Encrypt all secrets with SOPS, add Flux decryption support, rotate JWT_SECRET/AI_SERVICE_KEY

- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
2026-07-02 17:56:28 +05:30 · 2026-07-02 17:56:28 +05:30 · b4f371d415
commit b4f371d415
parent 8515bcd3fe
16 changed files with 255 additions and 79 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: apps/.*\.ya?ml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
--- a/apps/ai-guard/base/secret.yaml
+++ b/apps/ai-guard/base/secret.yaml
@ -1,8 +1,23 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: ai-guard-secrets
-  namespace: nxtgauge-ai
+    name: ai-guard-secrets
+    namespace: nxtgauge-ai
 type: Opaque
 stringData:
-  ai-service-key: ""
+    ai-service-key: ""
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjblkzcGRBRWhROVlieEtL
+            MG51WmF6RThLTHN4K3YwVUxkYTBZek5HdzJNClY0cXFmM3NaY1M4V1ZPQWx1UlZo
+            bVFibWNlVjRBclRCMUl4MlowYm1ocjQKLS0tIDNoNEgwckZRdEROZmFybUd3NnhU
+            YTFWcWdUZk90ZWkzVkpWWXhWVzJQbzQK8Qe0Mrz80DruvKEW7sFvTMrhyUIsTK3p
+            BQtp4WPQZpedJG6RN3Q0hs3d6D2un/wvlq1OFyHOWsheh3sbuYn+Qg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:17:30Z"
+    mac: ENC[AES256_GCM,data:kCzNtzPNF2jVJoQQO4J28MkcNw0uzTrJaQbCCXxwnkWdO+HFMYCskYwrxxouwuP2Gupt1vHOE8nk+a/oWzKCv5rhuVa6VyyMH9ufK5XPhJbuYMsf2IsuLgHWE95lhJEerezusm6L68rS45i+YCd0/biS7vc0AIxt8NcI2soCcPE=,iv:pacRPzx4+K+dsNxASA1I2oeLZNK3gy0bydDbt58jsjw=,tag:RVnbv1myFiTSifjurd/kyg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/litellm/OPENCODE_CONNECT.md
+++ b/apps/litellm/OPENCODE_CONNECT.md
@ -5,7 +5,7 @@
 | Setting | Value |
 |---------|-------|
 | **Base URL** | `http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1` |
-| **API Key** | `sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9` |
+| **API Key** | `<REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>` |

 ## Available Models

@ -18,7 +18,7 @@
 ### Option 1: Environment Variables

 ```bash
-export OPENAI_API_KEY="sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9"
+export OPENAI_API_KEY="<REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>"
 export OPENAI_API_BASE="http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1"
 export LLM_MODEL="askash-main"
 ```
@ -30,7 +30,7 @@ Create `~/.config/opencode/config.json`:
 ```json
 {
  "provider": "openai",
-  "apiKey": "sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9",
+  "apiKey": "<REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>",
  "baseUrl": "http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1",
  "model": "askash-main"
 }
@ -44,7 +44,7 @@ Create `.opencode` in your project root:
 {
  "llm": {
    "provider": "openai",
-    "apiKey": "sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9",
+    "apiKey": "<REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>",
    "baseUrl": "http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1",
    "model": "askash-main"
  }
@ -56,11 +56,11 @@ Create `.opencode` in your project root:
 ```bash
 # List models
 curl http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1/models \
-  -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9"
+  -H "Authorization: Bearer <REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>"

 # Chat completion
 curl http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1/chat/completions \
-  -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" \
+  -H "Authorization: Bearer <REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "askash-main",
--- a/apps/litellm/README.md
+++ b/apps/litellm/README.md
@ -10,7 +10,7 @@ LiteLLM is deployed as an API gateway to the internal Ollama service, providing
 - **Security**: API key required via `LITELLM_MASTER_KEY`

 ## Master Key
-**Production Master Key**: `sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9`
+**Production Master Key**: `<REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>`

 ⚠️ **IMPORTANT**: Store this key securely. It grants full access to the LLM API.

