Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
---
|
|
|
|
|
apiVersion: bitnami.com/v1alpha1
|
|
|
|
|
kind: SealedSecret
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: stalwart-admin-credentials
|
|
|
|
|
namespace: stalwart
|
|
|
|
|
spec:
|
|
|
|
|
encryptedData:
|
|
|
|
|
admin-email: AgA6gOWZpJVbz0mLCBwyGwpnSLDAYSyUhVeipZ01IDsQ5P8AKuFJbdVPTcD6TrsIehCIzf8Sid5dSV1yxkztKqz0Zp0mT+4JJu7cvSVCk1SdYHU/RDtzppV/OWlr5o19cLtU31eSnkOWNNxlCYa0VCNujwCwtJ1KcccLTDSXd8tFJc/iVVOjt2W9wrLRIGE0iKfGdAwkfhY8KAZyV9AKphbijUf8fYO9X1Xk4CKUEVZNHGQMH4pIths+KwbW4FX0oG97QaBThiH8owFeAEi3lpGBgF0Dbp/vKzmmafJbEVnvyoPTH3PF1BEhc6uvluiRgzJ8D8Rqpk9+arEGUTyesZJN4gcVE+Jyu7wHuAsCM9uBYz2EM8k/wg7Fgatd8udKdppXonP+y3a2qgbUxru2FDffTtg2nAW/yG2fYmViKOFDOAMBafe1CLUMTr7immv156iJWyIZxBNP9PeF1UFSM1Ndkxc06/MP+xXKR32NRGNlCFEp/NhbydCJbrpmAi+KyJBLNhS7krKMmgza3HApwYRoXmjVjpVoc3jYYXjxD0PEYVXmmj6m90olAUao+g4DBTKCHocpi/PNoIgbJ4EApqvTMs59IGa0v870EerLmdn2ypM+K62XUBzSPU0erYOCUQriSKGbOqWOfyZLdohhvbsxbp3GXG6o1HLQ3wuuZ5TnW9/ks1++sOczuOU+mHdqc4FaRvohMNqPlcpLD2K7QtDzNVtq
|
|
|
|
|
admin-password: AgCGkbKLoN+KEU8yZmfPu5j45KoHssDoL6TfCefanaWlv5NP81GUA2iVH1asg4aCW9exfSyhho7Pu+tG+MtU5PCMBghusKaGYsnD6c0URJhBELjiSvzicJlvpZNRew3b66jComtXt/7pdbxq61jB+xpbjO0qReMkhYeJ5gKWrMWbXPMJZrrEOn8idrtjeNPyKuBL82bf/O8ID+g/OUdODAEdprmWSJxYARQMnQysAN0865iDxWKaTxS/3edAxomRlYmIwn9UgXDH/1kwc+XEZErfwDiT/eMUz8Bku3vbzr1Im4jzqZUT/Iy+7vCBLVxSAIZ/8mH1qvnUPUV6JhQ/nxf9JYlMQPp3mBk0DDfkxU5A7dP+l0TrJEnaYUCK45c4XIQ0RbM1ckWyJ52Leyqoy0W0/fH2SxyycVe4zw92nbX7+m4phoVKtZgARMKQybPpmVeylqDqwa+HEtN5eODg0oJg6d1xVyw8mP3LTyrzLRMzFZ3/C2aGKKPK1UdJls+biS0U+TBXEQehYBRmkN9dZlgYbqBkJQKHwWp5Fjw4qmu7WL8WivBlyzPeCxESAcLBDC7NvKwm/vGl09Gwks0y8JbGkyWfv8iFHdRU0+UXLKVYYXfYnBIRssw4yVh3COQ1yv5C40XGfduYkdh+pZ29Qv553WPlfH2dgNzw0So35LTeEc7+C7bTzWCAXEdyhsrDu4eDUTyZh6OOBG4EWX2X94A/qftX7VbsQzHLAfbbdY61Bn1L2z37hVEoOuXx1w==
|
|
|
|
|
