commit ecca58508c778a803c5e4713fc748cce4ae6502c
parent 1a20fc33173ff3de3d319ae014c023b2cbb773eb
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 13 Dec 2025 19:14:35 +0100
add github config to sentry
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
2 files changed, 140 insertions(+), 133 deletions(-)
diff --git a/apps/talos_cluster/sentry/release.yaml b/apps/talos_cluster/sentry/release.yaml
@@ -1,136 +1,143 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
- name: sentry
- namespace: sentry
+ name: sentry
+ namespace: sentry
spec:
- releaseName: sentry
- chart:
- spec:
- chart: sentry
- version: 27.8.x
- sourceRef:
- kind: HelmRepository
- name: sentry
- interval: 60m
- timeout: 20m0s
- values:
- ipv6: true
- user:
- create: true
- email: mtrnord@nordgedanken.dev
- password: ENC[AES256_GCM,data:Fpt9rdvQgDQX,iv:Um52XDuSDJDSfINDhv8JcVMzTzQKxpdjAdDEBAaq+mw=,tag:5STBL+rdlM8rzRCOlhcUJw==,type:str]
- # this is required on the first installation, as sentry has to be initialized first
- # recommended to set false for updating the helm chart afterwards,
- # as you will have some downtime on each update if it's a hook
- # deploys relay & snuba consumers as post hooks
- asHook: true
- hooks:
- dbCheck:
- image:
- repository: toolbelt/netcat
- tag: latest
- pullPolicy: Always
- vroom:
- persistence:
- enabled: true
- size: 5Gi
- accessMode: ReadWriteMany
- storageClass: longhorn
- geodata:
- persistence:
- storageClass: longhorn
- sentry:
- singleOrganization: true
- web:
- enabled: true
- features:
- orgSubdomains: false
- enableProfiling: false
- enableSessionReplay: true
- enableFeedback: true
- enableSpan: true
- enableUptime: false
- system:
- url: https://sentry.mtrnord.blog
- adminEmail: ENC[AES256_GCM,data:plZYpaAaFk//QxrQjpH8yv1bJbofLR8rce0Or1Sh,iv:uAhawuOcnuDFFzFs+HPbfHmzt+nWoD9z2V/uh9VObog=,tag:i3JkQx+fpuXst6ArkryK1A==,type:str]
- public: false
- secretKey: ENC[AES256_GCM,data:BweqTvfnZ0ord278V3S2R71fU1cuFSNee8zUsXBmRibHdbdHbJambBfMsFuXAv1mv9sgIRCjsJir/cCxxiVwAg==,iv:YqtVYNFluR9xKIdJTzhD5BO7dPcikV4QBCnR5bbtQOE=,tag:2qe/cg2FyQ9j4G/HFlYYMQ==,type:str]
- mail:
- backend: smtp
- smtp:
- host: mail.midnightthoughts.space
- useTls: true
- useSsl: false
- port: 587
- username: support@midnightthoughts.space
