feat: simplify hugo deployment to single nginx container

clusters/homelab/apps/hugo/deployment.yaml

@@ -13,33 +13,24 @@ spec:
       labels:
         app: hugo
     spec:
-      initContainers:
-        - name: artifact-fetch
-          image: ghcr.io/fluxcd/flux-cli:v2.8.5
-          env:
-            - name: REGISTRY_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: hugo-registry
-                  key: token
-          command:
-            - sh
-            - -c
-            - |
-              flux pull artifact oci://forgejo.net-scope.org/hans/hugo-site:latest \
-                --output=/public \
-                --creds=hans:${REGISTRY_TOKEN}
-          volumeMounts:
-            - name: public
-              mountPath: /public
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: nginx
-          image: nginx:alpine
+          image: forgejo.net-scope.org/hans/hugo-site:latest
           ports:
             - containerPort: 80
-          volumeMounts:
-            - name: public
-              mountPath: /usr/share/nginx/html
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_BIND_SERVICE
           resources:
             requests:
               memory: "32Mi"
@@ -47,6 +38,3 @@ spec:
             limits:
               memory: "64Mi"
               cpu: "100m"
-      volumes:
-        - name: public
-          emptyDir: {}

clusters/homelab/apps/hugo/kustomization.yaml

@@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - secret.sops.yaml
   - deployment.yaml
   - service.yaml

clusters/homelab/apps/hugo/secret.sops.yaml

@@ -1,27 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:rJQ=,iv:bi/botBQBrdFbDnz7mPo+4Z2KC83phpX9QwSWEd7ocw=,tag:Mb2Bc8A0/kPf+E76C3OPlA==,type:str]
-kind: ENC[AES256_GCM,data:wqikSiKu,iv:IRgsTcmRYllYvv32z7ap0MVm3XxbFHLmhEZNB1yYfxo=,tag:J7SaIlHKAK96yOgQ4/TG/w==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:tuyp95XjnJ7hmselZQ==,iv:Qdb1EA8uQaWzHE1xcHvf0ht+iyHmya9AaoNsUVeVCnw=,tag:2tYxvILbN41gOA4jYqAGcQ==,type:str]
-    namespace: ENC[AES256_GCM,data:VkkF3Q==,iv:Kegn4sgJEllCpAbn9GMzUknaQIC96ke608qsBNfjgQ4=,tag:cdZv3OkvkPDjFGCKhwuJ8Q==,type:str]
-stringData:
-    token: ENC[AES256_GCM,data:sjNXGCiW5sKi45zCg+lfNCsxHUD7A0I5/AHuHNM5Vhwlrk+qoTLJxQ==,iv:arjjTTUal/W5jLrarKIMk4bYVWs/PUW5Yr+sn04mNb8=,tag:wbdluuXxrZ4ZvZB1lC1toA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWKzNIc1RXZng0N3NiM2xE
-            eTA5cFhJMUZRbW4wK3pITmE0OEFZaE1DY2k4CjZtOFptUWhQaTZZOS8rb2dGOEVN
-            N2dYMDlnczlPRWJXcWszVWc5dDVZbVUKLS0tIFA2ODYwczRCRk5CaHA5NW9Nd3JU
-            SWM2K2VNRDRaRmpjY3pGdVZjbEM4ZlkKcJ2Ytx9kzQaHbuw8saYIUwwojCqxiOQc
-            gIQe/FlvZ0m8Azfr5BL5NKUcWvMYSQo6si7lngRpYBDIGw/VY6g7AA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T17:52:35Z"
-    mac: ENC[AES256_GCM,data:ZKmWO8CyAp48Bnv10c+kNBksF27oDLfkKEQ9JsBNcGb171Cxf7r21YZ9g5WGXGPxdFntWDZVDmevRVIRIb4KKMeb7UfukqKz9S4yNHaYzCo637XDohl7B9jyr9yN59kk67csYFW3fiptn96l5+NLimSAU6nSaaDEkB4HlCmi7xs=,iv:2hqcGeezi0T4jgqTVGzLNzBQkiig7mUAfSZ6qWVer60=,tag:bKovesylpjQy29lVOvzo4Q==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4