diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..65b05fa --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,4 @@ +creation_rules: + - path_regex: apps/.*\.ya?ml$ + encrypted_regex: ^(data|stringData)$ + age: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l diff --git a/apps/ai-guard/base/secret.yaml b/apps/ai-guard/base/secret.yaml index 59c0402..64c6b1b 100644 --- a/apps/ai-guard/base/secret.yaml +++ b/apps/ai-guard/base/secret.yaml @@ -1,8 +1,23 @@ apiVersion: v1 kind: Secret metadata: - name: ai-guard-secrets - namespace: nxtgauge-ai + name: ai-guard-secrets + namespace: nxtgauge-ai type: Opaque stringData: - ai-service-key: "" + ai-service-key: "" +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjblkzcGRBRWhROVlieEtL + MG51WmF6RThLTHN4K3YwVUxkYTBZek5HdzJNClY0cXFmM3NaY1M4V1ZPQWx1UlZo + bVFibWNlVjRBclRCMUl4MlowYm1ocjQKLS0tIDNoNEgwckZRdEROZmFybUd3NnhU + YTFWcWdUZk90ZWkzVkpWWXhWVzJQbzQK8Qe0Mrz80DruvKEW7sFvTMrhyUIsTK3p + BQtp4WPQZpedJG6RN3Q0hs3d6D2un/wvlq1OFyHOWsheh3sbuYn+Qg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:17:30Z" + mac: ENC[AES256_GCM,data:kCzNtzPNF2jVJoQQO4J28MkcNw0uzTrJaQbCCXxwnkWdO+HFMYCskYwrxxouwuP2Gupt1vHOE8nk+a/oWzKCv5rhuVa6VyyMH9ufK5XPhJbuYMsf2IsuLgHWE95lhJEerezusm6L68rS45i+YCd0/biS7vc0AIxt8NcI2soCcPE=,iv:pacRPzx4+K+dsNxASA1I2oeLZNK3gy0bydDbt58jsjw=,tag:RVnbv1myFiTSifjurd/kyg==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/litellm/OPENCODE_CONNECT.md b/apps/litellm/OPENCODE_CONNECT.md index 55c652c..814fd62 100644 --- a/apps/litellm/OPENCODE_CONNECT.md +++ b/apps/litellm/OPENCODE_CONNECT.md @@ -5,7 +5,7 @@ | Setting | Value | |---------|-------| | **Base URL** | `http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1` | -| **API Key** | `sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9` | +| **API Key** | `` | ## Available Models @@ -18,7 +18,7 @@ ### Option 1: Environment Variables ```bash -export OPENAI_API_KEY="sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" +export OPENAI_API_KEY="" export OPENAI_API_BASE="http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1" export LLM_MODEL="askash-main" ``` @@ -30,7 +30,7 @@ Create `~/.config/opencode/config.json`: ```json { "provider": "openai", - "apiKey": "sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9", + "apiKey": "", "baseUrl": "http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1", "model": "askash-main" } @@ -44,7 +44,7 @@ Create `.opencode` in your project root: { "llm": { "provider": "openai", - "apiKey": "sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9", + "apiKey": "", "baseUrl": "http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1", "model": "askash-main" } @@ -56,11 +56,11 @@ Create `.opencode` in your project root: ```bash # List models curl http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1/models \ - -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" + -H "Authorization: Bearer " # Chat completion curl http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1/chat/completions \ - -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" \ + -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "model": "askash-main", diff --git a/apps/litellm/README.md b/apps/litellm/README.md