Research-Stack/4-Infrastructure/storage/restic/restic.env
Brandon Schneider 61fdb6c6e7 infra(vps): deploy Authentik, credential vault, age-sops, PQC, ARR plan
- LXC 100: Authentik 2025.4 with PostgreSQL 16 + Redis
- LXC 100: Credential vault HTTP service on port 9100 (PG-backed)
- VPS: Caddy reverse proxy with Let's Encrypt DNS-01 for researchstack.info,
  auth.researchstack.info, vault.researchstack.info
- VPS: Post-quantum SSH (mlkem768x25519-sha256) in sshd_config
- Repo: age-sops secret management enabled
  - Encrypt: .env, restic.env, credentials.json, appflowy.env,
    tailscale-auth.key, porkbun.env, API KEYS/*.txt
  - Add .sops.yaml at repo root and update k3s-flake/.sops.yaml
- Porkbun DNS: update A records to 46.232.249.226, add vault/auth subdomains
- Tailscale: auth key added to credential server (RackNerd microVM)
- Docs: PQC posture, VPS status, Authentik setup guide, ARR stack plan

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-05-20 18:00:11 -05:00

56 lines
9.3 KiB
Bash

#ENC[AES256_GCM,data:Uzhq/lNhyv6lZ0ig8Z48nwoPjzLAGH9PSoA7IcUVW91mWLYsMEzVIEW4lc+N64gAP+L8cUN08h2H9HAZnJtr4jE=,iv:pmWpu1UvUZHwr6imRSfllOHera42HhSnmhTK8yYeHmY=,tag:9H9yAq5LXI3uYIh1TomNqA==,type:comment]
#ENC[AES256_GCM,data:UpK/LUGELutyOL88JTmx9ErzwnPDIQNCAC+UfzTuwaz2Ll2MCNCsZolLSptZLeKdBJaxqpClKWWsJrbH2bE9uegyL51Iz3/KTnmKHDlxZFDIywvJTLmou9Y=,iv:qtOiAx1IENJzsfKWVEzQ0AvTsWVuGXChob+bfgR1xVg=,tag:9btmRPM17jgmyl6OMDLw1A==,type:comment]
#
#ENC[AES256_GCM,data:stFXqF8JkakLs+hnsbqfhEln,iv:TzgD8iVyBdTSlWq7u2qJJyqkvXvrhAEROSgy5QW4IZ0=,tag:dt/ZkTaxqn/ZOFQdZs445A==,type:comment]
#ENC[AES256_GCM,data:WpBRjv6rU1o09LvNCNqRflU3XKGRGjAtAVxxZQvYSuvaa3em4oGTVX4UDNWdQuG5OLn7CGMGjXSGZTosWMVIs4Z4ufDsoaSL041Hy4huutKa8tlkIhIm3gK/0z+Ur8oguP/KFTvWiavxiSK4p7SN5nQdbnNtmWRcui4EszYkQPgaLFEB6RyhDLy2+Fb/1Zrc6i2X7mA9ovQc1uR9eJbn7knw6tk+7En1wMmZ0iD7uHSAzEBpzI9QVbZqpr8gjDnpBG1iUblE32LJJAhk6fU3d2UCNe7dv6zpGPA/vtFa+UYehWjSXVHWJw==,iv:qZQTz5h/YTyXqzDFonQ9UY3oUlHRQKQYb2FKZd3xahU=,tag:mBqGrYgP6E6uK4bFAZEaSA==,type:comment]
