The previous B2_ACCESS_KEY_ID used the account's master-key ID (a raw
12-char account ID), which the B2 S3-compatible endpoint rejects with
403 InvalidAccessKeyId ("Malformed Access Key Id") even though it
authenticates fine against B2's native API. This was the root cause of
document uploads failing with a 500. Replaced with a properly scoped
Application Key generated for the Nxtgauge-object bucket, verified
against the live S3 endpoint (put/get/delete all succeed).
Wires the PayU credentials for the classic hosted-checkout hash flow
(PAYU_MERCHANT_KEY, PAYU_SALT), consumed by the payments service's
resolve_payu_config fallback and the admin payment-gateway config API.
Old password was reused across the postgres superuser, Redis, and
Forgejo's separate nxtgauge DB role. Rotated only the postgres role
and Redis (Forgejo's nxtgauge role password is untouched and still
valid, verified against the live DB).
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/
- Commit the Flux GitRepository/Kustomization (previously only applied manually)
with a decryption stanza referencing the sops-age key (created out-of-band,
not committed)
- Rotate JWT_SECRET (previously exposed in plaintext) and set a real
AI_SERVICE_KEY (was an empty placeholder), shared between
nxtgauge-backend-rust and nxtgauge-ai-assistant
- Wire JWT_SECRET into the ai-assistant deployment (was missing entirely,
causing every authenticated request to fail)
- Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT
docs; move the litellm prod overlay off a plaintext secretGenerator onto an
encrypted patch
Adds Kustomize base+prod overlays for nxtgauge-frontend-solid,
nxtgauge-admin-solid, and nxtgauge-backend-rust (18 services).
ArgoCD Image Updater configured for auto-deploy on high-performance-latest tag.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
