Story Crater Bot
5144ab732d
Phase 0 continuation: enable ArgoCD to decrypt SOPS-encrypted secrets on sync. 1. Update ArgoCD Helm values (terraform/argocd-bootstrap.tf): - Add SOPS_AGE_KEY_FILE env var to repoServer - Mount sops-age K8s Secret at /home/argocd/.sops - Add ConfigManagementPlugin for SOPS (detects *.enc.yaml files) 2. Update encrypted secrets with real values: - k8s/base/secrets.enc.yaml: encrypted with actual service credentials - All secret values encrypted at rest in git - ArgoCD decrypts on sync using K8s Secret + AGE key Prerequisites: - K8s Secret created: kubectl create secret generic sops-age -n argocd --from-file=keys.txt=/Users/rockliang/.sops/key.txt - SOPS_AGE_KEY_FILE env var set in ArgoCD repoServer (done above) Next: Phase 1 — migrate 9 hookless releases to ArgoCD + create Applications that reference encrypted secrets.
39 lines
3.5 KiB
YAML
39 lines
3.5 KiB
YAML
authentik:
|
|
secret_key: ENC[AES256_GCM,data:4u/VJKGJL6J+ILh2+HY=,iv:mZus6YQX7TK6BK8JbHvS113ph4jZpUqKiKLK69nLc8k=,tag:xj/FhXl/GpA7zfYBkyEpGA==,type:str]
|
|
bootstrap_password: ENC[AES256_GCM,data:z5qyj124j90pimo07QQ=,iv:oJj54T0WEoy4zq8gTPsCBEZ5BqJubbyuLBdb9in98oU=,tag:SaVmxgIqxhzBjOnMi1PT6g==,type:str]
|
|
bootstrap_token: ENC[AES256_GCM,data:zbs67SwmNqXUj1inerg=,iv:TL3hu2NR9eCvZQHM9L2WJHlhi1lqNJDU+tKHJHy8OZM=,tag:2fzVZDXazzNrExBq/12dfQ==,type:str]
|
|
postgresql_password: ENC[AES256_GCM,data:lnisFWkVkv9LmRiB+cA=,iv:nFcecdugM8GB+ty4Ac5HhN84ekWk+VpDRh2QuW7cZhk=,tag:8Nu9aodwPqQ+1OP4xRVr2g==,type:str]
|
|
minio:
|
|
root_user: ENC[AES256_GCM,data:MQQHIaoc1tuG8A==,iv:92bGTYwyqc7tasjO0F8j2cBH28/ZOBHMkawsix6Z0UE=,tag:gkug3OeiZ5tpPrtXApFfsg==,type:str]
|
|
root_password: ENC[AES256_GCM,data:Neb1t95cJqxnnXKCIAYqLl6N0zdtD843RrnHyXhnEulZhvqPeMC2Y1DIZr8=,iv:NSveFwxhONWq8MfcVCvjLisbHJgZfkLBBp9Z0tmxQ+Y=,tag:zM0hpg97GcMJ9YFtDj7vjQ==,type:str]
|
|
oidc_client_secret: ENC[AES256_GCM,data:I+JJuokOMYX/52sSxos=,iv:wxZQ1NaeYCF3EMkZKyrzTXP35fbiA8VnMZV3cX+NYuA=,tag:O/7kuLTws7cz45GbACHsYQ==,type:str]
|
|
forgejo:
|
|
admin_password: ENC[AES256_GCM,data:WbjwEpB6vkRjZEwXg1QVPVl0pj5/QOfuo0SJndBr5OE=,iv:jvZ7+IH++qaUJL9Ts2+6X5ip1QvLOeGfzoBsKsFjbwo=,tag:zQXfRuXUdqwTcA7EDzRwJA==,type:str]