@ -42,13 +42,13 @@ All aliases route to the same Ollama model (`gemma3:270m`):
 ### List Available Models
 ```bash
 curl https://llm.nxtgauge.com/v1/models \
-  -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9"
+  -H "Authorization: Bearer <REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>"
 ```

 ### Test Chat Completion
 ```bash
 curl https://llm.nxtgauge.com/v1/chat/completions \
-  -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" \
+  -H "Authorization: Bearer <REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "askash-main",
@ -65,7 +65,7 @@ curl https://llm.nxtgauge.com/v1/chat/completions \
 ```bash
 kubectl run test-curl --rm -i --restart=Never --image=curlimages/curl:latest -- \
  http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1/models \
-  -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9"
+  -H "Authorization: Bearer <REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>"
 ```

 ## OpenCode Configuration
@ -75,7 +75,7 @@ Create/edit `~/.config/opencode/opencode.json`:
 ```json
 {
  "baseURL": "https://llm.nxtgauge.com/v1",
-  "apiKey": "sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9",
+  "apiKey": "<REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>",
  "models": {
    "default": "askash-main",
    "available": [
@ -95,7 +95,7 @@ Create `.env.local` in your Ask Ash project:
 # LiteLLM Provider Configuration
 LLM_PROVIDER=openai_compatible
 OPENAI_BASE_URL=https://llm.nxtgauge.com/v1
-OPENAI_API_KEY=sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9
+OPENAI_API_KEY=<REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>
 LLM_MODEL=askash-main
 AI_DEBUG=true
 ```
@ -109,7 +109,7 @@ providers:
  - id: openai
    config:
      apiBaseUrl: https://llm.nxtgauge.com/v1
-      apiKey: sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9
+      apiKey: <REDACTED - see nxtgauge-litellm-secrets Secret, key LITELLM_MASTER_KEY>
      model: askash-main
 ```

--- a/apps/litellm/base/db-secret.yaml
+++ b/apps/litellm/base/db-secret.yaml
@ -1,11 +1,26 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: litellm-db-credentials
-  namespace: nxtgauge-ai
+    name: litellm-db-credentials
+    namespace: nxtgauge-ai
 type: Opaque
 stringData:
-  DATABASE_URL: "postgresql://litellm:litellm123@postgres.nxtgauge-ai.svc.cluster.local:5432/litellm"
-  DB_USER: "litellm"
-  DB_PASSWORD: "litellm123"
-  DB_NAME: "litellm"
+    DATABASE_URL: ENC[AES256_GCM,data:pCnOS9l7BlmxL5aDcaaulSgNxQa2M8a7uhVbnQ98k3NFNsJILkVJmALxzsufRsJhlSFAzfGR+3dSSPPrAzBzFzPMWjxOEtmKH4/9lMqRpVKYlQY=,iv:ucMlqs1WvAY7+vK93EC7NIdIOCvYgmFujZJP+VblTEU=,tag:mPm97ID7QXqJHIs+7Bp6Gg==,type:str]
+    DB_USER: ENC[AES256_GCM,data:DEV7RshBbg==,iv:0C2vDbjSsyyWB2ueOJSIbjflvjZaOMHp7uYcf92A+RQ=,tag:5dypXrRYgbc4yIuT9J3uDQ==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:/9hbGZMnXxqEMQ==,iv:zGPlktP7ahdY4xbhhQLKw90IwlG0rT15eBIdGmfsLYM=,tag:eazhcIWuhQJYB/ZcwD7RbQ==,type:str]
+    DB_NAME: ENC[AES256_GCM,data:+ZsZs4tCxg==,iv:BoySPuXGlfzVYQ6Nnco6AduRvtYSfCKSrQ7O+RCS5ew=,tag:xeUcIVRg9hEjKqVmIyd/dw==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQkNZdml4cnM2ZjJTSWRR
+            V1ptVU5CY0lMdVV4L0tNUXRJVE84ZmczcUhrCnUvdWd1bndqZWUxaUZEQkoyQzBL
+            NkQ2NDNPVXJVcVcwMHlML2ZxQmsvZ2sKLS0tIG5GNXhCNjhJY1BTczllY2k1aTlo
+            QTNnZmwwUzlDM0c1VzV6Z0hJclI1TFEKnE1Zl5FdPnO+638Whw77pSqTE0yJFHWY
