux/README.md

@@ -0,0 +1,49 @@
+# Flux CD GitOps Configuration
+
+This directory contains Flux CD cluster-level glue (the `clusters/` GitRepositories + Kustomizations that wire the app manifests). Chart-level resources (HelmRepositories + HelmReleases) moved to `carbon/k8s/gitops/<component>/` in Phases 2–3 of the GitOps refactor (see `plans/gitops-refactor-2026-04-20.md`).
+
+You do **not** need the `flux` CLI locally — `deploy.js` bootstraps Flux via a single `kubectl apply -f <release url>`.
+
+## Directory layout
+
+```
+carbon/k8s/
+├── flux/
+│   ├── clusters/
+│   │   ├── primary/vibecarbon.yaml   # GitRepository + Kustomizations (app manifests)
+│   │   └── standby/vibecarbon.yaml
+│   └── README.md                     # you are here
+└── gitops/
+    ├── supabase/
+    │   ├── kustomization.yaml        # configMapGenerator + resources list
+    │   ├── helm-repository.yaml      # supabase-community HelmRepository
+    │   └── helm-release.yaml         # supabase HelmRelease (reads supabase-values ConfigMap)
+    └── cert-manager-webhook-hetzner/
+        ├── kustomization.yaml
+        ├── helm-repository.yaml      # hetzner-cloud HelmRepository
+        └── helm-release.yaml
+```
+
+## How deploy wires Flux
+
+1. `ensureFluxRunning(env)` — applies `https://github.com/fluxcd/flux2/releases/download/v2.8.5/install.yaml`, then `kubectl rollout status` on the four flux-system controllers (`source`, `helm`, `kustomize`, `notification`).
+2. **Cert-manager webhook** (only when DNS provider = hetzner): `kubectl apply -k carbon/k8s/gitops/cert-manager-webhook-hetzner/` → `kubectl wait helmrelease/cert-manager-webhook-hetzner`.
+3. **Supabase**: deploy renders `supabase.values.yaml` (substituting `{{DOMAIN}}` / `{{PROJECT_NAME}}`) into a tempdir containing the bundle files, then `kubectl apply -k <tempdir>` (kustomize generates the `supabase-values` ConfigMap from the rendered file). Then `kubectl wait helmrelease/supabase` (25 min budget).
+
+Flux's 5-minute HelmRepository interval means transient source-controller fetch failures self-heal inside the HelmRelease wait budget. There is no client-side reconcile poking.
+
+## Useful commands (post-deploy, for debugging)
+
+```bash
+kubectl get helmrelease,kustomization,helmrepository -A
+kubectl describe helmrelease supabase -n flux-system
+kubectl annotate --overwrite helmrelease/supabase -n flux-system reconcile.fluxcd.io/requestedAt="$(date -u +%FT%TZ)"
+kubectl logs -n flux-system deploy/helm-controller --tail=200
+kubectl logs -n flux-system deploy/source-controller --tail=200
+```
+
+## Secrets
+
+The Supabase HelmRelease reads secrets from the `vibecarbon-secrets` Secret in the `vibecarbon` namespace (created by deploy before the HelmRelease is applied). The cert-manager-webhook-hetzner HelmRelease reads `hetzner-api-token` in the `cert-manager` namespace.
+
+If you need to ship additional secrets through Git (e.g. for other HelmReleases), use Sealed Secrets, SOPS, or External Secrets Operator. Phase 4 of the GitOps refactor (GitRepository-driven reconciliation, see plan doc) is when we introduce this.

