# cluster-secrets

SealedSecrets for credentials belonging to components **not** deployed from this
repo's ArgoCD apps (cert-manager, argocd itself, and solitaire — whose manifests
live in the Ferrous-Solitaire repo). They are committed here **encrypted**, purely so
the cluster's secrets are reproducible after a rebuild.

No ArgoCD Application watches this directory; these are applied manually:

    kubectl apply -f apps/cluster-secrets/

## Disaster recovery

These are useless without the sealed-secrets controller's private key. Restore it
FIRST, or a fresh controller will generate a new key and none of these can be decrypted:

    gpg -d /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg | kubectl apply -f -
    kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
    kubectl apply -f apps/cluster-secrets/

Passphrase for that file lives in the password manager. It is not recorded anywhere else.

## Contents
| File | Secret | Notes |
|---|---|---|
| cloudflare-api-token-sealedsecret.yaml | cert-manager/cloudflare-api-token | DNS-01 ACME; TLS renewal depends on it |
| argocd-gitea-repo-sealedsecret.yaml | argocd/gitea-rusty-solitare | repo creds; needs label argocd.argoproj.io/secret-type=repository |
| solitaire-gitea-registry-sealedsecret.yaml | solitaire/gitea-registry | image pull secret (dockerconfigjson) |
| solitaire-matomo-sealedsecret.yaml | solitaire/matomo-secret | |
| solitaire-secrets-sealedsecret.yaml | solitaire/solitaire-secrets | |