commit 121a7f9eec1444337a238cb0ba8dd95a546d8d29
parent a7bd8dc0711a106fef70f8e3c762fa7e2c30f417
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Fri, 11 Jul 2025 09:00:01 +0200
Prepare new cluster
Diffstat:
4 files changed, 90 insertions(+), 95 deletions(-)
diff --git a/clusters/talos_cluster/flux-system/gotk-sync.yaml b/clusters/talos_cluster/flux-system/gotk-sync.yaml
@@ -19,7 +19,7 @@ metadata:
namespace: flux-system
spec:
interval: 10m0s
- path: ./clusters/2024_cluster
+ path: ./clusters/talos_cluster
prune: true
sourceRef:
kind: GitRepository
diff --git a/infrastructure_talos/controllers/capacitor.yaml b/infrastructure_talos/controllers/capacitor.yaml
@@ -17,16 +17,16 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdzFqa1N0TkxXeUxvUEFP
- QU55MVNEa3gvRkJiVHY1S1BOS1lzZ1l3S2dNCjZ2VjdsMHEwQmd1My9SNXVZcEth
- dXBra0U4anROSzRrYjFtdTc5L1dyZncKLS0tIFR3d3I1UHo4dTRnTWg3RUtXd2tD
- RXd3S2xvY0VUdzdud3h6S3J0cFhqQm8KY8YyTmxH0uXSEj2di/g6eJxHhANDsekt
- o4wbxiQNHdQdSgPyIYHf+KEj7v/9V5iaKlXsVIWcmSvDfIyzzDLC6A==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBaG15Q1dnMzhqRDVGQjJT
+ ZFkxWXBPRGo5WWZPM2FWRVB1Ujk5cHBWb2h3CnFKRXc2SXl3UW9vZWE2RDlzZVRE
+ WkREZS9IbWdOU3FjMzdrems5SThwNWsKLS0tIHdDNWlMWHk3a2h0ZS9OUnR5L2NH
+ UWNBRnhzV3dmSjlZZ2ZITHp3dmVOWFUK4lnBo3zKdmtctW9g2xqhg6NWyHXIIfio
+ rzy7KPPv8P2CfvlVHfLyLr1gDnHKLPAvwMdrscSjSXuqUk0r+Cgwng==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-02-19T14:43:45Z"
- mac: ENC[AES256_GCM,data:Y9GZ8y4E1MYcO0t58vsC5h2Tv5xGfE7ACylRTtMYjv2EsENavElY7hZB4YzDmEy+L2AIfm+5GKAj8mi/I9/FdHqTHroOR3oEWb6z/EdLcSg5xhB+Nds0uXG9lmve86+jH0Pmer7xbVWiTYWV97KeffU8AqnzcBgzwg8nXSGOqPQ=,iv:D6cyxRBthnRUooi/JSsufkGrbykO6Ge20zTVRhQl6cA=,tag:BVSDQfLHdvRqcEWKQKS20Q==,type:str]
+ lastmodified: "2025-07-11T06:55:22Z"
+ mac: ENC[AES256_GCM,data:jK9anMBm8ehDxj4ESUq8Fi5XgSVbXamFSxDnF5hqSEEpSVAd3opapLRRXkA6RQyuB/ny0yvyIIN+RSRrSpQKo3plJJfWYaa1gVugYKCCATmi1HVjugSKccTLy7ZO5Qj9N1oVlbZJHPc01X8qc4vUmuWeAdvdF68KgI75apcLc3Q=,iv:Q0PhSDSgdF+kTbYX0JLeDtUiwDEgFGRAf6wOdmhwpKA=,tag:wBv17f+seY5kHrpekxN/7Q==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
@@ -54,16 +54,16 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdzFqa1N0TkxXeUxvUEFP
- QU55MVNEa3gvRkJiVHY1S1BOS1lzZ1l3S2dNCjZ2VjdsMHEwQmd1My9SNXVZcEth
- dXBra0U4anROSzRrYjFtdTc5L1dyZncKLS0tIFR3d3I1UHo4dTRnTWg3RUtXd2tD
- RXd3S2xvY0VUdzdud3h6S3J0cFhqQm8KY8YyTmxH0uXSEj2di/g6eJxHhANDsekt
