commit f22a29979b49cf92d5049eaa84f1c523408a98cb
parent 07607c8b2964a5150c54be852fbccafbe0b9fef6
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sun, 3 Aug 2025 17:32:59 +0200
Prepare db migration
Diffstat:
9 files changed, 2244 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/authentik/certificates.yaml b/apps/talos_cluster/authentik/certificates.yaml
@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: ldap-authentik
+ namespace: authentik
+spec:
+ secretName: ldap-authentik
+ privateKey:
+ rotationPolicy: Always
+ issuerRef:
+ name: letsencrypt-dns
+ kind: ClusterIssuer
+ commonName: "ldap.midnightthoughts.space"
+ dnsNames:
+ - "auth.midnightthoughts.space"
+ - "ldap.midnightthoughts.space"
+ additionalOutputFormats:
+ - type: CombinedPEM
+ - type: DER
diff --git a/apps/talos_cluster/authentik/ingress.yaml b/apps/talos_cluster/authentik/ingress.yaml
@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+ name: authentik-ldap
+ namespace: authentik
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: ldap.midnightthoughts.space
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: ldap
+ rules:
+ - backendRefs:
+ - name: ak-outpost-ldap
+ port: 389
diff --git a/apps/talos_cluster/authentik/kustomization.yaml b/apps/talos_cluster/authentik/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: authentik
+resources:
+ - repository.yaml
+ - ingress.yaml
+ - certificates.yaml
+ # TODO: Enable once db is migrated
+ #- release.yaml
diff --git a/apps/talos_cluster/authentik/release.yaml b/apps/talos_cluster/authentik/release.yaml
@@ -0,0 +1,179 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+ name: authentik
+ namespace: authentik
+spec:
+ releaseName: authentik
+ chart:
+ spec:
+ chart: authentik
+ version: "2025.6.3"
+ sourceRef:
+ kind: HelmRepository
+ name: authentik
+ interval: 60m
+ timeout: 25m
+ install:
+ timeout: 25m
+ remediation:
+ retries: 3
+ values:
+ #global:
+ #image:
+ #pullPolicy: Always
+ # https://github.com/goauthentik/authentik/issues/12464
+ #repository: ghcr.io/goauthentik/dev-server
+ #tag: gh-version-2024.12-arm64
+ authentik:
+ secret_key: ENC[AES256_GCM,data:Qq1S+Kk6yb//WVc1sTmoIu1DO4ejWlVpg4mqYCA8+kNuc/KloUUQP33tXRGYQIlePE6ykyeqctje9h1CHND9QQ==,iv:KjCWOBFelR08Bm4n8f7FsicFNBw7gzZ1MQ9yLwh6j0s=,tag:93XCTQjxJu28uhpSayM1EQ==,type:str]
+ # This sends anonymous usage-data, stack traces on errors and
+ # performance data to sentry.io, and is fully opt-in
+ error_reporting:
+ enabled: true
+ postgresql:
+ host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local
+ name: authentik
+ user: authentik
+ password: ENC[AES256_GCM,data:7qmIA2GYyHyR8/aFK75qvDb1Ndd+OfHwGfAQP/XLCEm8/6ocrVQhotkfS3XX5JIStZXRsvohZD5VZ9j1ShYILA==,iv:bwNic3q8ZW1oMhmL80Dg7KdZ59bdu/tQvIRiwvZZ2m0=,tag:TAFMjzlJnyKS/drf69EMOA==,type:str]
+ email:
+ # -- SMTP Server emails are sent from, fully optional
+ host: mail.nordgedanken.dev
+ port: 465
+ # -- SMTP credentials, when left empty, no authentication will be done
+ username: support@nordgedanken.dev
+ # -- SMTP credentials, when left empty, no authentication will be done
+ password: ENC[AES256_GCM,data:ShLG8GLcWjiA,iv:Pb2jXjIqlELaCFshqscNGsXUCp056sZbfCvc3jEOJwc=,tag:kg4PWpf5nOtzI+2R9ahV2Q==,type:str]
+ # -- Enable either use_tls or use_ssl, they can't be enabled at the same time.
+ use_tls: true
+ # -- Enable either use_tls or use_ssl, they can't be enabled at the same time.
+ use_ssl: false
+ # -- Connection timeout
+ timeout: 30
+ # -- Email from address, can either be in the format "foo@bar.baz" or "authentik <foo@bar.baz>"
+ from: ops@nordgedanken.dev
+ worker:
+ replicas: 2
+ resources:
+ limits: {}
+ requests:
+ cpu: 107m
+ memory: 578Mi
+ deploymentStrategy:
+ type: RollingUpdate
+ rollingUpdate:
+ maxSurge: 25%
+ maxUnavailable: 25%
+ # Mount the ldap certificate to /certs
+ volumes:
+ - name: ldap-cert
+ secret:
+ secretName: ENC[AES256_GCM,data:gkdJ6ufGzmE8UIrtR/Y=,iv:ajE/NG7B17OqHu5PVtI+STkiJQA2ZTv14yfWe9TZlNw=,tag:Pyz5nG4skc/vgMl5gg+83g==,type:str]
+ # Mount the ldap certificate to /certs
+ volumeMounts:
+ - name: ldap-cert
+ mountPath: /certs/ldap
+ server:
+ # Mount the ldap certificate to /certs
+ volumes:
+ - name: ldap-cert
+ secret:
+ secretName: ENC[AES256_GCM,data:UU2WJB3n7WzQRX5OEIk=,iv:YjPGIgu7UWhMEdAH/LJSHdDkin4tMMY2ZzBOguT9VQU=,tag:ryzrMsKoaViRmpx7URHhVw==,type:str]
+ # Mount the ldap certificate to /certs
+ volumeMounts:
+ - name: ldap-cert
+ mountPath: /certs/ldap
+ replicas: 2
+ deploymentStrategy:
+ type: RollingUpdate
+ rollingUpdate:
+ maxSurge: 25%
+ maxUnavailable: 25%
+ resources:
+ limits: {}
+ requests:
+ cpu: 181m
+ memory: 628Mi
+ env:
+ - name: AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS
+ value: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fe80::/10,::1/128,10.244.0.0/16,fc00:0::/96,fd00::/7
+ ingress:
+ annotations:
+ cert-manager.io/cluster-issuer: letsencrypt-dns
+ external-dns.alpha.kubernetes.io/hostname: auth.midnightthoughts.space
+ enabled: false
+ hosts:
+ - auth.midnightthoughts.space
+ - ldap.midnightthoughts.space
+ paths:
+ - /
+ pathType: Prefix
+ tls:
+ - hosts:
+ - auth.midnightthoughts.space
