rock e599c12f91 chore(iam): retire the minio OIDC credential from sops ...

storage/minio-oidc is owned by the KeyRotation object iam/minio now, so its value
leaves git. minio-creds and minio-user-ollama stay: they are the root console
credential and an application key, and neither rotates through ZITADEL yet.

The file keeps a header that says so, because a prune of the sops-secrets application
would delete that Secret and the controller recreates it on the next rotation.

2026-10-27 20:00:15 -07:00

..

_deferred-values-fragments

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

agent-pod-models.enc.yaml

pi-models: fix baseUrl to match homelab-frontend gateway contract

2026-08-20 00:26:52 -07:00

agent-pod-ssh-key.enc.yaml

fix(agent-pod): remote tui session for multi-agent

2026-08-18 15:08:04 -07:00

cloudflare-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

cloudflared-credentials.enc.yaml

feat(cloudflared): manage tunnel ingress locally via ConfigMap

2026-10-25 19:57:37 -07:00

etcd-defrag-creds.enc.yaml

fix(etcd): add a working 15-day defrag CronJob under the backend quota

2026-10-07 17:12:39 +08:00

forgejo-registry-pat-api.enc.yaml

feat(secrets): add forgejo-registry-pat for api namespace

2026-09-28 11:11:06 +08:00

forgejo-registry-pull.enc.yaml

feat: let the runner build and the cluster pull from the Forgejo registry

2026-08-19 21:48:01 -07:00

forgejo-registry-token.enc.yaml

fix(secrets): populate the empty sops placeholders and drop the unused one

2026-10-06 10:03:04 +08:00

forgejo-runner-token.enc.yaml

feat(forgejo): add runner-token Secret via ksops — forgejo-runner register initContainer needs the registration token (from gitea actions generate-runner-token); was missing so runner deploy stuck 0/1

2026-08-18 15:08:04 -07:00

forgejo-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

forgejo-smtp-secrets.enc.yaml

feat(forgejo): enable SMTP email notifications via Gmail

2026-09-13 06:01:05 +09:00

gotify-admin-secrets.enc.yaml

fix(gotify): move SOPS secrets to ksops generator

2026-09-10 22:32:24 +09:00

gotify-smtp-secrets.enc.yaml

fix(smtp): update gotify-smtp with real Gmail App Password

2026-09-13 05:57:21 +09:00

gotify-tokens-secrets.enc.yaml

fix(gotify): move SOPS secrets to ksops generator

2026-09-10 22:32:24 +09:00

grafana-gotify-bridge.enc.yaml

feat(gotify): bridge Grafana alerts into Gotify

2026-10-27 12:35:44 -07:00

grafana-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

homelab-ca-secrets.enc.yaml

fix(cert-manager): regenerate homelab-ca cert with basicConstraints CA:TRUE — old self-signed cert lacked CA:TRUE so the homelab-ca ClusterIssuer rejected it ('certificate is not a CA'); regen keypair Secret + trust-bundle ConfigMaps (4 ns) with matching CA cert

2026-08-18 15:08:04 -07:00

igotify-client-token.enc.yaml

feat(igotify): wire the assist bridge with a Gotify client token

2026-10-27 12:14:28 -07:00

kustomization.yaml

iam: add memory scope, service accounts, manual provisioning

2026-09-03 18:07:22 -07:00

loki-secrets.enc.yaml

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

memory-agent-oidc.enc.yaml

fix(secrets): populate the empty sops placeholders and drop the unused one

2026-10-06 10:03:04 +08:00

minio-secrets.enc.yaml

chore(iam): retire the minio OIDC credential from sops

2026-10-27 20:00:15 -07:00

oauth2-credentials.enc.yaml

chore(iam): retire the .enc files whose values rotation invalidated

2026-10-27 14:47:48 -07:00

paperless-ai-secrets.enc.yaml

feat(iam): wire all 9 consumer manifests to Zitadel OIDC

2026-10-26 04:34:51 +00:00

paperless-secrets.enc.yaml

feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

2026-08-25 11:11:37 -07:00

pi-sandbox-secrets.enc.yaml

feat(poimen): pi sandbox workspace volume, encrypted api keys, cluster dns rewrite (#54)

2026-10-06 01:49:12 +00:00

portfolio-secrets.enc.env

feat: add portfolio LLM_API_TOKEN to ksops secrets

2026-09-01 09:42:02 -07:00

portfolio-secrets.enc.yaml

feat: add portfolio SOPS secret for CI status

2026-08-31 22:33:00 -07:00

secret-generator.yaml

chore(iam): retire the .enc files whose values rotation invalidated

2026-10-27 14:47:48 -07:00

smtp-gotify-secrets.enc.yaml

feat(iam): deliver ZITADEL notifications through Gotify

2026-10-26 23:24:33 -07:00

talos-repair-config.enc.yaml

fix(oidc): remove the API-server restart Jobs from GitOps

2026-10-24 15:06:32 -07:00

vault-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

vault-unseal-keys.enc.yaml

fix: rotate vault unseal keys after vault-0 wipe/reinit

2026-08-26 16:33:35 -07:00

zitadel-login-service-key.enc.yaml

fix(iam): own the Zitadel login keypair through ksops

2026-10-25 19:16:18 -07:00

zitadel-masterkey.enc.yaml

fix(sops): repair the generator list and rotate the Zitadel masterkey

2026-10-24 18:24:28 -07:00