updates

home/cluster/argocd/image-updater/install.yaml

@@ -167,6 +167,12 @@ spec:
               key: argocd.token
               name: argocd-image-updater-secret
               optional: true
+        - name: IMAGE_UPDATER_INTERVAL
+          valueFrom:
+            configMapKeyRef:
+              key: interval
+              name: argocd-image-updater-config
+              optional: true
         - name: IMAGE_UPDATER_LOGLEVEL
           valueFrom:
             configMapKeyRef:
@@ -215,7 +221,49 @@ spec:
               key: log.level
               name: argocd-image-updater-config
               optional: true
-        image: quay.io/argoprojlabs/argocd-image-updater:v0.16.0
+        - name: ENABLE_WEBHOOK
+          valueFrom:
+            configMapKeyRef:
+              key: webhook.enable
+              name: argocd-image-updater-config
+              optional: true
+        - name: WEBHOOK_PORT
+          valueFrom:
+            configMapKeyRef:
+              key: webhook.port
+              name: argocd-image-updater-config
+              optional: true
+        - name: QUAY_WEBHOOK_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: webhook.quay-secret
+              name: argocd-image-updater-secret
+              optional: true
+        - name: DOCKER_WEBHOOK_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: webhook.docker-secret
+              name: argocd-image-updater-secret
+              optional: true
+        - name: GHCR_WEBHOOK_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: webhook.ghcr-secret
+              name: argocd-image-updater-secret
+              optional: true
+        - name: HARBOR_WEBHOOK_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: webhook.harbor-secret
+              name: argocd-image-updater-secret
+              optional: true
+        - name: WEBHOOK_RATELIMIT_ALLOWED
+          valueFrom:
+            configMapKeyRef:
+              key: webhook.ratelimit-allowed
+              name: argocd-image-updater-config
+              optional: true
+        image: quay.io/argoprojlabs/argocd-image-updater:v0.18.0
         imagePullPolicy: Always
         livenessProbe:
           httpGet:
@@ -232,6 +280,13 @@ spec:
             port: 8080
           initialDelaySeconds: 3
           periodSeconds: 30
+        resources:
+          limits:
+            cpu: 500m
+            memory: 1024Mi
+          requests:
+            cpu: 250m
+            memory: 512Mi
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

tofu/cloudflare.tf

@@ -438,6 +438,46 @@ locals {
   ])
 }
 
+# =============================================================================
+# towerops.net - Response Header Transform
+#
+# Sets the Content-Security-Policy explicitly at the Cloudflare layer so it
+# cannot be silently overridden by managed rulesets or other Cloudflare features.
+# =============================================================================
+
+locals {
+  towerops_csp = join("; ", [
+    "default-src 'self' data:",
+    "script-src 'self' 'unsafe-inline' https://a.w5isp.com",
+    "style-src 'self' 'unsafe-inline' 'unsafe-hashes'",
+    "img-src 'self' data: https:",
+    "font-src 'self' data:",
+    "connect-src 'self' ws: wss: https://a.w5isp.com",
+    "frame-ancestors 'none'",
+  ])
+}
+
+resource "cloudflare_ruleset" "towerops_response_headers" {
+  zone_id = cloudflare_zone.zones["towerops.net"].id
+  name    = "default"
+  kind    = "zone"
+  phase   = "http_response_headers_transform"
+
+  rules {
+    action = "rewrite"
+    action_parameters {
+      headers {
+        name      = "Content-Security-Policy"
+        operation = "set"
+        value     = local.towerops_csp
+      }
+    }
+    expression  = "true"
+    description = "set CSP for towerops.net"
+    enabled     = true
+  }
+}
+
 import {
   to = cloudflare_ruleset.towerops_firewall
   id = "zone/${local.cloudflare_zones["towerops.net"]}/3c209e50f21b40388733a7cfe8f62f4e"