andreas-email: AgBEqHQPc5maUzyPhsQoGdnmKcqPkDafZZDEFWHEjsSekzb3cNYZyzK7aLtY3HK64IyK7mqAlKOAn2bKhr6BCVR2wE61Fe6OwqfwF1VKjC22BQIECNkcVoSJxi64LdaOMzZ3Y0JMdA/h3Jrnf7lQLPzMi7+T53A9h8qUTE2TzyeIeu9e8W3ZIo8UNC/Hjo4GODKWr7DN8wSwm2u5vogMS9mzes08e0QFApQpEAfaZJ+aKbm9ayBjQS+Zjt6hVTI+iYWMxEFmuHi7eqoMeJRAofaVibQKJu/F6rCG9noJs4Y11KYjXorI1cIq8pg40EScfiLQOoTXemn6uI9P6vIzFAEm+r/Pl0HFwZDyrOoXi14QD7RLnIQHXZiyrYehUhKbyg6POE70rDOp9r/M4REL/4dCP4ifGqlnAgvhyCsxHDWNaxsmc8MHzybxkeOSpaQCKYAwQzGRbU9hCrsY8XVb0HYqTejrTSX8FqAMzavRAcFTsOACB2rXXh25OJmdNpPSeXpwiGQ7lhq1+yLn1TDCNiMkuSvFTjNTmP/wTgkzdCUQTwOY9gOeUrn7jZ68xWTcxxGQrE3qdxgCfvTH8C8icz5FA89gEYHBlr+dUvY9Tst1fCn/UhYqfrLjEO/izDS3li43QzdkNwNdwED96sRamEU5lJX9ivN+G9MMIOZ0TvTgffDQqEBHOZxisX+7eeMdoz5S6t9aUJCeJB8pFEniOMBbrsSHYn7VkcI85aLz
|
|
|
|
|
andreas-password: AgAZzQK5pwXwpwxcle8Rmr8k0mL2qVIY2biFPRJRZWNpLy92aQZWqe3mgMecH4ZlP/nuSMKo7dFbT/GxGd+uZC5SRDW044Gzt69wuQ+52wwoNNQdHAx2IU5UkUFAz4JjOvYzY6atHbF7yFxcq+MQxnWJHGQp3+/jacUo41imtD7gq/xVVw2QK1KPRdbHRg5B9o+EPHGDHjCWcOLlsaeaTNb2Q0K45E0yh8LoWTFRSWof7N+pFXOIhSU6pNlZMOD8SsHME+tR6jKAF5y7MIH/0Hh+ngzS3Cec/u+2d/du7dFvRqrrxLmFXA5oGm16ovC7w3Js4XFJICax1k23lx4erATDT6hbqkP8EGGjHAfnMKLmqWy4BPrM2QOk3omVDJj6a18r5BI06mX/uy/vzfz3SLR9sPzPcHxDJg6ExdRpGlh6fIg+j4Dr4qdQoruJcvKIX8nGCETH8dI83suSpjlk9NSWdmfn0eHQT+qdS729JRo6vqv/jRV3cYcGhNAtqhSebzQbSzara/ui9OSsKt+nRqL13xejM5307cZ0uixiB3WxI9MxK3YcrdQxJlw1TC/ddX3/oyzZJqG0EqxBFm7PQ3Wy+kAdIrPNRg0Bb2npvWsBaFWtFpPsbzyAlZPhb3gP1wgwxT+4OLf72n5UDjGZH38MQeRrels1LREhsoIdUQmG4y7/C9J59KOVCjO2Hb/8HPDFzS936syzBSEPRRRb3C5Y7erfIgu6AFuELPQcQQjle9i/OpoqmftNaQ4MDw==
|
|
|
|
|
paperclip-email: AgCimQ3gZPas6mcLbubokHVJdmqya3hebD6ZaEb40xPqPydXgR7w7BM4cQ3SbJN1+PGWfZUaTUdI2AydpnlRckkgY/QR1nrIOCKTnvF17F3iCWcFkweWlbeDegNvrc09lllSxfhn7fcHwwwnO4dVNi2M/mxbsGcEgSQEODS3Eh+KPnbXz9el1ArFTr8E/1RH71sEh4ZP5Vb4fv0+1kybWuBskJ68H+wNHxVXdUQLtUTHVlN5eqNkHrHqfgExhtSrSMnmuw2p9MOI8qJhdBoIyrgz04VqCFWKMD3Tc649l5nkJcgz9oAVHKsoL1D1zyqWdnDMuZ2XLpFL8fa+fF7zwh+leGMXMd2OeMa79z3oxP1vTRuK+GYnYJ6D6vjxEQD4V+6VArqCOOJDInAklVgCtrUyHDvZ0dWHDw/4IN8B0ITqTavHEPpOKULlzdDQpqD4/QyLT/YT5Ede+clEDNhvTanLAH57bk2TXAYKExQnKJvU0ct3cOpVzSEG5v+ZPiJ2llNKw8cC3LTCk3eGr1KaSRezTJfKATroJuLVlH00MqfXDNLRm5zBmIz0NMJFzsE5n3JS8IyMLeNqYw7rDncXyOo29sCnUG0OPaEtKrOuggl8YWfDC5OHzUZsQorkpsil7v6dBO/ZQk6OpRY1V/KTzptWDAC94FD7KsPGR5RKJEu1uV7o4Wu8VotQ0bqnMTLV9gOoG/E2Gm2o6KiwQqh2lHlWoWpLMytcpw==
