3 Commits

Include renames

Author	SHA1	Message	Date
rock	306c68e7ea	chore(iam): retire the .enc files whose values rotation invalidated ... grafana-oidc and comfyui-oauth2-proxy held nothing but the rotated credential, so both files are gone. oauth2-credentials survives with the two secrets that were not rotated (api-gw, poimen) and drops the three that were (grafana, minio, paperless). Leaving them would be worse than untidy: sops-secrets ran with selfHeal, so a stale file silently rewrites a rotated secret back to a value ZITADEL no longer accepts. 32 files remain, down from 34.	2026-10-27 14:47:48 -07:00
rock	c93a24f786	fix(secrets): populate the empty sops placeholders and drop the unused one ... (cherry picked from commit f6207ff2b0)	2026-10-06 10:03:04 +08:00
rock	03044614b7	chore: add encrypted backups and rotation schedule ... - database-passwords-backup.enc.yaml: SOPS-encrypted DB credentials - memory-agent-oidc.enc.yaml: SOPS-encrypted Poimen OIDC credentials - oauth2-credentials.enc.yaml: SOPS-encrypted all OAuth2 secrets (6 providers) - rotate-secrets.sh: 90-day rotation schedule (next: 2026-12-11) These files enable full credential recovery and rotation management. All SOPS-encrypted with cluster key for in-cluster decryption only. Manual decryption requires ~/.sops.yaml configuration + GPG key.	2026-09-12 23:52:34 +09:00