stack.basicstack.de/apps/stalwart/stalwart-s3-backup-sealed.yaml
CTO Agent a4f4c814ec Convert all secrets to SealedSecrets for enhanced security
This commit converts all application secrets to SealedSecrets, preventing
plaintext secrets from being stored in git.

Changes:
- Added .gitignore to prevent future plaintext secret commits
- Created 20 SealedSecret manifests across 8 applications:
  * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup
  * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC
  * Paperclip (4 secrets): main secrets, auth, OIDC, session
  * Forgejo (2 secrets): postgres, backup
  * BookStack (2 secrets): OIDC, MySQL
  * Passbolt (2 secrets): MariaDB, app secrets
  * Pocket ID (1 secret)
- Removed hardcoded secrets from 6 stalwart deployment files
- Replaced plaintext credentials with references to sealed secrets

All sealed secrets have been applied to the cluster and services verified
to be running correctly.

Related: DEV-203

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-01 18:38:27 +00:00

20 lines
4 KiB
YAML

---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: stalwart-s3-backup
namespace: stalwart
spec:
encryptedData:
access-key: AgAg8YEUTFc3YlfKKzIoHyG1WjL9+5F3enPhbWtyrEtLH7tiOaq9IEklOKft+ng8MJFNdORy3all7F9zjht436jlZFuVc75b/ZYWnKrjwhtnkfaSqmKPND0KmbBv/5IEu9rGM2UlwIJypxLzR4ef1aRDoTN9fdFL6lA5f0JETERCGrJqum69cKKV71yQ3Q0onlyftoymE00J5dThYrqSkKEB0GKRLqfDmvPY+oAocb2Hm6pIaM7/tM9MAS5fTr0ABHfvyB4qCro41PRl3QfVOfQpTb6yeW00p3heInBCPAvcUyH13VNH921WB5pEcARe54u4gsYe1TZH9DpzcaP3ZKS//5+5ST9pxkLnGidzwU3cCKDeGRDQuyC3hD7DgF2skZT1dSXaDOeeWZdS0ElWWszo251Mtk1CFbJe2oyKiWF/4z1rZ9l4aNcE3qP638zrfqHvRwwlLZpAiN9Auty1I1JDfp12yb8k9ojMq2coG2N56cQE7l9UxPCgfafhanI5VGweNJlkusG3HEHbE0QEXggNoY+iPpQNiJTAAz5Fm2uqo3WJjcx4/cz4+ZCwsUU2szgMhwmnOI+SLwcwD3SvkRMivDIh+eTpcMKdjmiXgiS1319ub69ns3hiw8THwnctevT550n9F+dhs8oc+2smsPAthrOgF2GSME+U91ALfhrq3H7WPCFU0mNLpAbM0KsYP5soSK16hibSYXr49PSo+S0Z571a4g==
bucket: AgBiQK1GGumYvtfPZSPbJNDVnwo83VY2YuEQliYIoxFtBk7i1PDJQgLOyRtls0OicD2Sz2qE01/vctkE/CYYjRGimTfYMteggPNcBjN63r9yA5mFT/e9FCYkVNzjME8bruAstWNITINDP3WYFMqIsQ/n61A+lGLlYmAxKs+Fv4pjZeRvggEoXPPp7hVqjkdJXoLhPhX8Q8JgqUO7ikcxXuLc/xUKegrvHOl37W0lHlShACAVbYjrfq4W21vrJdnjhJJiiu75j6nQAz246UrujbImKLVodyzkWK54aDbhOvNdQSgGslWkbYvQ+qJ7MVmKNcszp7ohOKMK6/M91BxIEPRFPEfR2n6pxD+2qrBMjUDMx9zbJTXKuGQKIq1AT8LQiKGYr9BlPZWK21nFLKy3BmTrMVqHL3e3l5gdo/PTf8QzX5l4AkO+mc33rJJkzQTQG5TzTUZNdyHn2hvvxsxOuDkz9vQ+L2n/icCX4pvYPozUrvcH2xRmpnC2WQhIJq1VCtz27mtKaoaTE6V6cxF+g3boFBI0SlauqX5lQoahrfOIvrY781vwCGK9K0OYrWHyVD+HvNUqtbjIqK0k9TZYrmkzUa/HI2DJdrVnvnAHNV4fEsVvKtx4K+kVY1pVG1z23uy8ITQi8mvPWRqH5hB1Yo0JKAjLsjWzUG++uvCtv87h+fx7mwiMndeAJSF1hWyjvM4OQJPmMYiCDr3nWkEhmvjEGQ==
