5 Commits

Include renames

Author	SHA1	Message	Date
Story Crater Bot	1ad52bf89c	fix(authentik): label argocd oidc-secret part-of=argocd — argocd's $secret substitution only reads labelled Secrets; without it OIDC login failed with oauth2 invalid_client (empty client_secret to IdP)	2026-08-18 15:08:04 -07:00
Story Crater Bot	d4d51bf5b4	fix(authentik): add minio policy scope mapping (homelab-admins->consoleAdmin else readonly) + set rock email — MinIO CLAIM_NAME=policy got no claim (no MinIO access); empty rock email broke Grafana OIDC (GitHub-style /emails 404)	2026-08-18 15:08:04 -07:00
Story Crater Bot	8ff3060ff0	refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments	2026-08-18 15:08:04 -07:00
Story Crater Bot	a8edb93196	fix(vault): add vault-minio-creds secret, was created by deleted helmfile presync hook ... Vault's S3 storage backend needs AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY from vault-minio-creds, previously generated by a helmfile presync hook that no longer exists post-Terraform/helmfile removal. Sourced from the same MINIO_ROOT_USER/PASSWORD already in .env. vault-unseal-keys still missing separately — needs a live 'vault operator init' run, deferred.	2026-08-18 15:08:04 -07:00
Story Crater Bot	41f5b05395	refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)	2026-08-18 15:08:03 -07:00