b4f371d415
- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/ - Commit the Flux GitRepository/Kustomization (previously only applied manually) with a decryption stanza referencing the sops-age key (created out-of-band, not committed) - Rotate JWT_SECRET (previously exposed in plaintext) and set a real AI_SERVICE_KEY (was an empty placeholder), shared between nxtgauge-backend-rust and nxtgauge-ai-assistant - Wire JWT_SECRET into the ai-assistant deployment (was missing entirely, causing every authenticated request to fail) - Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT docs; move the litellm prod overlay off a plaintext secretGenerator onto an encrypted patch
27 lines
1.9 KiB
YAML
27 lines
1.9 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: nxtgauge-admin-solid-secrets
|
|
namespace: nxtgauge
|
|
type: Opaque
|
|
stringData:
|
|
SMTP_HOST: ENC[AES256_GCM,data:6IGeRaJzzQ3fkX4jVVZ36mg=,iv:8H4BAFFoMd190M4q/85bEffL6yzdBaDjreF/X0xz2aU=,tag:nX+MUmTMYYK1rByglsMjUw==,type:str]
|
|
SMTP_PORT: ENC[AES256_GCM,data:s4aS,iv:e5ySOAp00lv8JKYA7+FZgl4naWyoHxBIfnySELQGPdo=,tag:Ofg0gkNGPEG77lOVWvbgmw==,type:str]
|
|
SMTP_USER: ENC[AES256_GCM,data:ijOeJ+2xZw0ire4=,iv:jP//72BqKjlYzreXG8oQVgeH0BHT3dxBaXpzKgBBYZ4=,tag:Sue0Eje/HbARTncl3V/UEg==,type:str]
|
|
SMTP_PASS: ENC[AES256_GCM,data:uGJFVFarFTVJFfvhdQYiQB+/4jPigE7xNNgYenJt4jpuF8UhMOuM3zuvZ+1x0QlMdYG/Og5SgC/RuHMhrbrNS3YbbJaC2eZjTurH2xyvY6iLLdLQHmcdGR7sCFsyoQ6IZybUrcd+DTCy1safsJm0Mh0fhZEBPq1qWsMZUolswsLj7TFsiXHDiG+ZU/AKHCn1,iv:LY38BvW3CrIfLhflq04X+bCgR4AP8c+VzW3Alpl7zFk=,tag:YIcGD3QViiGcGSAqk0HeyQ==,type:str]
|
|
SMTP_FROM: ENC[AES256_GCM,data:bfZgeNSLquqOhtCRlOXPesI8K9o=,iv:n9ApxTDgCG8zWZwEievDPzOGMIIxlFhV2CaL0FHs0mU=,tag:nrk5coQvWgZgslEnSmXQJw==,type:str]
|
|
sops:
|
|
age:
|
|
- recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUDRidXo3VHJWT2N3Y2Zz
|
|
eW1oMXJEb3FPNm1mOHVXOG1HWnRHSHB5UFQ4Ck4rSkc4ZXhyTEtCbWI4YkpKS1Vv
|
|
SUt4eG0rWHJUN2hyc2RaQ1VLUzJYQUUKLS0tIEkrSUFVQU1ubk9iRTQxWW9RclF6
|
|
VEdhdGdLV0U2c09idHNySVRWd2s2OTAKD2X/8Elyrl1X99JRwKZXe8nQvz92UuvU
|
|
fnlqzdjCWaHyd4Ib9t8WjLw5Hm+qLluZpci7UqJaQX9OAN2+HGC8Sg==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-02T12:17:30Z"
|
|
mac: ENC[AES256_GCM,data:OsdePD6gejqfmJck8JCkoRx2iztrQQ2GQQ99jXNYfnRIe0Mx8BHH4fpUQRT853Wr2tjQq0V9Vl8B0uQC05aCnBIhpOExg7Oyq+fm0FC0PmzkcyNsZjspIoux3UqsXh6aXfjaeL9/szCsdwlXplaMWdisibTgQYwt86zEieOPDFE=,iv:x0mEf7r50m089Vnn2VVfyCHBWwuhXce25deJ+TJOnBo=,tag:YocuQO6IzgcKfVrNbSbT7A==,type:str]
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.10.2
|