b4f371d415
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
24 lines
1.5 KiB
YAML
24 lines
1.5 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: nxtgauge-ai-assistant-secrets
|
|
namespace: nxtgauge
|
|
type: Opaque
|
|
stringData:
|
|
#ENC[AES256_GCM,data:DzWkRm3f8tFc02M5GVMtvWxLscWMt/AsTW7U0+KenEDguLPOGZjSqTflKwlP11V7v7p3bCkvpmKFvRq3B8Qi0g3zzp0Q,iv:TA8ADbjVM5gw8zc6Synn/Ue6BT8k/PUtyvoNrXEgzd4=,tag:rhFeomxaYhX+pWmKjYW3fQ==,type:comment]
|
|
ai-service-key: ENC[AES256_GCM,data:FjKo1h5loCYoXDOC4g37tLTbLU7lE+DewxMkUCXBO5op0tJByaXmBYy5ZZEDpplZxDsEPd4QiKoUg8bM9+2OSA==,iv:I//s3r9wSQujgtXPeFT1IArzu2LbObsFz7d8E0GN6iU=,tag:PkLaujtLklCWHQYGIB9uvQ==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQWU2UU13Z3dFcFFqeU9J
|
|
NThoMVE4UW5jeHFQaE9tY0p2aGliU3EyMVZrCng4RGhGbDVYM1M5WFdZZ3M5Tk1S
|
|
NldkdXRSS2dqckpvNUo5d1hqYUZLWE0KLS0tIGUzV2pqbW5ScEllbVBDeG1KNFJB
|
|
ckFFMndObTNzaFpyUVU5OTZOTUNiQXcKDPo+nnHRjPlswzW1WHQEde8Ae/icAsxH
|
|
+aq9NUpDQ8FTCdIu0rtqVS1VaEyt1kXgBmrjHIJCIVVvFzTKfuXLGA==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-02T12:18:28Z"
|
|
mac: ENC[AES256_GCM,data:DgCzaIaaDP4Q5lhOLkBmy1z0+kJ0CFBCGVal3WKiNpo8H9aEfArGsbvA4zleZphtzVP/R8GhegjUdkVXT+wZo30Py/4FLFuRxtiiUohxHCfaiqD/13KHKO6nEJPN3wV9Ab59x+PlWk8roDGuPggupUs7v4VdHKqk+qQwsaTuhiY=,iv:KdSKauwmArBWm817lFrYB7F7axx3TvKXBbbqOI0NOSg=,tag:dCi+4OgbyZKiXUZCR/I7ew==,type:str]
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.10.2
|