Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
---
|
|
|
|
|
apiVersion: bitnami.com/v1alpha1
|
|
|
|
|
kind: SealedSecret
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: directus-db-credentials
|
|
|
|
|
namespace: directus
|
|
|
|
|
spec:
|
|
|
|
|
encryptedData:
|
|
|
|
|
directus-password: AgCQIu94TKMO4Kqao/bJQfKTw2sGXW8tx3rOV+1J/iCKCPgWYRizylP1PpGgqvcXx/gNdGItlMQtymfJ9JY7jKpv2S7l0RvO6kmSovQeNFLC5QmW6S8ltEmpklz1fzV4pnuQQXUjDxaiw7m9JiIkrpmZGf8HDJpx1v01k+e3oPtICCF/9vFxNVquymAeQFME1GLt45LhBoubNlcgvjPni7LHv+lODzD4l61VD30bMxlgH/MYj0i3u9uhlGKI+Fvl5LJuNdd68QOmSQ5s3eu51O2eLUWjKTh+4M+qHkGLXA1cfOeqn1nNxlK2fSe9+VtHv8cvt5QRYoqap3sasUYWewQk7iOBtrPPrhdoU0tFvLxCyPK8cPL8mqH24TAds7sFaALs4niFX6IsLHNTXSdP2F2RnwodpOW0SGdAoTSYc8s7X576OdExtJNtmkffr4KKVRVBahJj1yWGxzEYZ+mHepP5ezDP3sZUN1QXKgsVfubxVapOdGuprdlu20vuk3meHkum9ctvsUUIJ+RKfM/tAVP1pQa0MwyKQNMissdA9Z5m3ibFm0Szuhg7R44NGMuMibMaMJTqBUrkzpjd61pmHjuSNB8lxChhqo/phT2GGDuwGdqZm68bfNuCDzFfUsWe0zaeeaREoGkVe+n9enCdUYmf2I25pOqcyd2/c9zCKOqm77KxiMUzdlWclrZBPglt8M1Za2gigMutIDSfkKZ5u1cRbViruhnx7Kvqe23EgRwfNgoXqhKWCW41AKcteA==
|
|
|
|
|
postgres-password: AgCMcWSshYc5RMxBG0f0Idycuy8EfPTYtZ6R/7N6F40xrzFiKLcz1rW9kcIPCpRd9m/ev3/3MRm0EYnw/a/7dcL1YZ28t9SuU/p3UA9wQxapiNeVrhH2pM9CJtrEjxq8xdCDapXAhmlB7PWfdpm40nCi7BzP0DZodx36NzOfy9JtA+EXBSGKzWqhAfiCRfUSvNRbv3oiYuJCjHcM7WtAUVHav5JhZ0HMc5jDCiGWFobsdm10dfcZtGcFjI6pUE7mOvs4JM+MfUekYAgUyulSlVaVt445JvXCVzh1CiY6Yc7RYtupmFJcnUjEbaolMwa0dJU81KUX5MDMXx2a0tmZNr7kFAgoPMCXPwILUIhKPYLCFVTBgIDXW2WF6IzvIF9Jm0L7PaXXmLcJprgkkWuD23vLADVJu68EqX7W/Y3ZDGW3sV9g9wl0kFoR+XjtrpKvg5Jpof0d5T+RQ7ELRNuXU9XWMzXr6dY20BQ3WVIje6u8qaEdfxR3jZpX+ui/biOQW0C+OjDIdWAGE3wtBOxv1hk30SJp03x25sNP8kgzF6Tlc8NYraOHIwcBepu3xDwMM/evSE32NSecpAXcLb6fjqob+kj8QR6UklxSSjVPZj1+J1ApKlngQ7qUOXqOaFyfv5zNz5flSc1Dodbks948DGG+E2wKTQOgGZAEz+tN3YODJ2HC1KfRzgOOUSLgn04whv+zxUobmUR7caOlk0hIyos6hjj0T4jfI2ADIGBMe/awLwgSbJCjT2YwovSf0w==
|
|
|
|
|
template:
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: directus-db-credentials
|
|
|
|
|
namespace: directus
|
2026-07-25 14:57:27 +00:00
|
|
|
annotations:
|
|
|
|
|
argocd.argoproj.io/compare-options: IgnoreExtraneous
|
Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
type: Opaque
|