|
|
oidc_client_secret: ENC[AES256_GCM,data:2ikhULuCiUx98G9FubTKolZrDLuctA6F7m7xSTK/K+qHAmN4Zuqi+BzU56dfC0W2g7ZUqQ8flPQ8Jw2HlR/mww==,iv:zVZeAdxraSEQNMSX1r08L8j5g7pCKP86OTOBAHg3AIU=,tag:vke5Pj7QnEPIbI6LswLXnQ==,type:str]
|
|
grafana:
|
|
admin_password: ENC[AES256_GCM,data:cFfbO8f/A2yQVnXUa2Trpnp9g6M=,iv:LEnAOBFwr4YtmlXdE+GnorFPR1zJ406sxch0pgnnTCs=,tag:LDkt62m8zIw6sBTIiJBLTA==,type:str]
|
|
oidc_client_secret: ENC[AES256_GCM,data:YQV8mM6ogq57bXb1oFCocO+JPhFztAhqosex54s4ZcvJDSnQbAy/ILfcTVqQ26qoD4M7Bf2p+P/lSAO9RXPKtA==,iv:X2X/k2MqdEXN0SO53RadvS3JKzkXlTfgSf5bZCaWFRI=,tag:UK+BvSBa2ZXLmZHoh/V18A==,type:str]
|
|
argocd:
|
|
oidc_client_secret: ENC[AES256_GCM,data:BxTd8J/hnMDRBwND1ho=,iv:hP8OwLWTiaB3tT5kQarDWpfPYe/wWP/7DP+TyM7OJZY=,tag:K05rRDyk6dJYAtjJmgtbNQ==,type:str]
|
|
temporal:
|
|
oidc_client_id: ENC[AES256_GCM,data:zKj5POhCGcfoXy+d+zg=,iv:1NmLIy0xQ9V9AZipU/r6HQOPkvsTFV29cESVFsRZaZw=,tag:U+SkYLAXj5OSNJImINO5sw==,type:str]
|
|
oidc_client_secret: ENC[AES256_GCM,data:hWgK6dhh7onHmTwq3UU=,iv:iahP7vl3RPQaOJDvlTVqjn1+w8H8y0AZ/CToiIpZtB4=,tag:qqRhHShIc36aEmtUHHUnig==,type:str]
|
|
ollama:
|
|
oidc_client_id: ENC[AES256_GCM,data:b9+dTdLSL4mbodLBcI8=,iv:gnborzVMME6Baw4LuvucjdqjNnyygXhRZ1K4yQyr26c=,tag:2DfC9uRbVKzf5zcPspa+vA==,type:str]
|
|
oidc_client_secret: ENC[AES256_GCM,data:Ow8JrhgCJlHfYfQ1GBc=,iv:QBXdVyowDKPsN4Fjbe9Eh0O4cTgrPAx6EfN5kpRRsek=,tag:zw4mN/SJQMh25vm/yoCNBQ==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVWZkRDRBc09BakYvaUZD
|
|
em1CcFhwOVpjRnJsYjhxM3J3WldnMjE3MkJvClJrT1BXaGFkOU80V3krbVRNYXVo
|
|
RE5Jb0dISEJiU1lVc1U4blI0b2d6SVUKLS0tIDM2dk95M08rQkNuYStYbks1ZVBG
|
|
L2pIS3ZMYUVxTndwcW1zNCtPbWJ0Y2sKW6SkSLf+y37WR0hVy5bVegnsjBRCsmqq
|
|
VYNVFf/xzrCU6Bjv0KV/1laHHmQoea1xQPC2l6KrptUEZoVjDYkKpQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|
|
lastmodified: "2026-07-15T22:03:57Z"
|
|
mac: ENC[AES256_GCM,data:wds9Tc4t3V5uTxdsXtJuuOXLfRNt+uPso6Ge3TTgv8BDDxN/jPQmBPljvdKp8U7kXhtq7ifgtEbJUwunZvBAhJN8T2gQs6+SaNgNS+H7RqWXWsTnMy0u1PAz6WX8FEYNeZMqePrkAtV6kLjx3B/b6bL+mRxVXut8+kBmfpKgoEI=,iv:Su6uHqqn5qdoIdxxOGRmapyv8OsYNbPwRVD/QHgJZa0=,tag:hh9KcYDXPaq+aGUDzJDPKQ==,type:str]
|
|
unencrypted_suffix: _unencrypted
|
|
version: 3.13.2
|