feat: add cloudflared tunnel

clusters/homelab/cloudflared.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cloudflared
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/homelab/cloudflared
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/homelab/cloudflared/deployment.yaml

@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloudflared
+  namespace: cloudflared
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: cloudflared
+  template:
+    metadata:
+      labels:
+        app: cloudflared
+    spec:
+      containers:
+        - name: cloudflared
+          image: cloudflare/cloudflared:latest
+          args:
+            - tunnel
+            - --no-autoupdate
+            - run
+          env:
+            - name: TUNNEL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: cloudflared-token
+                  key: token
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "10m"
+            limits:
+              memory: "128Mi"
+              cpu: "100m"

clusters/homelab/cloudflared/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - secret.sops.yaml
+  - deployment.yaml

clusters/homelab/cloudflared/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflared

clusters/homelab/cloudflared/secret.sops.yaml

@@ -0,0 +1,27 @@
+apiVersion: ENC[AES256_GCM,data:eK4=,iv:Fj5wQ5cf1oXPWjYdliVb80XUcB8C0BjVWFyrJyt7aTg=,tag:mj4K2ChwQ/D0Lt0gRPbrWw==,type:str]
+kind: ENC[AES256_GCM,data:RkAb4X+s,iv:Mi96QQgDXG+TWL40MMejPzDlRQR7PsfCmXLgbjDSOts=,tag:5akqEdOHMATYFD0A32GyRg==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:jTrtyL4uiQvljgdFTQZsJzI=,iv:JZDTet2SImWYViWVz4Jb794mTKEPq83N7sCyqO5WrKk=,tag:k1HB3F/UxEp6Nhy03LVUMg==,type:str]
+    namespace: ENC[AES256_GCM,data:sirE1yyWYNMj2Ko=,iv:1kn+UmmdGXbbBlUSGV+a6tqae8fOX0oimn9wufdEFFw=,tag:JZOYE2krRQl0OQcKW/m7YQ==,type:str]
+stringData:
+    token: ENC[AES256_GCM,data:ltlR1eARdiJOlxpZTMNAi0MMAGwHYs0Kub3Olyp6qXcPw7mzndSqJCmGXJZ9eeaas32GiQWwfy/RuMfJqsAWKpIB9BeaMZR+gV5k8Dyewo33vAyc0YGEn9bM3w7V7QhwXag6IdrXGq9hrZX+0N5zpCwUKlJ+sgIStNEJLkRqVmo3sVzIxPaXXdhQjPG3DuSMS2GpsmB953h3Dn9zTOD1pWj/PCPlt/IqXuQJMQcK66n+QLTYDWMD8Q==,iv:idN1jlq/L5fumsFj7FYvu1TmvZG7zXbYZPsNUxxPRM8=,tag:+SzZ6vEH5rauLD8ZEVwPwg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqNzBEYXl6ZTFhZkVJVlJw
+            L3loYUw1WkRKOVVxTVpVbldTSGhZZDFMV3dJCm5IZklSeUo4T1g1ZGFQL3Z4RGJt
+            SmtMU0ZhazlnUG1xc3lEUENlWEJGbjAKLS0tIDFiYlp2eis3eGlKQ3lZd1YxVy92
+            Ymp1M002ZngvOC9zMGxEcnNNSXdkYTQK23pcTLGewPx9ahx9EFajOJVAb50sC6Qm
+            dt9xrgkDWrgY9dMOUy2MuP4FSQcmnVQj89ED5pPbDECLkp4O8/Dr4A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-16T16:13:18Z"
+    mac: ENC[AES256_GCM,data:lRHtLKlsdEro8fqPW9/+1ZnVUwQWa2m+s/Kicnz0wBkguBGkXFRY8SHbu64xacBzKGATin3SHvnrrcCoeKo5X855zy1zzyYeEg8yBef3XhRwIpzGfSyfSGH1WSnz5WPAIIozDXDf3GCgC+PkS/RUuxPcRt0mrjYY3cwiAm9qT4I=,iv:ifosyPUbDhKUIRQ3ILXYCIODp8V852IO7YdHlx19JLs=,tag:RCmzUjnosRdqYHPvEHTBKg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4