Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
---
|
|
|
|
|
apiVersion: bitnami.com/v1alpha1
|
|
|
|
|
kind: SealedSecret
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: paperclip-secrets
|
|
|
|
|
namespace: paperclip
|
|
|
|
|
spec:
|
|
|
|
|
encryptedData:
|
|
|
|
|
AGENT_JWT_SECRET: AgCA2QFej+jJlYP3qMIbPAerVFbXImcDiGVf5Yjsw9hjQDQEQhZmDaQdjClBtotO4aHzIJ2zgS5rn22qHbea9DLk8SVZdC3R1YoWGL3fZGYX9dtaAGefVLekPbM/KVFAGV+a3ZAPqNgjEVBGC3jfz08ml+chbFXXMgzvfXGtxUZqpffhOWOuks7rUfUob1gqYeSYxOuuCew0S+0L740hv7+6mtBkUpQ+jpcgyO3PnUPMUAw0zg9Gropkpfz3NdDTZ34NZlVpg2kzJg7z97OOQpFT95bYRZZKfvRafOW05vpkWyFro+IbcG6B5r5HQ7JmmZLJcTiyW5hXuRC/KcFqfNJx1YVmKBhsVyQHecV6Av+N99Vh8lx6+PSoDzcztY3h3pjwXEaixBbV+Yv0ZS358MKB+IVMwyj1gBCmGsXLAoFSpspsEu/c6Eynjl99peGbFthZ912c3rxupvEgWuuvApbRYr5uh1D6LAZg6mbgCArQICBAQigN6qCUNhXETYCAwc8Wh9Q7OXCEInncWWVrVSgDcbR8TzGF0H82yc/oeI06twuhLkxGmgCS7xMyfzDvLPZf0TPF6JYtVNy2kXPs5kECXxF13VEOL2EWvPJZpQPGmqaUM5AiCeNmjd3LgC5Ol6Ww/GkJ4Pg0N18RJ1ti6MYMdOu3C8CDZrSeDaezcWX5KuWg++2453uiAsv2PMBaiS64cyNJiA7bHox1skS3pleoMfIHdj5LtQAnpbk5pvs0gqJP0tUfzxOnInInQg==
|
|
|
|
|
ANTHROPIC_API_KEY: AgBkK9ZBW/chQR/azcc2Dg8WgjTxDm9v1s0Tyv9BZ3NDlx2uUpyrSQOU78iW5VxYqDU1DmJYiWzxi2j04Z3oY/3AJUy9IkJW4CSIt4OoWNXgUlm913rP97fpTFGDdlEDXMkeclIcmnMT0dl/yHHIvkruFzgJlCI34DG7wv6NviYkg5J8CJeredz5KnhlkcQUTUEpVr7mGo1WkD0V3+al3j764XvqD9o3JQinbnUq8N+vwJ2HjxHbxhkahscudMnRt94KcJ1ap7AMBieT12LN/a3KFwy/I5AAYr3uZ0DALlNgX19Au2KFTNjdvQ301jAAyg2micwpPMjGRLOaXWjmrG1xGtH8QejleDMd5R4I5q8Hj5MiAcZ4QqxpQqNPgdnJnkZLGGDYVoK2OQK1uRt8ZVxg9snamRwLSC2o47HDhVgbI64hBaMHcxscSYTrVpwC/RUmcPPpKUbeE0T4fM8XKrXNSxyVWSd6wfpelNU+7YS5fYRkpEkxp0u02Lp/nbeMvrXjdNgOmG2fJB9byvsehl23Bud93QsARCWrDUmZpfzV5Uf+RG7Irso9CpFFO1pSrItD+Q++OBVvTfSBn9fGOWPzV+yFFOiKjvjhaSjWH1s77keJSSMuYDH048ks6u7ZTsUcR4rU7wMW4k6l+YTBBKsift2NtmWs/zxGCdzRZgJ80pBTYC0RN6tuoJwg5Z3xpec=
|
|
|
|
|