+ - ldap.midnightthoughts.space
+ secretName: auth-midnightthoughts-tls-secret
+ postgresql:
+ enabled: false
+ redis:
+ enabled: true
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2aEZVdzVpbWFYYkxlR1lJ
+ TElyM0tSeDMrQjNXbWIyV0dYcDNJUjFydjF3CmNPb2IzSnRSeFVIaFUzS2dtaktk
+ VXpvV0pGZ2tOdHhBM0hJQjRhWjJaVEUKLS0tIFFNdG5sazIxSkNZUUthT2Mxelo2
+ L2xFMnFYVWpPOFJqbXg1Um56dXZaVlUKlBPL7s2wl2+dJoGiC9b1oXBRvewd9LAe
+ LpuQF38AscU+pkNoi2WBFw2MsvEYF+EtPJczESIwiMetehRj2n4KxQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-02-19T14:22:13Z"
+ mac: ENC[AES256_GCM,data:cVtB9Yn3DtLT7DHh6r4y+Kooap4o3Vllx/nnNc8Zd2S2nQ5gmVSG/RBv88pNwCnybsUyK/Yd+1I1jwTzxIz9ZI1gosL23fLhJ9LK/Yzk3d56Z7krqXGp5IIw7I/lZyzyGlSp8R50KpGhZ8BObUU2C7mU7D+/W7ctnMj1mJLP+xg=,iv:4bdFaUt6lBYog6kpsZiixm6kYkzKRj8hwA335th9GVo=,tag:HorsmiQJ9ttuYC5rkzevCA==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: authentik
+ namespace: authentik
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - auth.midnightthoughts.space
+ - ldap.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: authentik-server
+ port: 80
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2aEZVdzVpbWFYYkxlR1lJ
+ TElyM0tSeDMrQjNXbWIyV0dYcDNJUjFydjF3CmNPb2IzSnRSeFVIaFUzS2dtaktk
+ VXpvV0pGZ2tOdHhBM0hJQjRhWjJaVEUKLS0tIFFNdG5sazIxSkNZUUthT2Mxelo2
+ L2xFMnFYVWpPOFJqbXg1Um56dXZaVlUKlBPL7s2wl2+dJoGiC9b1oXBRvewd9LAe
+ LpuQF38AscU+pkNoi2WBFw2MsvEYF+EtPJczESIwiMetehRj2n4KxQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-02-19T14:22:13Z"
+ mac: ENC[AES256_GCM,data:cVtB9Yn3DtLT7DHh6r4y+Kooap4o3Vllx/nnNc8Zd2S2nQ5gmVSG/RBv88pNwCnybsUyK/Yd+1I1jwTzxIz9ZI1gosL23fLhJ9LK/Yzk3d56Z7krqXGp5IIw7I/lZyzyGlSp8R50KpGhZ8BObUU2C7mU7D+/W7ctnMj1mJLP+xg=,iv:4bdFaUt6lBYog6kpsZiixm6kYkzKRj8hwA335th9GVo=,tag:HorsmiQJ9ttuYC5rkzevCA==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/authentik/repository.yaml b/apps/talos_cluster/authentik/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: authentik
+ namespace: authentik
+spec:
+ interval: 60m
+ url: https://charts.goauthentik.io
diff --git a/infrastructure_talos/configs/cnpg-cluster-barmancloud-ext.yaml b/infrastructure_talos/configs/cnpg-cluster-barmancloud-ext.yaml
@@ -0,0 +1,884 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ controller-gen.kubebuilder.io/version: v0.16.2
+ name: objectstores.barmancloud.cnpg.io
+spec:
+ group: barmancloud.cnpg.io
+ names:
+ kind: ObjectStore
+ listKind: ObjectStoreList
+ plural: objectstores
+ singular: objectstore
+ scope: Namespaced
+ versions:
+ - name: v1
+ schema:
+ openAPIV3Schema:
+ description: ObjectStore is the Schema for the objectstores API.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: ObjectStoreSpec defines the desired state of ObjectStore.
+ properties:
+ configuration:
+ description: |-
+ BarmanObjectStoreConfiguration contains the backup configuration
+ using Barman against an S3-compatible object storage
+ properties:
+ azureCredentials:
+ description: The credentials to use to upload data to Azure Blob Storage
+ properties:
+ connectionString:
+ description: The connection string to be used
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ inheritFromAzureAD:
+ description: Use the Azure AD based authentication without providing explicitly
+ the keys.
+ type: boolean
+ storageAccount:
+ description: The storage account where to upload data
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ storageKey:
+ description: |-
+ The storage account key to be used in conjunction
+ with the storage account name
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ storageSasToken:
+ description: |-
+ A shared-access-signature to be used in conjunction with
+ the storage account name
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ type: object
+ data:
+ description: |-
+ The configuration to be used to backup the data files
+ When not defined, base backups files will be stored uncompressed and may
+ be unencrypted in the object store, according to the bucket default
+ policy.
+ properties:
+ additionalCommandArgs:
+ description: |-
+ AdditionalCommandArgs represents additional arguments that can be appended
+ to the 'barman-cloud-backup' command-line invocation. These arguments
+ provide flexibility to customize the backup process further according to
+ specific requirements or configurations.
+
+ Example:
+ In a scenario where specialized backup options are required, such as setting
+ a specific timeout or defining custom behavior, users can use this field
+ to specify additional command arguments.
+
+ Note:
+ It's essential to ensure that the provided arguments are valid and supported
+ by the 'barman-cloud-backup' command, to avoid potential errors or unintended
+ behavior during execution.
+ items:
+ type: string
+ type: array
+ compression:
+ description: |-
+ Compress a backup file (a tar file per tablespace) while streaming it
+ to the object store. Available options are empty string (no
+ compression, default), `gzip`, `bzip2` or `snappy`.
+ enum:
+ - gzip
+ - bzip2
+ - snappy
+ type: string
+ encryption:
+ description: |-
+ Whenever to force the encryption of files (if the bucket is
+ not already configured for that).
