Story Crater BotandClaude Haiku 4.5
ee385e59a1
Phase 0 groundwork for helmfile→ArgoCD migration using SOPS (Secrets Operations): 1. Install SOPS + AGE encryption - AGE key generated and stored locally at ~/.sops/key.txt - Public key embedded in .sops.yaml for file encryption rules 2. Create K8s Secret for AGE private key - kubectl: create secret generic sops-age -n argocd --from-file=keys.txt=~/.sops/key.txt - ArgoCD will use this key to decrypt secrets at sync time 3. Encrypt initial secrets - k8s/base/secrets.enc.yaml: AES256_GCM encrypted secrets for all services - Placeholder values (will be replaced with real values per environment) - Secrets never visible in git (encrypted at rest) 4. Configure SOPS - .sops.yaml: creation rules for k8s/*/secrets.enc.yaml files - All future secret files auto-encrypt on edit (sops -e) Setup: Store AGE key as K8s Secret in argocd namespace: export KUBECONFIG=cluster-config/kubeconfig kubectl create secret generic sops-age -n argocd --from-file=keys.txt=~/.sops/key.txt Next: Configure ArgoCD Helm plugin to decrypt secrets on sync (Phase 0 continuation). Co-Authored-By: Claude Haiku 4.5 <[email protected]>
49 lines
1.1 KiB
Plaintext
49 lines
1.1 KiB
Plaintext
# Environment files — real values must never be committed
|
|
.env
|
|
.env.terraform.sh
|
|
|
|
# Private CA key and generated TLS certs — ca.key must never enter the cluster or git.
|
|
# Only ca.crt is safe to share, but we exclude the whole dir to avoid accidents.
|
|
forge/pki/
|
|
|
|
# Talos machine configs — contain WireGuard private keys, bootstrap tokens, PKI
|
|
cluster-config/controlplane.yaml
|
|
cluster-config/worker*.yaml
|
|
cluster-config/secrets.yaml
|
|
cluster-config/talosconfig
|
|
talos-forge-trust.yaml
|
|
# Kubeconfig — contains admin client certificate + private key
|
|
cluster-config/kubeconfig
|
|
|
|
*.html
|
|
LOG.md
|
|
project_context.md
|
|
.claude/*
|
|
|
|
ca.crt
|
|
ca.key
|
|
ca.srl
|
|
|
|
forgejo.crt
|
|
forgejo.key
|
|
forgejo.csr
|
|
|
|
# Compiled test binary — Go produces a native binary named after the directory.
|
|
# Source is k8s/storage/test/main.go; the binary has no place in version control.
|
|
k8s/storage/test/test
|
|
|
|
*.key
|
|
*.conf
|
|
|
|
# Allowed markdown: CLAUDE.example.md, README.md, TROUBLESHOOTING.md
|
|
CLAUDE.md
|
|
|
|
# Terraform state and cache (local files, remote state in MinIO)
|
|
.terraform/
|
|
terraform/.terraform/
|
|
terraform/*.tfstate
|
|
terraform/*.tfstate.*
|
|
terraform.tfvars.local
|
|
skills-lock.json
|
|
secrets-plaintext.yaml
|