BETTER_AUTH_SECRET: AgBaqrwdWMZApjXhTN/p1yEZcxgTEVywTtjVVeXYpESKI3Py/O7rY/wZrLDJ1G4yVJ240xjnnUkDNreJGXZfJSCu4ZjvywKuSc/aILKQ9WIi/QyeGDzQPkO24/qs7KFlW7G7P6CtepBCs6eZgp1W7HzLL4EWZ1flXrIygfKsvddr3vjWTB08uBnptcH0NpWdNH4WNIqAt10Hx/m9Z++XS0FHZH2Y9+v8pZB9jCMZ43VPuL1F31xlIW4g9ULuTyWQkJGjVJIiNYrMaZ2Ariw0+FoMc5iinelTnDxxXYyfqlOG66FjEolvAGAYirfuBUGvhZ2pxCP4+x7YddDhRhpBirY9u0uQp703hkgBlw/xqwBWimde177sy18VaYG2Pw7r+qWUdE98Rl7nXYLshqQKA5rQ0jAr+qaXpMqenEl/aCQ8YzovH12oCTBjE/kvS+hVoxgHAlIh6DFwPsPZ2Zyy/41Wi8VCgrhJmbF4g2xL9s4IedQzg8SDhkVjdjTJLO17iF5W+vn/IZhuLoXc2bSJ8OJHAyAJybXEav1xd4AyFiZLg3Z+49Ai5btX3vT9FcOGCEIVQeluPtyr1V0InLfMU4L1cbhCKpR/XnxDssn74RduPyA91BdaLc2nSuVKbGVi/cEjj7iElhekzVsg0xInQhgkr51iJkPHnqk9bAfX5ddZ1e4Ktl5EHhKkt1kvTYZS3fczNVqFORpVHtmECpgpc+KLJ7KTsB0JRbuX9bKHE1PmEv4XBHf+IuMLaTcIyQ==
|
|
|
|
|
DATABASE_URL: AgBSYZhZYNxzlVRgGH7wvqvBD+1xIvxq3OordmmuAkBDnx2sLu3YjZBfB+xhhBb0/WbvkWO11fBxNbaIztk2BL9263fe0VWgGqIGUvlXDPQ6iEUtU73Bntv4p21JOeHllIG4Ur0XEYpinXA91ZupcKr+UJ8sRsCu8jVv939RWIYPlJZhUduSZdo7S39ACUw92NesCj8gtWYKtyjkX1RSN5sDmvVrP4EDiP2bnuU9RtwirPfgvFzuiqIfUsew+NsTgCkFZB1rY6WEfxjNt6O4YCNRa4Pg1BVWZxKdJ93LRpNhcMdl3Luchz3/A2ybLoTA5eJhHjY6jFM/0KKeDwNejBtStiawORR96RFEI3xEBvGAFtbbcDFW4eEIt7bFy5lOLk4xl5PuJ7+c3ogulu6Qoa9Fw5qywCQnYbZZiyxrtWGhp1BKX+dOJRP+QJaRAGHAauYbtehB961ZALRSZtGE0YbYnmlN1KHlCkFv9EJ7SG1a1/zaMO9vk9dexBS20MjW3IWgUUfvFzccFS68pREg232ByXW+Ec0jMfCIOVPjKuA76t4MOwrZXD7gwbdwYPmRTxtMaX7S2IZHmXFri4PGgoarn32bQ81LW08xwZEbIoBXcRue6jJDBsSAl2CpCeoJTvVEl9WtCyGio6/eG7mfMAcvNRVmozE2ZhCSGTuRpwDiNpIz+vCBjx+esjastBtsMSWhOfpUR/wNfD26DexwTWKKba2qxOwT1hkLCNFLeJqZtWYSvHSg9Oyt2NfUoQw+dCzKPxeyq7HlPTnZ1J7NbA2rwDbt1wu2uolTvW7ReoWLIdmyQWXBFYs=
|
|
|
|
|
OIDC_CLIENT_SECRET: AgAREuUCCAWsPe1dng5Ei5nB6ejLs6XJ7wG1LZJf7qaRb+K11vjg71TyW5hULtLZX1gfHqvmwlEJl0hiNXaxjXex4D0YLsV6i1U3IOHPQLZsp0Fu9IcQ/j6vSD4aHPVWUKTX25Sciw6BauRwKXaTBZcPXZV9s4/EtHPf+zlHBVR2Hy1LqAOb7PF9LSdZxjhRu0n+/8iQ9hJOFGFD6y0fCA3Yic2D/b54GI5Z78EPr6YJPpJqgW9b5aMcT+gr8ip90ESEHDJUr2OOgdZ5385h4VV2B5CgJVHW3S/wTKQ6B2AWJV8tHo0W6MeOWJUkV1HXdJeP2MEPlQ9qmXn4yw/vRaJaozlXwQauMs1fw1r+h6AEtM4R9eGWiMN93S1fNBUzmeSg0fsiUHNYt61eCEMRnaWpMeXpnkBpWKoXDCJXoeZhi+hmVBiKBX5KzTX38/+zTzlpRSczfifEFqolmPuwvMBXOFAsl1LbpZVCpiKyKUilmZS6ZbXPm5JuCYD314MDhUVuWZAuq1aK0G91tMu6ddafBkzzDw1AgU85cTJemZ6sPdQGJvuXv8K8uLgANFERLjRB9e8SgWDNlRU5VYyQbgdMhlC+OROGhbJJ5hey8FOgz4Gad+QSBiTDEuKR3S0ln+GuP2w4dCbzXe0J7RZAK0E6O2G2SZtsAgJb6p2safd1zN/MkEhouGPGhffGXT4eJ0xxJy+sDcUE19g3asowZy34stLfYrBtAwBD0MdYN4TxoQ==
