commit fd719d479c7576883a98269dae98e2f73ba24855
parent fba80497aa933ff69b834eb81e01e5c4be763214
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Tue, 18 Nov 2025 15:31:14 +0100
meow
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
2 files changed, 82 insertions(+), 15 deletions(-)
diff --git a/apps/talos_cluster/externaldns/release2.yaml b/apps/talos_cluster/externaldns/release2.yaml
@@ -1,4 +1,63 @@
-data: ENC[AES256_GCM,data:Xfd9vyiuJwEREd/rJKZ/58DnH3pDoB4ZlEeGB98lUde2XlmGU03XJLHEZF6I4iSqKyWnvDx1f4OxufYyJRJWydiFIMQWnYb6blsg4Qfd2CQXa6UBHYr+4nP1nmftH0QREjIyQ7li8cDl/89Zz5EaVyFA1APEzgCUp1wjEEAf7JliiFYYftpyHMVPXdSHjlGgGlUQTVyHQvirhBWK59i8USRAZmcCrlRFVMfddyCE9CqaU47iRwCtfzywk4VzX6O75h1CaKy1U3SNkQ9Gb+kdHNMj6In3F/lgJzzoBM/VCfyWLt1+dNSbVQe71+JpCWr16x5EWyaVS3VwojBUL/woIGioyr3YptlZl3ddRI9yAARlXEQL82sxbhTCWjJJnLURQsficxzpXaHpHOPfO2ncG4bcbO4HeFvUpvLx4/Nc/IDWgmGe2dsAgoiapZioso1r+6jTFDe9CNI8QbGlgHLQzNA911RzyWHf6GNaQJKMb+sDJZrFHaAe9ahiVAIZPfcgsdB+FPDrixWfX1k96n0DlejJrPOdMoKb1XVlqp14D/j5N0Q4p4WOEjH8RMzrMCC+QSj9XZI1plsoTaz0kucY1zybuhq4/XF+oKETE5J37/oDA6nkl4t5k6BB5NLc1PnRH7MMvMtAAp/ydBtGXi66bLxLoX8zzXl2l2L4nqdtvCIF4Kx/aXk06XxqHqOWo2PNQziVrJPF7+kntpOmNn9EeGEugXMlQ6EAQs8VX4d9E+7NtB9ZFIvMDAY5LrQ2m0mjtrAQi0EXlzb07qMUf85oFIdC8KqnP7K0+7qguhQ6aklTzWfFulThqrZ3OHTaHfuaVb6iyQCzXzSo5c0gV0suxyV5E7Rvh0GDneyWeVjKnfC4NiS1aDq2/bRjhBsHjZKJpXJhzt9pNes0/IYiictq9PQ5akmRPnJx3UyBybln/qd2QvA4JkwMre06VcpEX+l4iULjfT+rNE7onvr8SAUz4CtE5gmuUnoktT3g/a32iOMMAi27BYErVb8kKoU6oYGyjZMoqhZ25r8u3lpZsae9jONvup4UXgStBGTJ8kLX4fw1+TdQy3NBl1FTIkkDbJl5N6Bjyn0UyrYKDLbjLSzUnbZPgsANz0nf+gg7n6lYexthf4umk2+REoiDSEyeiHPXxzzxybubRy47Gqb0mt7KB+pvohS7jbyCzndJS7waK6JZycMK15M24Lbnz2vlyvl9CVB/doxK13J3MG/WJtcHDq7Srn25fJwVSoFIUGUc9hOTutIIgcKDRG9ruDX/xYpov7fKIZEVDO33KHHQV1OZ2XHqnIpkBqN1Bc/3SOIhhKZ62mRMDZ/gdCSvl/hGODA+pSsoCYFhPVoW08m5sjzcvOilOAWbxeYECsO3leEZ9UTUzU4N9Fmt2iCpwb7x+PeyZ51uvBGAMtrQH7Ua5JuJp1+yvwpOrFICaTf1zybT7Jgxl3h8UtJSxPUnX05tS5GUyHW9/ccV6sVlKec+5Hq8OFPKokRc23QoqI0I/Y4KEJAAvgdVsQMqEMaVsNkl2d7B0dgHEOCLszxoLsX4C7PT+nGj8Msy4QHPZqsaqimCj4MfdTM1vtmUEprJsfcw9yzZs01vOpwAdlTSK4+mBBj7kiX51IwdD+E8I0ErLYiObzZ/Be8gXO3ohadY+wgijX1bcQSuE93KHr82Mgfuxk62NrIc5kqiYv35BynY0b3G+nSYiUjcZbGOdIXHTFqz70Z15qyC79yc//s9buPG1UTYInTELfLf6hg3MEazaKMKSai0HmtEzwmZ1js0wr6Q1RjgStFFxyVn5Gif7AXjEI3eYb/zk4hbZRkNXfGxzpGztRMDMez49jpGKiT/zuJ5Uz/6PugfzBg+DpkQYuEqahpxZylQtO4e6ohB02WuQT80VAj2AFdGykw39qwSzvWFXbAIy5gTikbWvZXPqJWtUQpNc//LnapOTzTJmgOtt2T6iXCtuMpb4pg5sYmDSAxXhQcgcicZQWfcsztult7iEtUci8Rczt5C0OS4Te0yZSqmmae3ze2FAM3KWJsNHgRdt22zRIFWIcq4leKZZhgWB+7gXQkfJ1OTVx6oh7Sckd+japroSdxgCmjVgjgMDvMDUicXjAEKmJ1AYxkiLL+0Bb1bfg2l5wZYIdFVw8cL1cUCCj+91CLj4UzVZ4qKckAkMorlgYu54S2werQJkE0GmM9wSoSk5xnCsxjeTnnf+qlEt8nB6c2xSE+zCkBkDNdT4xvjBTMT0Y0kMlluy0+8F94SAMcO02Pv7FpFbkCGl5wo7g==,iv:eURNnqmI6GjgPUhEyWMPgt9LmswzBwFmPJL2rA0oDhc=,tag:nNMGHRee/fNbjqkn65cEzw==,type:str]
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+ name: external-dns-pdns
+ namespace: kube-system
+spec:
+ releaseName: external-dns-pdns
+ chart:
+ spec:
+ chart: external-dns
+ sourceRef:
+ kind: HelmRepository
+ name: external-dns
+ interval: 50m
+ values:
+ logLevel: debug
+ extraArgs:
+ - ENC[AES256_GCM,data:fHGsjniwBGhkF6Tu8buDTaIVO5Ng3lApvqz0iC51,iv:2nxKUEEpxcUWNREtob2GYE5a0JNm1JU8qC8fqvYPaHU=,tag:ITaJLMjyoKN53H96ZLn19Q==,type:str]
+ - ENC[AES256_GCM,data:s01RAUO7cC0xWk+Zy2xaZoqtqtb7rB3TCChmPedOtvUSI3opp9I98/pyDQ46Pi6jMqbwrGw4uWHDAIliiDqkL6KEJzU0NTrAD16mjAwKFw==,iv:Z92RZDCtI9C0wIRh2VhYdsPd+zevEG1J29aEBvti8ek=,tag:iSaF9xKCopVkSeuU1qEYcA==,type:str]
+ - ENC[AES256_GCM,data:WAF/WIvh2kaRFyGHAFZGVYMHIg0p0Z33LGCIVQcASA==,iv:Mmd5eNsp0YWEsFT9KgrTijuSvGibQb+SgFOaGQ/G/2g=,tag:xlxXDUNCm1JazWam/iVWcg==,type:str]
+ provider:
+ name: pdns
+ sources:
+ - gateway-httproute
+ - gateway-grpcroute
+ - gateway-tcproute
+ - gateway-tlsroute
+ - gateway-udproute
+ #- service
+ rbac:
+ additionalPermissions:
+ - apiGroups:
+ - ""
+ resources:
+ - namespaces
+ verbs:
+ - get
+ - watch
+ - list
+ - apiGroups:
+ - gateway.networking.k8s.io
+ resources:
+ - gateways
+ - httproutes
+ - grpcroutes
+ - tlsroutes
+ - tcproutes
+ - udproutes
+ verbs:
+ - get
+ - watch
+ - list
+ - apiGroups:
+ - ""
+ resources:
+ - services
+ verbs:
+ - get
+ - watch
+ - list
sops:
kms: []
gcp_kms: []
@@ -8,14 +67,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuYVlrT2ZwNjlhUXdKZVlG
- U1JUakh6NGJheEV5TjZhVlI3TVFMU2FHSEJvCjYyNzMxV0g3MFdEdWttdnZpVnhs
- NU1zcTlSaVVXbzJ0bGlDYUR4Uk8vZ2cKLS0tIG1qelhURVlMUVk2bmR6L0pHc3hK