package/carbon/k8s/flux/clusters/primary/vibecarbon.yaml

@@ -0,0 +1,128 @@
+---
+# Flux GitRepository + Kustomizations for the primary cluster.
+#
+# URL is templated at project-create time via substitution of
+# {{GITHUB_OWNER}}/{{PROJECT_NAME}} (see src/create.js PLACEHOLDERS).
+# Applied once by the GitHub Actions deploy workflow at
+# .github/workflows/deploy.yml — after that, Flux reconciles the repo's
+# k8s/ directory every minute (GitRepository interval) and the
+# Kustomizations every 10 min.
+#
+# Layout in the customer's repo:
+#   k8s/base/                                # app + traefik + backup + etc.
+#   k8s/gitops/supabase/                     # HelmRepo + HelmRelease + values CM
+#   k8s/gitops/cert-manager-webhook-hetzner/ # HelmRepo + HelmRelease
+#   k8s/overlays/production-<region>/        # per-env overlay on top of base
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: vibecarbon
+  namespace: flux-system
+spec:
+  # 1-min poll keeps the "git push → reconcile" feedback loop tight.
+  interval: 1m
+  url: https://github.com/{{GITHUB_OWNER}}/{{PROJECT_NAME}}
+  ref:
+    branch: main
+  # Secret populated by the deploy workflow at first run, containing a
+  # `username` + `password` (PAT or GitHub App token with repo:read).
+  secretRef:
+    name: flux-system
+---
+# Base manifests (namespace, network policies, app, traefik, backup,
+# hetzner-ccm/csi placeholder kustomizations).
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vibecarbon-base
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: vibecarbon
+  sourceRef:
+    kind: GitRepository
+    name: vibecarbon
+  path: ./k8s/base
+  prune: true
+  wait: true
+  timeout: 10m
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: app
+      namespace: vibecarbon
+---
+# Supabase chart install (Phase 2 overlay from 2026-04-20 refactor).
+# The `supabase-values` ConfigMap content is generated by kustomize from
+# values.yaml inside the overlay — Flux's kustomize-controller runs the
+# same generation as `kubectl apply -k`.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vibecarbon-supabase
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: vibecarbon
+  path: ./k8s/gitops/supabase
+  prune: true
+  wait: true
+  timeout: 30m
+  dependsOn:
+    - name: vibecarbon-base
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: supabase
+      namespace: flux-system
+---
+# cert-manager-webhook-hetzner chart install (Phase 3 overlay).
+# Applied unconditionally; the ClusterIssuer DNS01 solver in
+# ./k8s/base/cert-manager/ references the webhook at install time.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vibecarbon-cert-manager-webhook-hetzner
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: vibecarbon
+  path: ./k8s/gitops/cert-manager-webhook-hetzner
+  prune: true
+  wait: true
+  timeout: 10m
+  dependsOn:
+    - name: vibecarbon-base
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: cert-manager-webhook-hetzner
+      namespace: flux-system
+---
+# Production overlay (region-specific patches on top of ./k8s/base).
+# Applied only when the region matches; the deploy workflow renders the
+# correct overlay name (production-nbg1, production-hel1, etc.) into a
+# Kustomization name specific to the cluster at apply time.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vibecarbon-production-nbg1
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: vibecarbon
+  sourceRef:
+    kind: GitRepository
+    name: vibecarbon
+  path: ./k8s/overlays/production-nbg1
+  prune: true
+  wait: true
+  timeout: 10m
+  dependsOn:
+    - name: vibecarbon-base

package/carbon/k8s/flux/clusters/standby/vibecarbon.yaml

@@ -0,0 +1,83 @@
+---
+# Flux GitRepository + Kustomizations for the standby cluster (HA setup).
+#
+# Mirror of clusters/primary/vibecarbon.yaml, minus the supabase
+# HelmRelease (the standby only runs replication-ready base resources;
+# Supabase runs on primary and replicates its DB to the standby's
+# postgres StatefulSet). The path layout + templating is identical.
+#
+# Applied once by the deploy workflow at first standby-cluster bootstrap.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: vibecarbon
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://github.com/{{GITHUB_OWNER}}/{{PROJECT_NAME}}
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vibecarbon-base
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: vibecarbon
+  sourceRef:
+    kind: GitRepository
+    name: vibecarbon
+  path: ./k8s/base
+  prune: true
+  wait: true
+  timeout: 10m
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: StatefulSet
+      name: postgres
+      namespace: vibecarbon
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vibecarbon-cert-manager-webhook-hetzner
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: vibecarbon
+  path: ./k8s/gitops/cert-manager-webhook-hetzner
+  prune: true
+  wait: true
+  timeout: 10m
+  dependsOn:
+    - name: vibecarbon-base
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: cert-manager-webhook-hetzner
+      namespace: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vibecarbon-production-hel1
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: vibecarbon
+  sourceRef:
+    kind: GitRepository
+    name: vibecarbon
+  path: ./k8s/overlays/production-hel1
+  prune: true
+  wait: true
+  timeout: 10m
+  dependsOn:
+    - name: vibecarbon-base