+ Allowed options are empty string (use the bucket policy, default),
+ `AES256` and `aws:kms`
+ enum:
+ - AES256
+ - aws:kms
+ type: string
+ immediateCheckpoint:
+ description: |-
+ Control whether the I/O workload for the backup initial checkpoint will
+ be limited, according to the `checkpoint_completion_target` setting on
+ the PostgreSQL server. If set to true, an immediate checkpoint will be
+ used, meaning PostgreSQL will complete the checkpoint as soon as
+ possible. `false` by default.
+ type: boolean
+ jobs:
+ description: |-
+ The number of parallel jobs to be used to upload the backup, defaults
+ to 2
+ format: int32
+ minimum: 1
+ type: integer
+ type: object
+ destinationPath:
+ description: |-
+ The path where to store the backup (i.e. s3://bucket/path/to/folder)
+ this path, with different destination folders, will be used for WALs
+ and for data
+ minLength: 1
+ type: string
+ endpointCA:
+ description: |-
+ EndpointCA store the CA bundle of the barman endpoint.
+ Useful when using self-signed certificates to avoid
+ errors with certificate issuer and barman-cloud-wal-archive
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ endpointURL:
+ description: |-
+ Endpoint to be used to upload data to the cloud,
+ overriding the automatic endpoint discovery
+ type: string
+ googleCredentials:
+ description: The credentials to use to upload data to Google Cloud Storage
+ properties:
+ applicationCredentials:
+ description: The secret containing the Google Cloud Storage JSON file with
+ the credentials
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ gkeEnvironment:
+ description: |-
+ If set to true, will presume that it's running inside a GKE environment,
+ default to false.
+ type: boolean
+ type: object
+ historyTags:
+ additionalProperties:
+ type: string
+ description: |-
+ HistoryTags is a list of key value pairs that will be passed to the
+ Barman --history-tags option.
+ type: object
+ s3Credentials:
+ description: The credentials to use to upload data to S3
+ properties:
+ accessKeyId:
+ description: The reference to the access key id
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ inheritFromIAMRole:
+ description: Use the role based authentication without providing explicitly
+ the keys.
+ type: boolean
+ region:
+ description: The reference to the secret containing the region name
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ secretAccessKey:
+ description: The reference to the secret access key
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ sessionToken:
+ description: The references to the session key
+ properties:
+ key:
+ description: The key to select
+ type: string
+ name:
+ description: Name of the referent.
+ type: string
+ required:
+ - key
+ - name
+ type: object
+ type: object
+ serverName:
+ description: |-
+ The server name on S3, the cluster name is used if this
+ parameter is omitted
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: |-
+ Tags is a list of key value pairs that will be passed to the
+ Barman --tags option.
+ type: object
+ wal:
+ description: |-
+ The configuration for the backup of the WAL stream.
+ When not defined, WAL files will be stored uncompressed and may be
+ unencrypted in the object store, according to the bucket default policy.
+ properties:
+ archiveAdditionalCommandArgs:
+ description: |-
+ Additional arguments that can be appended to the 'barman-cloud-wal-archive'
+ command-line invocation. These arguments provide flexibility to customize
+ the WAL archive process further, according to specific requirements or configurations.
+
+ Example:
+ In a scenario where specialized backup options are required, such as setting
+ a specific timeout or defining custom behavior, users can use this field
+ to specify additional command arguments.
+
+ Note:
+ It's essential to ensure that the provided arguments are valid and supported
+ by the 'barman-cloud-wal-archive' command, to avoid potential errors or unintended
+ behavior during execution.
+ items:
+ type: string
+ type: array
+ compression:
+ description: |-
+ Compress a WAL file before sending it to the object store. Available
+ options are empty string (no compression, default), `gzip`, `bzip2` or `snappy`.
+ enum:
+ - gzip
+ - bzip2
+ - snappy
+ type: string
+ encryption:
+ description: |-
+ Whenever to force the encryption of files (if the bucket is
+ not already configured for that).
+ Allowed options are empty string (use the bucket policy, default),
+ `AES256` and `aws:kms`
+ enum:
+ - AES256
+ - aws:kms
+ type: string
+ maxParallel:
+ description: |-
+ Number of WAL files to be either archived in parallel (when the
+ PostgreSQL instance is archiving to a backup object store) or
+ restored in parallel (when a PostgreSQL standby is fetching WAL
+ files from a recovery object store). If not specified, WAL files
+ will be processed one at a time. It accepts a positive integer as a
+ value - with 1 being the minimum accepted value.
+ minimum: 1
+ type: integer
+ restoreAdditionalCommandArgs:
+ description: |-
+ Additional arguments that can be appended to the 'barman-cloud-wal-restore'
+ command-line invocation. These arguments provide flexibility to customize
+ the WAL restore process further, according to specific requirements or configurations.
+
+ Example:
+ In a scenario where specialized backup options are required, such as setting
+ a specific timeout or defining custom behavior, users can use this field
+ to specify additional command arguments.
+
+ Note:
+ It's essential to ensure that the provided arguments are valid and supported
+ by the 'barman-cloud-wal-restore' command, to avoid potential errors or unintended
+ behavior during execution.
+ items:
+ type: string
+ type: array
+ type: object
+ required:
+ - destinationPath
+ type: object
+ instanceSidecarConfiguration:
+ description: InstanceSidecarConfiguration defines the configuration for the sidecar that runs
+ in the instance pods.
+ properties:
+ env:
+ description: The environment to be explicitly passed to the sidecar
+ items:
+ description: EnvVar represents an environment variable present in a Container.
+ properties:
+ name:
+ description: Name of the environment variable. Must be a C_IDENTIFIER.
+ type: string
+ value:
+ description: |-
+ Variable references $(VAR_NAME) are expanded
+ using the previously defined environment variables in the container and
+ any service environment variables. If a variable cannot be resolved,
+ the reference in the input string will be unchanged. Double $$ are reduced
+ to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
+ "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
+ Escaped references will never be expanded, regardless of whether the variable
+ exists or not.
+ Defaults to "".
+ type: string
+ valueFrom:
+ description: Source for the environment variable's value. Cannot be used
+ if value is not empty.
+ properties:
+ configMapKeyRef:
+ description: Selects a key of a ConfigMap.
+ properties:
+ key:
+ description: The key to select.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the ConfigMap or its key
+ must be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ fieldRef:
+ description: |-
+ Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
+ spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
+ properties:
+ apiVersion:
+ description: Version of the schema the FieldPath is written
+ in terms of, defaults to "v1".
