b4f371d415
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
26 lines
1.8 KiB
YAML
26 lines
1.8 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: nxtgauge-openobserve-endpoint-monitor-secret
|
|
namespace: nxtgauge
|
|
type: Opaque
|
|
stringData:
|
|
OO_ENDPOINT: ENC[AES256_GCM,data:AS2JCqQO8nKWY5CxK4K8RnfTShgmcETKBU6bo5KYhGX29HZ9S0svPgr7N8f2n2ukP79yxNJhRgoj1g5IHylrcOWHkg==,iv:rCXp7P/KD3OjNey2R4C1mIV1mwJloXY1b3cidQZDsq4=,tag:w1yHshbQAo97IJotL9N40Q==,type:str]
|
|
OO_ORG: ENC[AES256_GCM,data:Wr0KPRa6kA==,iv:+vF9x/yTmqsg6vK5cHucLURktlcY0qP/NpoFnF0YuKI=,tag:n0vpNEoNzeVKzCJ44IBXGQ==,type:str]
|
|
OO_STREAM: ENC[AES256_GCM,data:ihLyiAbqfZtDstT6aFrh9QUg,iv:V4PkyKL9PSD2k7o+Od7t7q4g3o38mqbPPxZ87YGQAvY=,tag:m3AAVpaI6WwSSkw86pEsUw==,type:str]
|
|
OO_AUTH_HEADER: ENC[AES256_GCM,data:VY7qW13SLjUVMb21dsUpKpMZU00QSGAI1oCJHfTC8wxatuw0js4+fwyfLhJk/5ejBV8=,iv:62O+daUXn6OoJ0xiZ6iNTYAOVEI/2phGm4EYsUG/ENc=,tag:/5LXx1a/tG442LPuJCwYnQ==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvWjByejZNaUo0TmVRWnpY
|
|
WUpHS3hNeUZ5VnNGNjZ0RXZXZmd3QVdjV1dvCnArSktlaGp0Y0RuUzJTMThsZzhE
|
|
aXBQZGRkZDRQM01HOThnamJwY2JGbWsKLS0tIG84ODMybWc5cVZ6TGRLQTRGOU4x
|
|
Zm5aZHpmQVU0djB2RkxiOERVRStrclUKgd9O6ldUlge0Kop14t4jUVidQIRfmLzg
|
|
+Ci3LgedKLE1Lxbwg9JbTpA9YkVucnLuHPbUYZrud91jn1jnkw6plg==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-02T12:17:30Z"
|
|
mac: ENC[AES256_GCM,data:vAHLnc8tTNxmMnZs66H2MPxjvVpdquV8VYFD9DvWE/cIEEcZLrXtF6F5Nrcn5CSOurWKJoSQKV+s8DZQvuocc5cS5i8QvxSNyj1pcK+JzTUdMoDFY/xwqvVS3tIQn29Cocx2TEU+XUYB0zTVKRYGZjaQEgRquXZmGXCPaPzZvso=,iv:qkieUNf/khdlOArHPFo96x864XufRO8z9xA9HQzTt08=,tag:4PiiRm5F/hicDrTX9PigsQ==,type:str]
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.10.2
|