stack.basicstack.de/apps/directus/directus-db-credentials-sealed.yaml

---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  creationTimestamp: null
  name: directus-db-credentials
  namespace: directus
spec:
  encryptedData:
    directus-password: AgCQIu94TKMO4Kqao/bJQfKTw2sGXW8tx3rOV+1J/iCKCPgWYRizylP1PpGgqvcXx/gNdGItlMQtymfJ9JY7jKpv2S7l0RvO6kmSovQeNFLC5QmW6S8ltEmpklz1fzV4pnuQQXUjDxaiw7m9JiIkrpmZGf8HDJpx1v01k+e3oPtICCF/9vFxNVquymAeQFME1GLt45LhBoubNlcgvjPni7LHv+lODzD4l61VD30bMxlgH/MYj0i3u9uhlGKI+Fvl5LJuNdd68QOmSQ5s3eu51O2eLUWjKTh+4M+qHkGLXA1cfOeqn1nNxlK2fSe9+VtHv8cvt5QRYoqap3sasUYWewQk7iOBtrPPrhdoU0tFvLxCyPK8cPL8mqH24TAds7sFaALs4niFX6IsLHNTXSdP2F2RnwodpOW0SGdAoTSYc8s7X576OdExtJNtmkffr4KKVRVBahJj1yWGxzEYZ+mHepP5ezDP3sZUN1QXKgsVfubxVapOdGuprdlu20vuk3meHkum9ctvsUUIJ+RKfM/tAVP1pQa0MwyKQNMissdA9Z5m3ibFm0Szuhg7R44NGMuMibMaMJTqBUrkzpjd61pmHjuSNB8lxChhqo/phT2GGDuwGdqZm68bfNuCDzFfUsWe0zaeeaREoGkVe+n9enCdUYmf2I25pOqcyd2/c9zCKOqm77KxiMUzdlWclrZBPglt8M1Za2gigMutIDSfkKZ5u1cRbViruhnx7Kvqe23EgRwfNgoXqhKWCW41AKcteA==
    postgres-password: AgCMcWSshYc5RMxBG0f0Idycuy8EfPTYtZ6R/7N6F40xrzFiKLcz1rW9kcIPCpRd9m/ev3/3MRm0EYnw/a/7dcL1YZ28t9SuU/p3UA9wQxapiNeVrhH2pM9CJtrEjxq8xdCDapXAhmlB7PWfdpm40nCi7BzP0DZodx36NzOfy9JtA+EXBSGKzWqhAfiCRfUSvNRbv3oiYuJCjHcM7WtAUVHav5JhZ0HMc5jDCiGWFobsdm10dfcZtGcFjI6pUE7mOvs4JM+MfUekYAgUyulSlVaVt445JvXCVzh1CiY6Yc7RYtupmFJcnUjEbaolMwa0dJU81KUX5MDMXx2a0tmZNr7kFAgoPMCXPwILUIhKPYLCFVTBgIDXW2WF6IzvIF9Jm0L7PaXXmLcJprgkkWuD23vLADVJu68EqX7W/Y3ZDGW3sV9g9wl0kFoR+XjtrpKvg5Jpof0d5T+RQ7ELRNuXU9XWMzXr6dY20BQ3WVIje6u8qaEdfxR3jZpX+ui/biOQW0C+OjDIdWAGE3wtBOxv1hk30SJp03x25sNP8kgzF6Tlc8NYraOHIwcBepu3xDwMM/evSE32NSecpAXcLb6fjqob+kj8QR6UklxSSjVPZj1+J1ApKlngQ7qUOXqOaFyfv5zNz5flSc1Dodbks948DGG+E2wKTQOgGZAEz+tN3YODJ2HC1KfRzgOOUSLgn04whv+zxUobmUR7caOlk0hIyos6hjj0T4jfI2ADIGBMe/awLwgSbJCjT2YwovSf0w==
  template:
    metadata:
      creationTimestamp: null
      name: directus-db-credentials
      namespace: directus
    type: Opaque