- o4wbxiQNHdQdSgPyIYHf+KEj7v/9V5iaKlXsVIWcmSvDfIyzzDLC6A==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBaG15Q1dnMzhqRDVGQjJT
+ ZFkxWXBPRGo5WWZPM2FWRVB1Ujk5cHBWb2h3CnFKRXc2SXl3UW9vZWE2RDlzZVRE
+ WkREZS9IbWdOU3FjMzdrems5SThwNWsKLS0tIHdDNWlMWHk3a2h0ZS9OUnR5L2NH
+ UWNBRnhzV3dmSjlZZ2ZITHp3dmVOWFUK4lnBo3zKdmtctW9g2xqhg6NWyHXIIfio
+ rzy7KPPv8P2CfvlVHfLyLr1gDnHKLPAvwMdrscSjSXuqUk0r+Cgwng==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-02-19T14:43:45Z"
- mac: ENC[AES256_GCM,data:Y9GZ8y4E1MYcO0t58vsC5h2Tv5xGfE7ACylRTtMYjv2EsENavElY7hZB4YzDmEy+L2AIfm+5GKAj8mi/I9/FdHqTHroOR3oEWb6z/EdLcSg5xhB+Nds0uXG9lmve86+jH0Pmer7xbVWiTYWV97KeffU8AqnzcBgzwg8nXSGOqPQ=,iv:D6cyxRBthnRUooi/JSsufkGrbykO6Ge20zTVRhQl6cA=,tag:BVSDQfLHdvRqcEWKQKS20Q==,type:str]
+ lastmodified: "2025-07-11T06:55:22Z"
+ mac: ENC[AES256_GCM,data:jK9anMBm8ehDxj4ESUq8Fi5XgSVbXamFSxDnF5hqSEEpSVAd3opapLRRXkA6RQyuB/ny0yvyIIN+RSRrSpQKo3plJJfWYaa1gVugYKCCATmi1HVjugSKccTLy7ZO5Qj9N1oVlbZJHPc01X8qc4vUmuWeAdvdF68KgI75apcLc3Q=,iv:Q0PhSDSgdF+kTbYX0JLeDtUiwDEgFGRAf6wOdmhwpKA=,tag:wBv17f+seY5kHrpekxN/7Q==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
---
apiVersion: v1
@@ -73,7 +73,7 @@ metadata:
namespace: flux-system
type: Opaque
stringData:
- client-secret: ENC[AES256_GCM,data:pc9uqSRlVTr1O390Mklb1U/deypdbaHRhubBvCaoyIPG5x7/Eoe7WmVLA/eSiG3lcRmTGyXp2xIkvs9n+sb8ioNBVjlA+FKhzDsh7YG9eXDa5G4bJ1nPhYGbYcxJGCqPIbvGpKl2mNE0B4CwesLf3ewcYlvWjQ6YeyIzWHfv6Uc=,iv:TSbkZ8U2J/RBK/w3NLX3TUmhYhcuHt/FbnQWLQGGY6M=,tag:h+9TiFTvl0aDkjJjqXjcHg==,type:str]
+ client-secret: ENC[AES256_GCM,data:5DLPmAMTFTi9R0XfiqdRZ8Q1UF9n0OigZbMojXh+h6WnpyTXhi5GeetvGJatUP82dKUiNuBHaOutdxTbarw5TJse6iv4TLfjhqz9nx+CQIQUKr4jeGXDumldSyaD4smRTGG7Wg7GCy2j9msNqzzb6W9aWcOnZmGJQu+/9tezsFI=,iv:M/CYyZnYSnCDXd4JBsyeR0Aav9ER0xZ+G2jmt0nfLLs=,tag:EY9MLwB9Pd6ggEQTDKZoLg==,type:str]
sops:
kms: []
gcp_kms: []
@@ -83,16 +83,16 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdzFqa1N0TkxXeUxvUEFP
- QU55MVNEa3gvRkJiVHY1S1BOS1lzZ1l3S2dNCjZ2VjdsMHEwQmd1My9SNXVZcEth
- dXBra0U4anROSzRrYjFtdTc5L1dyZncKLS0tIFR3d3I1UHo4dTRnTWg3RUtXd2tD
- RXd3S2xvY0VUdzdud3h6S3J0cFhqQm8KY8YyTmxH0uXSEj2di/g6eJxHhANDsekt
- o4wbxiQNHdQdSgPyIYHf+KEj7v/9V5iaKlXsVIWcmSvDfIyzzDLC6A==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBaG15Q1dnMzhqRDVGQjJT
+ ZFkxWXBPRGo5WWZPM2FWRVB1Ujk5cHBWb2h3CnFKRXc2SXl3UW9vZWE2RDlzZVRE
+ WkREZS9IbWdOU3FjMzdrems5SThwNWsKLS0tIHdDNWlMWHk3a2h0ZS9OUnR5L2NH
+ UWNBRnhzV3dmSjlZZ2ZITHp3dmVOWFUK4lnBo3zKdmtctW9g2xqhg6NWyHXIIfio
