mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-31 03:05:21 +00:00
61fdb6c6e7
- LXC 100: Authentik 2025.4 with PostgreSQL 16 + Redis
- LXC 100: Credential vault HTTP service on port 9100 (PG-backed)
- VPS: Caddy reverse proxy with Let's Encrypt DNS-01 for researchstack.info,
auth.researchstack.info, vault.researchstack.info
- VPS: Post-quantum SSH (mlkem768x25519-sha256) in sshd_config
- Repo: age-sops secret management enabled
- Encrypt: .env, restic.env, credentials.json, appflowy.env,
tailscale-auth.key, porkbun.env, API KEYS/*.txt
- Add .sops.yaml at repo root and update k3s-flake/.sops.yaml
- Porkbun DNS: update A records to 46.232.249.226, add vault/auth subdomains
- Tailscale: auth key added to credential server (RackNerd microVM)
- Docs: PQC posture, VPS status, Authentik setup guide, ARR stack plan
Generated with [Devin](https://cli.devin.ai/docs)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
38 lines
939 B
YAML
38 lines
939 B
YAML
# SOPS configuration for Research Stack
|
|
# Uses age for encryption.
|
|
# Post-quantum: standard age (X25519 + ChaCha20-Poly1305) is NOT post-quantum.
|
|
# PQC adoption tracked in 4-Infrastructure/docs/pqc-posture.md
|
|
#
|
|
# Usage:
|
|
# sops --encrypt --in-place <file>
|
|
# sops <file> # decrypt, edit, re-encrypt
|
|
# sops --decrypt <file> # decrypt to stdout
|
|
|
|
keys:
|
|
- &primary age1fvm02ruga67vnw5wws9p2ycckdmc0gp83m9s6cyld0ctpxyf8gzqy5wwsr
|
|
|
|
creation_rules:
|
|
- path_regex: 4-Infrastructure/infra/secrets/.*
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
- path_regex: 4-Infrastructure/deploy/.*/.*\.env$
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
- path_regex: 4-Infrastructure/storage/restic/.*\.env$
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
- path_regex: API KEYS/.*
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
- path_regex: \.env$
|
|
key_groups:
|
|
- age:
|
|
- *primary
|