From 0dddf15dc802a51d86e78932c161e3632d0ab6de Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 15 Jul 2026 16:02:20 -0700
Subject: [PATCH] feat(argocd): add SOPS-encrypted secrets for phase2 releases
 (loki, grafana, forgejo)

---
 .../apps/phase2-storage-observability-1.yaml  |  3 +++
 k8s/logging/grafana-secrets.enc.yaml          | 18 ++++++++++++++
 k8s/logging/loki-secrets.enc.yaml             | 24 +++++++++++++++++++
 k8s/talos-ci-cd/forgejo-secrets.enc.yaml      | 21 ++++++++++++++++
 4 files changed, 66 insertions(+)
 create mode 100644 k8s/logging/grafana-secrets.enc.yaml
 create mode 100644 k8s/logging/loki-secrets.enc.yaml
 create mode 100644 k8s/talos-ci-cd/forgejo-secrets.enc.yaml

diff --git a/k8s/argocd/apps/phase2-storage-observability-1.yaml b/k8s/argocd/apps/phase2-storage-observability-1.yaml
index 2115cae..2726998 100644
--- a/k8s/argocd/apps/phase2-storage-observability-1.yaml
+++ b/k8s/argocd/apps/phase2-storage-observability-1.yaml
@@ -17,6 +17,7 @@ spec:
     helm:
       valueFiles:
         - k8s/logging/loki-values.yaml
+        - k8s/logging/loki-secrets.enc.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: logging
@@ -44,6 +45,7 @@ spec:
     helm:
       valueFiles:
         - k8s/logging/grafana-values.yaml
+        - k8s/logging/grafana-secrets.enc.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: logging
@@ -71,6 +73,7 @@ spec:
     helm:
       valueFiles:
         - k8s/talos-ci-cd/forgejo-values.yaml
+        - k8s/talos-ci-cd/forgejo-secrets.enc.yaml
   destination:
     server: https://kubernetes.default.svc
     namespace: cicd
diff --git a/k8s/logging/grafana-secrets.enc.yaml b/k8s/logging/grafana-secrets.enc.yaml
new file mode 100644
index 0000000..1d86e79
--- /dev/null
+++ b/k8s/logging/grafana-secrets.enc.yaml
@@ -0,0 +1,18 @@
+adminPassword: ENC[AES256_GCM,data:qykgCu5Kv5IwzM1JFLXL7wgiAyI=,iv:bAph3Jd4fxuyglS7zrWIwzfUgK/wBwRrcEpKusgFhVk=,tag:ymwdnU/Dxnp54eGur2caoQ==,type:str]
+env:
+    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:FwldsYfbOkRYGcycxn5BHZk/dOZsu23e3UCPo7dJKrcyr0n8dXQ9nH5XVSRHDpLOdRk7wbQwl+4Rgb8bGs21/w==,iv:JkNEfbsEIeE9TGouDA1xgjS4fX+v/sDrimaGpc4iaME=,tag:6Z3X29GKbgd2x6ghWA+CUw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQdVNSMWZaVDZuN2RBKyt0
+            eWJHRm5vRlErZ1UweXA0N2xSNGdESE5leWo4CjQ2TTlONnpJK2VZWmxoamdhdHZN
+            ZGVMSU84SUZpVTUxREZlek9JcUxaTXcKLS0tIHlNaEpzZG1iaVpvU0E1UTQzbkVk
+            WnQxSHZ6S3cyZ2hUTlpTNXQyaVZzRU0KwU/0aRJ0D/UsqtFcrJLmuHpNELhTsfYS
+            4WL2TQ/yaUz261s7LEVQdpKUza8JjQXiKqqNcV2gaqEWurdx20ILzQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-07-15T23:02:08Z"
+    mac: ENC[AES256_GCM,data:LeN0mm7i7fsDpwtGQ6La7/UzhHbKfG1f/K30wW7fZJ1XbqPZGh7cdq07kMqrodlR6oWvrq7r4gbyuhcH9ptlxKgN4NuD3OoUjn6/CiPEF+wzgKMMgg2JdqFLsZNxVvGL/Ig3Y5hP5iag91QdtQxXaJmaV6Q9+FF6maYofsOU2rA=,iv:Eik9jEhdu+7qJv1oN7e1Vydnv7rh0pnRpbcBPDhh8e8=,tag:Mkry9bpTsmsf9Xs1jW7b1g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
diff --git a/k8s/logging/loki-secrets.enc.yaml b/k8s/logging/loki-secrets.enc.yaml
new file mode 100644
index 0000000..3453761
--- /dev/null
