b4f371d415
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
25 lines
1.6 KiB
YAML
25 lines
1.6 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: litellm-secrets
|
|
namespace: nxtgauge-ai
|
|
type: Opaque
|
|
stringData:
|
|
#ENC[AES256_GCM,data:TuZS4IVk6g2SXUpQWkoDALAK3ack+ekBGd24mDPJ5L0J4fQpA3zUYjcG,iv:Dox0GMeXJ0QeScAojVw6XRCprf1/YfGBaQYiT4p37eM=,tag:WSKyjkk2WPhVmR2fnxWhFg==,type:comment]
|
|
#ENC[AES256_GCM,data:1WnTc8lueif6P56qf53jReLQ2Zwowp+eNPO9zip7LBplvfc+zXrQ1HAF9g==,iv:LIXZlIOxl2VQS8Hc7MNQCh/c+RLFyhv3ppiY9ngYOEY=,tag:ozEMau2Qa6/vxq02lBCtbA==,type:comment]
|
|
LITELLM_MASTER_KEY: ENC[AES256_GCM,data:AKcD37IsUX77Fewg8AdklrJ+s88WdeFMMwmxERY=,iv:Sq1YbOQl4Q2A6d2uuB2lKl61qHTwwWf3KrYB8uFE36A=,tag:hjndpCamkXw5SjaSS4QA9Q==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrMElxRmFvWkNsc2pLMldG
|
|
SnNsaSsza2FpbUlkMG1RZGZJOWhrNmlwRG1vClhRL3phOGlSQmxEVmZWaTNEUFB1
|
|
bFFtemFNbFpMTlQyWVVhWFNLZlZtNTAKLS0tIGlwRjdGTHBtVlZKRkpwTVZaTjY1
|
|
Vmthb3FHR2xjUGRZZGxvci9ybHJ0WDgKIer4ERUBD+go3E19pvdb/zn75PrwVa3n
|
|
2bbLDG0clSu7KuaGdZh5AcNQTbl16sjiQxmxzqYIKib7neQBjDH3Kw==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-02T12:17:30Z"
|
|
mac: ENC[AES256_GCM,data:bCslBTumwUUk/wz0yfrdxRsucx/j4Ij/uO9RVE2b8bgKualJ0KYiN6kfgUpylTW0G67pslU1/eGkOcmG4/eYVmwIAn2m4MZ/ni7/0YZ/DoRQFqujscr2/sWYZi1LEtroj8jTEW+3Nw2g6Z0SobEoN2s+V8MrVgPR1Z7BCnvvE/g=,iv:ZGqA7pqhpwU2jYi8/dslaHtDYvrclc6UWbhHv922wYk=,tag:M1S63XwixHXij7RrHE+JGA==,type:str]
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.10.2
|