|
|
|
|
|
OPENAI_API_KEY: AgBIAmxVwn/J/vxPck2pv5h2AIizUz7zhnU5U0VN9SVsx9oOG9YRjPpHehMA+cWdRnZwPbTlAXWvBA09EynrLpM9ERuUGl7eNSa6N8V5ZASKDENtBL/QogeEx2+iYBIcFsLR1VHnTi7FGsgEKRpEu+Z7xmx8+2Piloqy4D6rVcwuG/RPy/0CN/WzVNDk3fpRQZmCQh1uBDJoHP3TkVu7W1jAGIWIk0Oko3nbnhFOZkvDvsRYnsEf4hNnqQJ+T2uJH1HoqD+sJ1pGdeczDTcIRWgED0OFXYOYjH9XscvJM+uKNkAklokkDrcqOn0ryOXwXPv7kla8KeuFSjrF4/JS0M9CbdUb8aQx0MxnF3LAyHJV+oqEHd4o3TK/3KGuR8zcD7+SXtIS8RkehOZXcGvq9ONkCncLxcTcqefikBdo8xJQGx8Zu24BoZNxx/l9888F1+1WEtmMM05q8gRXMc40DBNtO3uhYYh7Gvxl9sYVcnC0HyK6dvnwspOcSDYgy7m3zONYyyPtmrAE5r4er5lRvl0B2gzvL922A0S/e8/3LXKPm9aAuwfpQkHFS6vbCqBSyQtJQJlXGZmC8xb1L2W7bsbY0cC6fqRZEr0Y7dAlRT2/n1Bc/ffg4W3VgoNq0G182ymEk0Bjy2W3DF02Ivubw+9WSoi8jWIV36z48Rm9NDZn2qVd1drqe7Sj9/Z1h+t0K0w=
|
|
|
|
|
POSTGRES_PASSWORD: AgBu6J+RG+jLIANGDP4cfUJoejAATDzLTYtJPaO4/Fik9g4EGczWMSHvnmD2fnwyclB8Mp3lIrGdW9kbnCuk+JLZjynKhJ0JZwnbLpr79tfhaCNUjvE7AvycGkMkQoVH1l5OwLRW9ucz0caHDmZ2CadqN0EAW8L7ZwADUzSlL6UGUDwLzN/4kM1sSGbGichJrbduXGS0oAmiRH4MroIytQW5cmHOQaVSuhzPZSuzGKahVCC0uRJoWenRRBFQNu9moI0dVu8e0c0EnUJewHJlZFPSv+QAobipKqKKepP8965wKlaKxTRXOOEAp/qdN3w0VtX/P2VZ/I7S8sB5MmN1/yEL2lNOGxJuJupgCRDN7fLsRHvpg+DjwjpAfmXYQZH2Pj/dm6nuXsSS3bvCPM8MFHhSIIEcV04h9uFOvXhnjh4pjcWKOPKRNHjH2vETZbizB6NfkOUJoTSwyr0Jci/3jxHAuzIXlvE1l+EpMkea8TG2tCXVsgGthYuPIFEb+mNsDLV9hef8XNnUYqXQmM2xsMQ9NvzdbhxW/Ue3UQbMau0Z8Z30NCz8X+4Du4m09YuyfLCM8mfGoou+ZpkVzS2EPoOTebuYMCAjFOBdxm/C+9RH9G3JIj4d8LsMBMs2iJd/BVm7tI8RRKf9fL195neECzFNaoTDMfqAYaKpfGjLHzFALcq4b+sSOTSaVS2mfo7MpBG/oh3xHJwl3oApnWj8A4+W3bO2u0ACi97nBCQzUBQWMg==
|
|
|
|
|
template:
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: paperclip-secrets
|
|
|
|
|
namespace: paperclip
|
2026-07-26 10:00:04 +00:00
|
|
|
annotations:
|
|
|
|
|
argocd.argoproj.io/compare-options: IgnoreExtraneous
|
Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
type: Opaque
|