package/carbon/k8s/gitops/cert-manager-webhook-hetzner/helm-release.yaml

@@ -0,0 +1,38 @@
+---
+# Flux-managed replacement for the former imperative `helm install
+# cert-manager-webhook-hetzner` in deploy.js. Installed only when the
+# deployment uses Hetzner DNS (Cloudflare DNS01 has its own path).
+#
+# The webhook requires: cert-manager CRDs + controller Ready (installed
+# imperatively earlier in deploy) and the `hetzner-api-token` Secret in
+# the cert-manager namespace (created by deploy before this is applied).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-hetzner
+  namespace: flux-system
+spec:
+  interval: 10m
+  releaseName: cert-manager-webhook-hetzner
+  targetNamespace: cert-manager
+  chart:
+    spec:
+      chart: cert-manager-webhook-hetzner
+      sourceRef:
+        kind: HelmRepository
+        name: hetzner-cloud
+        namespace: flux-system
+  install:
+    timeout: 5m
+    remediation:
+      # First install failures are usually secret-missing or CRD-missing.
+      # Fail fast so the deploy surfaces the real issue.
+      retries: 0
+  upgrade:
+    timeout: 5m
+    remediation:
+      retries: 2
+  values:
+    secret:
+      name: hetzner-api-token
+      key: api-token

package/carbon/k8s/gitops/cert-manager-webhook-hetzner/helm-repository.yaml

@@ -0,0 +1,16 @@
+---
+# Hetzner Cloud Helm chart repository. Used by the
+# cert-manager-webhook-hetzner HelmRelease in this same overlay.
+# Migrated from carbon/k8s/flux/helm-repositories.yaml as part of
+# Phase 3 of the GitOps refactor.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: hetzner-cloud
+  namespace: flux-system
+spec:
+  # 5-minute interval matches Phase 1 convention. Short enough that
+  # initial source-controller fetch failures retry within the
+  # HelmRelease wait budget.
+  interval: 5m
+  url: https://charts.hetzner.cloud

package/carbon/k8s/gitops/cert-manager-webhook-hetzner/kustomization.yaml

@@ -0,0 +1,10 @@
+# Phase 3 of the GitOps refactor: cert-manager-webhook-hetzner as a
+# single kustomize bundle. Applied via `kubectl apply -k` directly from
+# this directory (no values templating needed — the HelmRelease's
+# values are static).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - helm-repository.yaml
+  - helm-release.yaml

package/carbon/k8s/gitops/supabase/helm-release.yaml

@@ -0,0 +1,66 @@
+---
+# Flux-managed replacement for the former imperative `helm install supabase`
+# in deploy.js. The values shape comes straight from supabase.values.yaml;
+# {{DOMAIN}} and {{PROJECT_NAME}} are substituted at deploy time.
+#
+# The HelmRelease reads secrets from the pre-created vibecarbon-secrets
+# Secret in the vibecarbon namespace (populated by our deploy flow before
+# this resource is applied).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: supabase
+  namespace: flux-system
+spec:
+  interval: 10m
+  releaseName: supabase
+  targetNamespace: vibecarbon
+  chart:
+    spec:
+      chart: supabase
+      sourceRef:
+        kind: HelmRepository
+        name: supabase-community
+        namespace: flux-system
+  install:
+    # First-time chart install includes postgres-init + DB migrations + all
+    # subchart init containers (wait-for-db). Observed 20+ min on cold nodes
+    # where images pull from Docker Hub in parallel. Budget 25m to give it
+    # headroom without blowing up the overall deploy timeout.
+    timeout: 25m
+    remediation:
+      # First install failures are usually schema / values / image problems.
+      # Fail fast instead of burning another 25m on a doomed retry.
+      retries: 0
+  upgrade:
+    timeout: 15m
+    remediation:
+      retries: 1
+  valuesFrom:
+    - kind: ConfigMap
+      name: supabase-values
+      valuesKey: values.yaml
+  # Expose PostgreSQL port 5432 on the node's interface so cross-cluster
+  # replication works. The standby cluster's supabase node opens a TCP
+  # connection to the primary's public IP on 5432 during pg_basebackup and
+  # subsequent streaming. Without hostPort the service is only reachable
+  # via ClusterIP or NodePort; NodePort cross-cluster was historically
+  # blocked by Hetzner Cloud firewalls even with a rule in place (see
+  # memory project_replication_broken.md). hostPort binds the port on the
+  # node's host network namespace, so it's reachable at the public node IP
+  # — and the Hetzner firewall rule for 5432 that src/lib/deploy/k8s/ha/
+  # index.js:254-266 adds now has something to route traffic to.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: supabase-supabase-db
+            patch: |
+              - op: add
+                path: /spec/template/spec/containers/0/ports/-
+                value:
+                  containerPort: 5432
+                  hostPort: 5432
+                  protocol: TCP
+                  name: postgres-host