+++ b/k8s/logging/loki-secrets.enc.yaml
@@ -0,0 +1,24 @@
+loki:
+    storage:
+        s3:
+            accessKeyId: ENC[AES256_GCM,data:rUe9BzMuNEk7Lg==,iv:a6oz4kQciHc/sqT1lu05CqI8+iJmi82JAQJ9BM5yBjo=,tag:M1CJmBQlbz/H08S2Y7eUCA==,type:str]
+            secretAccessKey: ENC[AES256_GCM,data:WEvUewgbriABBYllwMtyKsQw850Eb0J6CHc/MEY/NlsolWp9+eq6wKChknI=,iv:0rq4mv8cQ1za8ZLlR8voePiwZFdzK8sbRDDqgloO68g=,tag:r4GNYDa2fL1+d0gY5ndG1Q==,type:str]
+            bucketNames:
+                chunks: ENC[AES256_GCM,data:cAwa5qibAOvuhCk=,iv:Jqt3iHhLaHae6g4CsylytZxg+3fnTdw4PUinhaUaOCI=,tag:jVduzj+ggN9vQSD62qZ0jw==,type:str]
+                ruler: ENC[AES256_GCM,data:G1r90YhXWGkUOw==,iv:K1ddZrCVFAo+CZet+BV7KJh6RVPzGbsnVIkoZpjWCU0=,tag:o1xK1XLVtOqehTBIn9cNHg==,type:str]
+                admin: ENC[AES256_GCM,data:LhWklk60wExptQ==,iv:DpuT40Jl9H1nH04u+gm7pHFox7QrZ52WqNQuBqGiz8Y=,tag:ylGjb9J5CGXq/CxHtq732g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVW4vV0xvaGw4VUlGL1Fa
+            Tjh4V3RUV2d5L1padVZRVkE1V3BTRjg4bzNzCndjSHowU0s5a3I4NGsxNlBUVXFo
+            M1kwQjh3Rkw0VnlDWnh4Q3NSMmdUcXMKLS0tIGl4RWNvVzVyMHo5TC93SXJyWU1G
+            QzBJK0RrSnFiaTgxNnNiZWthM1J4TnMKPb3uoQLHPSTW0+6Kgsapa5/u6cN7aJa1
+            NcQIhd/PPibvvGb47OgLrh8djg7uGpVDMMn3v0Kv3Pu5bshJjZ2gBQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-07-15T23:02:08Z"
+    mac: ENC[AES256_GCM,data:Fg9WsV1LGCgCc9TQtxJ83rthGZCpi9Is/0ab7Udry90TxUHAnfhktP/V74lh8XQq+mVOjCT5ZAw1mpM93lj92/o3ZTb2LnGoaxD4Mj/3eL1T3oH6GQH9VRb7iq+aD5BkYZQd4jmxiIVET3K8a6a7Tt1hrWeKUYz1fcsC9IFIOJQ=,iv:sF8T/Q7+RBrU3dXBBDGS2j4SSiVIpE5wBlGgK7YKGTY=,tag:wqKm9p2SctnsS0jrk4jF/w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
diff --git a/k8s/talos-ci-cd/forgejo-secrets.enc.yaml b/k8s/talos-ci-cd/forgejo-secrets.enc.yaml
new file mode 100644
index 0000000..a567b83
--- /dev/null
+++ b/k8s/talos-ci-cd/forgejo-secrets.enc.yaml
@@ -0,0 +1,21 @@
+gitea:
+    admin:
+        password: ENC[AES256_GCM,data:8ZURcU/Zsq9visv81heAsrFN+y1mRCkvpOYgW4jiUO0=,iv:D0vr89m2wby10ogjs0Io6vBfdxW1OP2qJHgJObD4u9g=,tag:8okzx98V3zd8zHB6rK7Tkg==,type:str]
+    config:
+        oauth2:
+            client_secret: ENC[AES256_GCM,data:YbLBR21+4ZtsLwHhNQYj/gUIv5hNvabrsckmDKyYuOCgpR4LmUVdyWxFF2QycoofxHc7dIjZ9a1VMCN4umzeMQ==,iv:VrXWlcC4j5xOF+9cPVsphARdal9guE3NMtxM16AKZa0=,tag:1ch/k8pFJJ/LW/hJR+WNkA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAya3ZaRmlhVlV5cEJnSDRJ
+            cjZwN25xRUhsVkdlT0R4cy9pcmdnUVJLczJNCm0yY0w1c1Bhd2ZaRjhoQVJUOUox
+            UHRIUjBKalM3S3N4b29xUDVnS1NVbDgKLS0tIEN3NUZYdFExdm0vU3dMenZLTlFD
+            UWZlZWN6TXhvazhQN0c1Q1lFV1VHMkEKknyf4XuNt6FXZFFlKR0tGvd1qA83TTY+
+            olMucdjBGEFO4bylbuOO1Z8l7xyfPiFPNpadLtNb9vbxauXXn/ISfA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-07-15T23:02:08Z"
+    mac: ENC[AES256_GCM,data:LGRfU9VM87dbY5FCif2UWHxk0AuUsOEU2+t4+8wMgGCFzUCxPqnNd2vt5SF9SGoegfIGAZJw0uGQk89AfH+RNn8JTkU6a2hu4B+Zp7ebdCwDh8KSgUftYLLRu4BWf8Of+hpFfWVbZx4zw4bXGERt9nGfYyfTJM6RV+kcEgth1co=,iv:k9y3vOJsWLbqWXh8cbQFxD414dOMU4xKisgx4Xb1yb0=,tag:dN++eeYLfBReHJ2Mz9PRwQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2