feat(notesnook): manage secret via SealedSecret

Secrets are now committed encrypted (sealed-secrets v0.38.4) instead of hand-applied out-of-band, closing the config-DR gap the backups intentionally don't cover. Existing Secret adopted via the managed annotation (values verified unchanged). Controller private key backed up GPG-encrypted off-cluster. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-16 09:21:35 -07:00
parent 4b801e3444
commit 07654cd135
4 changed files with 50 additions and 26 deletions
@@ -1,19 +1,25 @@
-# DO NOT COMMIT THE REAL VERSION. Copy to notesnook-secret.yaml (gitignored),
-# fill real values from the old stack's .env, then:
-#   kubectl apply -f apps/notesnook/notesnook-secret.yaml
-# ArgoCD ignores this Secret's /data (see argocd/notesnook.yaml).
-apiVersion: v1
-kind: Secret
-metadata:
-  name: notesnook-secret
-  namespace: notesnook
-stringData:
-  NOTESNOOK_API_SECRET: "CHANGE_ME"
-  SMTP_USERNAME: "funman300@gmail.com"
-  SMTP_PASSWORD: "CHANGE_ME"
-  SMTP_HOST: "smtp.gmail.com"
-  SMTP_PORT: "587"
-  MINIO_ROOT_USER: "notesnook"
-  MINIO_ROOT_PASSWORD: "CHANGE_ME"
-  S3_ACCESS_KEY_ID: "notesnook"
-  S3_ACCESS_KEY: "CHANGE_ME"
+# NOTE: This app's Secret is now managed via SealedSecrets (notesnook-sealedsecret.yaml),
+# which IS committed (encrypted). You should not need to hand-apply a plain Secret.
+#
+# This file remains only as documentation of the required keys.
+#
+# To change a secret value:
+#   1. Build a plain Secret locally (NEVER commit it):
+#        kubectl -n notesnook create secret generic notesnook-secret \
+#          --from-literal=KEY=value ... --dry-run=client -o yaml > /tmp/s.yaml
+#   2. Seal it:
+#        kubeseal --format yaml --scope strict < /tmp/s.yaml \
+#          > apps/notesnook/notesnook-sealedsecret.yaml
+#   3. Commit the SealedSecret; ArgoCD applies it, controller unseals it.
+#
+# DISASTER RECOVERY: the controller's private key is backed up GPG-encrypted at
+#   /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg  (passphrase in password manager)
+# Restore it BEFORE applying SealedSecrets to a rebuilt cluster:
+#   gpg -d master-key-YYYYMMDD.gpg | kubectl apply -f -
+#   kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
+#
+# Required keys:
+#   NOTESNOOK_API_SECRET   (reuse existing — do NOT regenerate)
+#   SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT
+#   MINIO_ROOT_USER, MINIO_ROOT_PASSWORD
+#   S3_ACCESS_KEY_ID (= MINIO_ROOT_USER), S3_ACCESS_KEY (= MINIO_ROOT_PASSWORD)