From c559feea1862aa42071c69f538209383a11d41f0 Mon Sep 17 00:00:00 2001 From: sync-test Date: Sun, 26 Jul 2026 22:59:51 +0530 Subject: [PATCH] chore: rotate B2 storage credentials to scoped application key The previous B2_ACCESS_KEY_ID used the account's master-key ID (a raw 12-char account ID), which the B2 S3-compatible endpoint rejects with 403 InvalidAccessKeyId ("Malformed Access Key Id") even though it authenticates fine against B2's native API. This was the root cause of document uploads failing with a 500. Replaced with a properly scoped Application Key generated for the Nxtgauge-object bucket, verified against the live S3 endpoint (put/get/delete all succeed). --- apps/nxtgauge-backend-rust/base/secret.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/nxtgauge-backend-rust/base/secret.yaml b/apps/nxtgauge-backend-rust/base/secret.yaml index f7b1c1b..bae8979 100644 --- a/apps/nxtgauge-backend-rust/base/secret.yaml +++ b/apps/nxtgauge-backend-rust/base/secret.yaml @@ -19,8 +19,8 @@ stringData: B2_BUCKET_NAME: ENC[AES256_GCM,data:L+sRHOxaeicvmSGcyNDR,iv:UMbs+CkgygKm6FhmHA0fyFflUnqAypV5ZQZOQSRqQhc=,tag:d8F6YQGp+Y+EPx91mgjoBA==,type:str] B2_REGION: ENC[AES256_GCM,data:luhXJET9s1pePd35RMY=,iv:0pe4qXPmr20MbF/LIg1v2fgTwHQRQrDmVI5NfuSe+TM=,tag:L1C1jGcNiqOOSRoJi5xWxQ==,type:str] B2_ENDPOINT: ENC[AES256_GCM,data:gS8Mfhi9js8/V7VyzZxd1L1wTFz4Qj8+OYRd1gAm24qz,iv:NJL0FO6QY/eXsmZOi0hdJ2U24U3rdfCQ2hDSJhbx9aI=,tag:uwxHGolwss36llXWvCIvMw==,type:str] - B2_ACCESS_KEY_ID: ENC[AES256_GCM,data:ObKiwVZkQkNHGYyh,iv:NAWXJswVzHuhO9uku9S5ZFFYsduY0sQbSZRUuT3VK3w=,tag:WW3XuhT//8enUeq7m7YGpg==,type:str] - B2_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Y7m2PSALvibcwjWKf2aXCEuhJF+mlPwnVwNobXJJuZrGFgdPRUQ7WZbC,iv:EqXkCZ5/LP7riXRkZ+TnssYuPjyBQVVuPqBxLcQfAZc=,tag:EtF6dH/tK4Am7YyfEygGnw==,type:str] + B2_ACCESS_KEY_ID: ENC[AES256_GCM,data:igIgrTUQOv4k7WlOA8C5ieb/IBnA3jEmxw==,iv:17jBEpfKpk8CH3UfBQH4klrI5h5CroB3ok5yi/kpmKk=,tag:AArkjTemJHXQL24cA5GIZg==,type:str] + B2_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:xjjtDOV5CH+VMegjaRxofoSch8TpGXI2u9wR80Wl/Q==,iv:VHCUeZMQMjub5o/74e+dd3Src/T3GDs55N7w3xy5JA8=,tag:xGzvtDJJOhLeANp9dDqX3w==,type:str] AI_SERVICE_KEY: ENC[AES256_GCM,data:ivhSxI1Rvh/5nfe+1R5GFjCbZIzk2Tm58Fi3PpayPWASQR/KNj74kM6MIXg6MtSgJ4ZDKIJ9ZJOGdYPyacRV9A==,iv:KKMfdJGKReYsVGf55Hs3tyInQ761AJ5bhaUfqPY5fpM=,tag:jGmhwI6xxqM5U4oX5Ork6g==,type:str] PAYU_MERCHANT_KEY: ENC[AES256_GCM,data:EFqfCnQ1SnyCF60IWLFiRwN+zltPQAGiQ53tpwHQ1f9ikzLEJ++CIh8NEzRD5xz8LbfLnGQ7yj9X3tYwbXUPiQ==,iv:sRbzqQyXd0wJDSHPDkilyBP2BHzcA8YZoaQaBa4kWDU=,tag:FH9AV+zayS8PglligeeFMg==,type:str] PAYU_SALT: ENC[AES256_GCM,data:MydVCaI5,iv:l8aq0pirxcnLYRm0M0yvpmE/lx5r6c9UlrgXvWp2MQM=,tag:WUC1M/2cla0u9tXUMKhZUw==,type:str] @@ -35,7 +35,7 @@ sops: WFk2VkFuaVIxU21wOXlNZy9wL2hPWFkKIs9G/0ah7ng9BqLd3pAQE4wPEhCz601p fcHXdDkFdNlAwZK5cp1pV4FtZnudl71lRIWEUzb7vXubeaGExQDuFw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-07-02T13:00:10Z" - mac: ENC[AES256_GCM,data:EmRuLGV7IfCkFpTgEqdvOzlbS+qihAZCLyEIRrvLSXS7Or32OXshjUFNXxeFYJMXazwQ1wTDVRqhqqjToDUGntSzMaLZDukVBJVXSdYF5/p/dptBydajTlfq5SC8PIIW6JuoH+bmnFkHLG8yZpAups+BGDLroSSmOgxxcN/Yx7c=,iv:RdQOIeLoCmPJyYJOK2IIAU9YDDSSHslxZmEd5orxc28=,tag:9UIJFUyJDGlgtgz6cMjpeQ==,type:str] + lastmodified: "2026-07-26T17:29:17Z" + mac: ENC[AES256_GCM,data:NayJKUb4FRTn+8WI7QGdmd6iqElfpLtWvWTN1SGRfGkK+VQeNMjxgs8kbwpaaLlqfaRETZXvATF1T3r5g4B2u95w7c/hAHILAgy1lhhobnH0JwPkjYRMIEQzP/hikUgW4HoDp/eJL1o7k5MH8IGWj521MU74B2isuCnDhbRdcUw=,iv:5pbmOEckMERW5U3t4EtCrQDHAVY2Fjq8AyhQremHI8I=,tag:Bmtt1OaeBC8SCQ8fMvcbJA==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.10.2