d5e8c28a6a
This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing>
16 lines
1.1 KiB
YAML
16 lines
1.1 KiB
YAML
---
|
|
apiVersion: bitnami.com/v1alpha1
|
|
kind: SealedSecret
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: pocket-id-secrets
|
|
namespace: pocket-id
|
|
spec:
|
|
encryptedData:
|
|
ENCRYPTION_KEY: AgBM639EX8/HwWMnseTcoch5BgSFTXwgeMjEoC7/bwxeJq9SDmtDKSI4y57+deHv3JxaoqjitJ2N+oK1SS6lLd1odx/9nVarzu2OMFUg0Jj9TlZybe+lSoIBkqTU7P9O3jznybrVfqOowlWVJznucSiVOlrJfYgqOaGmAW3bNZ/oQCmFNIb2fu68sltuOMLYS0AgPrkWxn8vr7Js1MeoVx9gbq75RwW9mpOkvSQOPupiYFdjMUNHR/ye2bE/yyT/sZZ1xjzL5ImKmSL3khMsriAio/o/019sftZ7AWWRsyYGWtPvFz/FTgQEDoBGztep5D3MU4yKYMxvkX/q5BLP5K5+qkt1UypsytAUtjIqY4+aU63Na5yGoXSZIGXJ80E1yJjGnyRRP8WVADM42QXX8yXMerlP0pyfchYJHXklU0n3QlDftHXjIn+BYODwRsPaNIXrbLnfQfq7chUqHAxA7URhtlnghMhZki0sxdLpjmtvLa1vSw0kGdjGsE14GxJqHmpdHU2axPhENh9oDH/9pYWZEbZiN6RzI+aWqU0h5c8covX0Lu3UX1QViTTAgMg8Ecc7JTbq6VJd7BgjdUfE4RIaE+BuOT4A2LOZaI6ycUDYESfphRtotbMwIWIHQdXXrniP3UJk2pv6ZxSN7JwiemNKLNIyPi5pvamvJDefIKjyVb/XNmJvvDosw2Sd7+3j+nHld9ktlA++eqmjk7Xoi6RZk6saQiXDT/bv7uv2ycsUKQOeoaVWrZ+WUdcavQ==
|
|
template:
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: pocket-id-secrets
|
|
namespace: pocket-id
|
|
type: Opaque
|