d5e8c28a6a
This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing>
66 lines
1.3 KiB
YAML
66 lines
1.3 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: stalwart-stalwart-config
|
|
namespace: mail
|
|
labels:
|
|
app.kubernetes.io/instance: stalwart
|
|
app.kubernetes.io/name: stalwart
|
|
data:
|
|
config.json: |
|
|
{
|
|
"store": {
|
|
"db": {
|
|
"type": "rocksdb",
|
|
"path": "/var/lib/stalwart/data"
|
|
},
|
|
"blob": {
|
|
"type": "rocksdb",
|
|
"path": "/var/lib/stalwart/blobs"
|
|
}
|
|
},
|
|
"directory": {
|
|
"internal": {
|
|
"type": "internal",
|
|
"store": "db"
|
|
}
|
|
},
|
|
"authentication": {
|
|
"fallback-admin": {
|
|
"user": "admin",
|
|
"secret": "REPLACED_BY_SECRET"
|
|
}
|
|
},
|
|
"server": {
|
|
"hostname": "mail.basicstack.de",
|
|
"http": {
|
|
"bind": ["[::]:8080"],
|
|
"protocol": "http"
|
|
}
|
|
},
|
|
"session": {
|
|
"ehlo": {
|
|
"require": true
|
|
},
|
|
"auth": {
|
|
"directory": "internal"
|
|
}
|
|
},
|
|
"queue": {
|
|
"path": "/var/lib/stalwart/queue",
|
|
"hash": 64
|
|
}
|
|
}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: stalwart-stalwart-env
|
|
namespace: mail
|
|
labels:
|
|
app.kubernetes.io/instance: stalwart
|
|
app.kubernetes.io/name: stalwart
|
|
type: Opaque
|
|
stringData:
|
|
STALWART_LOG_LEVEL: "info"
|
|
STALWART_LOG_FORMAT: "json"
|