+            eA8YPz9z3MfkNEv94aue67zClbW1rx73cc90ASvPUpMm1l4NVb9ivQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:17:30Z"
+    mac: ENC[AES256_GCM,data:a1WLtxBrW1GHHr1zg58D+pSvAHT/AYqYtXSZBAW8rkyFgU8PslzUCy7Fgs8ImhcQf3ykMGJH7rKDtG3DKqhr+VWHse0P30u3OgxfOoMIeSyWMKtlg9DWsWKpk3Eid/0iNW3XsCF/0PgORIfvEdbUkMSFlWLlXIZ4Qs4fon4YGFM=,iv:z6GbmWObIgnZ9DnHJpSx8SsAD5ukRgmboGdVwb28cMU=,tag:T/mgHx8fvtOaPP9m65ATPg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/litellm/base/secret.yaml
+++ b/apps/litellm/base/secret.yaml
@ -1,10 +1,25 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: litellm-secrets
-  namespace: nxtgauge-ai
+    name: litellm-secrets
+    namespace: nxtgauge-ai
 type: Opaque
 stringData:
-  # Master key for LiteLLM API authentication
-  # Change this to a secure key for production
-  LITELLM_MASTER_KEY: "PLACEHOLDER-UPDATE-IN-OVERLAY"
+    #ENC[AES256_GCM,data:TuZS4IVk6g2SXUpQWkoDALAK3ack+ekBGd24mDPJ5L0J4fQpA3zUYjcG,iv:Dox0GMeXJ0QeScAojVw6XRCprf1/YfGBaQYiT4p37eM=,tag:WSKyjkk2WPhVmR2fnxWhFg==,type:comment]
+    #ENC[AES256_GCM,data:1WnTc8lueif6P56qf53jReLQ2Zwowp+eNPO9zip7LBplvfc+zXrQ1HAF9g==,iv:LIXZlIOxl2VQS8Hc7MNQCh/c+RLFyhv3ppiY9ngYOEY=,tag:ozEMau2Qa6/vxq02lBCtbA==,type:comment]
+    LITELLM_MASTER_KEY: ENC[AES256_GCM,data:AKcD37IsUX77Fewg8AdklrJ+s88WdeFMMwmxERY=,iv:Sq1YbOQl4Q2A6d2uuB2lKl61qHTwwWf3KrYB8uFE36A=,tag:hjndpCamkXw5SjaSS4QA9Q==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMElxRmFvWkNsc2pLMldG
+            SnNsaSsza2FpbUlkMG1RZGZJOWhrNmlwRG1vClhRL3phOGlSQmxEVmZWaTNEUFB1
+            bFFtemFNbFpMTlQyWVVhWFNLZlZtNTAKLS0tIGlwRjdGTHBtVlZKRkpwTVZaTjY1
+            Vmthb3FHR2xjUGRZZGxvci9ybHJ0WDgKIer4ERUBD+go3E19pvdb/zn75PrwVa3n
+            2bbLDG0clSu7KuaGdZh5AcNQTbl16sjiQxmxzqYIKib7neQBjDH3Kw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:17:30Z"
+    mac: ENC[AES256_GCM,data:bCslBTumwUUk/wz0yfrdxRsucx/j4Ij/uO9RVE2b8bgKualJ0KYiN6kfgUpylTW0G67pslU1/eGkOcmG4/eYVmwIAn2m4MZ/ni7/0YZ/DoRQFqujscr2/sWYZi1LEtroj8jTEW+3Nw2g6Z0SobEoN2s+V8MrVgPR1Z7BCnvvE/g=,iv:ZGqA7pqhpwU2jYi8/dslaHtDYvrclc6UWbhHv922wYk=,tag:M1S63XwixHXij7RrHE+JGA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/litellm/overlays/prod/kustomization.yaml
+++ b/apps/litellm/overlays/prod/kustomization.yaml
@ -6,12 +6,6 @@ namespace: nxtgauge-ai
 resources:
  - ../../base

-# Use secretGenerator to create production secret
-secretGenerator:
-  - name: litellm-secrets
-    literals:
-      - LITELLM_MASTER_KEY=sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9
-
-# Delete the base secret since we're replacing it
-generatorOptions:
-  disableNameSuffixHash: true
+# Overrides the placeholder LITELLM_MASTER_KEY from base/secret.yaml via strategic merge.
+patches:
+  - path: secret.yaml
--- a/apps/litellm/overlays/prod/secret.yaml
+++ b/apps/litellm/overlays/prod/secret.yaml
@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: litellm-secrets
+    namespace: nxtgauge-ai
+type: Opaque
+stringData:
+    LITELLM_MASTER_KEY: ENC[AES256_GCM,data:cY9TuaFw5lS33WupTrWN4MrLtj9eGCZWwKsWjfU6xvLfksb8fZSxBuy3te9iA2scQFpkAaTtHfc0d3BqhfB/f/kQfUZWqpXNI53x4jhQ5cQ=,iv:JDL+6l1LvjdeCPFZ0uRNMxl8bZ2Hma45OnMADHcQImQ=,tag:u+icxo/y18YcRuwHHQzWSQ==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBySEpkalRaaWczNHpDbTI0
+            UUlZNWtiZlIxcWs1TDJSUTBuek44YjB5bENrCk5qMThoT2hEa3QvWHVWMGpLWW8w
+            aGVSTVhrVmNCdzhmZGUvS3Y1UENTRjQKLS0tIHd3aW9MaEpRUFJ0QkUzR2ZHVE1D
+            ZDNjMEtDUTFYWXA1NkdFNTVia2hQNVkK1yb+LQtESLOo30KWHxpahlV6V0AL7R98
