b4f371d415
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
26 lines
1.7 KiB
YAML
26 lines
1.7 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: litellm-db-credentials
|
|
namespace: nxtgauge-ai
|
|
type: Opaque
|
|
stringData:
|
|
DATABASE_URL: ENC[AES256_GCM,data:pCnOS9l7BlmxL5aDcaaulSgNxQa2M8a7uhVbnQ98k3NFNsJILkVJmALxzsufRsJhlSFAzfGR+3dSSPPrAzBzFzPMWjxOEtmKH4/9lMqRpVKYlQY=,iv:ucMlqs1WvAY7+vK93EC7NIdIOCvYgmFujZJP+VblTEU=,tag:mPm97ID7QXqJHIs+7Bp6Gg==,type:str]
|
|
DB_USER: ENC[AES256_GCM,data:DEV7RshBbg==,iv:0C2vDbjSsyyWB2ueOJSIbjflvjZaOMHp7uYcf92A+RQ=,tag:5dypXrRYgbc4yIuT9J3uDQ==,type:str]
|
|
DB_PASSWORD: ENC[AES256_GCM,data:/9hbGZMnXxqEMQ==,iv:zGPlktP7ahdY4xbhhQLKw90IwlG0rT15eBIdGmfsLYM=,tag:eazhcIWuhQJYB/ZcwD7RbQ==,type:str]
|
|
DB_NAME: ENC[AES256_GCM,data:+ZsZs4tCxg==,iv:BoySPuXGlfzVYQ6Nnco6AduRvtYSfCKSrQ7O+RCS5ew=,tag:xeUcIVRg9hEjKqVmIyd/dw==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRQkNZdml4cnM2ZjJTSWRR
|
|
V1ptVU5CY0lMdVV4L0tNUXRJVE84ZmczcUhrCnUvdWd1bndqZWUxaUZEQkoyQzBL
|
|
NkQ2NDNPVXJVcVcwMHlML2ZxQmsvZ2sKLS0tIG5GNXhCNjhJY1BTczllY2k1aTlo
|
|
QTNnZmwwUzlDM0c1VzV6Z0hJclI1TFEKnE1Zl5FdPnO+638Whw77pSqTE0yJFHWY
|
|
eA8YPz9z3MfkNEv94aue67zClbW1rx73cc90ASvPUpMm1l4NVb9ivQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-02T12:17:30Z"
|
|
mac: ENC[AES256_GCM,data:a1WLtxBrW1GHHr1zg58D+pSvAHT/AYqYtXSZBAW8rkyFgU8PslzUCy7Fgs8ImhcQf3ykMGJH7rKDtG3DKqhr+VWHse0P30u3OgxfOoMIeSyWMKtlg9DWsWKpk3Eid/0iNW3XsCF/0PgORIfvEdbUkMSFlWLlXIZ4Qs4fon4YGFM=,iv:z6GbmWObIgnZ9DnHJpSx8SsAD5ukRgmboGdVwb28cMU=,tag:T/mgHx8fvtOaPP9m65ATPg==,type:str]
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.10.2
|