d5e8c28a6a
This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing>
18 lines
2.6 KiB
YAML
18 lines
2.6 KiB
YAML
---
|
|
apiVersion: bitnami.com/v1alpha1
|
|
kind: SealedSecret
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: stalwart-oauth2-proxy-secret
|
|
namespace: stalwart
|
|
spec:
|
|
encryptedData:
|
|
client-id: AgARqBsHsoED3MPN81QKic7nfuLpv4CAIpqkPQL3lwUSqmmbxK4JAO2wGuSpS0we+tr7p84VhXWHIe5e7jfe3J+lj5W0JAZdfwEED/5lV/wKD/xNfHgO0iKUTJHvetU7i3ecMogVqJGqG9rX42dE83LfybZ4Ua21AcjTMPSQmakQb8204VXIxqTlOFBD0f7hWNCs7IZ+AfLBjLEZHqmdfh849/TKwXnXFDtYMYzG16o/+zkXBKkOoK/RuPQN8Nt2YdA7Xd1AqU/DggzD8GzMJEvPEFvZQjBnq+hgrxa4lY5dj+S6nJ9/Tt+dLYV6+08vSPLM8mN0jc0Vd73lr2aGnjL8TurKB7s3yDeKsBUgqoilkDJO7YoCBfx3px73lK+a1G+i+KNf7iUcTIGIRq+nIYLHXP3OWSFCIBHe5BhH4oyB3GRUIhHhgBTEMXnHyxALqfzsr3SMHdnRHYnvz9IMLWxw1NTiQhvEP8zF0gZLjpHATWglPvX50vQnESc30HYa0HXc2F9xPX0oTnWucmviuSKGS0DHmNO9zKLFZNR2DJm/FVY6AMaH2YZxpM/3RDqEmCbfGzLgzslaIz8vp432FhR/Isl9yzHV4SJDlXKBlD/EDNo9tthgpqzQilBxx2I79ute1Nbt0Ka71P7doeVyl93NYKCFWhh36hHwlM4vpePUmpRronv4iZl35xzAoV8hNm1RxxLCI79PESH4Qk6XeXiQXBt0s5T7/3ZaMUDnxugY3G9F1U4=
|
|
client-secret: AgBbziMEuveXDkylbbtppuNIHyJ7rcC6Do+qANtpk89N4Qqo+wFmG/mPzCXDpCjX/i+o7r4vOhwfuzHREy42Pn76VaulYiNpkETiIGFc7266dCIIEwSaHcn353iMHgDYQgnqehsHZejq6EGUEM1Wtv7O+8Bt1O+E7jLxxeAtB6XdaFwyDvvZrpJuN981me1DMPk4tvEfoVkDwtVm+dKogR5GnaN1FK75hojCoqU+SxUulmX6ykj7fdV2GPsxQTOFT1gy/hSWfR3BZ1ZBhHgt3xtfWKWm5DUcn7CFCJGgVxXbe1xspL7ntZu/aDtV01K1udVAVVGnmrckpYr9R54+ATnhcIvt4O8kRBHyJKdeP/Fi9hN7Kupc7yL+gljMaQhMMYu8gtC7Vf9cDPH1ytMfhbyrF2lkKY7MU+iWvFxVPnY6tgd2R2dwhSB0Uxde7iznAiVgD1dObw0JDlHhIKQHn5+Bp9z0gYscK3BJPLbW+xCCIkTOFWXnCu9ahDXD7C+pEpngp1hGdGmMhT1wKjD2GY+8RAlO2Gz9K1Jdix6ukqL2LY35QgdSXrxrJgkD1xRkQP6BEBHefcYcP1QO9gl+xKmxPDZX60MgT0RYAE9ETJBuLuw/11kZKjthlWkgzqzwwKd9S+jk6aghcJueTv89gTcRnDlP9URjjQi8iFk/ag9+Af2Q4ftW7NPu7K141onzA0VPE3ZruwhQVhpWVbLb+cXfmShbn360TECBFFXXAj1oBA==
|
|
cookie-secret: AgAzT2XhiQrTb2AU5nZAPCJqTZTXk/nSCU3FUgu0g/7N5Wg7vis5MLv8RaUSNrx7nDBFtHO0YJb8cWx+UF69j2tBNmnOYYFmhYIE+U0oK7ZgKuTfbFUiQISmOwKzq/JCbsn9pR/jsjaBXCiIfVBvV15tVDj44iDtVNRtmgjHfatvD/N2YaPn5KP8t/8Xr+Enp8PF58+Z44OO30hG9mXXInAZzPuKbv9kOwMDdRGm+6gWczigyC26Cl3oIVRO4t5TcKDcoEmQD9N7NfEjbZ/D+6GpruYIM7u1W9rEip63SHZ6ty0B2m9BmQZYRWcJPX5ISh5VHPvxY665gAcg1+Qooekp9YcHubb8FJjMHGBuXj2fJVjCbjSZSIuiU6cEoIn9C2yX24rvcVOG7EMDysG9LqDsZnkvqFsQ2uRuQR9d3oKZPkR9xXGibOHDIKPcWVH212hX7QtAo7On0JeeDM/QiSBs+MKuF1l4pdiGfyXqZ0pwrlHsfWwZaZYDYRhMWmftrZTsjTBMDZ9Cw8i2BQpk9NC04wCwJ6EPNySPD9HLJ9HNnet6bEAFmLmMZyN9x6vbW20VJKfx09eOjd99Y4TlEIsVLyUF9S29lVoib09EfzvDMn9axDIYaZ0SKhqZF+eH0lHzhr1vXtMxfecLO9kjBarcAuSilfIS6XqtwcXXUhjiRbz0qGtUNvy3n+xWVCTXtAz0FB4cuUSIqxoV0gXeDRNNQiRdCJNABNGLJxKHYcl4QA==
|
|
template:
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: stalwart-oauth2-proxy-secret
|
|
namespace: stalwart
|
|
type: Opaque
|