endpoint: AgA1XHEld9VqRTQw+YI+v4loinopol4fnkTtI60M/XI9READfFfFkV555q//jCdWHeo2jXuGiW+cdcAlDsMouzzGk2RnHpfxPIHzZuV02yWOT8jmG48JifDTQl2Pdrl3fgpia/dYFmoSG7VLxJDHpl8q6yt/HOoECI+LFciu9MV2AYihO0UBd0wd+PufRn4mGuhc7jIJp2BtyTAQvhC1/r+0l7a7BZWCtGemCDz2KhyunAV7qywuNE7TPQPtco+q4JhbycF6iMfb2yBot+Av2+fP1FseW7m3ybeVL8VEpggtvuErffwXysl2vfQBVHAyY+KpBF4BQDUwcABKk/HkT0KJ6jDy/WuSOqAds4w7KyVIaz6qCtqr8zI+/GAont1Y1vwpprVcyYGDAU10T4s2E2xcQRtq1ynq0O4F79ilvDXyAobwAgTbJC4ssE5VfLmnMYFNbL2bJHzw4A68tUu48n7Uu3wL+hehZMq+MwHlvU1urfbiptLF4Pl0TifiQYufMgDwmARpJcekQBoGIwSWFPPFIhVSbgK3ZxYbJqx3v4Gb9jek0KaNrlCEWCERoxMcROgQO+yKWiyUMe01O0t2xIiLW95H70TnTXfA+/B8Xr14otT9SM6rLH8fYy6+ctpmR9SzBSqH32N1PlJecYxgi0GgxFwxPGwz0Ccqx7xgizYthv5nMEaf1cZm8fVvZF/8KecSDHAK/jNXyJn3rHr1vqb3bohbTbhTagnxQNdun3CkDMwFjA==
restic-password: AgB+D9uD90BTJTRmTNHqVdXE74cXPEWp5t8R0rYTyTgptKY79NkKJc4iOlTstX2KRdzMibSleTu7slM1FHLJZZs/xsIyMRAWVAdkCRMiVqOetpI+6QtwEdjoxt2kiJNEL7AVJiU+8ZrWlK95PsQBUhk8YYjKNh6Cjfkqkb7+PfeSrSNWve9nm6HqVPBxEUSkOtHuchVziuuCepHjPbrN3//awRtoJO0b+8eRULvZmHepNXzCkzKZe0LpHvho/DlTbJAfuQBPYGWwEYD/8DBkpIHdbE4AfCmEm4U1IxfGW5FE34++n0OPyAKM6qeTF46jmVZV2PRXv0QOz3qqGLM9U4VbBWE8OzFPi7mjtQRgkttfmMsMrxLXG4ODUlURfBhcXJJRA818mbzJ8t29DHuGpIcJxW28SbE2uVwQNjzDKp0RlIvjMH0S1D6xwf0E/00FiZ8ng9nD0bbf9JYpnQY4RDQacV4TLvJNKK4rc2VVJ4e1t7mvADk1BtFfDFIYtNXszMxGxs2vfRB6UtVXk80jXgLa8LdDEWyRpkTa1USvD3T02kukub95AcPGdnWQX6GDPuDDJS9BuZIWboelkNVuFPNbvemzecX45IVP8qLbS9NpBMfOyDHrS+PSvkxMpHy/LvNT/U/A81OIwFhperE9vIMEGvwh0Hq6wx2//Fiso2v8xzdfcZXWWM4HZTfvbdQymqk9d9hmjoDVkBhpQxnBGYNytzdWb8VCudrvHvIY+BAS9OuuB9TIv4FLeO0iXg==
secret-key: AgAl5eIpafdecB7CDhUiVQ3ozrf+7ND9pTs6rKqlvbleVRFqsC+/wzGhmVh/1ZOliaDQDR0oUbPwESDuIF74GmYWLjJU//D8D/hnldkg6guJyE6mzkMsEy+LY6fKO6vlfeJocLscscheuKRl7wdXBqc17APvgX97YnH64GPNIypOx5Xhvp9br9C9BZEOkfQD0Dfq7mKxJqDDjUTecQRt6+EpLzdYhkZdWs6Mw9oQUFmto10AA6zoQ8b2p/CaLu8REmVxZzgfA6ve9CMeVq1t6olcNUnrj+yMtByPmsJL4bGZLKWAzdmGzeEOb7IZ8bAJ0tRlLLjzxq3oP4UQgNs9EgzJLe/2mv+3y6T01vDmTzjOWm398Gm9e7ZQThSnfJEDZe2UKfj6ejcEzLkKHVcFJ0haUpJYrCOQLgEfFzG264FuhCjZsIWxRA8IBpJ85/UoPcFAlplai44kEjY/pOtCembOHYd8HTJh1QpI1wyGzRe7r8li7WhaQSOFihU1ZLXEhIZ2NDF2p+qs6ywYlRvqF8gKGZRJvLcH9o3cEA7ju2WPDkX+dv9AtdONZhZniY0U5C0UfOQ6gapQ40VP+KrrrDy+FkzFCjJDshJY7XPkDHQOoUmnIRdbdDoXjH2gITsqQZhJalGEZqxlP65qSYTDkaPtUjIVbZLU7UibLF0niwhp6CQJX3AJSndH6Tk9pG2y8S9xE23tbtW64fyefu8RhoAp76pPjXxZ7kyQHRqmipJgcca0Hn4YkxrC
template:
metadata:
creationTimestamp: null
name: stalwart-s3-backup
namespace: stalwart
type: Opaque