Convert all secrets to SealedSecrets for enhanced security This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing> 2026-07-01 18:38:27 +00:00			`---`
			`apiVersion: bitnami.com/v1alpha1`
			`kind: SealedSecret`
			`metadata:`
			`creationTimestamp: null`
			`name: directus-db-credentials`
			`namespace: directus`
			`spec:`
			`encryptedData:`
			directus-password: AgCQIu94TKMO4Kqao/bJQfKTw2sGXW8tx3rOV+1J/iCKCPgWYRizylP1PpGgqvcXx/gNdGItlMQtymfJ9JY7jKpv2S7l0RvO6kmSovQeNFLC5QmW6S8ltEmpklz1fzV4pnuQQXUjDxaiw7m9JiIkrpmZGf8HDJpx1v01k+e3oPtICCF/9vFxNVquymAeQFME1GLt45LhBoubNlcgvjPni7LHv+lODzD4l61VD30bMxlgH/MYj0i3u9uhlGKI+Fvl5LJuNdd68QOmSQ5s3eu51O2eLUWjKTh+4M+qHkGLXA1cfOeqn1nNxlK2fSe9+VtHv8cvt5QRYoqap3sasUYWewQk7iOBtrPPrhdoU0tFvLxCyPK8cPL8mqH24TAds7sFaALs4niFX6IsLHNTXSdP2F2RnwodpOW0SGdAoTSYc8s7X576OdExtJNtmkffr4KKVRVBahJj1yWGxzEYZ+mHepP5ezDP3sZUN1QXKgsVfubxVapOdGuprdlu20vuk3meHkum9ctvsUUIJ+RKfM/tAVP1pQa0MwyKQNMissdA9Z5m3ibFm0Szuhg7R44NGMuMibMaMJTqBUrkzpjd61pmHjuSNB8lxChhqo/phT2GGDuwGdqZm68bfNuCDzFfUsWe0zaeeaREoGkVe+n9enCdUYmf2I25pOqcyd2/c9zCKOqm77KxiMUzdlWclrZBPglt8M1Za2gigMutIDSfkKZ5u1cRbViruhnx7Kvqe23EgRwfNgoXqhKWCW41AKcteA==
			postgres-password: AgCMcWSshYc5RMxBG0f0Idycuy8EfPTYtZ6R/7N6F40xrzFiKLcz1rW9kcIPCpRd9m/ev3/3MRm0EYnw/a/7dcL1YZ28t9SuU/p3UA9wQxapiNeVrhH2pM9CJtrEjxq8xdCDapXAhmlB7PWfdpm40nCi7BzP0DZodx36NzOfy9JtA+EXBSGKzWqhAfiCRfUSvNRbv3oiYuJCjHcM7WtAUVHav5JhZ0HMc5jDCiGWFobsdm10dfcZtGcFjI6pUE7mOvs4JM+MfUekYAgUyulSlVaVt445JvXCVzh1CiY6Yc7RYtupmFJcnUjEbaolMwa0dJU81KUX5MDMXx2a0tmZNr7kFAgoPMCXPwILUIhKPYLCFVTBgIDXW2WF6IzvIF9Jm0L7PaXXmLcJprgkkWuD23vLADVJu68EqX7W/Y3ZDGW3sV9g9wl0kFoR+XjtrpKvg5Jpof0d5T+RQ7ELRNuXU9XWMzXr6dY20BQ3WVIje6u8qaEdfxR3jZpX+ui/biOQW0C+OjDIdWAGE3wtBOxv1hk30SJp03x25sNP8kgzF6Tlc8NYraOHIwcBepu3xDwMM/evSE32NSecpAXcLb6fjqob+kj8QR6UklxSSjVPZj1+J1ApKlngQ7qUOXqOaFyfv5zNz5flSc1Dodbks948DGG+E2wKTQOgGZAEz+tN3YODJ2HC1KfRzgOOUSLgn04whv+zxUobmUR7caOlk0hIyos6hjj0T4jfI2ADIGBMe/awLwgSbJCjT2YwovSf0w==
			`template:`
			`metadata:`
			`creationTimestamp: null`
			`name: directus-db-credentials`
			`namespace: directus`
			`type: Opaque`