b4f371d415
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
39 lines
4 KiB
YAML
39 lines
4 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: nxtgauge-backend-rust-secrets
|
|
namespace: nxtgauge
|
|
type: Opaque
|
|
stringData:
|
|
DATABASE_URL: ENC[AES256_GCM,data:7HYKVZc0cTBfkJq6bs6VvW0Xmzdgd4mL2UD2yOhksG2UTObcKZrKlAy1y7gTYPY23Vy0ttLKRmTnssllj5111vyvpsCLyeWWElzUl2B457QjLbjRxEAELA==,iv:EG26SgvpbVLqs7Okz14ylouGXyLf2/L81GGQyJ6NYyk=,tag:B8aLIhSR5G+n6rvyPZmqew==,type:str]
|
|
JWT_SECRET: ENC[AES256_GCM,data:/SbAXJE3u6kJJfL3Go2JoRwmZt8P0MGV7gYtcpYzE4TSjpLqcVB4PpclrzkxzUt4N8omnOXepousmqSFx0fFiQ==,iv:/+q2UFxNYlagHMynYr1cNWY/MUPek3iVj88Ml3pSSe4=,tag:zNqpr3ZfLGFmqLZVDp14tg==,type:str]
|
|
#ENC[AES256_GCM,data:NwWD9qcBt10NLznH1CtFS7jHkMrAECU50KRfBXYfa5ps0RwcNtlGEK5LhxmhNF7Hj+8wN3vRQm31,iv:H6VG1AluCHNINR43oLOfaRXm8N7NhGHGbHp8AZhxO74=,tag:yVGvSzFGkmImKD0+9+vfvQ==,type:comment]
|
|
REDIS_URL: ENC[AES256_GCM,data:6tZP6nOStdx2hcfFijRiMoar8OWc9gn8LGsTussYoxOu72E9OMVNjMrUJZgv7Ku1+uKAb3M4JH0BGYHSuWqS7mQ=,iv:rShXcm8ZFpP0jvZm/y85eZwXXpWTEZAVnOQVl9siaz8=,tag:47JLNmt0tIuR7toI+zaoNA==,type:str]
|
|
SMTP_HOST: ENC[AES256_GCM,data:UrDtzbTtJrIpmsZyU+7I8Fs=,iv:Q2NhRYNEmkeS162BM+ro7KLIv3ybm7Eb3LAd1huOBCI=,tag:OqrIXU4JMWErWzDEoWbEKA==,type:str]
|
|
SMTP_PORT: ENC[AES256_GCM,data:SyZ7,iv:IdH6laFQKD0ldeb/jgC+RC/zWX2pfYIo8l6I+a4CmA4=,tag:QIMt0DTq/UrE9+R27kx0Kg==,type:str]
|
|
SMTP_USER: ENC[AES256_GCM,data:Kx2A9tjXOWuta/Q=,iv:y4YGN0Tg+94Tpc1BG9vSp4Z77kkOREraXfggkJ4umYs=,tag:DiuETUlGzAHYuq6dRMzNlQ==,type:str]
|
|
SMTP_PASS: ENC[AES256_GCM,data:z96REIjbLfwA6Sh1bRBgD1xobNjwLJPecr9OilI9c+ROQD/gzpfaOc/0mmDSN2kYJpyuIY5BGMzDSwtP+hesQzQ/a6MNrelh08JAY96CZnaqbXhzZCjTbHmB/DoSnC3UDoChjoNL6F7Q4L5I1gRVkwGtuyEfTCiKwHEYLrY94iKsuWso86Tga+B8DfhMnAvI,iv:+oF81kyGLzM8Yspb7HOdOI2UDtYpDiqmalw+4f8W2F4=,tag:kG9g9wMx4JCEc650kyZO8A==,type:str]
|
|
SMTP_FROM_NAME: ENC[AES256_GCM,data:xTByiZiSRjk=,iv:gqkEHwOJkfFHdzNBK5Hx9s65YZZsNS8OtOfcAQYsOkE=,tag:+7QHKYjOQaFiOWMMzO0A1g==,type:str]
|
|
