SilverSight/.sops.yaml
allaun 781578001d feat(infra): age/SOPS secrets surface + webhook receiver
- Add .sops.yaml (workstation + cluster age keys)
- Add infra/secrets/homarr-values.enc.yaml (SOPS encrypted)
- Add infra/secrets/authentik-values.enc.yaml (SOPS encrypted)
- Add infra/secrets/webhook-secret.enc.yaml (SOPS encrypted)
- Add infra/webhook/hooks.yaml (adnanh/webhook config)
- Add infra/webhook/deploy.sh (SOPS decrypt + helm upgrade)
- Add infra/webhook/deployment.yaml (k3s Deployment + RBAC)

age keys:
  workstation: age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq
  cluster:     age1s6t5qpt0h7xlj98zkza0e7pjzj686k38xdu7jrz0nsreaw092drq4v7h02

Cluster private key stored only in k8s secret sops-age (namespace: infra).
2026-07-05 22:35:27 -05:00

13 lines
559 B
YAML

creation_rules:
- path_regex: .*\.enc\.yaml$
age: >-
age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq,
age1s6t5qpt0h7xlj98zkza0e7pjzj686k38xdu7jrz0nsreaw092drq4v7h02
- path_regex: secrets/.*
age: >-
age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq,
age1s6t5qpt0h7xlj98zkza0e7pjzj686k38xdu7jrz0nsreaw092drq4v7h02
- path_regex: infra/.*\.yaml$
age: >-
age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq,
age1s6t5qpt0h7xlj98zkza0e7pjzj686k38xdu7jrz0nsreaw092drq4v7h02