rock 03044614b7 chore: add encrypted backups and rotation schedule ...

- database-passwords-backup.enc.yaml: SOPS-encrypted DB credentials
- memory-agent-oidc.enc.yaml: SOPS-encrypted Poimen OIDC credentials
- oauth2-credentials.enc.yaml: SOPS-encrypted all OAuth2 secrets (6 providers)
- rotate-secrets.sh: 90-day rotation schedule (next: 2026-12-11)

These files enable full credential recovery and rotation management.
All SOPS-encrypted with cluster key for in-cluster decryption only.
Manual decryption requires ~/.sops.yaml configuration + GPG key.

2026-09-12 23:52:34 +09:00

..

_deferred-values-fragments

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

agent-pod-models.enc.yaml

pi-models: fix baseUrl to match homelab-frontend gateway contract

2026-08-20 00:26:52 -07:00

agent-pod-ssh-key.enc.yaml

fix(agent-pod): remote tui session for multi-agent

2026-08-18 15:08:04 -07:00

authentik-secrets.enc.yaml

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

cloudflare-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

database-passwords-backup.enc.yaml

chore: add encrypted backups and rotation schedule

2026-09-12 23:52:34 +09:00

forgejo-registry-pat.enc.yaml

Add Forgejo registry PAT secret (encrypted with SOPS, ksops managed)

2026-08-23 16:15:26 -07:00

forgejo-registry-pull.enc.yaml

feat: let the runner build and the cluster pull from the Forgejo registry

2026-08-19 21:48:01 -07:00

forgejo-registry-token.enc.yaml

Add Poimen Memory to ArgoCD wave 2 deployment (namespace: poimen)

2026-08-22 23:09:02 -07:00

forgejo-runner-token.enc.yaml

feat(forgejo): add runner-token Secret via ksops — forgejo-runner register initContainer needs the registration token (from gitea actions generate-runner-token); was missing so runner deploy stuck 0/1

2026-08-18 15:08:04 -07:00

forgejo-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

gotify-admin-secrets.enc.yaml

fix(gotify): move SOPS secrets to ksops generator

2026-09-10 22:32:24 +09:00

gotify-smtp-secrets.enc.yaml

feat(iam): rock user with Forgejo email, email password recovery, encrypt SMTP creds

2026-09-12 23:44:26 +09:00

gotify-tokens-secrets.enc.yaml

fix(gotify): move SOPS secrets to ksops generator

2026-09-10 22:32:24 +09:00

grafana-oidc-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

grafana-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

homarr-auth-oidc.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-18 15:08:04 -07:00

homarr-db-encryption.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-18 15:08:04 -07:00

homarr-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

homelab-ca-secrets.enc.yaml

fix(cert-manager): regenerate homelab-ca cert with basicConstraints CA:TRUE — old self-signed cert lacked CA:TRUE so the homelab-ca ClusterIssuer rejected it ('certificate is not a CA'); regen keypair Secret + trust-bundle ConfigMaps (4 ns) with matching CA cert

2026-08-18 15:08:04 -07:00

kustomization.yaml

iam: add memory scope, service accounts, manual provisioning

2026-09-03 18:07:22 -07:00

loki-secrets.enc.yaml

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

memory-agent-oidc.enc.yaml

chore: add encrypted backups and rotation schedule

2026-09-12 23:52:34 +09:00

minio-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

oauth2-credentials.enc.yaml

chore: add encrypted backups and rotation schedule

2026-09-12 23:52:34 +09:00

paperless-secrets.enc.yaml

feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

2026-08-25 11:11:37 -07:00

portfolio-secrets.enc.env

feat: add portfolio LLM_API_TOKEN to ksops secrets

2026-09-01 09:42:02 -07:00

portfolio-secrets.enc.yaml

feat: add portfolio SOPS secret for CI status

2026-08-31 22:33:00 -07:00

secret-generator.yaml

fix(gotify): move SOPS secrets to ksops generator

2026-09-10 22:32:24 +09:00

vault-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

vault-unseal-keys.enc.yaml

fix: rotate vault unseal keys after vault-0 wipe/reinit

2026-08-26 16:33:35 -07:00