pi be44a576d4 fix(iam): own the Zitadel login keypair through ksops ...

The chart generated the login RSA keypair on every render, so
checksum/secret-login-service-key changed each time and both Zitadel
Deployments stayed permanently OutOfSync.

Adopt the live keypair into k8s/argocd/secrets/zitadel-login-service-key.enc.yaml
(SOPS, age recipient from .sops.yaml), list it in the ksops generator, and point
login.loginServiceKeySecretName at it. The chart then stops generating the
keypair and the Deployment checksums become deterministic.

2026-10-25 19:16:18 -07:00

..

_deferred-values-fragments

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

agent-pod-models.enc.yaml

pi-models: fix baseUrl to match homelab-frontend gateway contract

2026-08-20 00:26:52 -07:00

agent-pod-ssh-key.enc.yaml

fix(agent-pod): remote tui session for multi-agent

2026-08-18 15:08:04 -07:00

authentik-secrets.enc.yaml

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

cloudflare-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

etcd-defrag-creds.enc.yaml

fix(etcd): add a working 15-day defrag CronJob under the backend quota

2026-10-07 17:12:39 +08:00

forgejo-registry-pat-api.enc.yaml

feat(secrets): add forgejo-registry-pat for api namespace

2026-09-28 11:11:06 +08:00

forgejo-registry-pull.enc.yaml

feat: let the runner build and the cluster pull from the Forgejo registry

2026-08-19 21:48:01 -07:00

forgejo-registry-token.enc.yaml

fix(secrets): populate the empty sops placeholders and drop the unused one

2026-10-06 10:03:04 +08:00

forgejo-runner-token.enc.yaml

feat(forgejo): add runner-token Secret via ksops — forgejo-runner register initContainer needs the registration token (from gitea actions generate-runner-token); was missing so runner deploy stuck 0/1

2026-08-18 15:08:04 -07:00

forgejo-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

forgejo-smtp-secrets.enc.yaml

feat(forgejo): enable SMTP email notifications via Gmail

2026-09-13 06:01:05 +09:00

gotify-admin-secrets.enc.yaml

fix(gotify): move SOPS secrets to ksops generator

2026-09-10 22:32:24 +09:00

gotify-smtp-secrets.enc.yaml

fix(smtp): update gotify-smtp with real Gmail App Password

2026-09-13 05:57:21 +09:00

gotify-tokens-secrets.enc.yaml

fix(gotify): move SOPS secrets to ksops generator

2026-09-10 22:32:24 +09:00

grafana-oidc-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

grafana-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

homarr-auth-oidc.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-18 15:08:04 -07:00

homarr-db-encryption.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-18 15:08:04 -07:00

homarr-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

homelab-ca-secrets.enc.yaml

fix(cert-manager): regenerate homelab-ca cert with basicConstraints CA:TRUE — old self-signed cert lacked CA:TRUE so the homelab-ca ClusterIssuer rejected it ('certificate is not a CA'); regen keypair Secret + trust-bundle ConfigMaps (4 ns) with matching CA cert

2026-08-18 15:08:04 -07:00

kustomization.yaml

iam: add memory scope, service accounts, manual provisioning

2026-09-03 18:07:22 -07:00

loki-secrets.enc.yaml

fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError)

2026-08-18 15:08:04 -07:00

memory-agent-oidc.enc.yaml

fix(secrets): populate the empty sops placeholders and drop the unused one

2026-10-06 10:03:04 +08:00

minio-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

oauth2-credentials.enc.yaml

fix(secrets): populate the empty sops placeholders and drop the unused one

2026-10-06 10:03:04 +08:00

paperless-ai-secrets.enc.yaml

fix(sops): add LLM_AUTH_CLIENT_SECRET for paperless-ai-agent Authentik auth

2026-09-14 23:19:43 +09:00

paperless-secrets.enc.yaml

feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup

2026-08-25 11:11:37 -07:00

pi-sandbox-secrets.enc.yaml

feat(poimen): pi sandbox workspace volume, encrypted api keys, cluster dns rewrite (#54)

2026-10-06 01:49:12 +00:00

portfolio-secrets.enc.env

feat: add portfolio LLM_API_TOKEN to ksops secrets

2026-09-01 09:42:02 -07:00

portfolio-secrets.enc.yaml

feat: add portfolio SOPS secret for CI status

2026-08-31 22:33:00 -07:00

secret-generator.yaml

fix(iam): own the Zitadel login keypair through ksops

2026-10-25 19:16:18 -07:00

talos-repair-config.enc.yaml

fix(oidc): remove the API-server restart Jobs from GitOps

2026-10-24 15:06:32 -07:00

vault-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00

vault-unseal-keys.enc.yaml

fix: rotate vault unseal keys after vault-0 wipe/reinit

2026-08-26 16:33:35 -07:00

zitadel-login-service-key.enc.yaml

fix(iam): own the Zitadel login keypair through ksops

2026-10-25 19:16:18 -07:00

zitadel-masterkey.enc.yaml

fix(sops): repair the generator list and rotate the Zitadel masterkey

2026-10-24 18:24:28 -07:00