Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
---
|
|
|
|
|
apiVersion: bitnami.com/v1alpha1
|
|
|
|
|
kind: SealedSecret
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: pocket-id-secrets
|
|
|
|
|
namespace: pocket-id
|
|
|
|
|
spec:
|
|
|
|
|
encryptedData:
|
|
|
|
|
ENCRYPTION_KEY: AgBM639EX8/HwWMnseTcoch5BgSFTXwgeMjEoC7/bwxeJq9SDmtDKSI4y57+deHv3JxaoqjitJ2N+oK1SS6lLd1odx/9nVarzu2OMFUg0Jj9TlZybe+lSoIBkqTU7P9O3jznybrVfqOowlWVJznucSiVOlrJfYgqOaGmAW3bNZ/oQCmFNIb2fu68sltuOMLYS0AgPrkWxn8vr7Js1MeoVx9gbq75RwW9mpOkvSQOPupiYFdjMUNHR/ye2bE/yyT/sZZ1xjzL5ImKmSL3khMsriAio/o/019sftZ7AWWRsyYGWtPvFz/FTgQEDoBGztep5D3MU4yKYMxvkX/q5BLP5K5+qkt1UypsytAUtjIqY4+aU63Na5yGoXSZIGXJ80E1yJjGnyRRP8WVADM42QXX8yXMerlP0pyfchYJHXklU0n3QlDftHXjIn+BYODwRsPaNIXrbLnfQfq7chUqHAxA7URhtlnghMhZki0sxdLpjmtvLa1vSw0kGdjGsE14GxJqHmpdHU2axPhENh9oDH/9pYWZEbZiN6RzI+aWqU0h5c8covX0Lu3UX1QViTTAgMg8Ecc7JTbq6VJd7BgjdUfE4RIaE+BuOT4A2LOZaI6ycUDYESfphRtotbMwIWIHQdXXrniP3UJk2pv6ZxSN7JwiemNKLNIyPi5pvamvJDefIKjyVb/XNmJvvDosw2Sd7+3j+nHld9ktlA++eqmjk7Xoi6RZk6saQiXDT/bv7uv2ycsUKQOeoaVWrZ+WUdcavQ==
|
|
|
|
|
template:
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: pocket-id-secrets
|
|
|
|
|
namespace: pocket-id
|
2026-07-12 14:49:32 +00:00
|
|
|
annotations:
|
|
|
|
|
argocd.argoproj.io/compare-options: IgnoreExtraneous
|
Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
type: Opaque
|