- SnExZWNabFNHWHZSc3o4LzZhNVpFd28KwpHp2HHnGoiOHVcjEqN8xmdgDYN4TlHZ
- P4/GblkHRtgriBXrJ8u6+N6/3JFD/NxLtqvrj0ZDcdKB2GicAqszmA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUWlONElUOEtQTzB3dDRT
+ WXNDNEkwY0RjcmFKRG93UE9xUHNudzgyU0JZCit6b3l3R2prYjNwbCt3Ryt2UjUz
+ UTNMUXcwZmlEZjltQXU1Y0s4NzlrUGcKLS0tIFZodjY1bHhzbVZpRU84MjBFd00y
+ MCtyNWFDN1BTSDRDZ0lnRXZ5b1p4ZkUKSnZM1LFWf3N54na2fj8Qe3EocJ3m30ct
+ CTJTxTaM0h4+707QKpjQiZTtwfyaxGzMY3SI9linmT2fYK4z679h6w==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-11-18T14:23:25Z"
- mac: ENC[AES256_GCM,data:RaOAN26i+g4TYRLryquswC0etti97ZaifBBwpTvOVKKyzH9sGDTddU/GkBW31JS4ZTsKQKvbhrB4zAfS1rViNLPXgWamtTSqknROtF7430Ay3XrbLqA8fxLUr3RdBocNl97sxAfikRO59VqXO75Fl0QtilNuCYDTMYWtzMn6F20=,iv:8QPp/pH80+9K6J89UraD1w8qRwYrKIwFM5GPmu+SoK0=,tag:4vtAHgzlUaHWq+OtZBhA1w==,type:str]
+ lastmodified: "2025-11-18T14:31:04Z"
+ mac: ENC[AES256_GCM,data:RcdKVKfFX1S69Hac+LjqmsXsa49N7B6O/9lJalIUmtmS7l9HQR9ttyIqexzWFZY8vSDi/EPu7K5xjuK7P9yXzIIdMuwZjHBZ3EzdphF46pDOGvFostkcMhEkqKrmNvMWX+9UH24z3QrcK1ftJhB3Y/9B20+F7+NdsBRtiOXqdRo=,iv:bBxcQmrQ4w5bhcbtlQIp6oQcCZuHkI2JJhZxfvcd9dk=,tag:wDz1m79bVG5BGEvdw75KRA==,type:str]
pgp: []
- unencrypted_suffix: _unencrypted
+ encrypted_regex: ^(extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/encrypt.sh b/encrypt.sh
@@ -1,10 +1,18 @@
#!/bin/bash
-sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
+if [ -z "$1" ]; then
+ echo "No file specified. Encrypting default file: apps/talos_cluster/externaldns/release2.yaml"
+ # Encrypt apps/talos_cluster/externaldns/release.yaml as a whole
+ sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
- --in-place "$1"
+ --encrypted-regex '^(extraArgs|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
+ --in-place apps/talos_cluster/externaldns/release2.yaml
+else
+ echo "Encrypting file: $1"
-# Encrypt apps/talos_cluster/externaldns/release.yaml as a whole
-#sops encrypt -i --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
-# apps/talos_cluster/externaldns/release2.yaml
+ sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
+ --encrypt \
+ --encrypted-regex '^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
+ --in-place "$1"
+
+fi
