Research-Stack/4-Infrastructure/k3s-flake/.sops.yaml at 84da520be9b60cde3f0aabfb54c6cf020270190d - allaun/Research-Stack - Forgejo: Beyond coding. We Forge.

allaun/Research-Stack

mirror of https://github.com/allaunthefox/Research-Stack.git synced 2026-07-31 03:05:21 +00:00

Brandon Schneider 61fdb6c6e7 infra(vps): deploy Authentik, credential vault, age-sops, PQC, ARR plan

- LXC 100: Authentik 2025.4 with PostgreSQL 16 + Redis
- LXC 100: Credential vault HTTP service on port 9100 (PG-backed)
- VPS: Caddy reverse proxy with Let's Encrypt DNS-01 for researchstack.info,
  auth.researchstack.info, vault.researchstack.info
- VPS: Post-quantum SSH (mlkem768x25519-sha256) in sshd_config
- Repo: age-sops secret management enabled
  - Encrypt: .env, restic.env, credentials.json, appflowy.env,
    tailscale-auth.key, porkbun.env, API KEYS/*.txt
  - Add .sops.yaml at repo root and update k3s-flake/.sops.yaml
- Porkbun DNS: update A records to 46.232.249.226, add vault/auth subdomains
- Tailscale: auth key added to credential server (RackNerd microVM)
- Docs: PQC posture, VPS status, Authentik setup guide, ARR stack plan

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-05-20 18:00:11 -05:00

7 lines

177 B

YAML

Raw Blame History

 keys:
   - &admin age1fvm02ruga67vnw5wws9p2ycckdmc0gp83m9s6cyld0ctpxyf8gzqy5wwsr
 creation_rules:
   - path_regex: secrets/.*\.age$
     key_groups:
       - age:
           - *admin