+            /lxtOCj50zlknAhPKbQg/TSyvHHqbx0TAiEs6xG0R1OUnqTxI/kKfw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:19:43Z"
+    mac: ENC[AES256_GCM,data:RsTBxbfUtXZtAQp5KRl7YPbagNopbK2upzIOZLrotDgra2QShwllhTOCGcm0x4F3xz+G/yeOYq8g22/p/D/buy/voIz8Z/r9F06OIblc8fO8HaEibJfI1rRf3a2I+wRAmnltMmtdMyp3YN7y9/uAsbIra4iBkVOjcJ5HCE509ug=,iv:BobfQK4ldBupRf5VPc8Vaki+uaiHB1eEmc/UZ6tsUeo=,tag:CQyHEZ+HfwxpvVIkus9BpA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/nxtgauge-admin-solid/base/secret.yaml
+++ b/apps/nxtgauge-admin-solid/base/secret.yaml
@ -1,12 +1,27 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: nxtgauge-admin-solid-secrets
-  namespace: nxtgauge
+    name: nxtgauge-admin-solid-secrets
+    namespace: nxtgauge
 type: Opaque
 stringData:
-  SMTP_HOST: "smtp.zeptomail.in"
-  SMTP_PORT: "587"
-  SMTP_USER: "emailapikey"
-  SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA=="
-  SMTP_FROM: "support@nxtgauge.com"
+    SMTP_HOST: ENC[AES256_GCM,data:6IGeRaJzzQ3fkX4jVVZ36mg=,iv:8H4BAFFoMd190M4q/85bEffL6yzdBaDjreF/X0xz2aU=,tag:nX+MUmTMYYK1rByglsMjUw==,type:str]
+    SMTP_PORT: ENC[AES256_GCM,data:s4aS,iv:e5ySOAp00lv8JKYA7+FZgl4naWyoHxBIfnySELQGPdo=,tag:Ofg0gkNGPEG77lOVWvbgmw==,type:str]
+    SMTP_USER: ENC[AES256_GCM,data:ijOeJ+2xZw0ire4=,iv:jP//72BqKjlYzreXG8oQVgeH0BHT3dxBaXpzKgBBYZ4=,tag:Sue0Eje/HbARTncl3V/UEg==,type:str]
+    SMTP_PASS: ENC[AES256_GCM,data:uGJFVFarFTVJFfvhdQYiQB+/4jPigE7xNNgYenJt4jpuF8UhMOuM3zuvZ+1x0QlMdYG/Og5SgC/RuHMhrbrNS3YbbJaC2eZjTurH2xyvY6iLLdLQHmcdGR7sCFsyoQ6IZybUrcd+DTCy1safsJm0Mh0fhZEBPq1qWsMZUolswsLj7TFsiXHDiG+ZU/AKHCn1,iv:LY38BvW3CrIfLhflq04X+bCgR4AP8c+VzW3Alpl7zFk=,tag:YIcGD3QViiGcGSAqk0HeyQ==,type:str]
+    SMTP_FROM: ENC[AES256_GCM,data:bfZgeNSLquqOhtCRlOXPesI8K9o=,iv:n9ApxTDgCG8zWZwEievDPzOGMIIxlFhV2CaL0FHs0mU=,tag:nrk5coQvWgZgslEnSmXQJw==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUDRidXo3VHJWT2N3Y2Zz
+            eW1oMXJEb3FPNm1mOHVXOG1HWnRHSHB5UFQ4Ck4rSkc4ZXhyTEtCbWI4YkpKS1Vv
+            SUt4eG0rWHJUN2hyc2RaQ1VLUzJYQUUKLS0tIEkrSUFVQU1ubk9iRTQxWW9RclF6
+            VEdhdGdLV0U2c09idHNySVRWd2s2OTAKD2X/8Elyrl1X99JRwKZXe8nQvz92UuvU
+            fnlqzdjCWaHyd4Ib9t8WjLw5Hm+qLluZpci7UqJaQX9OAN2+HGC8Sg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:17:30Z"
+    mac: ENC[AES256_GCM,data:OsdePD6gejqfmJck8JCkoRx2iztrQQ2GQQ99jXNYfnRIe0Mx8BHH4fpUQRT853Wr2tjQq0V9Vl8B0uQC05aCnBIhpOExg7Oyq+fm0FC0PmzkcyNsZjspIoux3UqsXh6aXfjaeL9/szCsdwlXplaMWdisibTgQYwt86zEieOPDFE=,iv:x0mEf7r50m089Vnn2VVfyCHBWwuhXce25deJ+TJOnBo=,tag:YocuQO6IzgcKfVrNbSbT7A==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/nxtgauge-ai-assistant/base/deployment.yaml
+++ b/apps/nxtgauge-ai-assistant/base/deployment.yaml
@ -41,6 +41,11 @@ spec:
                secretKeyRef:
                  name: nxtgauge-ai-assistant-secrets
                  key: ai-service-key
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: nxtgauge-backend-rust-secrets
+                  key: JWT_SECRET
          resources:
            requests:
              cpu: 100m
--- a/apps/nxtgauge-ai-assistant/base/secret.yaml
+++ b/apps/nxtgauge-ai-assistant/base/secret.yaml
@ -1,10 +1,24 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: nxtgauge-ai-assistant-secrets
-  namespace: nxtgauge
+    name: nxtgauge-ai-assistant-secrets
+    namespace: nxtgauge
 type: Opaque
 stringData:
-  # TODO: set to the shared key expected by callers of the AI assistant.
