From 3a9675f9928df8fd368c2e8f95892c39324da2f9 Mon Sep 17 00:00:00 2001 From: Alex Date: Thu, 16 Jul 2026 10:01:58 -0700 Subject: [PATCH] feat(secrets): seal remaining user-provided cluster secrets Converts cloudflare-api-token, argocd repo creds, nightscout, and the three solitaire secrets to SealedSecrets (adopted in place; values verified unchanged by before/after data hash). Controller-generated secrets (cert-manager webhook CA, LE account key, argocd internals) intentionally left alone. Verified post-seal: argocd repository label and dockerconfigjson type preserved, letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy. Co-Authored-By: Claude Opus 4.8 (1M context) --- apps/cluster-secrets/README.md | 30 +++++++++++++++++++ .../argocd-gitea-repo-sealedsecret.yaml | 21 +++++++++++++ .../cloudflare-api-token-sealedsecret.yaml | 16 ++++++++++ ...solitaire-gitea-registry-sealedsecret.yaml | 16 ++++++++++ .../solitaire-matomo-sealedsecret.yaml | 21 +++++++++++++ .../solitaire-secrets-sealedsecret.yaml | 16 ++++++++++ apps/nightscout/kustomization.yaml | 1 + apps/nightscout/nightscout-sealedsecret.yaml | 18 +++++++++++ 8 files changed, 139 insertions(+) create mode 100644 apps/cluster-secrets/README.md create mode 100644 apps/cluster-secrets/argocd-gitea-repo-sealedsecret.yaml create mode 100644 apps/cluster-secrets/cloudflare-api-token-sealedsecret.yaml create mode 100644 apps/cluster-secrets/solitaire-gitea-registry-sealedsecret.yaml create mode 100644 apps/cluster-secrets/solitaire-matomo-sealedsecret.yaml create mode 100644 apps/cluster-secrets/solitaire-secrets-sealedsecret.yaml create mode 100644 apps/nightscout/nightscout-sealedsecret.yaml diff --git a/apps/cluster-secrets/README.md b/apps/cluster-secrets/README.md new file mode 100644 index 0000000..71920fe --- /dev/null +++ b/apps/cluster-secrets/README.md @@ -0,0 +1,30 @@ +# cluster-secrets + +SealedSecrets for credentials belonging to components **not** deployed from this +repo's ArgoCD apps (cert-manager, argocd itself, and solitaire — whose manifests +live in the Ferrous-Solitaire repo). They are committed here **encrypted**, purely so +the cluster's secrets are reproducible after a rebuild. + +No ArgoCD Application watches this