+ type: string
+ fieldPath:
+ description: Path of the field to select in the specified
+ API version.
+ type: string
+ required:
+ - fieldPath
+ type: object
+ x-kubernetes-map-type: atomic
+ resourceFieldRef:
+ description: |-
+ Selects a resource of the container: only resources limits and requests
+ (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
+ properties:
+ containerName:
+ description: "Container name: required for volumes, optional
+ for env vars"
+ type: string
+ divisor:
+ anyOf:
+ - type: integer
+ - type: string
+ description: Specifies the output format of the exposed
+ resources, defaults to "1"
+ pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+ x-kubernetes-int-or-string: true
+ resource:
+ description: "Required: resource to select"
+ type: string
+ required:
+ - resource
+ type: object
+ x-kubernetes-map-type: atomic
+ secretKeyRef:
+ description: Selects a key of a secret in the pod's namespace
+ properties:
+ key:
+ description: The key of the secret to select from. Must
+ be a valid secret key.
+ type: string
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ optional:
+ description: Specify whether the Secret or its key must
+ be defined
+ type: boolean
+ required:
+ - key
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ required:
+ - name
+ type: object
+ type: array
+ type: object
+ required:
+ - configuration
+ type: object
+ status:
+ description: ObjectStoreStatus defines the observed state of ObjectStore.
+ type: object
+ required:
+ - metadata
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ labels:
+ app.kubernetes.io/managed-by: kustomize
+ app.kubernetes.io/name: plugin-barman-cloud
+ name: plugin-barman-cloud
+ namespace: postgres-cluster
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ labels:
+ app.kubernetes.io/managed-by: kustomize
+ app.kubernetes.io/name: plugin-barman-cloud
+ name: leader-election-role
+ namespace: postgres-cluster
+rules:
+ - apiGroups:
+ - ""
+ resources:
+ - configmaps
+ verbs:
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - patch
+ - delete
+ - apiGroups:
+ - coordination.k8s.io
+ resources:
+ - leases
+ verbs:
+ - get
+ - list
+ - watch
+ - create
+ - update
+ - patch
+ - delete
+ - apiGroups:
+ - ""
+ resources:
+ - events
+ verbs:
+ - create
+ - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: metrics-auth-role
+rules:
+ - apiGroups:
+ - authentication.k8s.io
+ resources:
+ - tokenreviews
+ verbs:
+ - create
+ - apiGroups:
+ - authorization.k8s.io
+ resources:
+ - subjectaccessreviews
+ verbs:
+ - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: metrics-reader
+rules:
+ - nonResourceURLs:
+ - /metrics
+ verbs:
+ - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ labels:
+ app.kubernetes.io/managed-by: kustomize
+ app.kubernetes.io/name: plugin-barman-cloud
+ name: objectstore-editor-role
+rules:
+ - apiGroups:
+ - barmancloud.cnpg.io
+ resources:
+ - objectstores
+ verbs:
+ - create
+ - delete
+ - get
+ - list
+ - patch
+ - update
+ - watch
+ - apiGroups:
+ - barmancloud.cnpg.io
+ resources:
+ - objectstores/status
+ verbs:
+ - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ labels:
+ app.kubernetes.io/managed-by: kustomize
+ app.kubernetes.io/name: plugin-barman-cloud
+ name: objectstore-viewer-role
+rules:
+ - apiGroups:
+ - barmancloud.cnpg.io
+ resources:
+ - objectstores
+ verbs:
+ - get
+ - list
+ - watch
+ - apiGroups:
+ - barmancloud.cnpg.io
+ resources:
+ - objectstores/status
+ verbs:
+ - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: plugin-barman-cloud
+rules:
+ - apiGroups:
+ - ""
+ resources:
+ - secrets
+ verbs:
+ - create
+ - delete
+ - get
+ - list
+ - watch
+ - apiGroups:
+ - barmancloud.cnpg.io
+ resources:
+ - objectstores
+ verbs:
+ - create
+ - delete
+ - get
+ - list
+ - patch
+ - update
+ - watch
+ - apiGroups:
+ - barmancloud.cnpg.io
+ resources:
+ - objectstores/finalizers
+ verbs:
+ - update
+ - apiGroups:
+ - barmancloud.cnpg.io
+ resources:
+ - objectstores/status
+ verbs:
+ - get
+ - patch
+ - update
+ - apiGroups:
+ - postgresql.cnpg.io
+ resources:
+ - backups
+ verbs:
+ - get
+ - list
+ - watch
+ - apiGroups:
+ - rbac.authorization.k8s.io
+ resources:
+ - rolebindings
+ - roles
+ verbs:
+ - create
+ - get
+ - list
+ - patch
+ - update
+ - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ labels:
+ app.kubernetes.io/managed-by: kustomize
+ app.kubernetes.io/name: plugin-barman-cloud
+ name: leader-election-rolebinding
+ namespace: postgres-cluster
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: leader-election-role
+subjects:
+ - kind: ServiceAccount
+ name: plugin-barman-cloud
+ namespace: postgres-cluster
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: metrics-auth-rolebinding
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: metrics-auth-role
+subjects:
+ - kind: ServiceAccount
+ name: plugin-barman-cloud
+ namespace: postgres-cluster
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ labels:
+ app.kubernetes.io/managed-by: kustomize
+ app.kubernetes.io/name: plugin-barman-cloud
+ name: plugin-barman-cloud-binding
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: plugin-barman-cloud
+subjects:
+ - kind: ServiceAccount
+ name: plugin-barman-cloud
+ namespace: postgres-cluster
+---
+apiVersion: v1
+data:
+ SIDECAR_IMAGE: |
+ Z2hjci5pby9jbG91ZG5hdGl2ZS1wZy9wbHVnaW4tYmFybWFuLWNsb3VkLXNpZGVjYXI6dj
+ AuMS4w
+kind: Secret
+metadata:
+ name: plugin-barman-cloud-498t9gthct
+ namespace: postgres-cluster
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+ annotations:
+ cnpg.io/pluginClientSecret: barman-cloud-client-tls
+ cnpg.io/pluginPort: "9090"
+ cnpg.io/pluginServerSecret: barman-cloud-server-tls
+ labels:
+ app: barman-cloud
+ cnpg.io/pluginName: barman-cloud.cloudnative-pg.io
+ name: barman-cloud
+ namespace: postgres-cluster
+spec:
+ ports:
+ - port: 9090
+ protocol: TCP
+ targetPort: 9090
+ selector:
+ app: barman-cloud
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ labels:
+ app: barman-cloud
+ name: barman-cloud
+ namespace: postgres-cluster
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: barman-cloud
+ strategy:
+ type: Recreate
+ template:
+ metadata:
+ labels:
+ app: barman-cloud
+ spec:
+ containers:
+ - args:
+ - operator
+ - --server-cert=/server/tls.crt
+ - --server-key=/server/tls.key
+ - --client-cert=/client/tls.crt
+ - --server-address=:9090
+ - --leader-elect
+ - --log-level=debug
+ env:
+ - name: SIDECAR_IMAGE
+ valueFrom:
+ secretKeyRef:
+ key: SIDECAR_IMAGE
+ name: plugin-barman-cloud-498t9gthct
+ image: ghcr.io/cloudnative-pg/plugin-barman-cloud:v0.1.0
+ name: barman-cloud
+ ports:
+ - containerPort: 9090
+ protocol: TCP
+ readinessProbe:
+ initialDelaySeconds: 10
+ periodSeconds: 10
+ tcpSocket:
+ port: 9090
+ resources: {}
+ volumeMounts:
+ - mountPath: /server
+ name: server
+ - mountPath: /client
+ name: client
+ serviceAccountName: plugin-barman-cloud
+ volumes:
+ - name: server
+ secret:
+ secretName: barman-cloud-server-tls
+ - name: client
+ secret:
+ secretName: barman-cloud-client-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: barman-cloud-client
+ namespace: postgres-cluster
+spec:
+ commonName: barman-cloud-client
+ duration: 2160h
+ isCA: false
+ issuerRef:
+ group: cert-manager.io
+ kind: Issuer
+ name: selfsigned-issuer
+ renewBefore: 360h
+ secretName: barman-cloud-client-tls
+ usages:
+ - client auth
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: barman-cloud-server
+ namespace: postgres-cluster
+spec:
+ commonName: barman-cloud
+ dnsNames:
+ - barman-cloud
+ duration: 2160h
+ isCA: false
+ issuerRef:
+ group: cert-manager.io
+ kind: Issuer
+ name: selfsigned-issuer
+ renewBefore: 360h
+ secretName: barman-cloud-server-tls
+ usages:
+ - server auth
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+ name: selfsigned-issuer
+ namespace: postgres-cluster
+spec:
+ selfSigned: {}
diff --git a/infrastructure_talos/configs/cnpg-cluster.yaml b/infrastructure_talos/configs/cnpg-cluster.yaml
@@ -0,0 +1,557 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: postgres-cluster
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: pg-s3-credentials
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ ACCESS_KEY_ID: ENC[AES256_GCM,data:gr3wSNRZTflgHeIuur5P5YlxJJw=,iv:GhwhkwVevPO6NGY2p1kPVNhOWYAGPZaBtYfcW6OVvjU=,tag:tO5FvSVnVeNp5/xodHFw8A==,type:str]
+ ACCESS_SECRET_KEY: ENC[AES256_GCM,data:tQbziz0uyxcQ7DR+YNmTi2rbMr/n8UNMjsBccG1W/koH+PXFzw4/QQ==,iv:+8f6oHhCSN91kkgAMewyXwe39TS+i4OyaED8fzXxoz0=,tag:GCXF9QileGUVVk1XmDlLTQ==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+ name: pg-cluster-v2
+ namespace: postgres-cluster
+spec:
+ instances: 3
+ imageName: ghcr.io/cloudnative-pg/postgresql:17.2@sha256:13ee1d8acd9bce3626f2abe6559fc2c092926038d5cd55eff59be2a48c6b176c
+ enableSuperuserAccess: true
+ primaryUpdateMethod: switchover
+ ephemeralVolumesSizeLimit:
+ shm: 250Mi
+ temporaryData: 250Mi
+ postgresql:
+ parameters:
+ # Tuned by https://pgconfigurator.cybertec-postgresql.com/
+ # Connectivity
+ #max_connections: "220"
+ superuser_reserved_connections: "5"
+ # # Memory Settings
+ # shared_buffers: 2048 MB
+ # work_mem: 32 MB
+ # maintenance_work_mem: 320 MB
+ # huge_pages: "off"
+ # effective_cache_size: 6 GB
+ # effective_io_concurrency: "150"
+ # random_page_cost: "1.5"
+ # # Monitoring
+ # track_io_timing: "on"
+ # # track execution times of pl-language procedures if any
+ # track_functions: pl
+ # # Replication
+ # max_wal_senders: "10"
+ # # Checkpointing
+ # checkpoint_timeout: 15 min
+ # checkpoint_completion_target: "0.9"
+ # max_wal_size: 1024 MB
+ # min_wal_size: 512 MB
+ # # WAL writing