-  ai-service-key: ""
-
+    #ENC[AES256_GCM,data:DzWkRm3f8tFc02M5GVMtvWxLscWMt/AsTW7U0+KenEDguLPOGZjSqTflKwlP11V7v7p3bCkvpmKFvRq3B8Qi0g3zzp0Q,iv:TA8ADbjVM5gw8zc6Synn/Ue6BT8k/PUtyvoNrXEgzd4=,tag:rhFeomxaYhX+pWmKjYW3fQ==,type:comment]
+    ai-service-key: ENC[AES256_GCM,data:FjKo1h5loCYoXDOC4g37tLTbLU7lE+DewxMkUCXBO5op0tJByaXmBYy5ZZEDpplZxDsEPd4QiKoUg8bM9+2OSA==,iv:I//s3r9wSQujgtXPeFT1IArzu2LbObsFz7d8E0GN6iU=,tag:PkLaujtLklCWHQYGIB9uvQ==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQWU2UU13Z3dFcFFqeU9J
+            NThoMVE4UW5jeHFQaE9tY0p2aGliU3EyMVZrCng4RGhGbDVYM1M5WFdZZ3M5Tk1S
+            NldkdXRSS2dqckpvNUo5d1hqYUZLWE0KLS0tIGUzV2pqbW5ScEllbVBDeG1KNFJB
+            ckFFMndObTNzaFpyUVU5OTZOTUNiQXcKDPo+nnHRjPlswzW1WHQEde8Ae/icAsxH
+            +aq9NUpDQ8FTCdIu0rtqVS1VaEyt1kXgBmrjHIJCIVVvFzTKfuXLGA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:18:28Z"
+    mac: ENC[AES256_GCM,data:DgCzaIaaDP4Q5lhOLkBmy1z0+kJ0CFBCGVal3WKiNpo8H9aEfArGsbvA4zleZphtzVP/R8GhegjUdkVXT+wZo30Py/4FLFuRxtiiUohxHCfaiqD/13KHKO6nEJPN3wV9Ab59x+PlWk8roDGuPggupUs7v4VdHKqk+qQwsaTuhiY=,iv:KdSKauwmArBWm817lFrYB7F7axx3TvKXBbbqOI0NOSg=,tag:dCi+4OgbyZKiXUZCR/I7ew==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-secret.yaml
+++ b/apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-secret.yaml
@ -1,11 +1,26 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: nxtgauge-openobserve-endpoint-monitor-secret
-  namespace: nxtgauge
+    name: nxtgauge-openobserve-endpoint-monitor-secret
+    namespace: nxtgauge
 type: Opaque
 stringData:
-  OO_ENDPOINT: "http://o2-openobserve-standalone.openobserve.svc.cluster.local:5080"
-  OO_ORG: "default"
-  OO_STREAM: "nxtgauge_endpoints"
-  OO_AUTH_HEADER: "Basic cm9vdEBleGFtcGxlLmNvbTpDb21wbGV4cGFzcyMxMjM="
+    OO_ENDPOINT: ENC[AES256_GCM,data:AS2JCqQO8nKWY5CxK4K8RnfTShgmcETKBU6bo5KYhGX29HZ9S0svPgr7N8f2n2ukP79yxNJhRgoj1g5IHylrcOWHkg==,iv:rCXp7P/KD3OjNey2R4C1mIV1mwJloXY1b3cidQZDsq4=,tag:w1yHshbQAo97IJotL9N40Q==,type:str]
+    OO_ORG: ENC[AES256_GCM,data:Wr0KPRa6kA==,iv:+vF9x/yTmqsg6vK5cHucLURktlcY0qP/NpoFnF0YuKI=,tag:n0vpNEoNzeVKzCJ44IBXGQ==,type:str]
+    OO_STREAM: ENC[AES256_GCM,data:ihLyiAbqfZtDstT6aFrh9QUg,iv:V4PkyKL9PSD2k7o+Od7t7q4g3o38mqbPPxZ87YGQAvY=,tag:m3AAVpaI6WwSSkw86pEsUw==,type:str]
+    OO_AUTH_HEADER: ENC[AES256_GCM,data:VY7qW13SLjUVMb21dsUpKpMZU00QSGAI1oCJHfTC8wxatuw0js4+fwyfLhJk/5ejBV8=,iv:62O+daUXn6OoJ0xiZ6iNTYAOVEI/2phGm4EYsUG/ENc=,tag:/5LXx1a/tG442LPuJCwYnQ==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvWjByejZNaUo0TmVRWnpY
+            WUpHS3hNeUZ5VnNGNjZ0RXZXZmd3QVdjV1dvCnArSktlaGp0Y0RuUzJTMThsZzhE
+            aXBQZGRkZDRQM01HOThnamJwY2JGbWsKLS0tIG84ODMybWc5cVZ6TGRLQTRGOU4x
+            Zm5aZHpmQVU0djB2RkxiOERVRStrclUKgd9O6ldUlge0Kop14t4jUVidQIRfmLzg