|
|
|
|
|
paperclip-password: AgAA74Yj0aKe18zRqinlKT8NaV1U3x+71gWMaE3eQ+SYI9S/9PTiFNJQ2aNVEFl/vdIhKli/F+LVQZ5dBBu7ryoTQbfJUSTJaCguuQTbOVRNpHm8/aqT+PbJUzfHrCM125o5rah0YITmkOyv8M2ZUW2tFic5xyTZQ3SDRQrhxxbIKbSWQ44rBkwhTBAKxFBd7wR/hMH7NYvmcLXchcIJHwPEsgGrsEegIyc0LONWXlx5uzjdRNkvA4MWnoc5lFpu3ndCks3OnkAYlHd7PFKAYWhWJWGJswSoNLagxerQdik/yLbadH/29eLkYG5Hcgle2SaonBVxpDFsfmenkDAEIY7xbgmJk3ZbCo+27ykSWoNyZN5DnFKhzQ/eYOh/yrW8oMHJbt698nKR4BGvP1BRj3xOJiBxVmCzXcZtkN3lRBh+VvXLHrs0K8vKmJJ9MSqF51TzCg+tYZH0lBi1fy2qh96qCVObR86drh5VQrKVmAioVhqezsW60WMOVko8vzUNWG1nWvVjDTWGffprtS+3ddiTJ42d2S8HhpJiQKq942LwkC/AUzceXPEjyW6SVFp49nMo9mFpQr2aZvxKzu2cQE32XeMfEQq9tVF58iBXg6a1N9TVP5J4rSLUR1kmGnwrxHzVnZcNMKLTgUxNZLu71kIwru/lGaLh141RWzKDpOG75e3afjwX+NhkBgDruTV32pM+Yf84b5zxewrFWGuRaMD+Qonqxbz+0aUzq3KxZ3FY1YJqtSoB73iGdtIyBA==
|
|
|
|
|
recovery-admin-password: AgB3QBYlyS7D71xR0ohvyxmfUIvgplaGjEj5RAqEY5fvKcksNjA8i3FEY3WZzKcxymG9L1ePsmxgUJUZNYbwnO9TwkaeDfEuPHlWiG271XXrQrYDl4ftCGKlRbMuY3DBZSwMB5OvC+1+PEKCxeN5J5eO2VjjFp6eUBgD4RzBFFvQV4D9kwWIJ1IIG/PidLJhf78PPoSUK46FXGuQlBKozjefaofIycWowDSFtTdotJyXbIr51iwNOyTsq5rcd1Z7EEGwrVpKYGpXJulsILImp1YJ4PUMowTwFWaj4R5/nEoteVenJM3o6a9CY7c31VDObDouAhrCa/k/onAmVrxFFAMKTHLtfORQMcOSR8vyioB41WMgBzGa4MyqdgnUSV91aYANCx1TveGqcROtMUo1WQwk3LzJNHPtxp/0ZrfDWDS1kgznajs12GRmfWI7NB90GbsirfcZedgg4FkdeSAFgL7Nb3BhoK06Fp794w8FlEGJATyoS1BdB+6aai7TPhLL8quN9jQuA8cVHI8vVjF+vDUAUtIad7XXhcGVs6E//fdY4I8dVX1L8TjpvrYZFkXOZzVOi6LCLgFbNf1IStYd8AX22RTZs1ny9EDyBXRdawwpXCm4y07e5P/4/vXVOTtmA11uzzzeZ4kfdbv78alJ4WzZO17lG/jX3aakOHL99MH2GZt/1lvHMpfY8UV4lM2u9T9zfJ4lvT2g6fCLlET6ivMubskwiOunYKiAcSQG8NqFiJDhZN/OF2zSApNqfQ==
|
|
|
|
|
template:
|
|
|
|
|
metadata:
|
2026-07-25 15:15:42 +00:00
|
|
|
annotations:
|
|
|
|
|
argocd.argoproj.io/compare-options: IgnoreExtraneous
|
Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
creationTimestamp: null
|
|
|
|
|
name: stalwart-admin-credentials
|
|
|
|
|
namespace: stalwart
|
|
|
|
|
type: Opaque
|