#ENC[AES256_GCM,data:JH70sjSgTbpD0aLWqXP2qWx96OyLa7NoIIOkIPeFXf58wmKCOqpmxUE1gMFdGSpg4WVz2kVOkWuOzvWoSG+Nc8Z/5GDak9UjfnG2nHlnNS1Q,iv:/fBujQ0ZQfXhw2w17xGJnslEOY4X1okF6z2LQEPz6IM=,tag:5IO8tB0pasjtmDrsUNH9ug==,type:comment]
#ENC[AES256_GCM,data:TFJRUsaiECFENRg8jBXazLpaG9D1QYEvmNkrEhK8sM59N4l9tB6Ezljssy+pa4kg6JFjPGCkemgdCR3l8WLDBc5Qkc7cJv+oBBYJ+Q==,iv:uE3gC6h9dZ1CMleQT5GvtJDgvb77M9sfy/fEFPUmM1Q=,tag:u/dsO4f23PCgL1NFWaluPw==,type:comment]
#ENC[AES256_GCM,data:gOAfkDU1cz8PcbWSxrGRfpE8P+PwNsOWkMMfjbWxJrbNv9dPvvMkY8vJupDQbZ0zuYwFsu4VExGHttZGeg==,iv:rIpJiHTUSeoW7ojuEsyAwTgYZGqv6usGKKTxGI+pUfo=,tag:JAW/Xk+cs/+J1XLfnq4nKA==,type:comment]
#ENC[AES256_GCM,data:NBn7LZVE8Xord41rsOfQkaI7dC6o9drlldmqF8xUrmAi3CCzvJy1Ag4VB5eQSTmvOcBuVtdy2NOipW3OrX0EM6Gyp5qL1YZtSoAs,iv:xgcyBZ3eJ7aceknw7BWDlSWpMfpDpf4kSD1hDWqXHGw=,tag:EGGDQ1EcY9ZrG0fgJC/YOw==,type:comment]
#
#ENC[AES256_GCM,data:o6rXeoJRcN82BlEkAE1e1Ml6BBuYbaR9Ut94lNJtD4Vnz7WHLy3eXnGiZgVctkNDGXyLonSsGEPO0PU/7/LAiLDTXZSvgfdoIImU,iv:qRkRWKuJG/MiQ8k0I5dYv6AM7oysgyP8tXs4VHiCN7A=,tag:cT66+bzsZ/3Nh/j5zNBJIw==,type:comment]
#ENC[AES256_GCM,data:wWJh1C2zykxXMa2+crNQuZZSmuqe7L/uViGOG+C+Uds/thYbPi/eXO1FWvBtw7m9I/xQHYJLSRtLkIoFQMpT+dZXxOlTCqNjb/ykNQ==,iv:jOAq0iaJaYgPs5eym5CNL5T+DfHFvp2m/j09Dv+KD0k=,tag:6N78ZJIRJSVUnXuVGWt08g==,type:comment]
#ENC[AES256_GCM,data:F6AC3CDD+bjCRRscPlwQRIA6tTPpLnrcxBTNvgyyVGA+WWUyWXuieqb9VSqoh+N0C9IAuVITtEb/hwjra9dBgZUm3vYiPnkvnu7d,iv:ZhVw24NYot1ChBe48zF2LHZrJk/PTTMVO4++yNSg7zY=,tag:iXrf+ubXKBOg62mmZTFnqg==,type:comment]
#ENC[AES256_GCM,data:DcmHGcqJrn8lzxtOdk40T6aWTveRcl0QQLXvtm9akZ2cgOdcFzzwiW9k7lM=,iv:3dQbFBTXjJrwCCZsH7SQ5Ug0UOc8O/o13z2B/oOAVSM=,tag:WTaUQPySEPdw9V10LLFOIQ==,type:comment]
#
#ENC[AES256_GCM,data:lnTk0iQhBrXCFMj98944Prhszecrr1CvPDQ7g9b26p+xawgX96PJMHNQwEkE6IgE/jp9fU8=,iv:pmAVrgSutcyK0xiaN1zAm+btDslV2uJxDn9ghwiy7Og=,tag:HIGCcwOUxXo7m6e5ANM2/g==,type:comment]
#ENC[AES256_GCM,data:ynDdcom/41vJzSqZ+aUOdT0zZ4xLlhrJLob23XGi4YcpK0suyALnYEDqboVWZJrjc9N4,iv:8/ZUozY3ZTJv47mYJFOPqp/VamMeXy4KsMXlrSP4p8w=,tag:mFmTjSMZIS9sB6xcOP3FXA==,type:comment]
#ENC[AES256_GCM,data:KsqBSy2RN+TSszxWQ/GYY1TNRtUMR2GolPO8aqt21f9qrbliUmqmN/aUbzSHSFN5ha57RMB6II2SI2QQH78cig==,iv:XsifmmZdwgsUzIemQlgleMQk3f98AKiMLp3ZkFn+vLI=,tag:4HpfFq7I+SsJQNq0T7U8lQ==,type:comment]