- password: ENC[AES256_GCM,data:fNsnS+z80azxzL0avx32NXwOUwcM31OrdIDGUJ1GWZy+Uvm+ylSP7SRa+cS5hy3Wltng6TbsvMs6zQ93zB7P4Q==,iv:pkFfVCUKg2LCQUST/92KZEnx8PfKUZ1YV0mGnwJDkBQ=,tag:CmyyNTmSMtHuNkv+i88yuQ==,type:str]
- from: Sentry <support@midnightthoughts.space>
- auth:
- register: false
- ingress:
- enabled: false
- filestore:
- persistence:
- enabled: true
- size: 5Gi
- accessMode: ReadWriteMany
- storageClass: longhorn
- clickhouse:
- persistentVolumeClaim:
- enabled: true
- dataPersistentVolume:
- storage: 20Gi
- storageClass: longhorn
- accessModes:
- - ReadWriteOnce
- - ReadWriteMany
- zookeeper:
- persistence:
- enabled: true
- size: 8Gi
- accessModes:
- - ReadWriteOnce
- - ReadWriteMany
- storageClass: longhorn
- redis:
- master:
- persistence:
- enabled: true
- size: 5Gi
- accessModes:
- - ReadWriteOnce
- - ReadWriteMany
- storageClass: longhorn
- postgresql:
- enabled: false
- externalPostgresql:
- port: 5432
- username: sentry
- password: ENC[AES256_GCM,data:S14yKVunj1oBW7RyXgu6dpZPqv7hHyxJEB7YwJNPwl3WpyZYQg9TCgc2FdHE+rn8oQvk5HLDbCJVJR9cxj23dg==,iv:i2F51Jdy+8VIXh6gtcR7SN5xAShGMEOQmfNtqbZNSi4=,tag:QiFIZ6PF2TOTpJBEJRqCxg==,type:str]
- database: sentry
- connMaxAge: 600
- host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local
- sslMode: require
- rabbitmq:
- enabled: false
+ releaseName: sentry
+ chart:
+ spec:
+ chart: sentry
+ version: 27.8.x
+ sourceRef:
+ kind: HelmRepository
+ name: sentry
+ interval: 60m
+ timeout: 20m0s
+ values:
+ ipv6: true
+ user:
+ create: true
+ email: mtrnord@nordgedanken.dev
+ password: ENC[AES256_GCM,data:B3Af+D9KOFNg,iv:cvGE0zGM1Bo8cHe+hCN8VZ9nwsRtrB4eaR+tJrgLZeY=,tag:EacDHrjzYQBuaMG2xU4D9Q==,type:str]
+ # this is required on the first installation, as sentry has to be initialized first
+ # recommended to set false for updating the helm chart afterwards,
+ # as you will have some downtime on each update if it's a hook
+ # deploys relay & snuba consumers as post hooks
+ asHook: true
+ hooks:
+ dbCheck:
+ image:
+ repository: toolbelt/netcat
+ tag: latest
+ pullPolicy: Always
+ vroom:
+ persistence:
+ enabled: true
+ size: 5Gi
+ accessMode: ReadWriteMany
+ storageClass: longhorn
+ geodata:
+ persistence:
+ storageClass: longhorn
+ sentry:
+ singleOrganization: true
+ web:
+ enabled: true
+ features:
+ orgSubdomains: false
+ enableProfiling: false
+ enableSessionReplay: true
+ enableFeedback: true
+ enableSpan: true
+ enableUptime: false
