stack.basicstack.de/apps/platform-prod/paperclip-auth-secret-sealed.yaml

---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: paperclip-auth-secret
  namespace: platform-prod
spec:
  encryptedData:
    better-auth-secret: AgA5HmbWv21FilfH73iNAgqiTtImfz2noM6b5O+WImgMkE+EBTY5EXOD7puZJmuK7QJKNv2+81e7PIpAuZeTlw+3AIp43BebSElpQcGAfvA66B5TpILIB9cR1zgO+taaRIsoMOvPqzXMbT4bU5TN4CNyCavRQx6uMc/MRpJ8/xM9ae+AipcWEY3xPvunKfmJvMowHl2lECjD//V8+LPXNV2KiEoshmPeu2xp3appiLFbm/4pnLoGuiABzXw3PsO49OeQ7n788YyvaCdn81+TzoHF+yeJHyVNMOMLSutO44vQXWdgb86lmWBMbFLgNoGHsD/VWMl3NIYredidxUEQQl6rdpu60Zkl9NTgYtogIkmmt7MaJww8Bkocvggf1gQxYLzbowWFCO50UwNLXy4yYtZbpH/gj+wbL3BnH9Sqn2Rk/QwxDsldMfbcmJk+dvX6s2jGcQ1YCQnKC26g6NZ7xCIcuZtEaSYTJthzYPpTdYYj9SY+1XpAItlnW9dj+zVg3wxifBViB7nqAHXjB3yHztiGyUTQo9C22zIgewxEq/4gCxLYx3HfPyHOKPD6aHMmFnTIFszO2JleV8xjiMy5+m9sFYvxUaPyHY2nO69CqoPJji7f8125YHPPZimUbluyPi2eXDCrN9aRXxe2478pyXaogfWft/vTX1lNyb79k2H/eKL7lpGDzov0smIqTgdUBi6VALpw7n23v3dCEniUwuE/UlcVCYfQQ1bUqw55X5FXUM5aSDS+ps6ZbcIiTUfdRsbopIOrJcukBpF+
  template:
    metadata:
      creationTimestamp: null
      name: paperclip-auth-secret
      namespace: platform-prod
    type: Opaque
Convert all secrets to SealedSecrets for enhanced security This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing> 2026-07-01 18:38:27 +00:00			`---`
			`apiVersion: bitnami.com/v1alpha1`
			`kind: SealedSecret`
			`metadata:`
			`creationTimestamp: null`
			`name: paperclip-auth-secret`
			`namespace: platform-prod`
			`spec:`
			`encryptedData:`
			better-auth-secret: AgA5HmbWv21FilfH73iNAgqiTtImfz2noM6b5O+WImgMkE+EBTY5EXOD7puZJmuK7QJKNv2+81e7PIpAuZeTlw+3AIp43BebSElpQcGAfvA66B5TpILIB9cR1zgO+taaRIsoMOvPqzXMbT4bU5TN4CNyCavRQx6uMc/MRpJ8/xM9ae+AipcWEY3xPvunKfmJvMowHl2lECjD//V8+LPXNV2KiEoshmPeu2xp3appiLFbm/4pnLoGuiABzXw3PsO49OeQ7n788YyvaCdn81+TzoHF+yeJHyVNMOMLSutO44vQXWdgb86lmWBMbFLgNoGHsD/VWMl3NIYredidxUEQQl6rdpu60Zkl9NTgYtogIkmmt7MaJww8Bkocvggf1gQxYLzbowWFCO50UwNLXy4yYtZbpH/gj+wbL3BnH9Sqn2Rk/QwxDsldMfbcmJk+dvX6s2jGcQ1YCQnKC26g6NZ7xCIcuZtEaSYTJthzYPpTdYYj9SY+1XpAItlnW9dj+zVg3wxifBViB7nqAHXjB3yHztiGyUTQo9C22zIgewxEq/4gCxLYx3HfPyHOKPD6aHMmFnTIFszO2JleV8xjiMy5+m9sFYvxUaPyHY2nO69CqoPJji7f8125YHPPZimUbluyPi2eXDCrN9aRXxe2478pyXaogfWft/vTX1lNyb79k2H/eKL7lpGDzov0smIqTgdUBi6VALpw7n23v3dCEniUwuE/UlcVCYfQQ1bUqw55X5FXUM5aSDS+ps6ZbcIiTUfdRsbopIOrJcukBpF+
			`template:`
			`metadata:`
			`creationTimestamp: null`
			`name: paperclip-auth-secret`
			`namespace: platform-prod`
			`type: Opaque`