+            +Ci3LgedKLE1Lxbwg9JbTpA9YkVucnLuHPbUYZrud91jn1jnkw6plg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:17:30Z"
+    mac: ENC[AES256_GCM,data:vAHLnc8tTNxmMnZs66H2MPxjvVpdquV8VYFD9DvWE/cIEEcZLrXtF6F5Nrcn5CSOurWKJoSQKV+s8DZQvuocc5cS5i8QvxSNyj1pcK+JzTUdMoDFY/xwqvVS3tIQn29Cocx2TEU+XUYB0zTVKRYGZjaQEgRquXZmGXCPaPzZvso=,iv:qkieUNf/khdlOArHPFo96x864XufRO8z9xA9HQzTt08=,tag:4PiiRm5F/hicDrTX9PigsQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/nxtgauge-backend-rust/base/secret.yaml
+++ b/apps/nxtgauge-backend-rust/base/secret.yaml
@ -1,23 +1,39 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: nxtgauge-backend-rust-secrets
-  namespace: nxtgauge
+    name: nxtgauge-backend-rust-secrets
+    namespace: nxtgauge
 type: Opaque
 stringData:
-  DATABASE_URL: "postgresql://postgres:chandan2026%401@pg-postgresql.data.svc.cluster.local:5432/nxtgauge"
-  JWT_SECRET: "bPU0RQ/N7JW8CDCioe6AFBw/lBLTm++pGtta20pcsTX36p3OyheplgUyiD66OCuV"
-  # Password contains '@', so it must be URL-encoded as %40.
-  REDIS_URL: "redis://:chandan2026%401@redis-master.data.svc.cluster.local:6379"
-  SMTP_HOST: "smtp.zeptomail.in"
-  SMTP_PORT: "587"
-  SMTP_USER: "emailapikey"
-  SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA=="
-  SMTP_FROM_NAME: "NXTGAUGE"
-  SMTP_FROM_EMAIL: "support@nxtgauge.com"
-  SMTP_SECURE: "false"
-  B2_BUCKET_NAME: "Nxtgauge-object"
-  B2_REGION: "eu-central-003"
-  B2_ENDPOINT: "s3.eu-central-003.backblazeb2.com"
-  B2_ACCESS_KEY_ID: "dc99dfa1435d"
-  B2_SECRET_ACCESS_KEY: "003fa963ca8ab98716d5ccbe0c591459392a2f1920"
+    DATABASE_URL: ENC[AES256_GCM,data:7HYKVZc0cTBfkJq6bs6VvW0Xmzdgd4mL2UD2yOhksG2UTObcKZrKlAy1y7gTYPY23Vy0ttLKRmTnssllj5111vyvpsCLyeWWElzUl2B457QjLbjRxEAELA==,iv:EG26SgvpbVLqs7Okz14ylouGXyLf2/L81GGQyJ6NYyk=,tag:B8aLIhSR5G+n6rvyPZmqew==,type:str]
+    JWT_SECRET: ENC[AES256_GCM,data:/SbAXJE3u6kJJfL3Go2JoRwmZt8P0MGV7gYtcpYzE4TSjpLqcVB4PpclrzkxzUt4N8omnOXepousmqSFx0fFiQ==,iv:/+q2UFxNYlagHMynYr1cNWY/MUPek3iVj88Ml3pSSe4=,tag:zNqpr3ZfLGFmqLZVDp14tg==,type:str]
+    #ENC[AES256_GCM,data:NwWD9qcBt10NLznH1CtFS7jHkMrAECU50KRfBXYfa5ps0RwcNtlGEK5LhxmhNF7Hj+8wN3vRQm31,iv:H6VG1AluCHNINR43oLOfaRXm8N7NhGHGbHp8AZhxO74=,tag:yVGvSzFGkmImKD0+9+vfvQ==,type:comment]
+    REDIS_URL: ENC[AES256_GCM,data:6tZP6nOStdx2hcfFijRiMoar8OWc9gn8LGsTussYoxOu72E9OMVNjMrUJZgv7Ku1+uKAb3M4JH0BGYHSuWqS7mQ=,iv:rShXcm8ZFpP0jvZm/y85eZwXXpWTEZAVnOQVl9siaz8=,tag:47JLNmt0tIuR7toI+zaoNA==,type:str]
+    SMTP_HOST: ENC[AES256_GCM,data:UrDtzbTtJrIpmsZyU+7I8Fs=,iv:Q2NhRYNEmkeS162BM+ro7KLIv3ybm7Eb3LAd1huOBCI=,tag:OqrIXU4JMWErWzDEoWbEKA==,type:str]
+    SMTP_PORT: ENC[AES256_GCM,data:SyZ7,iv:IdH6laFQKD0ldeb/jgC+RC/zWX2pfYIo8l6I+a4CmA4=,tag:QIMt0DTq/UrE9+R27kx0Kg==,type:str]