+ system:
+ url: https://sentry.mtrnord.blog
+ adminEmail: ENC[AES256_GCM,data:vGMEbI3jkiQKMB2oUwH/3qYD9o4jGg8hvH4+5f9C,iv:5a545ZSXWkt8OcBXK5SOSMPnTtcNiiFd6o9eQyuSgR4=,tag:JsAy7WO18qJDiYhtIrnZ1A==,type:str]
+ public: false
+ secretKey: ENC[AES256_GCM,data:MKSDeG68U+tXEHSAM8DrUGyhzZALHOnN7Lpyr47fMiDNTEX1TAxEykgRNNtyhTJXmCWTGS3Ez963ABeWdw1QCA==,iv:/90nzu/pl8B9bt9leuaCX9LWVtc5tKH5+92USKkDR8I=,tag:+UCfXUDSTcKvSsJLBZnBVA==,type:str]
+ mail:
+ backend: smtp
+ smtp:
+ host: mail.midnightthoughts.space
+ useTls: true
+ useSsl: false
+ port: 587
+ username: support@midnightthoughts.space
+ password: ENC[AES256_GCM,data:KJyrV08Q8r1NPP7evSOoapqftpNtFRsFeC3dufT1XlTFEinHk7f/lbJkMFrW+Wq1LUzahruETca6BJgEGwIQvw==,iv:3+QJscUKyz68CrHUJq5VVS58KQ1QHUGiGr+wgFhPkd4=,tag:HPgMp2gfoFgfJPhl125gPg==,type:str]
+ from: Sentry <support@midnightthoughts.space>
+ github:
+ appId: ENC[AES256_GCM,data:RfCPY0rlCg==,iv:j4uf4TNl6lOp2s6MT2/PZ1yvOjU02M+m1AWifv/VDMo=,tag:SFcEi2r7VZz3Q+2Rp+m/Pw==,type:str]
+ appName: Sentry Midnightthoughts
+ clientId: ENC[AES256_GCM,data:v5Xuk2EkMCK15UEOmWfWketR3Fo=,iv:dFLM63WfGeHvUa4LlqTb61DuqowT/d7zC7uJw9Burhs=,tag:r56u1y1q9QBMrlQAYDdC4w==,type:str]
+ clientSecret: ENC[AES256_GCM,data:FuqjoPCF8Lqa2k/li9pfZ7ZpoKzsI42wQAAwZzOmdU3f5pjEBPQvKQ==,iv:GInBKLixCeDJeB6/juFBonh+Gx7lXQa/oPOzJGaLbGo=,tag:5af8y+3b3LlueN6GiRGQgw==,type:str]
+ privateKey: ENC[AES256_GCM,data:HDPbGkZ4hrM4SrG/dW3r5wymixJE09ue7lrt04T42oa8E4RELMB/BpAEVpYJNSGkQiA+5K54VbgngBxlASlQMirjcpZwPqZ6jFPIP++JoIUznpo61UW7cz+t8eioNjdOsEH3bgqDDKqXUjVhyubdJRshHVJQSNr2szR/2109+46VoQ4gGzpB9YQXpxtO8IhpU/2FFJTxCxLnWXtJuwX0vuEpeIEg1iiK5pTZTcNbBbp4u5lf0FoF4kttdwtzcWvlWRBmS1Q/3sxaCSzgu8LHnJwRDC2GY1X4Vfh5O9ckFAFYqx9hJ732yte/YFXKaB/JDMciVHlw5ert4V6Eyrz8Qt6no/T0RsppTSmXgLspjniVjtujwlAIYJ93bdY+4pVRuVkwN4GximejC5Q3c6uq6BCt5eIBad4/bvNqBvP4skDy9198A47lVLHLptuzsJQ2vy1LI3Sv1HMNcrz4WnKed4KeBOiXZE1scyQyD8/31gpaJPVg6LMhHiznPECwDM5R2Y9DLS7p50+uvrajeS7UHgww1sGEaAF8a5VdX9Z++0XYmUHGw4ehPvoxEYmBIkuC/XyYY8/iWVIFuLNHkH+gfWKsZ8KbBdaE3DeVk8509Zsko6zMYOFoIIX95FvMSSt9AVmyKilkL5j1336y0gX0AKdD5LIaU3yQn4Xgx6AhevlPrRUeMmZA9ERTyiMyoIuVdgjSpYiH8Ltgfx1pKbaJAfPJqrIXdgRdna89MU0E++i2K+ixnVkhxVxfz7P0wZ8HkJCnMEpWj/QFjkJa48tQDr2wviYOCgjPDdKOwlNt6bYIT1zwyz5sBqRcIHWIPRt3ym6v3iP/8yKBJPjiWRzEO31I55JuFdznFC1v/VHNqwDhW7TBsygqaAlAR946dy+u0jwecckgN+qtvvGE2YKN1mvsJpn/nAFEc9LUJn5Uc+llwkmcQZbl+2tu00SJkozp+L+0ntN2rsvdXFCn3Fb93CPQkJLez+0aZ3XdyU3ZiDz25SEvtzD/8rxzPBIAljbQL3KhqIGIFT+btDvtHkrciScIAHH1ON+yJjyxMXxlhcK7UFNvLZ5HDcyTIYem1hA7mwEvLCXZ2huemvsog03H0KAOPduEQlyoQZKdkBEBeoG3ydeTWjE9LnNlUSNlgD8jYcRAw/NfzhDgJpGV8k+mAJQbo7j1/txshps2qSgIfUW+9rZhehc4GBI9BULo8wA+zIFL2DXa/Mrkto5ruXdYPW2TBHs3zw6G9lPvNeyuDB2xsi4gjecZeyXEU3YZJLMSsr55aX+dT4psVISvpYcNmOc1ut2Ofi22282Fek7bB9r4uGvulhHRqfa6HbtVPwEmA6S2j0V6hvvdWQzhSVB9eBeZlLxF7+MQBz090vjtVD988MlhMAjRk3ZTCcCsYgInddi/LUP6ApxXL9hgkuu6QKho3I4Xd9QBTNxRYrr4UqT84qIYfQRVX7rERftGq6h1lYwxf7bpBdCOR5/xi7x8qv8yogvaaoZtwjYT4ikx+rHqz9oxqRA448bOg8SNzG2zbQEaC6J04FY5JY2ZfQtH5JDUXt0RNhMhP39BMU7ZbTZ3/kLp9zgzSXL5na3kr9632Z6SgIQNdqi3p3WLsYWMmiqlaJNeuR7m4/KXniAOLuHKwH0D9DTiZ0LywkVJiriHgLyWmuQzAB+VakDO7xasRCMzvupNFIsv5qAK+cdroB4uuN2qtyWSFRSQqk1QgTP8bzNj9rlVxZbwe47rAq5MyaHsuw+SbQZNED+s3zTZcdy9YS+L38ituRFEewrCH2IzynCDJ3zN6WdMMx9xBUEis2hzznydKMWri/qFyCfl9OR9f4TbBteG18xEsmG6M7Sl7AsJ/DPHoNzuElSANKWWEK/aOC4UXiqAr9QO3Ejr2AQ1qSTlgfgNgOVyJ7LPhJgmlvwccsdC+6Bx1t7bjRP7cIgoAjLb6U61hffDoWQJOuGC5/ZIqipmQLKiCXxY4JyszUwYJatG6NC+URnUJM9U29YN/h7brJkyH/FLoaYkvpq9vcnriG0r2P1rlld1xii/jbTWxAZbFmfKRA3JOYoachcc2yFeOy3fLysmrT7Aqh2QlwlDbtg/7u2vZv94Ax2Y71CDNHWq5ln3n90dyThOQluEahKuQOPCS5S0X8yY4xXBS/Kp55TirtwjB9o9VMcJrMSY/lIEQZLJIri2YRwRE9hbHxEsbC457pbvunJFa8+m28yv1LzHh4qB1cBUZUc=,iv:lDKmP3wugyvPt3pTG+O57u0mdZFz80KMGZ9DK8WY1Ec=,tag:5vV1DZRP3euVWH5cyOj1Og==,type:str]
+ webhookSecret: ENC[AES256_GCM,data:uF8F+Qy5RIUcao4pYUafCOjt3Bwp9Mia4nWJSLlEZ5a0fMjomYPyajRMb4EwqnndPE9pXQtKt0+4KYKfIstd4g==,iv:XGZvMGVtVYXUzITMK6Li8hqtqfVqx5FKbhQOMpEHy6E=,tag:MTVQyoAZ/BoZuSTRtIP2Uw==,type:str]
+ auth:
+ register: false
+ ingress:
+ enabled: false
+ filestore:
+ persistence:
+ enabled: true
+ size: 5Gi
+ accessMode: ReadWriteMany
+ storageClass: longhorn
+ clickhouse:
+ persistentVolumeClaim:
+ enabled: true
+ dataPersistentVolume:
+ storage: 20Gi
+ storageClass: longhorn
+ accessModes:
+ - ReadWriteOnce
+ - ReadWriteMany
+ zookeeper:
+ persistence:
+ enabled: true
+ size: 8Gi
+ accessModes:
+ - ReadWriteOnce
+ - ReadWriteMany
+ storageClass: longhorn
+ redis:
+ master:
+ persistence:
+ enabled: true
+ size: 5Gi
+ accessModes:
+ - ReadWriteOnce
+ - ReadWriteMany
+ storageClass: longhorn
+ postgresql:
+ enabled: false
+ externalPostgresql:
+ port: 5432
+ username: sentry
