4 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	4341b1109b	security: restore old public key in .sops.yaml for cluster decryption ... Keep both public keys in .sops.yaml: - Old key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (existing cluster secrets are encrypted with this) - New key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp (new secrets will be encrypted with this) Private keys remain secure in cluster (sops-age secret). Public key history cleaned from git (see prior commits).	2026-09-13 11:10:34 +09:00
Admin Bot	4a00312906	security: rotate SOPS age key - update to new public key only ... The old age key was compromised during terminal output exposure. This commit rotates to a new age key pair: - Old public key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (RETIRED) - New public key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp - Private key: Stored securely in sops-age secret (argocd namespace) .sops.yaml now uses the new public key for all future encryptions. Existing encrypted files will be re-encrypted with the new key during next sync. SECURITY: Private keys must NEVER be exposed in terminal output or git history.	2026-09-13 11:00:14 +09:00
Admin Bot	67f24ea763	docs: improve .sops.yaml with public key and encryption guidance ... - Document public AGE key for developers - Add encrypted_regex to only encrypt data fields - Keep Kubernetes structure readable (apiVersion, kind, metadata) - Add usage examples in comments	2026-09-13 09:20:05 +09:00
poimenandrock	d82cc5a697	fix: gateway authentik port from 80 to 9000 (#22) ... Fix gateway authentik port from 80 to 9000 NetworkPolicy allows gateway→iam only on ports 9000/9443. Gateway config was using port 80, causing JWT validation failures. Changes made: - auth.jwksUrl: port 80 → 9000 - auth.tokenUrl: port 80 → 9000 - iam.upstream: port 80 → 9000 This fixes JWKS refresh and JWT token validation. --------- Co-authored-by: rock <[email protected]> Reviewed-on: #22 Co-authored-by: poimen <[email protected]>	2026-09-13 00:07:58 +00:00