directory; these are applied manually: + + kubectl apply -f apps/cluster-secrets/ + +## Disaster recovery + +These are useless without the sealed-secrets controller's private key. Restore it +FIRST, or a fresh controller will generate a new key and none of these can be decrypted: + + gpg -d /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg | kubectl apply -f - + kubectl -n kube-system rollout restart deploy/sealed-secrets-controller + kubectl apply -f apps/cluster-secrets/ + +Passphrase for that file lives in the password manager. It is not recorded anywhere else. + +## Contents +| File | Secret | Notes | +|---|---|---| +| cloudflare-api-token-sealedsecret.yaml | cert-manager/cloudflare-api-token | DNS-01 ACME; TLS renewal depends on it | +| argocd-gitea-repo-sealedsecret.yaml | argocd/gitea-rusty-solitare | repo creds; needs label argocd.argoproj.io/secret-type=repository | +| solitaire-gitea-registry-sealedsecret.yaml | solitaire/gitea-registry | image pull secret (dockerconfigjson) | +| solitaire-matomo-sealedsecret.yaml | solitaire/matomo-secret | | +| solitaire-secrets-sealedsecret.yaml | solitaire/solitaire-secrets | | diff --git a/apps/cluster-secrets/argocd-gitea-repo-sealedsecret.yaml b/apps/cluster-secrets/argocd-gitea-repo-sealedsecret.yaml new file mode 100644 index 0000000..b8402e6 --- /dev/null +++ b/apps/cluster-secrets/argocd-gitea-repo-sealedsecret.yaml @@ -0,0 +1,21 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: gitea-rusty-solitare + namespace: argocd +spec: + encryptedData: + password: AgBhlHGmiLheVHJuHdg7nLAeriCka35zqVhi5VeugM+BT3JuMiFnZs7riC1U6BbCRwkVFZGA1ecegelKowtkwvohlegGWLIx0GJIfLKA2uuRqD9JdPc7x9x9+hPu8OqE9/vZrV4ojQ0BtD1C/XQDxHmVGn0p6doxIwoiQJMPNYceuvWiVEqMky93mX//8/DbgT/Wi8qK74OhI32oKgPwh9+AbF+kB3N+gnZHk68eETvrmQVMMHGy6JcjbknTdIThU5DI9OgUxhuPZO9kylD9A5M2cSdFVvuWb3Zp86aMO/fnLJxgPSnpqXYDJp4E1dxIpu5neq1OwVyNQwrbUMQKvjsIb9cOzhAojxoyruzzOfadYVafGUtiIdNQU4U1IQJPlSRZyFAYmOAiN+dF9ZokNtSdPEYJZijPovw06nXo+xvuO8JoK5lh4l6XbvN3ilRIdaBeJGGsjJrH0kf3C5vqD0fkBtopymZuhj74joo7MaDAXMlWaQqN/ER28vAfVcxz8mZ/673Td6a8AM4WLbL30IrJJOWrgBvrqbr0peXfXkDVgCXNDaG/PlwirhOzpc2E6kqppAZrqLvL2Seuo57pcnc79mUU79saewNeiHnv/t8lZhfXJ2Ya5UDqu3lha4mhckYb8OOSwk+GpJ8CUZqOJ1j4oruQaUtFb0y1l0lesLQL6CE38t2kyidMhSu05cg2NUqpZGH8xRLCClYjt0nHpfM3hZqp9Ka8coCQ9lVTHf0Kh88DkB8ZlXep + type: AgAPt1KdfoqkWYyAcGC7NmTow6+Emr3Uvav1vmYyGUQpiFpFTcmnpMwQBnrZ8hTLBvXNVgQvhgkl9iGHUr3CESd/nFkd68hDg5PN3mAL3fBn8Ng0e3ctD1zWYQSd2v1MqhIARRM3vOutAx2n2lpSJkEhwHGIadG+fdW1u/apqMuiQIAU9V15/rilY/riEJdZOZm+cRUWcdSHsR0lbkQ3wQWVoH9GT8yl+IUAhDjoZad+DuLCjvlC8oOWXtToGuKkcFgVVHow+3aXY49oXm8mBqdj2y+/dcBPhuw3RTKlVNYn4OR7AqOtmWvh88gghKXDSoS12QADyggNKxaLBVc5HA0CMe5hfJDPf7gIZpx32HBOxPtwLQkycfw9QFiZgkz61wu8htNO09kpZvq2TmuKKbae1vfat8iFmAljIH4xBlMFGRPvjZLm3psOgFZo+XYUZogYqvWlnmA4/H8Pj3fxRmjZohcwbR333jzBck9M74/d19Qv7Oyini+BTmk9iZwU2D9jZL82AjFc9fOgvcU57aMZ1UdOLLxLQwAUCd41flv0vR+7s30gyh0wKvc/ShSrGJUbgegS6JqoncuRu6thOjUuP6xeUCcWgM9xkg2L7N6Pzo/jwVPNUcxFyZ9ZLZXVtJEQubAXDze7Soui/VJAT1CEtH+9eLceRLk3xoIPnrWBK6kpxs5MrltvS8W/+9UCuc3GTAY= + url: AgCCMYfzUfvm3BlVnaCUu0FKglk77trG4x2EZqK4+PsYmPtB4czZmerMaqFk/RXGWR/pYa/EZL/CfJRdZE+qA3fJHjKWSKpBV5mfb2s8GaEHQl6kBUgIaDiCj7MCIu25b00zHe5agcZBUydD3T+V7ABtMhZTkQvUA+4OZjzQhdas0n6F/hDWBlhWQAzEY2Hj4KRY9r7thyuWYK2m3a4dCXepry2WAGG/sYn4qtD487NOQCNJ9qedg1eI0o0zbL45ErrLLJ3kIhC0upyEMekF85fVgUVu9uTRGvRzdibk55VgqrJPEZwxn3DHvqrJp2e2NYnY6Vo2dpa1avCwdORxA/pK5m4NjetTlD78N2+rJujuAODdglQQXEbe5Kscp0CChI5+/cVPD/gFsnt6YHiEohkMHYT7w+Aa+NWpikcL+QH7pQfKoW+LQKTM89eeVhcgDHsYavqk2oIL/X8+j2I3nFGJPiqkrAgbV95u7SO0tTycfq9m8+hs2yUodxAd2wUxOKk516COTYQ6WzpPXKTCje92m/XqtshoqF4PfH1Fxdf3bE6DS+X8XFOL3z+nR/8neaPbX0VC4kTDks3I2slc+uGRr7YZM+Wv9shsQzJXVgbbJYZgXJS0bwuvUhnc+BMUixPKMx772TjYDvXzsi/xubYyAsIT6KOyzJ+AyT+M7f+754vdrM6uinNnLpSbYN6J1MJ4WNhWluJidpYuBwhFCYg5V/71T6P62lgepaqPkwwHggwHwfVkRQfc7KqWimcfbS4HSFQ= + username: AgAOrTTBYkYzZqSHaj03zUnpkSB8daMP0CoGGfw9dWwDK/BNgRzEdkTEGpCKwtJN5ojKTjZTm9q014clw8gXTz2sX5k/NFFF3L9UxeRksrixJUtzLe9deOah+XvurxalhDXHClBIWCipqUGmqdShPOYY8vLHVuXzmVPstLiW58eUmnG/Wafo95weUpFr078rZUKu3+f7DkFP9j+3HqJAsOZsEOjhfCtvmhaOjwHVBldXBR964R1H52w/Jbr3WILNEKSso9/fZD279cvbdBESd7NPuj6UM60cZE8NB5rV6cOkHT9yncFBRq2co13lCo34Xl/4fpqRfF1Dq41DiO8Cm1n5i7EJeY5XyfmKl+Eq6FEGuDxQBVdxFtQfSERICk4g+GJkzJdDhaESzTMeANqLM5alTnIrn/MX+dhCnmD3N6VTYwN8Xiso4CTRPUEwwQqf5CY+prgWQLTUoqomfS4m81C9JCDqKKwKj0mc9df+rGzfIQXNR8W0ETcgitr/9TxTtGMVcU8wanNgNQbV8vu+AKmJZPgXCs7ghqLarzXuTPPPrF/12gtvG77+Gpa/Qh3RsUq3v35fbZZHyy2Evg4D18Rt7nUmvf3ao5QVgG/vI60WjM2TNmNtBmCjrbzGGntZuL3om4LZAV9EIhDDWL6ISdaUtgubrRpGSW7lNgfemi8NIkTq5hd/o/vK8j3ozOsLacvsRaMDnrK3LP8= + template: + metadata: + annotations: + sealedsecrets.bitnami.com/managed: "true" + labels: + argocd.argoproj.io/secret-type: repository + name: gitea-rusty-solitare + namespace: argocd + type: Opaque diff --git a/apps/cluster-secrets/cloudflare-api-token-sealedsecret.yaml b/apps/cluster-secrets/cloudflare-api-token-sealedsecret.yaml new file mode 100644 index 0000000..63c05c6 --- /dev/null +++ b/apps/cluster-secrets/cloudflare-api-token-sealedsecret.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: cloudflare-api-token + namespace: cert-manager +spec: + encryptedData: + api-token: AgDB+icQdE9haTjqxdeXMFJJkDteMpN+jIjgsbT0RQo55rx8e4U6y4FgBcadOovNDF9g4slD4xqalcJVLBeJWvEZ80wOBhzY+9iP+m8HUPzmm67XWCJgnADtWoBjXqZT6NgUoxNb8MMDrFXdRPatM74o3cbVOcp7dIumOEgo+IML0+TdyIXIkSkjMaPTBQZwkxJ5SQs7WQfnRQw1rTxc9lti49LtH3tELWWLK8MdCOtj23OU4YkbzdbZsqymsiHTYJTK80YyL8bP+TjEMp6ZFstkvEvk8Xk6JNiuPqymiQLTK3y9MOfxK6Picux4Q5KGvWoi3N3D3Ol3I5mwsCXGlZA2WfDIyl86VcrYEphKqouxD/dMNJRJW0vzxbtNiFHBBQDulKfmWs9QVYvA2lD+fdPC34CbvyzyVCBVgg9bp/4OUHWkq0Koo5PDVGgIO7ylHP3YHu271koLNmcIKLBKnMlVnhX5RDVjAk48sFK9+rla6mDiQ19xJpd4P5ep1NxRe9NV0DtFrsRVLsbvPe27P0pwICevG/9OPzfDHQyd6ScGzKM+ltzpi6qgyLudu2bb+0rQ83r6EEvCW654nTGatlGaIbyG1n3cs7V2TlMYRyUYD8IjVXpRoVbYqnxMK2PoGL9ZgKGBoYTKabGYZnl9ngUBHwipEPXZ1ShxmvMn3/l1Mjr1thUlO2ktRMo19gGGAUulnFPoHycY7DxFwyxFa9vcHH//oejC20Lut3kq6cJCYt98WtOtXWqaY45t0gsEcnX89nvkyA== + template: + metadata: + annotations: + sealedsecrets.bitnami.com/managed: "true" + name: cloudflare-api-token + namespace: cert-manager + type: Opaque diff --git a/apps/cluster-secrets/solitaire-gitea-registry-sealedsecret.yaml b/apps/cluster-secrets/solitaire-gitea-registry-sealedsecret.yaml new file mode 100644 index 0000000..c0c035b --- /dev/null +++ b/apps/cluster-secrets/solitaire-gitea-registry-sealedsecret.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: gitea-registry + namespace: solitaire +spec: + encryptedData: + .dockerconfigjson: AgC4qgegUdhckd0IVypEjGhMEshxPaZ1Xk6JYbmxZqFyzdIQs72Uv/HxIYTwnfMKcKPd75mkFz6wi4I5yAFRnZDs3JFMujHejIXXAxNYB+mp9jTCDGGS+V4V84zEbdNNuXFBZ034LrnOMeOhn14+ieq22FZWX4w/pnjPpuMGpWL2aunG4nCwoRikXMcvZfVptGjfrYUDEYksCGPcoIlGaV9xuMRQcdt2gWeecs0UdZtTDVBUOVNX4CnnZX2zrTdEX6MCooPqUsv4ZMjDUhjSeLUDgNeAZde0jhbc3wSdjedeeUOqlLTfYgeVRaABUaaslVsBAqTp7MTDjhBYpXl9IRJkiV/RTaC+6vlL1Gku8rva9B2RjORTWL2+IGxiFWmyKnkAR1OxJIkH4VpuiimpWV5eVTNNBSH80k+rquYA8KOjn8aJQ6ZxXN8kOSz3xicNOjZpSp+6eCPwSFUEJePSA/z0JaKWtVYk+rB24D2FHqUkVwOV/X1AG65zsHG1gTUNdr/2k42jB7SOHsBr/0nCgvuJoXftxXnLLinKmBDKa3hHhG7Wjqq5p3eu1MWAADvn0p4UiM/mhomCPHP9oPiuAiiYPMU6Z3nL2eAT2vA0i9gikv9vrk0e6HEtCW2FUlk7JtPZjJCJwKjqlAPu5dceS+YD/eETLX1h1AwugzDbYjtasfiRoQ+AiOqyWitNrds6Dcqk8SlMsWsGf/SRfODR1Dh/JFX6du+dyNzcyJM6L2s0dSCCRuBcUPi2NrjNXbwcIVOHepPLRXyz4KuGNH6pF6ePLpdlxH5DuatTvcaeTKdEtLjwW2YUmK/L66DldrFs5OhGpD02L+LPWYHjrARa/yCl7NWTU7lfzvhGLukVZ2nJG7INYRvPy9qnHIYLRdwpdK+t0UaMCWOgeeThHF4PWn/+BZEjpSk0jDsqj4ETCjtf0NonqhONceeVdg== + template: + metadata: + annotations: + sealedsecrets.bitnami.com/managed: "true" + name: gitea-registry + namespace: solitaire + type: kubernetes.io/dockerconfigjson diff --git a/apps/cluster-secrets/solitaire-matomo-sealedsecret.yaml b/apps/cluster-secrets/solitaire-matomo-sealedsecret.yaml new file mode 100644 index 0000000..3dc6588 --- /dev/null +++ b/apps/cluster-secrets/solitaire-matomo-sealedsecret.yaml @@ -0,0 +1,21 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: matomo-secret + namespace: solitaire +spec: + encryptedData: + MATOMO_ADMIN_PASSWORD: AgCfXf0iM1z1Z3RFkWV1De+u5hCwR5nJyH8OJJy95vboJReTx+pKph4nkHSX1dCOSkm1rDBXu/hAyzq2bytXG7qa7xLMtQLpBl0X/Q/b1tI+G+hwDolOQSzKUSuKghf9n0d7wDBHho1n5JPptTYuyC1jhRzugw9v3lXXzUHT/vS4sypVJ9QGj8fBoyRrld0LLTTooRIV5l0+R3daGrk8EJyV+cx300aFQ1xYBCMgjhexW5lVsbTtYNSZNx0aejPt0pPeOBqZbDHTBKXQA4mXP0VvCHyB6LanZ2oJImbJXyUVKM4uxKrICSVdCPdyOWk22rh4sm1DalmPSAYOS5aEKWOlcX87YCOByamiFF3J/vbtolscqcpWQOE9dv1fBNW8hHEHRmneNyH5UEn7q3Bz3ruqotl1b4wq9tmr5cyYCAZPRXWXKLr6oXr+eGjU0ZliAS/fIJ/VF7MvQpqelS10x+MSSnTV8u+ju9sZuQkRMWVdy/OPFj6S4pxZTfuqwF/Bsptg+TL+kXoAf5zKJjBwEUlEDGkoevGwryADLsITd10kc86zDhrjdLrh7Y5RcKIuXe8H51mzCTHuThB3oxEVQEsgftRudRwvubRmYg3/9HC/k7TSFVX2fmBi+fk3YVTdvxldrRj0+UaRPm+48Ohuxvqccj5N1dFgZXL9Z3TRP6EnuxY5Ehm/dVJx+NXQEH9mGpWJ0lVJAk54i2B+PzbEDYsW1qRaEnXXNkw= + MYSQL_DATABASE: AgAH48u2q6zQrN5PaWFRZWssUzStVmIvydUQMZSMqEkrCUK91RzOla0v6Yx9pV1lxlPrqW5NJQ3vQxD7VI4YYiD3FL3DlLFru2wgAT5emvU/UvZnUC6wh5zAxQNjaDPMbjinzVHflKHTztKSyXnnn8j7E2uTAAiRbFpjE94uckBVAxbrUohk62yTFThJ7Y08MV48RE2v5NugWumyisKoMjpo7Wovrj76a17yLO80QQ4Af5Fnk2sAw9/hk4SFrCl5OXdOGq71wtCw8jNAsqHZRlM6cXkcRiGYoFKWTgsW+h/VnSEbuWuEAyF71u/hnre6mSk8Ci5k+VGkTh37afaIcjNdihH8EcWeubOIIxVm7f3LCQ4S9dXMalqG3Frc0QX2zH5eZL0qEqy1zEJ8weXZkgMy6WspCWegnVvfubVZzvrUlRu+oZDpt4SpiKiEWh9g3R5GImWXPrmVm5feet0A7Ff9QhhLdLTl2K/mqTiK5kj0mfbmXnnBvGhh8YNaa5CBTlE3C/5TH/Cop2Qno4/xsgvAqMr5qSd+xUy65S94pOdlc38ngNNsWe71/jfP49u/szO2v/OHnXE2JbhFArAeMRYvcLKIxf73Us/IiliKwIRdFWO2cYknD6Z2FplM9IoC9BmTSgZZMagz0+SnsZBVcVP+K7yizKFVtj5rTjcsHSvqRaAFrOxyiqPAdI7yQTOa/QYHIpHD4f8= + MYSQL_PASSWORD: AgC2K1DumViJ6BO8+ACM7ayaE6R46mEiPcFmftjF1wHGaSLYejk0sqJWdh1DHWo2Xa1jk7CnCZBmhZmbbbteDR/E2hKEDfDa3YTQIBVIn+G2blEsSmG/tgnbhW/ZZUSwF/Z/i2I+gMbQDUeKsnSSZ2I+dOo/jVnCfps3xz/9s+ChhrM7mqc9J1Qumh4rtIAd8X+cXPq20rHUMfKm8jt4m/w7UY0DGg5CuoHswrfteo40LtW8KcP4Pc4N/b7uDCdZY54iEzg4e2EL/QlayX8PFiqgRzOHr/fMZ6Z7wWCEiP13V+gPdHaajdqJzlz0QgwvxI5EUOv6Pl2efIfoitOnCvQz7cw7cpT6iapCi9SY65kWRlrDYmybpfP06Jvk39r3HtUzLNEn9cadagbVg1zsjTm/EtMvNPfwY5MQdra0rbQy2b/WI0U8V5Olf9LvrW+y6kRs+YGFKY+FO1CNrWD2N9i/0K5jQVHPx5p3LZPyILKmDZN8ndPDNAGfjRmIC7WHPHRm3sY55P0xc5fI9hb9qss+2BfH70cRu+rdylO70pIcrV/px6V4xTI76MXVp90j4lxbTmwTLggJY6aZoh8NOCU3oaHGwzCXwTDmVpAzgx5amLuG8l4VM8dqBOke7FB0x8Q+2VTK0OEqFiYUVRY0KIwc8i7fXziR0Y/MMbzMyY0EjpoE+kOjNSKgrCxnWxoBCO/0rmlPqeWP1rrbh4h4EfaDIaZ/YG0XsiA= + MYSQL_ROOT_PASSWORD: AgCiCZzjb0xHh/ZttsDcnWp6jauP5wBYEoFNc5yRJ+WbSiEBB/ayTHP23XJUH6tBDs9xTGjvoXsMJi5yAX2hxMT/fQ0tlTTzoGlwq2fNdWGkqAL1qkOxLRRyoJhnDA0E98sb6v4LBxWCWlCCBgBrZNi2TMpRI+M5htrEfWXcdUa4pPqGDh5Wd1P7z/DLdmtyAGSIIq3BS6T5dnNaobJj4ya/X9PamzZP9Ck3A98qKJnQpHgUKOgm9zWGx/tpxXpru4oNmYvGxDC6Og7XxfVvBp+eBRcWYMuE6ds6cH5iqvrsJJJJBR1vjVTa3UJ8ByP1tyUngJxiz3YQY/zX+UtewkO93AkBA4eU4oZvUxi6+HzRBBHqK3AEjWbuGKRRbmyfjLAvp/nNmTo3MKKPRDILkNG2yA9d/WDama9L9wTiS48SGZdIo8JesPfOJ86ag6XnLdC7BoO6s3W7zuTyXJ8Lre3e65oo9zDHqIX1OgAJBSXq9yuYK7aZG0gTgZauKtktJJFRexwmaCGkrUP9c19jrdDBj87A1gr5+dNYPqt0yuZqIw/rNLjXdLUqh9HqBev1abYyfJ4Z3BkgKUyFfyicTUMma8WfGFWlEoKFbwnaL2Z2/d2GhqP876Tu+YpFDC5GcqszBpfy0Gg83nhIsWlaWWSRtkIr0NTL3LewtvZKbIqjb/VM0xeiYf5iBO30Ma9NtiFzYU4D1Z5A5cQzdGlqfF5bN8toL5iCkVs= + MYSQL_USER: AgAr+wwear3WFeXjqEuB2bY5SF5KpkGQvEeLZlxKwaMSH+PeVxylHUxlPmg2EQAFezfoR0EzOJtTLttNUDi2+7vLIeS0i6GRoHIHul1oInzMiOQWognohU868OqUwuNJedgwGhskx3TgKspRsUUykhcyQTmPP5GbbfH16i11pYQzCVcZ0H8/rRdey3UDwVZl3nY0Ei6d2kXXEKLwBwRsuQ3q0ZfCYCIrnpSuK00tPYubo16ESYdvy50oP4Ssn2NO2j2Httk6EAUtH1HpAdwmjleEIuVXeXIAdK6Ne5N3JXVTqt/JoI1J0PvPgmIaGSMFTyo59IfKfatD7TqFW/JbDp/Ui3pByqEjNljrrs+RqzJ+6tl77U9/hFO2kN61VP1zLpkK6uNYTnGH1ENjjdmCy3Ih/+j9CJ2DVdQ0pp24cBG1cMi2gm66j/w6389OqAjOQoi7ta8GwVdmltAFij3tvrS+aCV2MSS5BgtqJXk8zfLAPW43MKar2N5aH1N1ODiZ99EIfJM9UsTPRDWDuRPiNzuINF2XxGiG6VQwAVVzmlK6s4R65zU9ZpNVi4gFZZlYhppM2IVlM+02w/7pE1c5Am+tMnpWnIM2Z32YcKASdZT/K1MpL/7CSerfcr+gYh4hepWUFKfirVGoZ4LerIEG0OEDaLM/hxZH3hxh8s/kHRQWovgXqGIkcCLJRlwn/zEyy2WeCnSmcQk= + template: + metadata: + annotations: + argocd.argoproj.io/sync-options: Prune=false + sealedsecrets.bitnami.com/managed: "true" + name: matomo-secret + namespace: solitaire + type: Opaque diff --git a/apps/cluster-secrets/solitaire-secrets-sealedsecret.yaml b/apps/cluster-secrets/solitaire-secrets-sealedsecret.yaml new file mode 100644 index 0000000..2f47805 --- /dev/null +++ b/apps/cluster-secrets/solitaire-secrets-sealedsecret.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: solitaire-secrets + namespace: solitaire +spec: + encryptedData: + jwt-secret: AgCDylu761COJ1pbjk1QZbZ9tbwYVX0k2I0T5U/UXhaNPJsNaekiOz0+1063VphPYILey16I+ijc1OplzMgUNaLCdYRCeFjfq1XR2+ntfv3EhtZG19CFlyoZWrQ0guliV3fD0pqMpstClZQ7LmvdeseQ7tknDYrOKg5A19k9eP4kO3SQXW2nuPesDTwddVOs1hU33noIeFAM89cI9TdPC5s9RYjB4sbWFbbtgJPmebku1Mcc/PaTepx0GjaS52OK7cSkcsp+JRlZ6oENfv7EpZSu4V3qW3ajFXLHUSGvxP8VlQGCrLRS2RkNY7b15X3HctYxEdkq1Co4kjArFQ9Ut7qqUl26ANNcfSPnrN3xKA+xBGREr3x8VhQAvWmm/CKAedxmTnIImfpmrerbVELLl3gGz2OztFFzt0l9kcXnlpOBVjmoYvn9O6WStp4YecUy70FrMKmI9Q40qsy10E2hQR5wK+y2ptd6RZ6DCLxS2yRIldqflQPjBdhFjRZl+5cQIwVAaWrqrHd7/J98E1mTd0Pn5cb1iboIdET0Hc/98hF+VMiXQ3GRyih5+brazTePIEpfgDVwmpBodaiqwC2c3qpqWFudt1WQsUupud/koosb3YOWy9sRXTBVaS7hA+X+Pq9woAQeXaJs1CWcPb5amsG7DGpOT8O7DswjODfS53g0yX0SK+6VoZgU0poT68i7PkDyHQ3S96Boz1LxKV8RmLTQbxrREXwXkyCCRof6ZhJfYclKNfncoc8TDRm7rcGfi4lRB2lMq5W1gALJhOl2BADA + template: + metadata: + annotations: + sealedsecrets.bitnami.com/managed: "true" + name: solitaire-secrets + namespace: solitaire + type: Opaque diff --git a/apps/nightscout/kustomization.yaml b/apps/nightscout/kustomization.yaml index 01dbd3b..0ba8284 100644 --- a/apps/nightscout/kustomization.yaml +++ b/apps/nightscout/kustomization.yaml @@ -4,6 +4,7 @@ kind: Kustomization resources: - namespace.yaml - nightscout-configmap.yaml + - nightscout-sealedsecret.yaml - mongo-pvc.yaml - mongo-deployment.yaml - mongo-service.yaml diff --git a/apps/nightscout/nightscout-sealedsecret.yaml b/apps/nightscout/nightscout-sealedsecret.yaml new file mode 100644 index 0000000..7ed256e --- /dev/null +++ b/apps/nightscout/nightscout-sealedsecret.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: nightscout-secret + namespace: nightscout +spec: + encryptedData: + API_SECRET: AgC0frB9Yx9u8pzIE1//OVLdEFaFZSAguSlosSF6ZcQg2sJrunqlxygNujo8LxPHv9YsT1Wwjcl7B0+4SVpqygkIAIN15dQiQX8QEYAytGkRv2nnG1q7jaW/m9S5D5EAIyFgzLHtO8zFCw6lO+e5Yt+qgEE7ZRN/eWEOK9LIYmIhVa7Pbc/xQoueqS2XxtHORhyLU3b74e4GEzb0HJDSDYq1LZfTqi1dnuxKTx0zNcFhQL/QM2W+kUhuZEM/eWpdQt4GBgRvNRT1CPUCeHw1Hf5veh38CxiByU3jYy1SA5q/GN5skgq7fEReKGpBLNIadgjt9516Mognt/f+C60E/VHxKyIWb9F6Lf0tJT9lRv2mU9bX3YykPHLzrVIZ/TdFQ/SDqZ6I2Lz5MOSIJWV5pTqPOvMBLNdzGLOx56kdolxBbwNYRAsELKwwlZnW27Kodc1PFgtFbfkwpoVGdnh3xdyFPQTBcUTyZHAMcproZAhMrcALdyT0rAvnNICFetvGsacT0gv+2c88UWvb1UZ0FYKcnQmUWKD5ou69Gspm2mr+izVt1dQPNa5wxLbRFF5pzong4Q/6hVA+VX1i8rR7/D0adaqdvPYOV36Wl80JLmGbgpilFnDTZP5IQV8kaIZqb94Y1YqOlkciAcO6eICQuXf923kigELB9CYPEUoQCOYWCGBFTFxLbIwq3dvQEjgDoNyR0P3D1mPhR6mCEt7n + MONGODB_URI: AgA9Wj9k2Tdq3UiZVSK8QBhxqxch4pMWDPzWVG/gRcSsAs0KNGiDfd3MINencnSPF5Qf6ChOdc1XXJVZg83H/no068nNev+qT11T/xs7cFNhFgagYzp5bd7i5vsxIC9f69GfGbtOie32phQtCQgjkjwv9seYFywbR6u6cuaBl0wcU/RJRfLEr+goGW3EEtV0yvqxMUeg574D/uL9TSs2uZ9/XGBWGrEzbwIQkyWpUKSn7BWlCxPLQn1s7yOVQsjCKiehzb5EyEkqXhhv2QKObHyIduETFcx+8Pw40QCLVL4IXaAIV//gxDxPJPRbJ+3kL09sWW1ZdnLyvu6Tf7S228MA7uswq3Qe67q/s3vm31+ujnjGugmFtABRVAwvvmC44r79PtrRatMzeRaqMWAJSb+aGv0vxCBifA2qK/mGMIkniSFK0ciV19+Bv6m4L8IB4B4Vn1ookYjcyp0YiSqTJo2c5gMaCHqfwIS6F53+RBod0iQHByLpELgYx9h7qwoNsbFqFTDQLPk8qH1tBoJO3b1vp6FWIFLlkHbuJLfA8hBnWDEEvKoSbVjiDwyusW6duJ3CF4F0WugtfUtg8YVffR1RllUczzPgie1MCl1eZaY9ro86W1+vMC9SRyewIPTUxi64Xpmv4LtXdqdcBctSw3SxWz0ITjVk2pOgDFDOxYYRpngAiLk+8FGRzKiWM175L1E/LyjQsdsNrwwfhWjkaYQbHyelBBh/R5EJTIx2aqLL7hY6 + template: + metadata: + annotations: + argocd.argoproj.io/sync-options: Prune=false + sealedsecrets.bitnami.com/managed: "true" + name: nightscout-secret + namespace: nightscout + type: Opaque