+ password: ENC[AES256_GCM,data:hjAL/V98v8/I5Xds87JlPtqVjmoXRDKLVUuYqQ4RCcuxvl/nMtPFPMsMv/fqupKuQAfm0bLFL0qyLHP6ICQ8BQ==,iv:ONsrKtx1/n2fEVZphYDtReer2/qebMkuIxvMG507qUM=,tag:oCOrDc7AMIqm8iLc+HRx8A==,type:str]
+ database: sentry
+ connMaxAge: 600
+ host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local
+ sslMode: require
+ rabbitmq:
+ enabled: false
sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPa2FYR1FVU2s5ZTkzVkpY
- cjRGNDVlakUvc2Fjc0NGTW5EcStwbEtOZWx3CjRlVk05eDl3UWx4ZHdEOTFBdnNK
- V0thYnN0YXJodWdjaTBxQ0I0K2E1b00KLS0tIGpZMSt1SS9iZG5Oa0MzVXZyTWJF
- TktKWlpEWVNoVDZ1aHZFcUZCSEpWTDgKD4oZuOmSthgYz3phX8fjvGnzngk87X3o
- WP0TcjIcmEqx7U1+qjCDl+bvaiGg3R90nqNWtvMbnsJi23KQOWAkHA==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-12-13T15:16:19Z"
- mac: ENC[AES256_GCM,data:EJ2ZjcrNeaYXIZXRajUbcbptN3iE7UwLOVruaC4ciQ3TtFSZ4y9s8vMFpkEboR2OFoj6TwNNJlsC7m+t+kwWKbGVsFb+lp9O5HIkrCZmGB+rIvOoAm7pTGHqB7+Mzlb5jO75iArZq/bqGoa1QLNS/4O+HSVItnNHqif5tmhFBWc=,iv:8DXY0H2sDM7Pb+/O6VFf29G6OWnOS1zC5W3JSn2ArGM=,tag:DL9Z9YtrtU1p7pt+xVtupw==,type:str]
- pgp: []
- encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey)$
- version: 3.9.1
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSU5xWjhoUkhDWWw5dXg0
+ N2prS1dtbEJmRk5SVmJ5UmJ3c0VrYURpd0UwCkcrV1pFbkVSQ3hxZDQ0V3plbDdU
+ bklWd1pRbGliL3dJQ0tsYkJDOFV2RGMKLS0tIG1CZmlIWERyU0JpMTNtTElxdkNC
+ NjFDaHNRRlNjd2YzV2lhazVJeTJBRVUK0wCcxY4ZQEDC2uDDQIXwLX6P7D/AMm/O
+ J284p846sgBLjesLf7vDhJi7Rp5f5wWlJGLkMnitq8qdRgVcP1IfVw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-12-13T18:14:23Z"
+ mac: ENC[AES256_GCM,data:roHCWTWV5pyEAPhIT/FoGwI6wQlFGjBveAm0VbY/Q4X1UOUNNDAu0NYZmaWQYoKeZLPWbNCNuCVxyJfNtigXpYauKGtAAflMnKgvK0NlNpUThChAPu2RSvBmfQlF2e4nF1HCGcrtgMNO9SG/yat3yM4TKKyiui5/vTR5u+iS9dU=,iv:QCsrt53RQFjpX3ZH5w7Hxc8Ar1gH7KPoT7po9yFNfSo=,tag:aR9hnF+CyqszmX69+xK5+w==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/encrypt.sh b/encrypt.sh
@@ -5,13 +5,13 @@ if [ -z "$1" ]; then
# Encrypt apps/talos_cluster/externaldns/release.yaml as a whole
sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey)$' \
+ --encrypted-regex '^(extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$' \
--in-place apps/talos_cluster/externaldns/release2.yaml
else
echo "Encrypting file: $1"
sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey)$' \
+ --encrypted-regex '^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$' \
--in-place "$1"
fi