#ENC[AES256_GCM,data:yf6lHF5H+/R26GZW4jA8b/uBmsaGFRa9SjG9FgV9sPPguBzvhShqXcnDO5Q4eL0gTjvo1BWvVtW9c8OuZJaPVOYRGJKlH9oT,iv:/VGb5YhwJyt/vWJqM+EPJUNmGeHP6uVtxfMK6ALIoZ0=,tag:q6Ti3L0ddH/m0+2BmxUF1w==,type:comment]
#ENC[AES256_GCM,data:ZHOmHkpAkfQOCuJO0EueTxbs1HKsnw/s5bqiB+84ZXGau7R8FpLozNcVJeiZlyNOm6g7KCIi1B72CSPbe4edFLyenlG6uJS4ao7+,iv:RE340ZogoG2fD97Klb9Pln0Fj+XKtPY90MAEKudfDes=,tag:/QQzvnrCrkHRro3UltzymA==,type:comment]
#
#ENC[AES256_GCM,data:TKTNUVKG2zrdKA/cFKTr5FRZGjnF5Yj0QuFhw8JaHlWFPZXvp/JHV3k8aYhaE8IJL4LAT71LzD/6iPqI34IMDhdwUtM0Ji8/SfkEqRm1M1y4omy8gUNNZwdVg673+debz2HEs3BdmxnQ57eeDPetvkjq8U6o9/9VjKn/C+/DStUIREaNLruhjNYubiYpWbqmR883Bhkp/Wf77taw1lIAC/2fIDXKvnYDmBpFdEgCCyytKMY1H3OQAysLnmGjSWXOG+gpMAGgPh5RjizTGMdLulj0swhAcyzoHI48ZFUZAXNjsO1Vog02oA==,iv:O55iHYiznOTfGLa/K1/wg9pRjZ2p/0K42DTxJD+FPJk=,tag:k9gb4x+3slxV+8U1opmnoA==,type:comment]
#ENC[AES256_GCM,data:bQ4biTHOMaSiyA==,iv:Qc2Y2hmp/ofkZsucAmh6iSsGOA0WSGUP/prkKKwz2eQ=,tag:0Sd+Ql4B5g4B7LKx2CC+sA==,type:comment]
#
#ENC[AES256_GCM,data:WvjatAun3vcyhMowoF4soVw8SwBxd2L58+5xdtbPOlwBOaheMpDiLJ8dAwARhpWEmiL6cOB6Jaed,iv:UdOQMJa8XN5IxVNzIGJdOWwU0daPRy9OWgs6Ezap600=,tag:T16BzwFDNR7Vg+ZrfuJ8+Q==,type:comment]
#ENC[AES256_GCM,data:yizbDb8zWj8LL4kwgIXvGVNFC1cyyAxLC2I8K2rY+CVjLE/EL+er0tOWNvc9yWrTJ+mikffbLhbqGfG1nepHfHU=,iv:wZrAL+uxmvLLwPKV93JZhzVbSXmaQeMLEcBoXvDSXRA=,tag:1jQrW+BwmyJ14QqIa65gPA==,type:comment]
#ENC[AES256_GCM,data:ACRCJLaHBMmBK2styTT7pX9FfjK8d3yxP4mXZjZWbXF/y9+8bJdGPObZfk/cSwJPtTTnm3oBjXOBEBkhEOrf,iv:2z3A8l6VMIc6dLoaDBHxt6JchQyfuNbPv464nIIfulw=,tag:n7eiy93+3uY6nKcVyVZ7Vw==,type:comment]
#
#ENC[AES256_GCM,data:2v83PGCTG4l/SNQMjoJMC+wKuc5BG/+Sz9Ki/gUClML8UqA6IJbRcsjjVg==,iv:AEYfca0aTcz0m5n1HGupS25F6hAdeh4y4KJhMewf/O0=,tag:TKhVlBUL4ls+6LmOQ22Irg==,type:comment]
#ENC[AES256_GCM,data:rrj6jCn8LJbtAocxjeEupCGMY+trWko00krOz8A2xA7g+W4vNeDoGoV3ztAFBoFSZ5XfWqd6kAfeVVjkmrpN5s+LJCAiUcp8Pnt9oHu5QA/sOGHCGMG3tE4=,iv:RN6aLiViOfZ4eELrALGdi61cs6efbrDQ29YslF5Xhfc=,tag:iDOPvaWh8rs5klO9eBnBuQ==,type:comment]