index 9fb077c..681c79e 100644 --- a/apps/litellm/README.md +++ b/apps/litellm/README.md @@ -10,7 +10,7 @@ LiteLLM is deployed as an API gateway to the internal Ollama service, providing - **Security**: API key required via `LITELLM_MASTER_KEY` ## Master Key -**Production Master Key**: `sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9` +**Production Master Key**: `` ⚠️ **IMPORTANT**: Store this key securely. It grants full access to the LLM API. @@ -42,13 +42,13 @@ All aliases route to the same Ollama model (`gemma3:270m`): ### List Available Models ```bash curl https://llm.nxtgauge.com/v1/models \ - -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" + -H "Authorization: Bearer " ``` ### Test Chat Completion ```bash curl https://llm.nxtgauge.com/v1/chat/completions \ - -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" \ + -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "model": "askash-main", @@ -65,7 +65,7 @@ curl https://llm.nxtgauge.com/v1/chat/completions \ ```bash kubectl run test-curl --rm -i --restart=Never --image=curlimages/curl:latest -- \ http://litellm.nxtgauge-ai.svc.cluster.local:4000/v1/models \ - -H "Authorization: Bearer sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9" + -H "Authorization: Bearer " ``` ## OpenCode Configuration @@ -75,7 +75,7 @@ Create/edit `~/.config/opencode/opencode.json`: ```json { "baseURL": "https://llm.nxtgauge.com/v1", - "apiKey": "sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9", + "apiKey": "", "models": { "default": "askash-main", "available": [ @@ -95,7 +95,7 @@ Create `.env.local` in your Ask Ash project: # LiteLLM Provider Configuration LLM_PROVIDER=openai_compatible OPENAI_BASE_URL=https://llm.nxtgauge.com/v1 -OPENAI_API_KEY=sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9 +OPENAI_API_KEY= LLM_MODEL=askash-main AI_DEBUG=true ``` @@ -109,7 +109,7 @@ providers: - id: openai config: apiBaseUrl: https://llm.nxtgauge.com/v1 - apiKey: sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9 + apiKey: model: askash-main ``` diff --git a/apps/litellm/base/db-secret.yaml b/apps/litellm/base/db-secret.yaml index 16f573a..2d65ac3 100644 --- a/apps/litellm/base/db-secret.yaml +++ b/apps/litellm/base/db-secret.yaml @@ -1,11 +1,26 @@ apiVersion: v1 kind: Secret metadata: - name: litellm-db-credentials - namespace: nxtgauge-ai + name: litellm-db-credentials + namespace: nxtgauge-ai type: Opaque stringData: - DATABASE_URL: "postgresql://litellm:litellm123@postgres.nxtgauge-ai.svc.cluster.local:5432/litellm" - DB_USER: "litellm" - DB_PASSWORD: "litellm123" - DB_NAME: "litellm" + DATABASE_URL: ENC[AES256_GCM,data:pCnOS9l7BlmxL5aDcaaulSgNxQa2M8a7uhVbnQ98k3NFNsJILkVJmALxzsufRsJhlSFAzfGR+3dSSPPrAzBzFzPMWjxOEtmKH4/9lMqRpVKYlQY=,iv:ucMlqs1WvAY7+vK93EC7NIdIOCvYgmFujZJP+VblTEU=,tag:mPm97ID7QXqJHIs+7Bp6Gg==,type:str] + DB_USER: ENC[AES256_GCM,data:DEV7RshBbg==,iv:0C2vDbjSsyyWB2ueOJSIbjflvjZaOMHp7uYcf92A+RQ=,tag:5dypXrRYgbc4yIuT9J3uDQ==,type:str] + DB_PASSWORD: ENC[AES256_GCM,data:/9hbGZMnXxqEMQ==,iv:zGPlktP7ahdY4xbhhQLKw90IwlG0rT15eBIdGmfsLYM=,tag:eazhcIWuhQJYB/ZcwD7RbQ==,type:str] + DB_NAME: ENC[AES256_GCM,data:+ZsZs4tCxg==,iv:BoySPuXGlfzVYQ6Nnco6AduRvtYSfCKSrQ7O+RCS5ew=,tag:xeUcIVRg9hEjKqVmIyd/dw==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQkNZdml4cnM2ZjJTSWRR + V1ptVU5CY0lMdVV4L0tNUXRJVE84ZmczcUhrCnUvdWd1bndqZWUxaUZEQkoyQzBL + NkQ2NDNPVXJVcVcwMHlML2ZxQmsvZ2sKLS0tIG5GNXhCNjhJY1BTczllY2k1aTlo + QTNnZmwwUzlDM0c1VzV6Z0hJclI1TFEKnE1Zl5FdPnO+638Whw77pSqTE0yJFHWY + eA8YPz9z3MfkNEv94aue67zClbW1rx73cc90ASvPUpMm1l4NVb9ivQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:17:30Z" + mac: ENC[AES256_GCM,data:a1WLtxBrW1GHHr1zg58D+pSvAHT/AYqYtXSZBAW8rkyFgU8PslzUCy7Fgs8ImhcQf3ykMGJH7rKDtG3DKqhr+VWHse0P30u3OgxfOoMIeSyWMKtlg9DWsWKpk3Eid/0iNW3XsCF/0PgORIfvEdbUkMSFlWLlXIZ4Qs4fon4YGFM=,iv:z6GbmWObIgnZ9DnHJpSx8SsAD5ukRgmboGdVwb28cMU=,tag:T/mgHx8fvtOaPP9m65ATPg==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/litellm/base/secret.yaml b/apps/litellm/base/secret.yaml index 75cd8ac..98ebefe 100644 --- a/apps/litellm/base/secret.yaml +++ b/apps/litellm/base/secret.yaml @@ -1,10 +1,25 @@ apiVersion: v1 kind: Secret metadata: - name: litellm-secrets - namespace: nxtgauge-ai + name: litellm-secrets + namespace: nxtgauge-ai type: Opaque stringData: - # Master key for LiteLLM API authentication - # Change this to a secure key for production - LITELLM_MASTER_KEY: "PLACEHOLDER-UPDATE-IN-OVERLAY" + #ENC[AES256_GCM,data:TuZS4IVk6g2SXUpQWkoDALAK3ack+ekBGd24mDPJ5L0J4fQpA3zUYjcG,iv:Dox0GMeXJ0QeScAojVw6XRCprf1/YfGBaQYiT4p37eM=,tag:WSKyjkk2WPhVmR2fnxWhFg==,type:comment] + #ENC[AES256_GCM,data:1WnTc8lueif6P56qf53jReLQ2Zwowp+eNPO9zip7LBplvfc+zXrQ1HAF9g==,iv:LIXZlIOxl2VQS8Hc7MNQCh/c+RLFyhv3ppiY9ngYOEY=,tag:ozEMau2Qa6/vxq02lBCtbA==,type:comment] + LITELLM_MASTER_KEY: ENC[AES256_GCM,data:AKcD37IsUX77Fewg8AdklrJ+s88WdeFMMwmxERY=,iv:Sq1YbOQl4Q2A6d2uuB2lKl61qHTwwWf3KrYB8uFE36A=,tag:hjndpCamkXw5SjaSS4QA9Q==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMElxRmFvWkNsc2pLMldG + SnNsaSsza2FpbUlkMG1RZGZJOWhrNmlwRG1vClhRL3phOGlSQmxEVmZWaTNEUFB1 + bFFtemFNbFpMTlQyWVVhWFNLZlZtNTAKLS0tIGlwRjdGTHBtVlZKRkpwTVZaTjY1 + Vmthb3FHR2xjUGRZZGxvci9ybHJ0WDgKIer4ERUBD+go3E19pvdb/zn75PrwVa3n + 2bbLDG0clSu7KuaGdZh5AcNQTbl16sjiQxmxzqYIKib7neQBjDH3Kw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:17:30Z" + mac: ENC[AES256_GCM,data:bCslBTumwUUk/wz0yfrdxRsucx/j4Ij/uO9RVE2b8bgKualJ0KYiN6kfgUpylTW0G67pslU1/eGkOcmG4/eYVmwIAn2m4MZ/ni7/0YZ/DoRQFqujscr2/sWYZi1LEtroj8jTEW+3Nw2g6Z0SobEoN2s+V8MrVgPR1Z7BCnvvE/g=,iv:ZGqA7pqhpwU2jYi8/dslaHtDYvrclc6UWbhHv922wYk=,tag:M1S63XwixHXij7RrHE+JGA==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/litellm/overlays/prod/kustomization.yaml b/apps/litellm/overlays/prod/kustomization.yaml index 990da26..aee740a 100644 --- a/apps/litellm/overlays/prod/kustomization.yaml +++ b/apps/litellm/overlays/prod/kustomization.yaml @@ -6,12 +6,6 @@ namespace: nxtgauge-ai resources: - ../../base -# Use secretGenerator to create production secret -secretGenerator: - - name: litellm-secrets - literals: - - LITELLM_MASTER_KEY=sk-litellm-prod-1c66d63e701c32cd85922a62fd2e087469486a9b7a34d950423a8726d0aceec9 - -# Delete the base secret since we're replacing it -generatorOptions: - disableNameSuffixHash: true +# Overrides the placeholder LITELLM_MASTER_KEY from base/secret.yaml via strategic merge. +patches: + - path: secret.yaml diff --git a/apps/litellm/overlays/prod/secret.yaml b/apps/litellm/overlays/prod/secret.yaml new file mode 100644 index 0000000..63b56d3 --- /dev/null +++ b/apps/litellm/overlays/prod/secret.