homelab-frontend

103 Commits 6 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	4a00312906	security: rotate SOPS age key - update to new public key only CI / CI (push) Successful in 5m25s Details The old age key was compromised during terminal output exposure. This commit rotates to a new age key pair: - Old public key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (RETIRED) - New public key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp - Private key: Stored securely in sops-age secret (argocd namespace) .sops.yaml now uses the new public key for all future encryptions. Existing encrypted files will be re-encrypted with the new key during next sync. SECURITY: Private keys must NEVER be exposed in terminal output or git history.	2026-09-13 11:00:14 +09:00
Admin Bot	67f24ea763	docs: improve .sops.yaml with public key and encryption guidance - Document public AGE key for developers - Add encrypted_regex to only encrypt data fields - Keep Kubernetes structure readable (apiVersion, kind, metadata) - Add usage examples in comments	2026-09-13 09:20:05 +09:00
poimenandrock	d82cc5a697	fix: gateway authentik port from 80 to 9000 (#22 ) Fix gateway authentik port from 80 to 9000 NetworkPolicy allows gateway→iam only on ports 9000/9443. Gateway config was using port 80, causing JWT validation failures. Changes made: - auth.jwksUrl: port 80 → 9000 - auth.tokenUrl: port 80 → 9000 - iam.upstream: port 80 → 9000 This fixes JWKS refresh and JWT token validation. --------- Co-authored-by: rock <[email protected]> Reviewed-on: #22 Co-authored-by: poimen <[email protected]>	2026-09-13 00:07:58 +00:00

Author

SHA1

Message

Date

Admin Bot

4a00312906

security: rotate SOPS age key - update to new public key only

CI / CI (push) Successful in 5m25s

Details

The old age key was compromised during terminal output exposure.
This commit rotates to a new age key pair:
- Old public key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (RETIRED)
- New public key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
- Private key: Stored securely in sops-age secret (argocd namespace)

.sops.yaml now uses the new public key for all future encryptions.
Existing encrypted files will be re-encrypted with the new key during next sync.

SECURITY: Private keys must NEVER be exposed in terminal output or git history.

2026-09-13 11:00:14 +09:00

Admin Bot

67f24ea763

docs: improve .sops.yaml with public key and encryption guidance

- Document public AGE key for developers
- Add encrypted_regex to only encrypt data fields
- Keep Kubernetes structure readable (apiVersion, kind, metadata)
- Add usage examples in comments

2026-09-13 09:20:05 +09:00

poimenandrock

d82cc5a697

fix: gateway authentik port from 80 to 9000 (#22 )

Fix gateway authentik port from 80 to 9000

NetworkPolicy allows gateway→iam only on ports 9000/9443.
Gateway config was using port 80, causing JWT validation failures.

Changes made:
- auth.jwksUrl: port 80 → 9000
- auth.tokenUrl: port 80 → 9000
- iam.upstream: port 80 → 9000

This fixes JWKS refresh and JWT token validation.

---------

Co-authored-by:  rock <[email protected]>
Reviewed-on: #22
Co-authored-by: poimen <[email protected]>

2026-09-13 00:07:58 +00:00