+    SMTP_USER: ENC[AES256_GCM,data:Kx2A9tjXOWuta/Q=,iv:y4YGN0Tg+94Tpc1BG9vSp4Z77kkOREraXfggkJ4umYs=,tag:DiuETUlGzAHYuq6dRMzNlQ==,type:str]
+    SMTP_PASS: ENC[AES256_GCM,data:z96REIjbLfwA6Sh1bRBgD1xobNjwLJPecr9OilI9c+ROQD/gzpfaOc/0mmDSN2kYJpyuIY5BGMzDSwtP+hesQzQ/a6MNrelh08JAY96CZnaqbXhzZCjTbHmB/DoSnC3UDoChjoNL6F7Q4L5I1gRVkwGtuyEfTCiKwHEYLrY94iKsuWso86Tga+B8DfhMnAvI,iv:+oF81kyGLzM8Yspb7HOdOI2UDtYpDiqmalw+4f8W2F4=,tag:kG9g9wMx4JCEc650kyZO8A==,type:str]
+    SMTP_FROM_NAME: ENC[AES256_GCM,data:xTByiZiSRjk=,iv:gqkEHwOJkfFHdzNBK5Hx9s65YZZsNS8OtOfcAQYsOkE=,tag:+7QHKYjOQaFiOWMMzO0A1g==,type:str]
+    SMTP_FROM_EMAIL: ENC[AES256_GCM,data:hvP00nyhduBnWP9tS6suYtde9S4=,iv:EnP+eSSqfkeddKjlp6VlpZwFH8XZcBjk4XAg8omoJMA=,tag:xwM54O2iY0/3HrliIC87Mg==,type:str]
+    SMTP_SECURE: ENC[AES256_GCM,data:6mW7rpQ=,iv:9ONifzX5N1YyfWvFTNMJiGKyV25auoiKXFVWd45gDxQ=,tag:UCOpQczeDGDgJ326tFwEtw==,type:str]
+    B2_BUCKET_NAME: ENC[AES256_GCM,data:L+sRHOxaeicvmSGcyNDR,iv:UMbs+CkgygKm6FhmHA0fyFflUnqAypV5ZQZOQSRqQhc=,tag:d8F6YQGp+Y+EPx91mgjoBA==,type:str]
+    B2_REGION: ENC[AES256_GCM,data:luhXJET9s1pePd35RMY=,iv:0pe4qXPmr20MbF/LIg1v2fgTwHQRQrDmVI5NfuSe+TM=,tag:L1C1jGcNiqOOSRoJi5xWxQ==,type:str]
+    B2_ENDPOINT: ENC[AES256_GCM,data:gS8Mfhi9js8/V7VyzZxd1L1wTFz4Qj8+OYRd1gAm24qz,iv:NJL0FO6QY/eXsmZOi0hdJ2U24U3rdfCQ2hDSJhbx9aI=,tag:uwxHGolwss36llXWvCIvMw==,type:str]
+    B2_ACCESS_KEY_ID: ENC[AES256_GCM,data:ObKiwVZkQkNHGYyh,iv:NAWXJswVzHuhO9uku9S5ZFFYsduY0sQbSZRUuT3VK3w=,tag:WW3XuhT//8enUeq7m7YGpg==,type:str]
+    B2_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Y7m2PSALvibcwjWKf2aXCEuhJF+mlPwnVwNobXJJuZrGFgdPRUQ7WZbC,iv:EqXkCZ5/LP7riXRkZ+TnssYuPjyBQVVuPqBxLcQfAZc=,tag:EtF6dH/tK4Am7YyfEygGnw==,type:str]
+    AI_SERVICE_KEY: ENC[AES256_GCM,data:ivhSxI1Rvh/5nfe+1R5GFjCbZIzk2Tm58Fi3PpayPWASQR/KNj74kM6MIXg6MtSgJ4ZDKIJ9ZJOGdYPyacRV9A==,iv:KKMfdJGKReYsVGf55Hs3tyInQ761AJ5bhaUfqPY5fpM=,tag:jGmhwI6xxqM5U4oX5Ork6g==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1VmtFRTFKQmd6dzF6L1R6
+            MytrL2pNZ2hmQmVVVmZXbHA5Ri9SVC83QndnCmFVQkVpdTA4WHZnMzFCa1pRc3p1
+            akxJMEtRQkZpSmVvWFhmc1IxeDhiUGMKLS0tIDcyamQrU2dZSHU3UG5aMnRZdmdW
+            WFk2VkFuaVIxU21wOXlNZy9wL2hPWFkKIs9G/0ah7ng9BqLd3pAQE4wPEhCz601p
+            fcHXdDkFdNlAwZK5cp1pV4FtZnudl71lRIWEUzb7vXubeaGExQDuFw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:18:16Z"
+    mac: ENC[AES256_GCM,data:qCLwVgBKIESDCtitUuXXYs6u2hMrjdSa79RhXHwIF5nuUySgYYdKnOyqEVA2VfqCTaUObImH9HFYitwbxQU586d+TAHkIc0VEdYauPRq9bQinxWCjeMcrjw3+maPaGWadlvCItzPos8MC4Vj7JSPzg5YvEhDDj3lmu0ESxP2y/s=,iv:0N27Fk8CFO9K8N94So6WAfFvouTAZllS6ssJ4x6d/uM=,tag:PAlL8p64/TlfdCrha9PVtg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/apps/nxtgauge-frontend-solid/base/secret.yaml
+++ b/apps/nxtgauge-frontend-solid/base/secret.yaml