+ # wal_compression: "on"
+ # wal_buffers: "-1"
+ # wal_writer_delay: 200ms
+ # wal_writer_flush_after: 1MB
+ # wal_keep_size: 3650 MB
+ # # Background writer
+ # bgwriter_delay: 200ms
+ # bgwriter_lru_maxpages: "100"
+ # bgwriter_lru_multiplier: "2.0"
+ # bgwriter_flush_after: "0"
+ # # Parallel queries:
+ # max_worker_processes: "5"
+ # max_parallel_workers_per_gather: "3"
+ # max_parallel_maintenance_workers: "3"
+ # max_parallel_workers: "5"
+ # parallel_leader_participation: "on"
+ # # Advanced features
+ # enable_partitionwise_join: "on"
+ # enable_partitionwise_aggregate: "on"
+ # jit: "on"
+ # max_slot_wal_keep_size: 1000 MB
+ # track_wal_io_timing: "on"
+ # maintenance_io_concurrency: "150"
+ # wal_recycle: "on"
+ # #pg_hba:
+ # # - host all bugzilla all md5
+ # backup:
+ # target: prefer-standby
+ # retentionPolicy: 30d
+ # # barmanObjectStore:
+ # # destinationPath: s3://midnightthoughts-pg-backup/pg-base-backup
+ # # endpointURL: https://hel1.your-objectstorage.com
+ # # s3Credentials:
+ # # accessKeyId:
+ # # name: pg-s3-credentials
+ # # key: ACCESS_KEY_ID
+ # # secretAccessKey:
+ # # name: pg-s3-credentials
+ # # key: ACCESS_SECRET_KEY
+ # # wal:
+ # # compression: gzip
+ # # maxParallel: 2
+ # # data:
+ # # compression: gzip
+ # # immediateCheckpoint: true
+ # # jobs: 2
+ managed:
+ roles:
+ - name: freshrss
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: freshrss
+ - name: meowlnir
+ ensure: present
+ login: true
+ comment: Read Only Access for synapse required but RW to meowlnir db
+ superuser: false
+ passwordSecret:
+ name: meowlnir
+ - name: connectivity-tester-stage
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: connectivity-tester-stage
+ - name: connectivity-tester
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: connectivity-tester
+ - name: draupnir_synapse
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: draupnir-synapse
+ - name: authentik
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: authentik
+ - name: ejabberd
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: ejabberd
+ - name: vaultwarden
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: vaultwarden
+ - name: mastodon
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: mastodon
+ - name: openproject
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: openproject
+ - name: plausible
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: plausible
+ - name: coder
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: coder
+ - name: matrix_auth
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: matrix-auth
+ - name: cachet
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: cachet
+ - name: docuseal
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: docuseal
+ - name: bugzilla
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: bugzilla
+ - name: rundeck
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: rundeck
+ - name: plane
+ ensure: present
+ login: true
+ superuser: false
+ passwordSecret:
+ name: plane
+ storage:
+ storageClass: hcloud-volumes
+ size: 10Gi
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+ name: pg-cluster-v2
+ namespace: postgres-cluster
+spec:
+ selector:
+ matchLabels:
+ cnpg.io/cluster: pg-cluster-v2
+ podMetricsEndpoints:
+ - port: metrics
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+ name: hetzner-base-backup
+ namespace: postgres-cluster
+spec:
+ schedule: 0 5 4 * * */3
+ backupOwnerReference: self
+ method: barmanObjectStore
+ immediate: true
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: rundeck
+ namespace: postgres-cluster
+spec:
+ name: rundeck
+ owner: rundeck
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: plane
+ namespace: postgres-cluster
+spec:
+ name: plane
+ owner: plane
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: meowlnir
+ namespace: postgres-cluster
+spec:
+ name: meowlnir
+ owner: meowlnir
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: connectivity-tester-stage
+ namespace: postgres-cluster
+spec:
+ name: connectivity-tester-stage
+ owner: connectivity-tester-stage
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: connectivity-tester
+ namespace: postgres-cluster
+spec:
+ name: connectivity-tester
+ owner: connectivity-tester
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: freshrss
+ namespace: postgres-cluster
+spec:
+ name: freshrss
+ owner: freshrss
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+ name: synapse
+ namespace: postgres-cluster
+spec:
+ name: synapse
+ owner: synapse
+ ensure: absent
+ cluster:
+ name: pg-cluster-v2
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRXlmenV0ejNKY05Qamxy
+ MFdYU0hhZFdEdVdOdXRoQTczM0ZCMzZ5VWtNCkdGakF2bk5uOEI1ZTNCVlYzdDh0
+ dHJ1Vmd1ZEhJV3VIMXRBZXBtNHNHbHMKLS0tIE9KWE94R2NjTjZZNDhjTFEycklw
+ UDFMTDdhbC9FREFOVkxzQythMG81UWcKDSu0AHEXpJKP8dtGUQ5A4lG5F13h1AxD
