b4f371d415
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
27 lines
1.9 KiB
YAML
27 lines
1.9 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: nxtgauge-frontend-solid-secrets
|
|
namespace: nxtgauge
|
|
type: Opaque
|
|
stringData:
|
|
SMTP_HOST: ENC[AES256_GCM,data:ZyymsH6KNKIC9DMftVRKtyY=,iv:8l7Ue6qlUTyJqlSqyfFHwCpM4gkgaaucVX2Q6izaYN4=,tag:SC7NAtA9/er24PLnGV0oOQ==,type:str]
|
|
SMTP_PORT: ENC[AES256_GCM,data:+23C,iv:LZOuM1GiI1unVINYvBkH8c6LF0vBNDSrEQSjz3EXK2Y=,tag:ZjyJ4lZ3PgPGxRuOFFkT/A==,type:str]
|
|
SMTP_USER: ENC[AES256_GCM,data:ehnFRXh1w2SWCoo=,iv:s3w/Xgms8kNKF9PImHx5JpM0uvM7FC35jl9sCVmrek8=,tag:RagZTnqLwC06+MwK2Av0Rw==,type:str]
|
|
SMTP_PASS: ENC[AES256_GCM,data:LOMzp/mGddcwiJLfSB69fIn0mQvJVs14WjF/MNtO0qgW6LDX0erhsCtwPCoE73WUCiLKOKL0CwZPdZqxfAK9OE+edSF1CqnQdhOjuYtR4wElD1yj54t1/5wHRTFRTUXkPO/gnqKT3jWez3pxEc6rWpsLT2ZIwEWSP0E9SIKZW10K27G8+vNosuYrDc0yTmc9,iv:zrV5+/pHMjult/2kLDHZr3EuGyF5uFu3TrCvvms+2fA=,tag:g25HmbNv2Q7s/pXV/namCQ==,type:str]
|
|
SMTP_FROM: ENC[AES256_GCM,data:+R7du3/Bb2tE17FE9aJh8Y1NPa8=,iv:PjTsr/Nj1caWjxENmFMctjjxA995Fr1NWeYo7SC1PwY=,tag:NkqJxcJHUoWKqqkQcp9xQQ==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvKyt1WFZjUWxNY3BDdGZG
|
|
cnVnczgvVmFmYnIvK0M1OGptOE1tYUIrTUh3CnVPb0xMdnZPR2YwenpjK3h0QTZK
|
|
NEdQRFRjUXRPdHVZdDJZenF0NG9CWlEKLS0tIDZzNElsYm9RMTNZZS8xVnJhSCsx
|
|
NFgvM1VtUUJ0emVYandXcUJFRTRDdVEKoRum9CpLygcum+VUz4Ur79KeX+BxqDO/
|
|
f7oSAzdLYgLPyc867Fg8vKBQDUfZsARHudDtIhL2t+YFp2FHFZ9M6g==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-02T12:17:30Z"
|
|
mac: ENC[AES256_GCM,data:bc+mb3RSM4rLj6K2l4SrNNrFMg2evfVkNo7yzkgVC2RieJFpryfwf2Hfuq4qlXgI8KXh2eSyKWX3+UBlgZY17dneKP/1kSfVkgaAk46Uly448JHw6Vs94++7FlemLCe8t1EMCTtSfwK/AvKeCoOr1+BdbgDxCA8TBkTEp3Y5djM=,iv:kpBSTE04LLdjryiZD0pGCYjYV3Haitxxc67aamkkpMI=,tag:bJzs4R9vK5AwbdvhX7QZoA==,type:str]
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.10.2
|