From 3418b23d35d7f64c0a2fd04060ccdc9e96975722 Mon Sep 17 00:00:00 2001
From: Ashwin Kumar Sivakumar <ashwin@traceworks.in>
Date: Thu, 2 Jul 2026 18:15:10 +0530
Subject: [PATCH] Rotate Postgres (postgres role) and Redis passwords

Old password was reused across the postgres superuser, Redis, and
Forgejo's separate nxtgauge DB role. Rotated only the postgres role
and Redis (Forgejo's nxtgauge role password is untouched and still
valid, verified against the live DB).
---
 apps/nxtgauge-backend-rust/base/secret.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/nxtgauge-backend-rust/base/secret.yaml b/apps/nxtgauge-backend-rust/base/secret.yaml
index aa96161..c64754f 100644
--- a/apps/nxtgauge-backend-rust/base/secret.yaml
+++ b/apps/nxtgauge-backend-rust/base/secret.yaml
@@ -5,10 +5,10 @@ metadata:
     namespace: nxtgauge
 type: Opaque
 stringData:
-    DATABASE_URL: ENC[AES256_GCM,data:7HYKVZc0cTBfkJq6bs6VvW0Xmzdgd4mL2UD2yOhksG2UTObcKZrKlAy1y7gTYPY23Vy0ttLKRmTnssllj5111vyvpsCLyeWWElzUl2B457QjLbjRxEAELA==,iv:EG26SgvpbVLqs7Okz14ylouGXyLf2/L81GGQyJ6NYyk=,tag:B8aLIhSR5G+n6rvyPZmqew==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:R3qHCG6cS6DTvQ8JdlqK7mkk23VSy82HROYoW5dyQ2B0ZCloh5ht6Kxq3MXph2ajVAm6PFrejkt6KD4GDSUa9kj1F2pgwQZFsALSyymO9bsxi1KUBmP/WoG6WAH+Un0mq76S+S3XWR2Jdd2miT8Fhw9n7wI=,iv:Is4R3J1GvTIPhOR6Cz3SYQ3we/tUVdCckmrLp18SnMo=,tag:lDmQwWo5jJ66zn7uncmulw==,type:str]
     JWT_SECRET: ENC[AES256_GCM,data:/SbAXJE3u6kJJfL3Go2JoRwmZt8P0MGV7gYtcpYzE4TSjpLqcVB4PpclrzkxzUt4N8omnOXepousmqSFx0fFiQ==,iv:/+q2UFxNYlagHMynYr1cNWY/MUPek3iVj88Ml3pSSe4=,tag:zNqpr3ZfLGFmqLZVDp14tg==,type:str]
     #ENC[AES256_GCM,data:NwWD9qcBt10NLznH1CtFS7jHkMrAECU50KRfBXYfa5ps0RwcNtlGEK5LhxmhNF7Hj+8wN3vRQm31,iv:H6VG1AluCHNINR43oLOfaRXm8N7NhGHGbHp8AZhxO74=,tag:yVGvSzFGkmImKD0+9+vfvQ==,type:comment]
-    REDIS_URL: ENC[AES256_GCM,data:6tZP6nOStdx2hcfFijRiMoar8OWc9gn8LGsTussYoxOu72E9OMVNjMrUJZgv7Ku1+uKAb3M4JH0BGYHSuWqS7mQ=,iv:rShXcm8ZFpP0jvZm/y85eZwXXpWTEZAVnOQVl9siaz8=,tag:47JLNmt0tIuR7toI+zaoNA==,type:str]
+    REDIS_URL: ENC[AES256_GCM,data:/CpLZLe197yAFJupL9imWhxtYEs3hIR2iuOxmPHwxnfzyInUltmt20t7215ESGgzraW1nP11+YCxvdqm0zFsxPTv68frFToxp03/2zPxinvwXfFg6uOoZ2W8eGKR,iv:rqaJRVi+5NCy1h1qtljCu13pYme2k2cZ0WucE0CfhOY=,tag:7pJcXZKKcPSo41Jyomjf1Q==,type:str]
     SMTP_HOST: ENC[AES256_GCM,data:UrDtzbTtJrIpmsZyU+7I8Fs=,iv:Q2NhRYNEmkeS162BM+ro7KLIv3ybm7Eb3LAd1huOBCI=,tag:OqrIXU4JMWErWzDEoWbEKA==,type:str]
     SMTP_PORT: ENC[AES256_GCM,data:SyZ7,iv:IdH6laFQKD0ldeb/jgC+RC/zWX2pfYIo8l6I+a4CmA4=,tag:QIMt0DTq/UrE9+R27kx0Kg==,type:str]
     SMTP_USER: ENC[AES256_GCM,data:Kx2A9tjXOWuta/Q=,iv:y4YGN0Tg+94Tpc1BG9vSp4Z77kkOREraXfggkJ4umYs=,tag:DiuETUlGzAHYuq6dRMzNlQ==,type:str]
@@ -33,7 +33,7 @@ sops:
             WFk2VkFuaVIxU21wOXlNZy9wL2hPWFkKIs9G/0ah7ng9BqLd3pAQE4wPEhCz601p
             fcHXdDkFdNlAwZK5cp1pV4FtZnudl71lRIWEUzb7vXubeaGExQDuFw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-07-02T12:18:16Z"
-    mac: ENC[AES256_GCM,data:qCLwVgBKIESDCtitUuXXYs6u2hMrjdSa79RhXHwIF5nuUySgYYdKnOyqEVA2VfqCTaUObImH9HFYitwbxQU586d+TAHkIc0VEdYauPRq9bQinxWCjeMcrjw3+maPaGWadlvCItzPos8MC4Vj7JSPzg5YvEhDDj3lmu0ESxP2y/s=,iv:0N27Fk8CFO9K8N94So6WAfFvouTAZllS6ssJ4x6d/uM=,tag:PAlL8p64/TlfdCrha9PVtg==,type:str]
+    lastmodified: "2026-07-02T12:36:20Z"
+    mac: ENC[AES256_GCM,data:LWIX//XtnlGipVLiMSYmvgFCxWPpg7swF1p+P4HwF2806t+XpRryjLfvZN+7DEvEeAa/lXwiPv34spH8PGIQqE5PXRv9xOc/lLdVzNhM8E82XK/HY5JicMdxwG1DP6l66brMy/in3yCOYAzEDVnIHosVDzpT71HO3MBIBE9IpXc=,iv:ItTMaiBIDluKf159WFdOVyzfmfJ8Rl0ci3ZZ+HyOkNw=,tag:586MRBfu0XPxIvoxudbHAQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.10.2