SMTP_FROM_EMAIL: ENC[AES256_GCM,data:hvP00nyhduBnWP9tS6suYtde9S4=,iv:EnP+eSSqfkeddKjlp6VlpZwFH8XZcBjk4XAg8omoJMA=,tag:xwM54O2iY0/3HrliIC87Mg==,type:str]
|
|
SMTP_SECURE: ENC[AES256_GCM,data:6mW7rpQ=,iv:9ONifzX5N1YyfWvFTNMJiGKyV25auoiKXFVWd45gDxQ=,tag:UCOpQczeDGDgJ326tFwEtw==,type:str]
|
|
B2_BUCKET_NAME: ENC[AES256_GCM,data:L+sRHOxaeicvmSGcyNDR,iv:UMbs+CkgygKm6FhmHA0fyFflUnqAypV5ZQZOQSRqQhc=,tag:d8F6YQGp+Y+EPx91mgjoBA==,type:str]
|
|
B2_REGION: ENC[AES256_GCM,data:luhXJET9s1pePd35RMY=,iv:0pe4qXPmr20MbF/LIg1v2fgTwHQRQrDmVI5NfuSe+TM=,tag:L1C1jGcNiqOOSRoJi5xWxQ==,type:str]
|
|
B2_ENDPOINT: ENC[AES256_GCM,data:gS8Mfhi9js8/V7VyzZxd1L1wTFz4Qj8+OYRd1gAm24qz,iv:NJL0FO6QY/eXsmZOi0hdJ2U24U3rdfCQ2hDSJhbx9aI=,tag:uwxHGolwss36llXWvCIvMw==,type:str]
|
|
B2_ACCESS_KEY_ID: ENC[AES256_GCM,data:ObKiwVZkQkNHGYyh,iv:NAWXJswVzHuhO9uku9S5ZFFYsduY0sQbSZRUuT3VK3w=,tag:WW3XuhT//8enUeq7m7YGpg==,type:str]
|
|
B2_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Y7m2PSALvibcwjWKf2aXCEuhJF+mlPwnVwNobXJJuZrGFgdPRUQ7WZbC,iv:EqXkCZ5/LP7riXRkZ+TnssYuPjyBQVVuPqBxLcQfAZc=,tag:EtF6dH/tK4Am7YyfEygGnw==,type:str]
|
|
AI_SERVICE_KEY: ENC[AES256_GCM,data:ivhSxI1Rvh/5nfe+1R5GFjCbZIzk2Tm58Fi3PpayPWASQR/KNj74kM6MIXg6MtSgJ4ZDKIJ9ZJOGdYPyacRV9A==,iv:KKMfdJGKReYsVGf55Hs3tyInQ761AJ5bhaUfqPY5fpM=,tag:jGmhwI6xxqM5U4oX5Ork6g==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1VmtFRTFKQmd6dzF6L1R6
|
|
MytrL2pNZ2hmQmVVVmZXbHA5Ri9SVC83QndnCmFVQkVpdTA4WHZnMzFCa1pRc3p1
|
|
akxJMEtRQkZpSmVvWFhmc1IxeDhiUGMKLS0tIDcyamQrU2dZSHU3UG5aMnRZdmdW
|
|
WFk2VkFuaVIxU21wOXlNZy9wL2hPWFkKIs9G/0ah7ng9BqLd3pAQE4wPEhCz601p
|
|
fcHXdDkFdNlAwZK5cp1pV4FtZnudl71lRIWEUzb7vXubeaGExQDuFw==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-02T12:18:16Z"
|
|
mac: ENC[AES256_GCM,data:qCLwVgBKIESDCtitUuXXYs6u2hMrjdSa79RhXHwIF5nuUySgYYdKnOyqEVA2VfqCTaUObImH9HFYitwbxQU586d+TAHkIc0VEdYauPRq9bQinxWCjeMcrjw3+maPaGWadlvCItzPos8MC4Vj7JSPzg5YvEhDDj3lmu0ESxP2y/s=,iv:0N27Fk8CFO9K8N94So6WAfFvouTAZllS6ssJ4x6d/uM=,tag:PAlL8p64/TlfdCrha9PVtg==,type:str]
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.10.2
|