3 Commits

Include renames

Author	SHA1	Message	Date
rock	03044614b7	chore: add encrypted backups and rotation schedule ... - database-passwords-backup.enc.yaml: SOPS-encrypted DB credentials - memory-agent-oidc.enc.yaml: SOPS-encrypted Poimen OIDC credentials - oauth2-credentials.enc.yaml: SOPS-encrypted all OAuth2 secrets (6 providers) - rotate-secrets.sh: 90-day rotation schedule (next: 2026-12-11) These files enable full credential recovery and rotation management. All SOPS-encrypted with cluster key for in-cluster decryption only. Manual decryption requires ~/.sops.yaml configuration + GPG key.	2026-09-12 23:52:34 +09:00
rock	641ab8bf2f	iam: add queue oauth2 provider + temporal-worker queue access ... - Added queue OAuth2 provider (pk=13, client_id=queue-sqs) - Added client_credentials grant type to all OAuth2 providers - Updated temporal-worker-agent service account: - Added queue:send role - Added sqs_queues=* claim - Provisioning script now creates 6 OAuth2 providers (all complete) - All groups, scopes, and service accounts ready for Phase 2 Updated 2026-09-12 in provision-rbac.py	2026-09-12 23:50:32 +09:00
rock	7613b4fbf2	feat(iam): rock user with Forgejo email, email password recovery, encrypt SMTP creds ... - provision-rbac.py: create rock user ([email protected]) matching Forgejo - Email recovery flow: identification -> email stage -> password reset - SMTP via Gmail (gotify-smtp secret, SOPS-encrypted) - Recovery flow bound to brand for login page reset link - minio-provision-paperless: add bucket creation, use quay.io/minio/mc	2026-09-12 23:44:26 +09:00