#ENC[AES256_GCM,data:Q7dSJ0HQ0gvDjA5wTHL0XVQ9T6eAfGcyqJLSx6kjmVcmiPUObRXnOxW44vLFWRzujtGLWT9Nhu3H+bn/8UqLrsSBqmgoOb+2,iv:BCJyHekIP0yafQcpvBZdCh2R2lg3pMXwxYpMManCFC0=,tag:5j8mmokojG/HNZjirVcDEQ==,type:comment]
#
#ENC[AES256_GCM,data:E6JCJKsdsiKCq6UMl+g=,iv:BJc8esWPvgJ0d5PXioplmqRXhAPZvLccq/zpK3PoUNA=,tag:PSfDA3hN+sv2i0IQraFsUA==,type:comment]
#ENC[AES256_GCM,data:MvElE0FYAt6BXVcjwR9fypfxJ3I0E98jC2xZv6KBqA9xQXHQtV1kSXk+DrKAmEmKSt0URsCH51hiNw3CmLwBLU5JPq6hWAE=,iv:yQBTyGgjLPzaX/F+iL3VuzocQsLqwOjvI3NA4es5f2o=,tag:5hzANXIk4GZUanfW+EPNSQ==,type:comment]
#ENC[AES256_GCM,data:WhA+bKWfaLkx3C6J0VfIp7Qby4DY6n3g,iv:McYFk4Tr8b/L6DKvzhUQE9Qk/RbCqkkOzK3OFl2i32A=,tag:64OLgU1g4RNa6DmJ0Kflzw==,type:comment]
#ENC[AES256_GCM,data:Vd5o9KEBdRmhbs5WioMb2iGMJb9rLiJZU2qcD0Q6ZJRhr+Vet7vJTVapPw7D0OJK3twE3d84d8eDvayb,iv:CNEAMLFyRZv+TGJT8LpuL3U1bKDq/PSo5qx239v+qYo=,tag:GlxUai7SM+DibGVeIfyEBA==,type:comment]
#
#ENC[AES256_GCM,data:2CTOMrsaePECFOpOydk4aCfMtLUXVFrgBijuQ6JquvVzmEsyGKLE7keHPTgEkFWoiqOWrbIKoeBTxy/qqje5pNdY3lV7i1qkqBxRd26hZA9f/t2azaxAwUcDSig1eTtlDYKlWlsEwCXKtMOJgnUYAVyhqxjk4hdkUf+p+xKKOTOHh+X0zcycKTWxttBWmp7pBUgK1rlsbEj7utrYZqy+Dtbrut9uKAhoPyq8sTeuNRFqOvq9Zr2omehs3o3b63bQbTzSMDF9eRmiYGNCZUpVbJEoiS9zzg//DWDQR7ushe+V/cdnVcrqYw==,iv:heukOQVhvXMuLYG/m5sVCGkQDn8T2BjB2RmR0KgZF2I=,tag:Rkb1PrvoJ23sYHG6A3Enkg==,type:comment]
#ENC[AES256_GCM,data:/SgJT2EFwLBs7HIykjZ4Nojsm/0cRA==,iv:PnutnHoVOaTlQhDXS1RBarLrYPp1rBcrHTWpPLQQDRw=,tag:uwEgrNeMvQAjJ0auIcfbdw==,type:comment]
export AWS_ACCESS_KEY_ID=ENC[AES256_GCM,data:3JRfo7GzvGwYoCDS8pxMgprf7/0szgtnwtOrWw==,iv:hwGEJFOwbJWvbxQrfGmMnuaIryJKGAPPsu1hR+4ihUI=,tag:IQC4fvKYmsDv+9o1IqQXwQ==,type:str]
export AWS_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:yEpA+81xYei73fTVKBoSK8oUMdBOeIj5FedI2V/4DGE2zIkYb3FFcksiMjBhQVbuGKWac0p8veVCI/Nlh/GicDvi,iv:nh9lxRoPegpdjnJrU+JxppBOfL1UjbyVs27A9BDjETc=,tag:Idt5MrH7oKj9BdZodN5dOg==,type:str]
export AWS_DEFAULT_REGION=ENC[AES256_GCM,data:b7qHaeFNLVc=,iv:Zc26crDCTfcLihieTcF8PRXqWIj4kmnchUZFZ24lMx8=,tag:GmkGakHYWGkCkbpY7MvWwA==,type:str]
#ENC[AES256_GCM,data:MypQ/smV30mi/SeC0JKV5QjfBTxeXH630U40kg==,iv:XOV2da41hbmbKMXnTlCitLGtkIDLNmYwm0aih1RTaao=,tag:pe81fBUlJ2oqbUxo7SuMqg==,type:comment]