+ 8nL1WOng8koXu4wDIvdmND2G70Pyz3nOWuskz8ExTsUqL/q0qSioAQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-03T15:32:52Z"
+ mac: ENC[AES256_GCM,data:OoMBBzhf5Z6/1qrWIh5EFXe8PA1jCQ9qRdPpiAi1exP91D3Te7ZKT3ZfJv6a+ryOHtr5wr+EAh59809P5R2/7N3nuplnSUU62D2KOvlyljWpia/avdVm/qY8MWhJpUETidJr9jeY3XJnO8lY2aNvS89oXlUzCY5iLl3YZN2Cp0c=,iv:1/d2oVN7ta4gYH1C3eyab4ad7b52N1hDiBOfnD2u/cc=,tag:V6gO2mUnB204rzJFR+ZEcA==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/infrastructure_talos/configs/kustomization.yaml b/infrastructure_talos/configs/kustomization.yaml
@@ -2,3 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- cluster-issuers.yaml
+ - pg-secrets.yaml
+ - cnpg-cluster-barmancloud-ext.yaml
+ #- cnpg-cluster.yaml
diff --git a/infrastructure_talos/configs/pg-secrets.yaml b/infrastructure_talos/configs/pg-secrets.yaml
@@ -0,0 +1,569 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: authentik
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:erzl9PKrNZE6,iv:CDu4zVjgM8cwK84AlO5wN7bYY8IpsXwTCH6DRkuTtIw=,tag:rOuhV/ESdO06ylqX51AD8A==,type:str]
+ password: ENC[AES256_GCM,data:uT7EP3qH4dSRw7zTJbdt0I/+PFSjM32Gwq1MbrHinW4X8ofdHlS8RZdwLsRvUQmOTbz30rk9h3Hf918pf0KW8w==,iv:ZnUwi948mFtc1S3KEjnZeYwMT0QiISoskjBoJ4vbOb8=,tag:EWeZyj5Q0a0JHBCBcZG5MA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: cachet
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:ayNhybPJ,iv:EPXYk87WuqHa/qYhjHFFo0wLooUkIN/+lOUiZOtZVOk=,tag:gs7gQ0Q8aEbsSFdRVx+vXw==,type:str]
+ password: ENC[AES256_GCM,data:ZwY/mBiHFNaHisL9TwRueDobXt5HApB/g0xTTCAOgIXpilib6l3/2dUVWI1z0QNPzKS2rdMFR0s2pNT9qHrHcg==,iv:P+9bVJENNLQalA5CSXF/g1grY2NBDS+/9pv8GiFqUJk=,tag:+YKJyZNYcKbfph9kgCZkHg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: coder
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:PSXnxq4=,iv:Ys+F1uCEF7V6fVnQ0TPvToQnOPG5hj2fUL0aSlntzQ0=,tag:m1TC5z2DBD546n9YXFsNkQ==,type:str]
+ password: ENC[AES256_GCM,data:NLtlw/nS7ICY6+0t4oIOrZEeGDbvOI4GkIzMZ7YqFjqZvp6B5bKBgpkMcK9hpUq/2rxRF7JLdA6UJWB1KB6vAw==,iv:4sOGg462HXfEokSTz5V0gCqJoFThWuaRbZMe0CfiLqQ=,tag:Wd4vBalwJldp0u7lhuTv2w==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: draupnir-synapse
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:BMW9BFzcNw689LmXvnyfnw==,iv:o3p3jTeE7ZyWTFuEw2C5tfso6ahzIpKhtvVTDCgU+bE=,tag:VMx/bHAVOfX/VR4CXnsYjw==,type:str]
+ password: ENC[AES256_GCM,data:8f9IK9CE+mMxjyT90NvGHXI33ZR2c/ByKHntocZ7pZdD9/8OL7LRFbPypUhiP72RZFmbniMfO84uVX+TMX70Sw==,iv:Dx99tJb1kqKAsMQkj7tMmJ8YOccfZ09qcB+6iyrBgKU=,tag:xGtT+X9gAB6abuOl7KDO5g==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: ejabberd
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:WYSBz/tI+mI=,iv:tmqMjkC74A425pFrXYieYPhnsFk3+zExmTNBkJwukck=,tag:5O3ekxG771IH9C3asfm4Eg==,type:str]
+ password: ENC[AES256_GCM,data:R2gR7IkGYuCFJvdJsmHxmOKnTr/L7HNiL+a/YWgrvDWBlvrfuQG5RV3EYMjmmrH/52rQ1OV88DQ1yfq38kFoUw==,iv:fIH4upQdp/M5uPgQeWY0QEc6ThZQU9dAA2vXQsijqzg=,tag:bSR8Xmp3061nZ5hflxYWTg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: mastodon
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:NDTJ6BuwFEQ=,iv:zQq1Ee5vFPvu3I+2cggi+CTjg3mM95uyixAUqNnwdW4=,tag:HLLMlqWOSHsuaXzsJbqyqQ==,type:str]
+ password: ENC[AES256_GCM,data:oRzuOe126qab/c3O/B9Gjz/caqU8TJg6jBruYUYcH5f14MM7Mf9Xu5pv7/mQbIWJP5KvF7/Jg915rm9BRPrh2A==,iv:anf+EdXdgb/tG9n7PkWheq//nwjRup0P6BekT4s8TfU=,tag:TdloVYyO2AM0qTCeZWhveQ==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: matrix-auth
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:zvJ3G1nJ1uu8FD4=,iv:3y9abHLLVHUcKz/2i6+BKw9sJ1e1CypACYDxwQr0Fuc=,tag:+Far5J5cu8ByYKL6ba2ioA==,type:str]
+ password: ENC[AES256_GCM,data:BPJrjT3CCMdyBmPXM7klSEN6Lyp1aGyCVFuHwz+ZIVfge7neNAuOhEJCePNYXQjDFF7r4CSmJTWOepJer1wshQ==,iv:hdxQUB0shkw0P1wSrsqbh+CUWW69aLbNLJ7UAHeOcGw=,tag:mpIBBL0rphDtDAE/C4pKVw==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: openproject
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:uDQ02KnjDAYJ22A=,iv:9M/07xow+/OH8RJjUtXF/qzGnl5bin/24iOUxQzfs/c=,tag:WmCrJniGCwx713D5qMztMg==,type:str]
+ password: ENC[AES256_GCM,data:KzG1CI/nP594POi/66Cr4nFl4ddkui0jHfTOlLCZ0wDvxlaapwySUHBeA7tR5Nf1RlTi2ecpimEr1rNYywY9qA==,iv:UJVG6F23jpHwIOHv6gG4p5H2d7zTULQVyXBO6MH4954=,tag:7I2yrI6eIiZUxiH2SlHHlw==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: plausible
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:/uChpu66272x,iv:1IRBMsubF384/gsyN1EicRfwK+r5TJRBhhRALzAIrr8=,tag:NWPwBo44KCGmnMpXAh39Qg==,type:str]
+ password: ENC[AES256_GCM,data:PVtHFvzN3IS53AkgPgit7qlQ8k9AP8BimEVP2PiMKg5NgG8wHzNF4cICDH8GwbycJmv9WeVYZHCjmWuo+PPawA==,iv:iZ9q+BgWBbPbv9h3szsWPjQVO7oNphskYT6e5G0bpx4=,tag:DI7VQ9IucGrjUGDx0GT0wQ==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: synapse
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:d1Kwz8XuOQ==,iv:8Bu/JCfP5G2w9+HCC5uASyKxJ1ho9oL5FMw4Pd7aa0E=,tag:QkJSkoN9vIYywh8ryGexCA==,type:str]
