Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
---
|
|
|
|
|
apiVersion: bitnami.com/v1alpha1
|
|
|
|
|
kind: SealedSecret
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: directus-app-secrets
|
|
|
|
|
namespace: directus
|
|
|
|
|
spec:
|
|
|
|
|
encryptedData:
|
|
|
|
|
key: AgCakMsBdtU8L5mZe7WZ59x5Uj5/scaj/1RyV6uD5XDga18CQDvHS0Trf44Kb6K11eNvaDe6D1oo2a6FjkmInYx/1LxNUjir5c39x0AsUyy/zo64gI9t09WB5xTvi1+pjPneaqlXChLWhaQuUvoHPaUiVlmyxu0mgnz36/32GDXufuxNL85diJTxF5iz7iqQoRQ7u4Da0AGq8Jpx7pkvch4WfMoYGz3XDr+rf5l0TseB2nJ2EnakC8dsrdH7bpBgtoTmin8oviM1z1XGupuehJEU8iPEDF632yPJ92kNlJnZECXcWVp9G7/k9VHwkbgeJXulFK0d4FYG+aVzT9X8+uPRqhxnR+mqqRTyuQPxtdpz2J5o+KXl3XdunfTDLb/bIt9v1g3H1GCKB+31ACADo/W75BGI1aQLrjSV5iz/PFNH16/SGvbBdk8KOMzH06lRAU9xknG9leKdOpefg8xhECeI3jCfrHMzKHyr8NlEyAr6lkp0J09LIgt7bXcYa360AACEb5hnB9Uw/H3EHQoz5hfC7DUPDBY26MScWvv/D3p/DSKskTQuYN8xzaOTwmYeurVEqta4H0TYcJwqUS5ZtjM1TOpzTDrI0NXcQDMU3oiRni9hCijnfpO033WZrEU0Z731eWYYu6aEljKumjG7IGo9zRDBMonTELqB1TiWdD/U0QzGPi6/ewjehM5vcNRkJ9/zbn0Pxy5jXbstyVUqLz+w1pdeigfrr2moxrHA6mq49k+tl+rA7nesr69TgsCOvyoPaVq4pG355w4IzcQgV62y
|
|
|
|
|
secret: AgAFeUYRo9HQMB4fpQ7sYu81PydoI0tGFbFtJupdb11qBIvrEz2zV8vnNnKc/1v5PJmLUyeQb+ZbNprBu+6PtTPoLyUAufcaV3TTXXwBfn/HFwbuIDp/Zl8LMgvAojuqAh6LV9GYJZCZDhoI4Z5PCtIiOfGQ9tVmbPSscQSH7qlv62I4pTc+ShVrG3Vua16ThSOHN9qmqG4eHIW/wJbRV0318B9LYmiiGtO2XjGkOqpGrHDCEhp5y/9nrqARgeap6y7Ec9libcXqZw4bDjfkIEDR7uH1N1XqtcwM8/AAfp/t2KsFN32TNJvd2TU7OjChkGKInk9PP9p88RrKVd9EstOyfI9b7oJFlmCJCHFiJMj/9Me9QTWPxxkU1akOKesOAm+UqbeTFQme+ftsxNlRXdedzSqBGFeVL81IkPCEFBVdY9iWq9ll+vpeL1XMd1vxwcRt2jw6up2EnAr1AdaJnQqzALWUGnNw/6R3WNZA+uP3rtN+nFs4cvrj1IUNWNWaEksBfJI4KQHaaq2PvWA9LWg+lPleLKJIcY07gjQEyyJytds0hCbSFpFzKvwVzZQIrMmXXFePgquOevDaHQzL7lTjOjrzzRrlaOc69UtcxdS3NcL5aE6whPRwCPCGIMMsL49sjz6/19ez88rtyRFaCHOayK+LhJsvGYg+2EWkxv3cLjSBNppmGJeH+/EDbJ6U5G786lmCSwntClh/qdk3JueoYrtIpN6g0Y76sMhhScHmjJUO3r4bh6whWH74XqKGtWa7b4EfX7zQlmN9MHoj9G9l
|
|
|
|
|
template:
|
|
|
|
|
metadata:
|
|
|
|
|
creationTimestamp: null
|
|
|
|
|
name: directus-app-secrets
|
|
|
|
|
namespace: directus
|
2026-07-25 14:57:27 +00:00
|
|
|
annotations:
|
|
|
|
|
argocd.argoproj.io/compare-options: IgnoreExtraneous
|
Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.
Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
* Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
* Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
* Paperclip (4 secrets): main secrets, auth, OIDC, session
* Forgejo (2 secrets): postgres, backup
* BookStack (2 secrets): OIDC, MySQL
* Passbolt (2 secrets): MariaDB, app secrets
* Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets
All sealed secrets have been applied to the cluster and services verified
to be running correctly.
Related: DEV-203
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00
|
|
|
type: Opaque
|