@ -1,12 +1,27 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: nxtgauge-frontend-solid-secrets
-  namespace: nxtgauge
+    name: nxtgauge-frontend-solid-secrets
+    namespace: nxtgauge
 type: Opaque
 stringData:
-  SMTP_HOST: "smtp.zeptomail.in"
-  SMTP_PORT: "587"
-  SMTP_USER: "emailapikey"
-  SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA=="
-  SMTP_FROM: "support@nxtgauge.com"
+    SMTP_HOST: ENC[AES256_GCM,data:ZyymsH6KNKIC9DMftVRKtyY=,iv:8l7Ue6qlUTyJqlSqyfFHwCpM4gkgaaucVX2Q6izaYN4=,tag:SC7NAtA9/er24PLnGV0oOQ==,type:str]
+    SMTP_PORT: ENC[AES256_GCM,data:+23C,iv:LZOuM1GiI1unVINYvBkH8c6LF0vBNDSrEQSjz3EXK2Y=,tag:ZjyJ4lZ3PgPGxRuOFFkT/A==,type:str]
+    SMTP_USER: ENC[AES256_GCM,data:ehnFRXh1w2SWCoo=,iv:s3w/Xgms8kNKF9PImHx5JpM0uvM7FC35jl9sCVmrek8=,tag:RagZTnqLwC06+MwK2Av0Rw==,type:str]
+    SMTP_PASS: ENC[AES256_GCM,data:LOMzp/mGddcwiJLfSB69fIn0mQvJVs14WjF/MNtO0qgW6LDX0erhsCtwPCoE73WUCiLKOKL0CwZPdZqxfAK9OE+edSF1CqnQdhOjuYtR4wElD1yj54t1/5wHRTFRTUXkPO/gnqKT3jWez3pxEc6rWpsLT2ZIwEWSP0E9SIKZW10K27G8+vNosuYrDc0yTmc9,iv:zrV5+/pHMjult/2kLDHZr3EuGyF5uFu3TrCvvms+2fA=,tag:g25HmbNv2Q7s/pXV/namCQ==,type:str]
+    SMTP_FROM: ENC[AES256_GCM,data:+R7du3/Bb2tE17FE9aJh8Y1NPa8=,iv:PjTsr/Nj1caWjxENmFMctjjxA995Fr1NWeYo7SC1PwY=,tag:NkqJxcJHUoWKqqkQcp9xQQ==,type:str]
+sops:
+    age:
+        - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvKyt1WFZjUWxNY3BDdGZG
+            cnVnczgvVmFmYnIvK0M1OGptOE1tYUIrTUh3CnVPb0xMdnZPR2YwenpjK3h0QTZK
+            NEdQRFRjUXRPdHVZdDJZenF0NG9CWlEKLS0tIDZzNElsYm9RMTNZZS8xVnJhSCsx
+            NFgvM1VtUUJ0emVYandXcUJFRTRDdVEKoRum9CpLygcum+VUz4Ur79KeX+BxqDO/
+            f7oSAzdLYgLPyc867Fg8vKBQDUfZsARHudDtIhL2t+YFp2FHFZ9M6g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-02T12:17:30Z"
+    mac: ENC[AES256_GCM,data:bc+mb3RSM4rLj6K2l4SrNNrFMg2evfVkNo7yzkgVC2RieJFpryfwf2Hfuq4qlXgI8KXh2eSyKWX3+UBlgZY17dneKP/1kSfVkgaAk46Uly448JHw6Vs94++7FlemLCe8t1EMCTtSfwK/AvKeCoOr1+BdbgDxCA8TBkTEp3Y5djM=,iv:kpBSTE04LLdjryiZD0pGCYjYV3Haitxxc67aamkkpMI=,tag:bJzs4R9vK5AwbdvhX7QZoA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.10.2
--- a/clusters/production/flux-system/gotk-sync.yaml
+++ b/clusters/production/flux-system/gotk-sync.yaml
@ -0,0 +1,29 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+  url: https://github.com/Traceworks2023/nxtgauge-gitops.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/production
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
--- a/clusters/production/kustomization.yaml
+++ b/clusters/production/kustomization.yaml
@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - flux-system/gotk-sync.yaml
  - ../../apps/nxtgauge-backend-rust/overlays/prod
  - ../../apps/nxtgauge-frontend-solid/overlays/prod
  - ../../apps/nxtgauge-admin-solid/overlays/prod