+ rzy7KPPv8P2CfvlVHfLyLr1gDnHKLPAvwMdrscSjSXuqUk0r+Cgwng==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-02-19T14:43:45Z"
- mac: ENC[AES256_GCM,data:Y9GZ8y4E1MYcO0t58vsC5h2Tv5xGfE7ACylRTtMYjv2EsENavElY7hZB4YzDmEy+L2AIfm+5GKAj8mi/I9/FdHqTHroOR3oEWb6z/EdLcSg5xhB+Nds0uXG9lmve86+jH0Pmer7xbVWiTYWV97KeffU8AqnzcBgzwg8nXSGOqPQ=,iv:D6cyxRBthnRUooi/JSsufkGrbykO6Ge20zTVRhQl6cA=,tag:BVSDQfLHdvRqcEWKQKS20Q==,type:str]
+ lastmodified: "2025-07-11T06:55:22Z"
+ mac: ENC[AES256_GCM,data:jK9anMBm8ehDxj4ESUq8Fi5XgSVbXamFSxDnF5hqSEEpSVAd3opapLRRXkA6RQyuB/ny0yvyIIN+RSRrSpQKo3plJJfWYaa1gVugYKCCATmi1HVjugSKccTLy7ZO5Qj9N1oVlbZJHPc01X8qc4vUmuWeAdvdF68KgI75apcLc3Q=,iv:Q0PhSDSgdF+kTbYX0JLeDtUiwDEgFGRAf6wOdmhwpKA=,tag:wBv17f+seY5kHrpekxN/7Q==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
---
apiVersion: gateway.networking.k8s.io/v1
@@ -122,60 +122,16 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdzFqa1N0TkxXeUxvUEFP
- QU55MVNEa3gvRkJiVHY1S1BOS1lzZ1l3S2dNCjZ2VjdsMHEwQmd1My9SNXVZcEth
- dXBra0U4anROSzRrYjFtdTc5L1dyZncKLS0tIFR3d3I1UHo4dTRnTWg3RUtXd2tD
- RXd3S2xvY0VUdzdud3h6S3J0cFhqQm8KY8YyTmxH0uXSEj2di/g6eJxHhANDsekt
- o4wbxiQNHdQdSgPyIYHf+KEj7v/9V5iaKlXsVIWcmSvDfIyzzDLC6A==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBaG15Q1dnMzhqRDVGQjJT
+ ZFkxWXBPRGo5WWZPM2FWRVB1Ujk5cHBWb2h3CnFKRXc2SXl3UW9vZWE2RDlzZVRE
+ WkREZS9IbWdOU3FjMzdrems5SThwNWsKLS0tIHdDNWlMWHk3a2h0ZS9OUnR5L2NH
+ UWNBRnhzV3dmSjlZZ2ZITHp3dmVOWFUK4lnBo3zKdmtctW9g2xqhg6NWyHXIIfio
+ rzy7KPPv8P2CfvlVHfLyLr1gDnHKLPAvwMdrscSjSXuqUk0r+Cgwng==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-02-19T14:43:45Z"
- mac: ENC[AES256_GCM,data:Y9GZ8y4E1MYcO0t58vsC5h2Tv5xGfE7ACylRTtMYjv2EsENavElY7hZB4YzDmEy+L2AIfm+5GKAj8mi/I9/FdHqTHroOR3oEWb6z/EdLcSg5xhB+Nds0uXG9lmve86+jH0Pmer7xbVWiTYWV97KeffU8AqnzcBgzwg8nXSGOqPQ=,iv:D6cyxRBthnRUooi/JSsufkGrbykO6Ge20zTVRhQl6cA=,tag:BVSDQfLHdvRqcEWKQKS20Q==,type:str]
+ lastmodified: "2025-07-11T06:55:22Z"
+ mac: ENC[AES256_GCM,data:jK9anMBm8ehDxj4ESUq8Fi5XgSVbXamFSxDnF5hqSEEpSVAd3opapLRRXkA6RQyuB/ny0yvyIIN+RSRrSpQKo3plJJfWYaa1gVugYKCCATmi1HVjugSKccTLy7ZO5Qj9N1oVlbZJHPc01X8qc4vUmuWeAdvdF68KgI75apcLc3Q=,iv:Q0PhSDSgdF+kTbYX0JLeDtUiwDEgFGRAf6wOdmhwpKA=,tag:wBv17f+seY5kHrpekxN/7Q==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
- version: 3.9.1
----
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: SecurityPolicy
-metadata:
- name: oidc-capacitor
- namespace: flux-system
-spec:
- targetRefs:
- - group: gateway.networking.k8s.io