package/carbon/k8s/gitops/supabase/helm-repository.yaml

@@ -0,0 +1,18 @@
+---
+# Supabase community Helm chart repository.
+# Extracted from carbon/k8s/flux/helm-repositories.yaml as part of the
+# Phase 2 Supabase-kustomize bundle. The other HelmRepository
+# (`hetzner-cloud`) stays in the old file until Phase 3 migrates
+# cert-manager-webhook-hetzner.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: supabase-community
+  namespace: flux-system
+spec:
+  # 5-minute interval matches the global convention set in
+  # carbon/k8s/flux/helm-repositories.yaml. Short enough that initial
+  # source-controller fetch failures retry within our HelmRelease wait
+  # budget.
+  interval: 5m
+  url: https://supabase-community.github.io/supabase-kubernetes

package/carbon/k8s/gitops/supabase/kustomization.yaml

@@ -0,0 +1,33 @@
+# Phase 2 of the GitOps refactor: Supabase HelmRepository + HelmRelease +
+# values ConfigMap as a single kustomize bundle. See
+# plans/gitops-refactor-2026-04-20.md.
+#
+# How the deploy code uses this:
+#   1. Render carbon/k8s/values/supabase.values.yaml into a tempdir
+#      (substituting {{DOMAIN}} + {{PROJECT_NAME}}).
+#   2. Copy this kustomization + helm-repository.yaml + helm-release.yaml
+#      into the same tempdir.
+#   3. Run `kubectl apply -k <tempdir>`. Kustomize generates the values
+#      ConfigMap from the rendered values.yaml; Flux reconciles
+#      HelmRepository → HelmChart → HelmRelease in dependency order.
+#   4. Wait for `helmrelease/supabase` Ready condition.
+#
+# Replaces the imperative apply/poke/wait flow in
+# src/lib/deploy/k8s/index.js (~40 LOC eliminated).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - helm-repository.yaml
+  - helm-release.yaml
+configMapGenerator:
+  - name: supabase-values
+    files:
+      - values.yaml
+generatorOptions:
+  # Kustomize defaults to hashed ConfigMap names (supabase-values-abc123)
+  # so rolling updates trigger. Our HelmRelease references the name
+  # directly via `valuesFrom.name: supabase-values`, so we disable the
+  # hash suffix. Flux will notice ConfigMap changes via generation bumps
+  # and re-reconcile.
+  disableNameSuffixHash: true

package/carbon/k8s/infra/cert-manager-resources/cluster-issuers-cloudflare.yaml

@@ -0,0 +1,51 @@
+# Let's Encrypt ClusterIssuers for the `cloudflare` DNS provider strategy.
+#
+# Uses cert-manager's native Cloudflare DNS-01 solver: the controller
+# writes a TXT record under `_acme-challenge.<domain>` via the
+# Cloudflare API, Let's Encrypt resolves it to validate, no port-80
+# round trip and no interaction with Cloudflare's edge proxy. Required
+# when the domain is orange-clouded (HTTPS upgrade at the edge breaks
+# HTTP-01) and is the right default for any user already running
+# Cloudflare DNS.
+#
+# Requires Secret `cloudflare-api-token` with key `api-token` in the
+# cert-manager namespace, scoped at minimum to:
+#   - Zone:DNS:Edit on the target zone
+#   - Zone:Zone:Read on all zones (cert-manager reads zone metadata)
+# `applyK3sManifests` creates this Secret from `cloudflareApiToken`
+# before applying these issuers; without it cert-manager Orders pin
+# Pending forever.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod-cloudflare
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: "{{ADMIN_EMAIL}}"
+    privateKeySecretRef:
+      name: letsencrypt-prod-cloudflare-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging-cloudflare
+spec:
+  acme:
+    # Staging has higher rate limits but issues untrusted certs.
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: "{{ADMIN_EMAIL}}"
+    privateKeySecretRef:
+      name: letsencrypt-staging-cloudflare-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token