commit 2eec164e9382a75386f625329ea4e33bc5a4959b
parent 8bdae2ebd29c9f57681b64ae91bf6b832b33787b
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 20 Dec 2025 23:27:04 +0100
lets use the boring way
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
3 files changed, 33 insertions(+), 28 deletions(-)
diff --git a/apps/talos_cluster/immich/database-credentials.properties b/apps/talos_cluster/immich/database-credentials.properties
@@ -1,20 +0,0 @@
-{
- "data": "ENC[AES256_GCM,data:/w6z8Xa32itz+FJhYB9rYNDd/lxjdz3pXuoaf2VRnXgVt9dXdX/ooi22bND4ZAM9Rg6t/hnfexH0RLnXGV8z461UwxR/EB7owUw52cPKqcMDZm9bNcWT40w14e8QZnphu3+/AfhcrX8L2RkT0lyJM803R/mmuXqXypM7BCeauUlj672fAMOXr+u79B3Jh5Ae4nJRZ/ElcM+0WXiqnWcc+fk=,iv:6DWTgPE35qETgM7wKZitBrhCzHuwZT3gLColRoDyYoM=,tag:yR3S2KTaqJBCZSlus/4dKQ==,type:str]",
- "sops": {
- "kms": null,
- "gcp_kms": null,
- "azure_kv": null,
- "hc_vault": null,
- "age": [
- {
- "recipient": "age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh",
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpZWlOV0dFWTA2M29maHVq\nZTFyaGtqdTNFTExmMWd0ZklVWGRnVjMyQUhZCm40ZXV6N3ZZb1ZRbmNWNkYrUGh2\nZjV2Q0ZRb3VKakNDakRPNVluaHBPTzQKLS0tIEdZcDlNUEVqM2ZHRytwL2x0NVd4\nT2FGMUZUWFFIUDhsUTVPM2FzS1gzQkUKxEBcF0ovelrOQF1Q+AI3/TkWzpMLHJP9\nHqQieF2otG5kOiG+6pjXS2aOekwf4hsPTxtiZxQkAH0YaK7cXSrIgg==\n-----END AGE ENCRYPTED FILE-----\n"
- }
- ],
- "lastmodified": "2025-12-20T22:23:21Z",
- "mac": "ENC[AES256_GCM,data:8Uoxl877mSHE6c8fIms2aVzGqmwO7rIV4zsYYgXvuw0ew1c9Mb9dnMkvhJVm3VGCABSaago+eQgEs2aGqwjV34c/Kzf+5s3LxdI/2IaVfoB03HEGsqwlFnamrwSORu69/YdzN0z2hOJqugbgE4KIQlc6cPPUZDW71M72C9+T2e4=,iv:Z32eA5f+axaBnO0p+qXcOaOjKjDblZ6tDL5DlFtl6V0=,tag:cB1sSrC3gopbCShKpKdn2Q==,type:str]",
- "pgp": null,
- "encrypted_regex": "^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$",
- "version": "3.9.1"
- }
-}
-\ No newline at end of file
diff --git a/apps/talos_cluster/immich/database-credentials.yaml b/apps/talos_cluster/immich/database-credentials.yaml
@@ -0,0 +1,32 @@
+# Secret
+apiVersion: v1
+kind: Secret
+metadata:
+ name: immich-database
+ namespace: immich
+type: Opaque
+stringData:
+ host: ENC[AES256_GCM,data:ReseNUa2mc2Cf7C17/rxjYh5K+EZkZzKBe03vMqIBcKv1seGnP5Nqzk2SG5Svgxyh/8b,iv:anQMpD9bLkyOSQeKWfIQvsVEiOUz8aW/jzXV4yJrs7g=,tag:OdFmwjnoKp5Jb1xERMTQ5A==,type:str]
+ username: ENC[AES256_GCM,data:i4xsvTHL,iv:l5Mfr9/oLlP3hqfIpDqhz8Z1KtmvgD2OxewEZChcCC8=,tag:AVOWSu1IjhzpfvtE/xTNKQ==,type:str]
+ password: ENC[AES256_GCM,data:oJuJ7ulDQoreyuML5en4UOrhwRiNBqUCgaMsxE8EDtKgZQGFmtH8O1FFiU2IUWKvYCf3/4hLAr0KPNhNbXqQWQ==,iv:Bcu4WnbNIs8QCoqIxUO0VhdCOrsYkk9g0+YE7yeVHB8=,tag:bKNZ4nQbZL/YDlEx8d11Ug==,type:str]
+ dbname: ENC[AES256_GCM,data:NYj7qrNm,iv:K867td+2mraT2ne7ga8zEsO7kRG35MCKAEZ9xdrpGbw=,tag:vURQGZYVxC4Buvk8z3D42A==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsU2doMSt0cWhSd2M2L3BN
+ VEp5UktUSWRGUWh6OHNUTlpxbThkTVBEaGlBCjFrait6N3o0RFJkVGFpSEg0VlI4
+ TFYvb1htTHVaUmNES3pMTTN3bWRJUk0KLS0tIGFVY1RxdTZtMjNNZk1lNVJxNTRz
+ WUlrOGIrRWVOSFloTnlWMFdkQXpPWm8KwmzW87pNLHUEafGJG3tDyJv1aGgqv+5X
+ U86qdfLwxtg220rm6sq1+x0qdWRlAmmg1mij920dDL9lMZ2PqRT+TA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-12-20T22:26:54Z"
+ mac: ENC[AES256_GCM,data:Xf1XzBBgz4rPJqvrvpTmamE3f1pVLh9QYAxtQRqA0qKsauFiTXx2T+gjz91RDZozhI5dVu8rq+qfVEzIMCslwi3brBASeOIDZhozdkbS3PkCWNP5a/YaL727QZ7uViIIu+SoxyBZMYIMPyUSHG3Q3H77Ad6ICvE2PmNBMv3roeo=,iv:ToqbvhLxbeikmioryuJUs2ptc2MSPMrNT0h1hA9frSE=,tag:susZLm6jz8D6iqGq9uvTFw==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/immich/kustomization.yaml b/apps/talos_cluster/immich/kustomization.yaml
@@ -3,12 +3,6 @@ kind: Kustomization
namespace: immich
resources:
- repository.yaml
+ - database-credentials.yaml
- release.yaml
- route.yaml
-secretGenerator:
- - name: immich-database
- # Prevent the name from changing on each kustomize build
- options:
- disableNameSuffixHash: true
- files:
- - database-credentials.properties