+ password: ENC[AES256_GCM,data:kiBHhn6v7GAxnnC4QaYFniZ/KBLLeuM5bJ4vym292F5SCCQGrlAda0leude+iMVkMZkw6iJ2fLA29r2rx0E3yQ==,iv:rQCDzK60UWG1mp114cWYiWolmCHonp9QKJHGbhG8BsY=,tag:HqCO7EDoA42K2jaAroQDOg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: vaultwarden
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:QPfJZ6TRB5jck14=,iv:3voq6PUtDpbrX0c4tyFxKGHrQap1Twv6AGf5eWLPqsE=,tag:TuV2DcBA1jvyCNnxM2va1A==,type:str]
+ password: ENC[AES256_GCM,data:53EIRqNAcFbaujBB/SHWFWnkbZuU1zti++dpvE6/D4M4jwWwTakfOMQSMhE5IH1FaDG50Yq+IM755eQSY5J9NQ==,iv:WBCxUXLSk+9mTTtOPPnrWZu3NIshwcUVyjLWwyqtPro=,tag:loDkzUvnrsYsNA1R2Nsb6w==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: docuseal
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:qLk+9YVTGTE=,iv:pkL0gAHAXyWs6mvgKUDp2zY3FiUpAWYy+ySCg71c2fU=,tag:t3dfBKudd8y4n0IltSzR7w==,type:str]
+ password: ENC[AES256_GCM,data:LeV21DXDun51k5mAvvdpwqgqMXam+Eo8YrIsX1UxFodj2aEHFrEmP+qHNDuHtQ9hULKQmrS56FjHcT9gYzSxww==,iv:8RRf1LHy2SBXWmdCSem4d8BW19aY/uST+Rr19JT83rQ=,tag:TraGiuxQkJb53Ht8pdAb+Q==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: bugzilla
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:09ej1NhmkLw=,iv:gYj8XzTFBHRWzGrMN5di3sDBHQIkQWL2o0VibjVGoPk=,tag:NuIoZJrMBMX+auFljwsmig==,type:str]
+ password: ENC[AES256_GCM,data:iJOkeIPBJqlV1hz5Jv44/DXZF/cOM8CSUb04qyx9nHX5o/j2lPo0e4r8manLNQsx8gWoq/NhHDTRTCiP7eaQxg==,iv:11ACglkrVyePICRH/WvdLV7oIw9GdgWEqicVuT8UvHY=,tag:6za9LQb+igF7NhemCeeWSw==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: rundeck
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:aDDz11K4sw==,iv:0UHVwLa5xgNHoYcPJqjhD1qjK/daIBQJfgUdEk/XDj8=,tag:X1aAL6aE5L2geWfHV3TOlA==,type:str]
+ password: ENC[AES256_GCM,data:pKIM0byZpzbMS/rCUSE/+W1zxPqBG5sQTV0VnLtYsi9me+RqwGLu3PWfWgDF4iYMmD7GZKMSEIqdM0x+QKVlSw==,iv:mYZkzeqRvisvMVYsEg+iWthbnKVa7FyiA/OUru5q5gw=,tag:3Nk/wYaFnZmfyFvGH8363A==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: plane
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:rtA/hP0=,iv:vO3nm3RYBbCSv+qKVUNw3ILgfQliIEumu3/ANARo7jU=,tag:MEX5XFaOgrCBjIwlDcsAhw==,type:str]
+ password: ENC[AES256_GCM,data:RI6pMOonRBE4PTkWIidNTlEzhsmORzqYCzOKqhDKvYDIaLFNs75vrIEBxc05ssCLyN2N6rQFAGmZ2LdbDIA18w==,iv:HVF5p7vwf7h/RTzEPxma5eiMCA8gKtaGJ1vOy505mhY=,tag:S/JZ68SDDMKmJLbD4jYx7w==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: meowlnir
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:FE0llcsQkb4=,iv:TTXa6Ic2U9yJAsa4tcDNSnqSfvhxZqmhRX/v2baXoeI=,tag:I6s1N/S/WWcIPj+9gGZ5qg==,type:str]
+ password: ENC[AES256_GCM,data:vvtRaKOPUyHPB23nFJjRGzziby8iAXGDxJYRDvENgkJn80r/e5XEM6VT2ohICGIgD3wPZqgoZOU7jbbYQDpg3A==,iv:f8syRA7HswutxhsrtERg60cbCYOvPjVRuoClmp1uSgo=,tag:byE/EZvjcKOlE47Krz/wBg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: connectivity-tester-stage
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:GKIiW1KHh3BV23PFJlEAuzO+8/Z/1QUmlg==,iv:CqX4k84++x6TN/ciBigX1OMTGlKS6QhwZkYtNLSU27w=,tag:MrUNiU7I1pem8nUry7DqtQ==,type:str]
+ password: ENC[AES256_GCM,data:fNym16ugOwamfcsN3/Og873LhxbAL19yPlpg3czpCl6qEAW8P9Zvet5LtrktcMe/0j07hZ8GzgHZ5Q8lwdWNYw==,iv:RhOKGx6wi19EGoi1kwZVZXiK7gOU4xYJO8jkTkDR5T0=,tag:MjiuOy4Nwho4E6tmdLLzAA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: connectivity-tester
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:HpbajOc0q0ojW/be8iSPsnpYeQ==,iv:ZHwYnbhWCa4R8IJqEiiLdixbKw5RyKnXiY47PMqJy+o=,tag:GB2t+4IvWpPTy4PuwFcOfg==,type:str]
+ password: ENC[AES256_GCM,data:Z4UV/hHb3duLDbxSepGrGw1nOzWP6X37c35eqBPuL675ctAO+KgOa139IMeqiHoGoINFa2lNh4e4RiSVbfbumA==,iv:xPH2vcw3SpmpCCD6bLSfjP/TvriNGtfTKWVQGLAkDHo=,tag:PnrSadKpy96hotqrHgC0Wg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+kind: Secret
+metadata:
+ name: freshrss
+ namespace: postgres-cluster
+type: Opaque
+stringData:
+ username: ENC[AES256_GCM,data:Cq3o7ph+yUY=,iv:HjVHrgivX9bA0gV3QJhI2NVhGFnokedHTS/Mmk8uXxI=,tag:GSRa7BAuxOJuPkv1nuGiqA==,type:str]
+ password: ENC[AES256_GCM,data:lUVOy9j3ROxe9Aw5HOLGpyESY8wUFVlDCQWYmSA6DkanoXzcSIXOWaRIWTa6t0yyT5dc6PuqSg/ni0F+tDYxmg==,iv:2NldH+ynrIftPuCo5cHxZ4C19l7Idlowid4MR1a4CTU=,tag:FlrZFCdj5vg+oOgJDri0yA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyVEtCd1ZaQW9TdjJDNXBC
+ NzBiZjdrNTNKK1VUT1VLZC8xTWNObndIeG5rCm1aOWxISG1UMnJtemNVeUx3anA3
+ ZnFKLzJReFZnNFBuWXViT1I1S1lpWHMKLS0tIHh2N2Z4M1RzSnZUblJFSk1YaVNS
+ LzJncXV1L0ozYnlxeVl4Yk9nQmhTV3cKbdxEyNh8EwwG0U4YTvmsZQHp7DnZkvMy
+ 7O2OFuHNvN4754vJzAmSYm8KKzO9k7J2PSKyVt0CPYx49z1NiXtvOA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-07-25T14:10:03Z"
+ mac: ENC[AES256_GCM,data:n6UA3uwJBJ3HKJym6LcF91Bxg2qMGXNUFiHusAQ/ekr7vxsAW1Gpia0m/lYClbMscUR6oOskwFhDy8Qbn0QW9JVTceAk29heEJs043f0zhW0RvLk3mDdDprfsUZTbZ2NcKKsGJswQrGUa6+mkQy6kByWw752YtIzJ7y3pjYSFhE=,iv:5zU/Uax18qdSCQ2cFb6hP3aqvLUJZZJHhj6dNT3IgVA=,tag:4mbAxe4MMpUQTbQRmrFoVg==,type:str]
+ pgp: []
+ encrypted_regex: ^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