- kind: HTTPRoute
- name: capacitor
- oidc:
- provider:
- issuer: https://auth.midnightthoughts.space/application/o/capacitor/
- authorizationEndpoint: https://auth.midnightthoughts.space/application/o/authorize/
- tokenEndpoint: https://auth.midnightthoughts.space/application/o/token/
- clientID: LKNnKYcm816EEnnFTmEdfo91kmWyJnc3lrh98NWW
- #gitleaks:allow
- clientSecret:
- name: capacitor-oidc-config
- #redirectURL: https://ui.k8s.midnightthoughts.space/oauth2/callback
- #logoutPath: /logout
- refreshToken: true
- cookieDomain: midnightthoughts.space
-sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdzFqa1N0TkxXeUxvUEFP
- QU55MVNEa3gvRkJiVHY1S1BOS1lzZ1l3S2dNCjZ2VjdsMHEwQmd1My9SNXVZcEth
- dXBra0U4anROSzRrYjFtdTc5L1dyZncKLS0tIFR3d3I1UHo4dTRnTWg3RUtXd2tD
- RXd3S2xvY0VUdzdud3h6S3J0cFhqQm8KY8YyTmxH0uXSEj2di/g6eJxHhANDsekt
- o4wbxiQNHdQdSgPyIYHf+KEj7v/9V5iaKlXsVIWcmSvDfIyzzDLC6A==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-02-19T14:43:45Z"
- mac: ENC[AES256_GCM,data:Y9GZ8y4E1MYcO0t58vsC5h2Tv5xGfE7ACylRTtMYjv2EsENavElY7hZB4YzDmEy+L2AIfm+5GKAj8mi/I9/FdHqTHroOR3oEWb6z/EdLcSg5xhB+Nds0uXG9lmve86+jH0Pmer7xbVWiTYWV97KeffU8AqnzcBgzwg8nXSGOqPQ=,iv:D6cyxRBthnRUooi/JSsufkGrbykO6Ge20zTVRhQl6cA=,tag:BVSDQfLHdvRqcEWKQKS20Q==,type:str]
- pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
---
apiVersion: networking.k8s.io/v1
@@ -202,14 +158,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdzFqa1N0TkxXeUxvUEFP
- QU55MVNEa3gvRkJiVHY1S1BOS1lzZ1l3S2dNCjZ2VjdsMHEwQmd1My9SNXVZcEth
- dXBra0U4anROSzRrYjFtdTc5L1dyZncKLS0tIFR3d3I1UHo4dTRnTWg3RUtXd2tD
- RXd3S2xvY0VUdzdud3h6S3J0cFhqQm8KY8YyTmxH0uXSEj2di/g6eJxHhANDsekt
- o4wbxiQNHdQdSgPyIYHf+KEj7v/9V5iaKlXsVIWcmSvDfIyzzDLC6A==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBaG15Q1dnMzhqRDVGQjJT
+ ZFkxWXBPRGo5WWZPM2FWRVB1Ujk5cHBWb2h3CnFKRXc2SXl3UW9vZWE2RDlzZVRE
+ WkREZS9IbWdOU3FjMzdrems5SThwNWsKLS0tIHdDNWlMWHk3a2h0ZS9OUnR5L2NH
+ UWNBRnhzV3dmSjlZZ2ZITHp3dmVOWFUK4lnBo3zKdmtctW9g2xqhg6NWyHXIIfio
+ rzy7KPPv8P2CfvlVHfLyLr1gDnHKLPAvwMdrscSjSXuqUk0r+Cgwng==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-02-19T14:43:45Z"
- mac: ENC[AES256_GCM,data:Y9GZ8y4E1MYcO0t58vsC5h2Tv5xGfE7ACylRTtMYjv2EsENavElY7hZB4YzDmEy+L2AIfm+5GKAj8mi/I9/FdHqTHroOR3oEWb6z/EdLcSg5xhB+Nds0uXG9lmve86+jH0Pmer7xbVWiTYWV97KeffU8AqnzcBgzwg8nXSGOqPQ=,iv:D6cyxRBthnRUooi/JSsufkGrbykO6Ge20zTVRhQl6cA=,tag:BVSDQfLHdvRqcEWKQKS20Q==,type:str]
+ lastmodified: "2025-07-11T06:55:22Z"