export RESTIC_REPOSITORY=ENC[AES256_GCM,data:Fetv6j5/5kWBEAlRdV6wLdojNPZ7h37Xu6ja0OHprb7uhqOefhpAr5E=,iv:O2TdLS4HJ6dPxeObXymhZRW5tff7O65KGeQ9ka1btFk=,tag:56BtxR/rkkv7E6GqSDSsEw==,type:str]
export RESTIC_PASSWORD_FILE=ENC[AES256_GCM,data:0JF5Um631FTFEfwXPKtiFCuI5lSmA77S59qcTdI=,iv:VjKHFmZ2xzQiZmLWxdQbgBZosL9pPDDkQWnR5940S6w=,tag:TTa9iqqcJ8fkZZbn3ahVgQ==,type:str]
#ENC[AES256_GCM,data:PRbFQXdS8BrDlmWR4Lk8w0Sw7dX5KRqsk0dGNAwloK2FlzE9qF0OliH++XSBmoMwTq0XrcPjkZlw7jVi6bLvHS0=,iv:MugDXd0dQiyQnYUa4wB2R8LOZHk3/C6BtIBT6kPyEOs=,tag:CFgGUi2OCPBfO9vbvWN06A==,type:comment]
#ENC[AES256_GCM,data:iULvQ8NCKVvXETwumDrnxqUJw9vspftSwB0M2SEfVxil/WogR6rj/B6l5B2lynpTrdgw6ZRBBXIfRP0VLkkcx6I=,iv:1R+mCe3AE+lO3F1iLBHUQNRtvtGWHsJWcivQq4+35zM=,tag:qOBwigEYr1qgu6G9TXmtXg==,type:comment]
export RESTIC_REPO_COLD=ENC[AES256_GCM,data:q+H31uMtKmdcqHugq48ftUp7Og2IJ3sdX67DtTk=,iv:laLwPgVfAhcR60jqf91fcWFmFFms430xTgRmSNzlOWw=,tag:x+LpyzntU9lrWZbUFjY+KA==,type:str]
#ENC[AES256_GCM,data:rQM0QrgmfD7gHnkPC1rdQsDEkcxYJYWqEyZUzJCZ5tc39v885LBQKbRDNP13QKeWhvITtq3AEh8=,iv:nipmXQa1Ks4EpueZtAIQu3ZQAskRP+rrlZMumnTOBmc=,tag:gDiXiI6lomM2dftA87qBmQ==,type:comment]
export AWS_ENDPOINT_URL=ENC[AES256_GCM,data:rF7e2q4/9M3NOzgZNNuTH1VcBMNsgF0=,iv:AUGP1OzmmycGxpT2E4ws74gR2OuxWia9eIggxj6MnxE=,tag:uS3MKKkcVtWB68HlY9JAmA==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvaEpHSWxMMGNBWEd1UjVl\nenVaSDlqVkdrbDkzajRYSWRMaXVaa0M2ZDFjCmRHNnAyeXc3cElNRWxEcDVjZS9B\nZjFSWFhhR3NBOHFtcVA5L1hreWFEVjQKLS0tIGMvbmFORDZVRHhrZUlYUEVlSy91\nSkUzVUNtMEE3Q2t1N3YwQzRYblRWK0EK6+dgL6aJL4ReJBymH3ooizNGgXFyeOtY\n/pzdxSVDpHUIgbf21p8dpj6Oc983T7px4vMghxTiHUt6ny8JXNlyrg==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1fvm02ruga67vnw5wws9p2ycckdmc0gp83m9s6cyld0ctpxyf8gzqy5wwsr
sops_lastmodified=2026-05-20T22:10:41Z
sops_mac=ENC[AES256_GCM,data:DtUIcqPCIZTsELQTNqt/tEgUvruC9Q/jdqYchTahvny00TlXQT16tTzyimqPz5KBcCiexr4/aIl2wqt/ZJh8wT9U7LK60hCN8LoYIQYVqaU6K0gJX5F9I76POHiB46Dqk3d2eEo6o+pefQqxTe0OsP0c3Ko74KVDAMHbARMJG7Y=,iv:aFDMfYbXLXN4Mc06pzClGlgeRMni4W8fEgGOJh77ruo=,tag:/JN2aZSukKdaN5yUM8fYEg==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.13.0