feat(iam): a KeyRotation for every consumer except poimen-memory #84

2026-10-27T21:28:33Z

rock commented

2026-10-27 21:28:33 +00:00

Eight rotation objects, all suspended until the controller image exists. README records the .enc retirement target: six root-of-trust secrets survive, the rest leave git.

rock added 1 commit 2026-10-27 21:28:34 +00:00

feat(iam): define a KeyRotation for every consumer except poimen-memory c2071da9d8

Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and
api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and
whether the consumer reloads hot or needs a restart.

All are suspended: the controller image does not exist yet, and an unsuspended
object would claim an intent that no process acts on.

The README records the retirement target for the 34 .enc.yaml files: six
root-of-trust secrets that cannot rotate themselves survive, everything else
becomes a KeyRotation and leaves git.

rock added 1 commit 2026-10-27 21:28:35 +00:00

feat(iam): define a KeyRotation for every consumer except poimen-memory c2071da9d8

Eight objects cover grafana, argocd, comfyui, minio, paperless, immich, forgejo and
api-gw. Each names its ZITADEL app, the Secret it writes, the consumer to roll and
whether the consumer reloads hot or needs a restart.

All are suspended: the controller image does not exist yet, and an unsuspended
object would claim an intent that no process acts on.

The README records the retirement target for the 34 .enc.yaml files: six
root-of-trust secrets that cannot rotate themselves survive, everything else
becomes a KeyRotation and leaves git.

rock merged commit c2071da9d8 into main

2026-10-27 21:28:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#84