+ mac: ENC[AES256_GCM,data:jK9anMBm8ehDxj4ESUq8Fi5XgSVbXamFSxDnF5hqSEEpSVAd3opapLRRXkA6RQyuB/ny0yvyIIN+RSRrSpQKo3plJJfWYaa1gVugYKCCATmi1HVjugSKccTLy7ZO5Qj9N1oVlbZJHPc01X8qc4vUmuWeAdvdF68KgI75apcLc3Q=,iv:Q0PhSDSgdF+kTbYX0JLeDtUiwDEgFGRAf6wOdmhwpKA=,tag:wBv17f+seY5kHrpekxN/7Q==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/infrastructure_talos/controllers/capacitor_temp.yaml b/infrastructure_talos/controllers/capacitor_temp.yaml
@@ -0,0 +1,43 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+ name: oidc-capacitor
+ namespace: flux-system
+spec:
+ targetRefs:
+ - group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: capacitor
+ oidc:
+ provider:
+ issuer: https://auth.midnightthoughts.space/application/o/capacitor/
+ authorizationEndpoint: https://auth.midnightthoughts.space/application/o/authorize/
+ tokenEndpoint: https://auth.midnightthoughts.space/application/o/token/
+ clientID: LKNnKYcm816EEnnFTmEdfo91kmWyJnc3lrh98NWW
+ #gitleaks:allow
+ clientSecret:
+ name: capacitor-oidc-config
+ #redirectURL: https://ui.k8s.midnightthoughts.space/oauth2/callback
+ #logoutPath: /logout
+ refreshToken: true
+ cookieDomain: midnightthoughts.space
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Y1dqRnR6Wlc5R0xxMXRB
+ WWtDcFFETFAzcjdVempiSmtWMkdFNmZabkdnCmxoYjdFVisxQUhKSWtNWDZ0UTQw
+ ZnJFZzY5UmhlWU5aVyszSGg2VzBadXcKLS0tIE02b2xzY1pPWHZGSTUxSnc1SkNa
+ RENiUGZkZ1VJZm0xVHltbFR5azlRY28K8OyBCdnNoryiln5lgxIjgPXL0eigUlQj
+ eo7aPaQr7KZy25MGpNHEMOFxk8B6QzgWS+KtXtAf/iWwl0PoRRFsFw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-11T06:55:24Z"
+ mac: ENC[AES256_GCM,data:4qrKYJZhlURM0hBWv6XrL+d2DYinPOdgfXxnilxFO/lpemMjb8Jqu2qRYwhlaPWFHafVFj6o3wJ4ImGqqoKM7q2kSkCUEAmbWD2ioVRsqVOD6IztoFhAVDkEuAcyCRjcJeUELy4JXDARl6jd4ev+7AXJ4k80gCLBNMRgBWCW1lw=,iv:uTVK0q+YYPmazP4SzKKPhH0Jo76kR8kIvNDRxlgVqg8=,tag:kHI9zsb/MueKxZ6nAykaBA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/infrastructure_talos/controllers/cloudnative-pg-operator/operator.yaml b/infrastructure_talos/controllers/cloudnative-pg-operator/operator.yaml
@@ -24,12 +24,8 @@ spec:
# causing spurious drift detection
force: true
values:
- #image:
- # repository: ghcr.io/mtrnord/workaround_db_operator
- # pullPolicy: Always
- # tag: latest
- monitoring:
- podMonitorEnabled: true
- grafanaDashboard:
- create: true
- namespace: monitoring
+ #monitoring:
+ # podMonitorEnabled: true
+ # grafanaDashboard:
+ # create: true
+ # namespace: monitoring
