Alex
07654cd135
Secrets are now committed encrypted (sealed-secrets v0.38.4) instead of hand-applied out-of-band, closing the config-DR gap the backups intentionally don't cover. Existing Secret adopted via the managed annotation (values verified unchanged). Controller private key backed up GPG-encrypted off-cluster. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
26 lines
1.3 KiB
Plaintext
26 lines
1.3 KiB
Plaintext
# NOTE: This app's Secret is now managed via SealedSecrets (notesnook-sealedsecret.yaml),
|
|
# which IS committed (encrypted). You should not need to hand-apply a plain Secret.
|
|
#
|
|
# This file remains only as documentation of the required keys.
|
|
#
|
|
# To change a secret value:
|
|
# 1. Build a plain Secret locally (NEVER commit it):
|
|
# kubectl -n notesnook create secret generic notesnook-secret \
|
|
# --from-literal=KEY=value ... --dry-run=client -o yaml > /tmp/s.yaml
|
|
# 2. Seal it:
|
|
# kubeseal --format yaml --scope strict < /tmp/s.yaml \
|
|
# > apps/notesnook/notesnook-sealedsecret.yaml
|
|
# 3. Commit the SealedSecret; ArgoCD applies it, controller unseals it.
|
|
#
|
|
# DISASTER RECOVERY: the controller's private key is backed up GPG-encrypted at
|
|
# /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg (passphrase in password manager)
|
|
# Restore it BEFORE applying SealedSecrets to a rebuilt cluster:
|
|
# gpg -d master-key-YYYYMMDD.gpg | kubectl apply -f -
|
|
# kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
|
|
#
|
|
# Required keys:
|
|
# NOTESNOOK_API_SECRET (reuse existing — do NOT regenerate)
|
|
# SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT
|
|
# MINIO_ROOT_USER, MINIO_ROOT_PASSWORD
|
|
# S3_ACCESS_KEY_ID (= MINIO_ROOT_USER), S3_ACCESS_KEY (= MINIO_ROOT_PASSWORD)
|