riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity
383 Commits 7 Branches 0 Tags
f8de5f506b38f803b10908cf77c329bf731d68d5
Commit Graph
7 Commits
Author SHA1 Message Date
rock 03044614b7 chore: add encrypted backups and rotation schedule 
- database-passwords-backup.enc.yaml: SOPS-encrypted DB credentials
- memory-agent-oidc.enc.yaml: SOPS-encrypted Poimen OIDC credentials
- oauth2-credentials.enc.yaml: SOPS-encrypted all OAuth2 secrets (6 providers)
- rotate-secrets.sh: 90-day rotation schedule (next: 2026-12-11)

These files enable full credential recovery and rotation management.
All SOPS-encrypted with cluster key for in-cluster decryption only.
Manual decryption requires ~/.sops.yaml configuration + GPG key.
 2026-09-12 23:52:34 +09:00
rock 641ab8bf2f iam: add queue oauth2 provider + temporal-worker queue access 
- Added queue OAuth2 provider (pk=13, client_id=queue-sqs)
- Added client_credentials grant type to all OAuth2 providers
- Updated temporal-worker-agent service account:
  - Added queue:send role
  - Added sqs_queues=* claim
- Provisioning script now creates 6 OAuth2 providers (all complete)
- All groups, scopes, and service accounts ready for Phase 2

Updated 2026-09-12 in provision-rbac.py
 2026-09-12 23:50:32 +09:00
rock 7613b4fbf2 feat(iam): rock user with Forgejo email, email password recovery, encrypt SMTP creds 
- provision-rbac.py: create rock user ([email protected]) matching Forgejo
- Email recovery flow: identification -> email stage -> password reset
- SMTP via Gmail (gotify-smtp secret, SOPS-encrypted)
- Recovery flow bound to brand for login page reset link
- minio-provision-paperless: add bucket creation, use quay.io/minio/mc
 2026-09-12 23:44:26 +09:00
Story Crater Bot 27907387f6 docs: remove outdated docs describing the retired core/talos CLI workflow 2026-08-27 13:11:47 -07:00
Story Crater Bot d7c30a8af6 chore: retire TemporalWorker CRD — agent-harness-worker and Forgejo build workflow removed 2026-08-20 23:10:06 -07:00
Story Crater Bot e2781c72e2 chore(terraform): remove leftover terraform state-backup script and env example — repo is pure GitOps, terraform fully retired 2026-08-18 15:08:03 -07:00
Story Crater Bot 74729f1c59 docs(terraform): add state management script and best practices guide 2026-08-18 15:08:01 -07:00