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Secret +metadata: + name: litellm-secrets + namespace: nxtgauge-ai +type: Opaque +stringData: + LITELLM_MASTER_KEY: ENC[AES256_GCM,data:cY9TuaFw5lS33WupTrWN4MrLtj9eGCZWwKsWjfU6xvLfksb8fZSxBuy3te9iA2scQFpkAaTtHfc0d3BqhfB/f/kQfUZWqpXNI53x4jhQ5cQ=,iv:JDL+6l1LvjdeCPFZ0uRNMxl8bZ2Hma45OnMADHcQImQ=,tag:u+icxo/y18YcRuwHHQzWSQ==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBySEpkalRaaWczNHpDbTI0 + UUlZNWtiZlIxcWs1TDJSUTBuek44YjB5bENrCk5qMThoT2hEa3QvWHVWMGpLWW8w + aGVSTVhrVmNCdzhmZGUvS3Y1UENTRjQKLS0tIHd3aW9MaEpRUFJ0QkUzR2ZHVE1D + ZDNjMEtDUTFYWXA1NkdFNTVia2hQNVkK1yb+LQtESLOo30KWHxpahlV6V0AL7R98 + /lxtOCj50zlknAhPKbQg/TSyvHHqbx0TAiEs6xG0R1OUnqTxI/kKfw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:19:43Z" + mac: ENC[AES256_GCM,data:RsTBxbfUtXZtAQp5KRl7YPbagNopbK2upzIOZLrotDgra2QShwllhTOCGcm0x4F3xz+G/yeOYq8g22/p/D/buy/voIz8Z/r9F06OIblc8fO8HaEibJfI1rRf3a2I+wRAmnltMmtdMyp3YN7y9/uAsbIra4iBkVOjcJ5HCE509ug=,iv:BobfQK4ldBupRf5VPc8Vaki+uaiHB1eEmc/UZ6tsUeo=,tag:CQyHEZ+HfwxpvVIkus9BpA==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/nxtgauge-admin-solid/base/secret.yaml b/apps/nxtgauge-admin-solid/base/secret.yaml index 6915402..53a3aa9 100644 --- a/apps/nxtgauge-admin-solid/base/secret.yaml +++ b/apps/nxtgauge-admin-solid/base/secret.yaml @@ -1,12 +1,27 @@ apiVersion: v1 kind: Secret metadata: - name: nxtgauge-admin-solid-secrets - namespace: nxtgauge + name: nxtgauge-admin-solid-secrets + namespace: nxtgauge type: Opaque stringData: - SMTP_HOST: "smtp.zeptomail.in" - SMTP_PORT: "587" - SMTP_USER: "emailapikey" - SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA==" - SMTP_FROM: "support@nxtgauge.com" + SMTP_HOST: ENC[AES256_GCM,data:6IGeRaJzzQ3fkX4jVVZ36mg=,iv:8H4BAFFoMd190M4q/85bEffL6yzdBaDjreF/X0xz2aU=,tag:nX+MUmTMYYK1rByglsMjUw==,type:str] + SMTP_PORT: ENC[AES256_GCM,data:s4aS,iv:e5ySOAp00lv8JKYA7+FZgl4naWyoHxBIfnySELQGPdo=,tag:Ofg0gkNGPEG77lOVWvbgmw==,type:str] + SMTP_USER: ENC[AES256_GCM,data:ijOeJ+2xZw0ire4=,iv:jP//72BqKjlYzreXG8oQVgeH0BHT3dxBaXpzKgBBYZ4=,tag:Sue0Eje/HbARTncl3V/UEg==,type:str] + SMTP_PASS: ENC[AES256_GCM,data:uGJFVFarFTVJFfvhdQYiQB+/4jPigE7xNNgYenJt4jpuF8UhMOuM3zuvZ+1x0QlMdYG/Og5SgC/RuHMhrbrNS3YbbJaC2eZjTurH2xyvY6iLLdLQHmcdGR7sCFsyoQ6IZybUrcd+DTCy1safsJm0Mh0fhZEBPq1qWsMZUolswsLj7TFsiXHDiG+ZU/AKHCn1,iv:LY38BvW3CrIfLhflq04X+bCgR4AP8c+VzW3Alpl7zFk=,tag:YIcGD3QViiGcGSAqk0HeyQ==,type:str] + SMTP_FROM: ENC[AES256_GCM,data:bfZgeNSLquqOhtCRlOXPesI8K9o=,iv:n9ApxTDgCG8zWZwEievDPzOGMIIxlFhV2CaL0FHs0mU=,tag:nrk5coQvWgZgslEnSmXQJw==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUDRidXo3VHJWT2N3Y2Zz + eW1oMXJEb3FPNm1mOHVXOG1HWnRHSHB5UFQ4Ck4rSkc4ZXhyTEtCbWI4YkpKS1Vv + SUt4eG0rWHJUN2hyc2RaQ1VLUzJYQUUKLS0tIEkrSUFVQU1ubk9iRTQxWW9RclF6 + VEdhdGdLV0U2c09idHNySVRWd2s2OTAKD2X/8Elyrl1X99JRwKZXe8nQvz92UuvU + fnlqzdjCWaHyd4Ib9t8WjLw5Hm+qLluZpci7UqJaQX9OAN2+HGC8Sg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:17:30Z" + mac: ENC[AES256_GCM,data:OsdePD6gejqfmJck8JCkoRx2iztrQQ2GQQ99jXNYfnRIe0Mx8BHH4fpUQRT853Wr2tjQq0V9Vl8B0uQC05aCnBIhpOExg7Oyq+fm0FC0PmzkcyNsZjspIoux3UqsXh6aXfjaeL9/szCsdwlXplaMWdisibTgQYwt86zEieOPDFE=,iv:x0mEf7r50m089Vnn2VVfyCHBWwuhXce25deJ+TJOnBo=,tag:YocuQO6IzgcKfVrNbSbT7A==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/nxtgauge-ai-assistant/base/deployment.yaml b/apps/nxtgauge-ai-assistant/base/deployment.yaml index 604dd53..e23761b 100644 --- a/apps/nxtgauge-ai-assistant/base/deployment.yaml +++ b/apps/nxtgauge-ai-assistant/base/deployment.yaml @@ -41,6 +41,11 @@ spec: secretKeyRef: name: nxtgauge-ai-assistant-secrets key: ai-service-key + - name: JWT_SECRET + valueFrom: + secretKeyRef: + name: nxtgauge-backend-rust-secrets + key: JWT_SECRET resources: requests: cpu: 100m diff --git a/apps/nxtgauge-ai-assistant/base/secret.yaml b/apps/nxtgauge-ai-assistant/base/secret.yaml index 62db0db..2b7aa18 100644 --- a/apps/nxtgauge-ai-assistant/base/secret.yaml +++ b/apps/nxtgauge-ai-assistant/base/secret.yaml @@ -1,10 +1,24 @@ apiVersion: v1 kind: Secret metadata: - name: nxtgauge-ai-assistant-secrets - namespace: nxtgauge + name: nxtgauge-ai-assistant-secrets + namespace: nxtgauge type: Opaque stringData: - # TODO: set to the shared key expected by callers of the AI assistant. - ai-service-key: "" - + #ENC[AES256_GCM,data:DzWkRm3f8tFc02M5GVMtvWxLscWMt/AsTW7U0+KenEDguLPOGZjSqTflKwlP11V7v7p3bCkvpmKFvRq3B8Qi0g3zzp0Q,iv:TA8ADbjVM5gw8zc6Synn/Ue6BT8k/PUtyvoNrXEgzd4=,tag:rhFeomxaYhX+pWmKjYW3fQ==,type:comment] + ai-service-key: ENC[AES256_GCM,data:FjKo1h5loCYoXDOC4g37tLTbLU7lE+DewxMkUCXBO5op0tJByaXmBYy5ZZEDpplZxDsEPd4QiKoUg8bM9+2OSA==,iv:I//s3r9wSQujgtXPeFT1IArzu2LbObsFz7d8E0GN6iU=,tag:PkLaujtLklCWHQYGIB9uvQ==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQWU2UU13Z3dFcFFqeU9J + NThoMVE4UW5jeHFQaE9tY0p2aGliU3EyMVZrCng4RGhGbDVYM1M5WFdZZ3M5Tk1S + NldkdXRSS2dqckpvNUo5d1hqYUZLWE0KLS0tIGUzV2pqbW5ScEllbVBDeG1KNFJB + ckFFMndObTNzaFpyUVU5OTZOTUNiQXcKDPo+nnHRjPlswzW1WHQEde8Ae/icAsxH + +aq9NUpDQ8FTCdIu0rtqVS1VaEyt1kXgBmrjHIJCIVVvFzTKfuXLGA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:18:28Z" + mac: ENC[AES256_GCM,data:DgCzaIaaDP4Q5lhOLkBmy1z0+kJ0CFBCGVal3WKiNpo8H9aEfArGsbvA4zleZphtzVP/R8GhegjUdkVXT+wZo30Py/4FLFuRxtiiUohxHCfaiqD/13KHKO6nEJPN3wV9Ab59x+PlWk8roDGuPggupUs7v4VdHKqk+qQwsaTuhiY=,iv:KdSKauwmArBWm817lFrYB7F7axx3TvKXBbbqOI0NOSg=,tag:dCi+4OgbyZKiXUZCR/I7ew==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-secret.yaml b/apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-secret.yaml index 57fa46b..9102271 100644 --- a/apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-secret.yaml +++ b/apps/nxtgauge-backend-rust/base/openobserve-endpoint-monitor-secret.yaml @@ -1,11 +1,26 @@ apiVersion: v1 kind: Secret metadata: - name: nxtgauge-openobserve-endpoint-monitor-secret - namespace: nxtgauge + name: nxtgauge-openobserve-endpoint-monitor-secret + namespace: nxtgauge type: Opaque stringData: - OO_ENDPOINT: "http://o2-openobserve-standalone.openobserve.svc.cluster.local:5080" - OO_ORG: "default" - OO_STREAM: "nxtgauge_endpoints" - OO_AUTH_HEADER: "Basic cm9vdEBleGFtcGxlLmNvbTpDb21wbGV4cGFzcyMxMjM=" + OO_ENDPOINT: ENC[AES256_GCM,data:AS2JCqQO8nKWY5CxK4K8RnfTShgmcETKBU6bo5KYhGX29HZ9S0svPgr7N8f2n2ukP79yxNJhRgoj1g5IHylrcOWHkg==,iv:rCXp7P/KD3OjNey2R4C1mIV1mwJloXY1b3cidQZDsq4=,tag:w1yHshbQAo97IJotL9N40Q==,type:str] + OO_ORG: ENC[AES256_GCM,data:Wr0KPRa6kA==,iv:+vF9x/yTmqsg6vK5cHucLURktlcY0qP/NpoFnF0YuKI=,tag:n0vpNEoNzeVKzCJ44IBXGQ==,type:str] + OO_STREAM: ENC[AES256_GCM,data:ihLyiAbqfZtDstT6aFrh9QUg,iv:V4PkyKL9PSD2k7o+Od7t7q4g3o38mqbPPxZ87YGQAvY=,tag:m3AAVpaI6WwSSkw86pEsUw==,type:str] + OO_AUTH_HEADER: ENC[AES256_GCM,data:VY7qW13SLjUVMb21dsUpKpMZU00QSGAI1oCJHfTC8wxatuw0js4+fwyfLhJk/5ejBV8=,iv:62O+daUXn6OoJ0xiZ6iNTYAOVEI/2phGm4EYsUG/ENc=,tag:/5LXx1a/tG442LPuJCwYnQ==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvWjByejZNaUo0TmVRWnpY + WUpHS3hNeUZ5VnNGNjZ0RXZXZmd3QVdjV1dvCnArSktlaGp0Y0RuUzJTMThsZzhE + aXBQZGRkZDRQM01HOThnamJwY2JGbWsKLS0tIG84ODMybWc5cVZ6TGRLQTRGOU4x + Zm5aZHpmQVU0djB2RkxiOERVRStrclUKgd9O6ldUlge0Kop14t4jUVidQIRfmLzg + +Ci3LgedKLE1Lxbwg9JbTpA9YkVucnLuHPbUYZrud91jn1jnkw6plg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:17:30Z" + mac: ENC[AES256_GCM,data:vAHLnc8tTNxmMnZs66H2MPxjvVpdquV8VYFD9DvWE/cIEEcZLrXtF6F5Nrcn5CSOurWKJoSQKV+s8DZQvuocc5cS5i8QvxSNyj1pcK+JzTUdMoDFY/xwqvVS3tIQn29Cocx2TEU+XUYB0zTVKRYGZjaQEgRquXZmGXCPaPzZvso=,iv:qkieUNf/khdlOArHPFo96x864XufRO8z9xA9HQzTt08=,tag:4PiiRm5F/hicDrTX9PigsQ==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/nxtgauge-backend-rust/base/secret.yaml b/apps/nxtgauge-backend-rust/base/secret.yaml index 0d8b99f..aa96161 100644 --- a/apps/nxtgauge-backend-rust/base/secret.yaml +++ b/apps/nxtgauge-backend-rust/base/secret.yaml @@ -1,23 +1,39 @@ apiVersion: v1 kind: Secret metadata: - name: nxtgauge-backend-rust-secrets - namespace: nxtgauge + name: nxtgauge-backend-rust-secrets + namespace: nxtgauge type: Opaque stringData: - DATABASE_URL: "postgresql://postgres:chandan2026%401@pg-postgresql.data.svc.cluster.local:5432/nxtgauge" - JWT_SECRET: "bPU0RQ/N7JW8CDCioe6AFBw/lBLTm++pGtta20pcsTX36p3OyheplgUyiD66OCuV" - # Password contains '@', so it must be URL-encoded as %40. - REDIS_URL: "redis://:chandan2026%401@redis-master.data.svc.cluster.local:6379" - SMTP_HOST: "smtp.zeptomail.in" - SMTP_PORT: "587" - SMTP_USER: "emailapikey" - SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA==" - SMTP_FROM_NAME: "NXTGAUGE" - SMTP_FROM_EMAIL: "support@nxtgauge.com" - SMTP_SECURE: "false" - B2_BUCKET_NAME: "Nxtgauge-object" - B2_REGION: "eu-central-003" - B2_ENDPOINT: "s3.eu-central-003.backblazeb2.com" - B2_ACCESS_KEY_ID: "dc99dfa1435d" - B2_SECRET_ACCESS_KEY: "003fa963ca8ab98716d5ccbe0c591459392a2f1920" + DATABASE_URL: ENC[AES256_GCM,data:7HYKVZc0cTBfkJq6bs6VvW0Xmzdgd4mL2UD2yOhksG2UTObcKZrKlAy1y7gTYPY23Vy0ttLKRmTnssllj5111vyvpsCLyeWWElzUl2B457QjLbjRxEAELA==,iv:EG26SgvpbVLqs7Okz14ylouGXyLf2/L81GGQyJ6NYyk=,tag:B8aLIhSR5G+n6rvyPZmqew==,type:str] + JWT_SECRET: ENC[AES256_GCM,data:/SbAXJE3u6kJJfL3Go2JoRwmZt8P0MGV7gYtcpYzE4TSjpLqcVB4PpclrzkxzUt4N8omnOXepousmqSFx0fFiQ==,iv:/+q2UFxNYlagHMynYr1cNWY/MUPek3iVj88Ml3pSSe4=,tag:zNqpr3ZfLGFmqLZVDp14tg==,type:str] + #ENC[AES256_GCM,data:NwWD9qcBt10NLznH1CtFS7jHkMrAECU50KRfBXYfa5ps0RwcNtlGEK5LhxmhNF7Hj+8wN3vRQm31,iv:H6VG1AluCHNINR43oLOfaRXm8N7NhGHGbHp8AZhxO74=,tag:yVGvSzFGkmImKD0+9+vfvQ==,type:comment] + REDIS_URL: ENC[AES256_GCM,data:6tZP6nOStdx2hcfFijRiMoar8OWc9gn8LGsTussYoxOu72E9OMVNjMrUJZgv7Ku1+uKAb3M4JH0BGYHSuWqS7mQ=,iv:rShXcm8ZFpP0jvZm/y85eZwXXpWTEZAVnOQVl9siaz8=,tag:47JLNmt0tIuR7toI+zaoNA==,type:str] + SMTP_HOST: ENC[AES256_GCM,data:UrDtzbTtJrIpmsZyU+7I8Fs=,iv:Q2NhRYNEmkeS162BM+ro7KLIv3ybm7Eb3LAd1huOBCI=,tag:OqrIXU4JMWErWzDEoWbEKA==,type:str] + SMTP_PORT: ENC[AES256_GCM,data:SyZ7,iv:IdH6laFQKD0ldeb/jgC+RC/zWX2pfYIo8l6I+a4CmA4=,tag:QIMt0DTq/UrE9+R27kx0Kg==,type:str] + SMTP_USER: ENC[AES256_GCM,data:Kx2A9tjXOWuta/Q=,iv:y4YGN0Tg+94Tpc1BG9vSp4Z77kkOREraXfggkJ4umYs=,tag:DiuETUlGzAHYuq6dRMzNlQ==,type:str] + SMTP_PASS: ENC[AES256_GCM,data:z96REIjbLfwA6Sh1bRBgD1xobNjwLJPecr9OilI9c+ROQD/gzpfaOc/0mmDSN2kYJpyuIY5BGMzDSwtP+hesQzQ/a6MNrelh08JAY96CZnaqbXhzZCjTbHmB/DoSnC3UDoChjoNL6F7Q4L5I1gRVkwGtuyEfTCiKwHEYLrY94iKsuWso86Tga+B8DfhMnAvI,iv:+oF81kyGLzM8Yspb7HOdOI2UDtYpDiqmalw+4f8W2F4=,tag:kG9g9wMx4JCEc650kyZO8A==,type:str] + SMTP_FROM_NAME: ENC[AES256_GCM,data:xTByiZiSRjk=,iv:gqkEHwOJkfFHdzNBK5Hx9s65YZZsNS8OtOfcAQYsOkE=,tag:+7QHKYjOQaFiOWMMzO0A1g==,type:str] + SMTP_FROM_EMAIL: ENC[AES256_GCM,data:hvP00nyhduBnWP9tS6suYtde9S4=,iv:EnP+eSSqfkeddKjlp6VlpZwFH8XZcBjk4XAg8omoJMA=,tag:xwM54O2iY0/3HrliIC87Mg==,type:str] + SMTP_SECURE: ENC[AES256_GCM,data:6mW7rpQ=,iv:9ONifzX5N1YyfWvFTNMJiGKyV25auoiKXFVWd45gDxQ=,tag:UCOpQczeDGDgJ326tFwEtw==,type:str] + B2_BUCKET_NAME: ENC[AES256_GCM,data:L+sRHOxaeicvmSGcyNDR,iv:UMbs+CkgygKm6FhmHA0fyFflUnqAypV5ZQZOQSRqQhc=,tag:d8F6YQGp+Y+EPx91mgjoBA==,type:str] + B2_REGION: ENC[AES256_GCM,data:luhXJET9s1pePd35RMY=,iv:0pe4qXPmr20MbF/LIg1v2fgTwHQRQrDmVI5NfuSe+TM=,tag:L1C1jGcNiqOOSRoJi5xWxQ==,type:str] + B2_ENDPOINT: ENC[AES256_GCM,data:gS8Mfhi9js8/V7VyzZxd1L1wTFz4Qj8+OYRd1gAm24qz,iv:NJL0FO6QY/eXsmZOi0hdJ2U24U3rdfCQ2hDSJhbx9aI=,tag:uwxHGolwss36llXWvCIvMw==,type:str] + B2_ACCESS_KEY_ID: ENC[AES256_GCM,data:ObKiwVZkQkNHGYyh,iv:NAWXJswVzHuhO9uku9S5ZFFYsduY0sQbSZRUuT3VK3w=,tag:WW3XuhT//8enUeq7m7YGpg==,type:str] + B2_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Y7m2PSALvibcwjWKf2aXCEuhJF+mlPwnVwNobXJJuZrGFgdPRUQ7WZbC,iv:EqXkCZ5/LP7riXRkZ+TnssYuPjyBQVVuPqBxLcQfAZc=,tag:EtF6dH/tK4Am7YyfEygGnw==,type:str] + AI_SERVICE_KEY: ENC[AES256_GCM,data:ivhSxI1Rvh/5nfe+1R5GFjCbZIzk2Tm58Fi3PpayPWASQR/KNj74kM6MIXg6MtSgJ4ZDKIJ9ZJOGdYPyacRV9A==,iv:KKMfdJGKReYsVGf55Hs3tyInQ761AJ5bhaUfqPY5fpM=,tag:jGmhwI6xxqM5U4oX5Ork6g==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1VmtFRTFKQmd6dzF6L1R6 + MytrL2pNZ2hmQmVVVmZXbHA5Ri9SVC83QndnCmFVQkVpdTA4WHZnMzFCa1pRc3p1 + akxJMEtRQkZpSmVvWFhmc1IxeDhiUGMKLS0tIDcyamQrU2dZSHU3UG5aMnRZdmdW + WFk2VkFuaVIxU21wOXlNZy9wL2hPWFkKIs9G/0ah7ng9BqLd3pAQE4wPEhCz601p + fcHXdDkFdNlAwZK5cp1pV4FtZnudl71lRIWEUzb7vXubeaGExQDuFw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:18:16Z" + mac: ENC[AES256_GCM,data:qCLwVgBKIESDCtitUuXXYs6u2hMrjdSa79RhXHwIF5nuUySgYYdKnOyqEVA2VfqCTaUObImH9HFYitwbxQU586d+TAHkIc0VEdYauPRq9bQinxWCjeMcrjw3+maPaGWadlvCItzPos8MC4Vj7JSPzg5YvEhDDj3lmu0ESxP2y/s=,iv:0N27Fk8CFO9K8N94So6WAfFvouTAZllS6ssJ4x6d/uM=,tag:PAlL8p64/TlfdCrha9PVtg==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/apps/nxtgauge-frontend-solid/base/secret.yaml b/apps/nxtgauge-frontend-solid/base/secret.yaml index 4c513cc..e9ae61c 100644 --- a/apps/nxtgauge-frontend-solid/base/secret.yaml +++ b/apps/nxtgauge-frontend-solid/base/secret.yaml @@ -1,12 +1,27 @@ apiVersion: v1 kind: Secret metadata: - name: nxtgauge-frontend-solid-secrets - namespace: nxtgauge + name: nxtgauge-frontend-solid-secrets + namespace: nxtgauge type: Opaque stringData: - SMTP_HOST: "smtp.zeptomail.in" - SMTP_PORT: "587" - SMTP_USER: "emailapikey" - SMTP_PASS: "PHtE6r1ZR+zi3jV88RNW4/O4F8CkPdksqO9iJAhA4YcTD6dQFk1S+dl/wDC3/h97AKYWFfSczo1rt72etOuDLTnrMjlEDWqyqK3sx/VYSPOZsbq6x00esVgYdEfYVYDpcNFj3SPQut7dNA==" - SMTP_FROM: "support@nxtgauge.com" + SMTP_HOST: ENC[AES256_GCM,data:ZyymsH6KNKIC9DMftVRKtyY=,iv:8l7Ue6qlUTyJqlSqyfFHwCpM4gkgaaucVX2Q6izaYN4=,tag:SC7NAtA9/er24PLnGV0oOQ==,type:str] + SMTP_PORT: ENC[AES256_GCM,data:+23C,iv:LZOuM1GiI1unVINYvBkH8c6LF0vBNDSrEQSjz3EXK2Y=,tag:ZjyJ4lZ3PgPGxRuOFFkT/A==,type:str] + SMTP_USER: ENC[AES256_GCM,data:ehnFRXh1w2SWCoo=,iv:s3w/Xgms8kNKF9PImHx5JpM0uvM7FC35jl9sCVmrek8=,tag:RagZTnqLwC06+MwK2Av0Rw==,type:str] + SMTP_PASS: ENC[AES256_GCM,data:LOMzp/mGddcwiJLfSB69fIn0mQvJVs14WjF/MNtO0qgW6LDX0erhsCtwPCoE73WUCiLKOKL0CwZPdZqxfAK9OE+edSF1CqnQdhOjuYtR4wElD1yj54t1/5wHRTFRTUXkPO/gnqKT3jWez3pxEc6rWpsLT2ZIwEWSP0E9SIKZW10K27G8+vNosuYrDc0yTmc9,iv:zrV5+/pHMjult/2kLDHZr3EuGyF5uFu3TrCvvms+2fA=,tag:g25HmbNv2Q7s/pXV/namCQ==,type:str] + SMTP_FROM: ENC[AES256_GCM,data:+R7du3/Bb2tE17FE9aJh8Y1NPa8=,iv:PjTsr/Nj1caWjxENmFMctjjxA995Fr1NWeYo7SC1PwY=,tag:NkqJxcJHUoWKqqkQcp9xQQ==,type:str] +sops: + age: + - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvKyt1WFZjUWxNY3BDdGZG + cnVnczgvVmFmYnIvK0M1OGptOE1tYUIrTUh3CnVPb0xMdnZPR2YwenpjK3h0QTZK + NEdQRFRjUXRPdHVZdDJZenF0NG9CWlEKLS0tIDZzNElsYm9RMTNZZS8xVnJhSCsx + NFgvM1VtUUJ0emVYandXcUJFRTRDdVEKoRum9CpLygcum+VUz4Ur79KeX+BxqDO/ + f7oSAzdLYgLPyc867Fg8vKBQDUfZsARHudDtIhL2t+YFp2FHFZ9M6g== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-02T12:17:30Z" + mac: ENC[AES256_GCM,data:bc+mb3RSM4rLj6K2l4SrNNrFMg2evfVkNo7yzkgVC2RieJFpryfwf2Hfuq4qlXgI8KXh2eSyKWX3+UBlgZY17dneKP/1kSfVkgaAk46Uly448JHw6Vs94++7FlemLCe8t1EMCTtSfwK/AvKeCoOr1+BdbgDxCA8TBkTEp3Y5djM=,iv:kpBSTE04LLdjryiZD0pGCYjYV3Haitxxc67aamkkpMI=,tag:bJzs4R9vK5AwbdvhX7QZoA==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.10.2 diff --git a/clusters/production/flux-system/gotk-sync.yaml b/clusters/production/flux-system/gotk-sync.yaml new file mode 100644 index 0000000..decc6df --- /dev/null +++ b/clusters/production/flux-system/gotk-sync.yaml @@ -0,0 +1,29 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 10m0s + ref: + branch: main + secretRef: + name: flux-system + url: https://github.com/Traceworks2023/nxtgauge-gitops.git +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 10m0s + path: ./clusters/production + prune: true + sourceRef: + kind: GitRepository + name: flux-system + decryption: + provider: sops + secretRef: + name: sops-age diff --git a/clusters/production/kustomization.yaml b/clusters/production/kustomization.yaml index abbdbfb..0afafc4 100644 --- a/clusters/production/kustomization.yaml +++ b/clusters/production/kustomization.yaml @@ -1,6 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - flux-system/gotk-sync.yaml - ../../apps/nxtgauge-backend-rust/overlays/prod - ../../apps/nxtgauge-frontend-solid/overlays/prod - ../../apps/nxtgauge-admin-solid/overlays/prod