nxtgauge-gitops/.sops.yaml at main - ashwin/nxtgauge-gitops - Forgejo: Beyond coding. We Forge.

ashwin/nxtgauge-gitops

Ashwin Kumar Sivakumar b4f371d415 Encrypt all secrets with SOPS, add Flux decryption support, rotate JWT_SECRET/AI_SERVICE_KEY

- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/
- Commit the Flux GitRepository/Kustomization (previously only applied manually)
  with a decryption stanza referencing the sops-age key (created out-of-band,
  not committed)
- Rotate JWT_SECRET (previously exposed in plaintext) and set a real
  AI_SERVICE_KEY (was an empty placeholder), shared between
  nxtgauge-backend-rust and nxtgauge-ai-assistant
- Wire JWT_SECRET into the ai-assistant deployment (was missing entirely,
  causing every authenticated request to fail)
- Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT
  docs; move the litellm prod overlay off a plaintext secretGenerator onto an
  encrypted patch

2026-07-02 17:56:28 +05:30

4 lines

161 B

YAML

Raw Permalink Blame History

 creation_rules:
   - path_regex: apps/.*\.ya?ml$
     encrypted_regex: ^(data|stringData)$
     age: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l