fix: rotate Gitea DB password and Dashy API key off plaintext, fix internal CA issuerRef

Stage 1 of REFACTOR_PLAN.md. values/gitea.yaml and config/dashy/conf.yaml now
reference secrets injected at apply-time (gitea-postgres-secret.sh, .env) instead
of hardcoding a live DB password and weather API key in git. Both values must be
treated as compromised and rotated by the operator (see .env.example).

Also fixes authentik-ingress.yaml and traefik-dashboard-ingress.yaml, which
pointed at the internal-ca root ClusterIssuer instead of internal-ca-issuer,
the chained issuer every other internal Certificate uses -- causing untrusted-cert
warnings on the SSO login and Traefik dashboard.

Extends .gitignore for *.retry, .vault_pass*, kubeconfig patterns, and editor
swap files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -38,5 +38,11 @@ SWITCHBOT_SECRET=your_switchbot_secret_here
 # Immich database credentials
 IMMICH_POSTGRES_PASSWORD=your_password_here
 
+# Gitea database credentials (rotated off the plaintext value formerly in values/gitea.yaml)
+GITEA_POSTGRES_PASSWORD=your_password_here
+
+# Dashy weather widget API key (rotated off the plaintext value formerly in config/dashy/conf.yaml)
+DASHY_WEATHER_API_KEY=your_api_key_here
+
 PIA_USER=your_pia_username_here
 PIA_PASSWORD=your_pia_password_here

.gitignore

@@ -2,3 +2,10 @@
 .DS_Store
 tmp/
 old.debian-data
+*.retry
+.vault_pass*
+kubeconfig*
+*.kubeconfig
+*.swp
+*.swo
+*~

config/dashy/conf.yaml

@@ -1,5 +1,5 @@
 # Config for: Dashy dashboard
-# Applied by: manifests/apply-dashy-config.sh (creates ConfigMap from this file)
+# Applied by: manifests/core/apply-dashy-config.sh (renders secrets from .env, creates ConfigMap from this file)
 
 pageInfo:
   title: Good morning, Nik
@@ -60,14 +60,14 @@ sections:
         id: 1_928_iframe
       - type: weather
         options:
-          apiKey: 770d36389dd547e8e3daccb39debde64
+          apiKey: "${DASHY_WEATHER_API_KEY}"
           city: Tokyo, JP
           units: metric
           hideDetails: false
         id: 2_928_weather
       - type: weather-forecast
         options:
-          apiKey: 770d36389dd547e8e3daccb39debde64
+          apiKey: "${DASHY_WEATHER_API_KEY}"
           city: Tokyo, JP
           numDays: 5
           units: metric

manifests/authentik/authentik-ingress.yaml

@@ -9,7 +9,7 @@ metadata:
 spec:
   secretName: authentik-tls
   issuerRef:
-    name: internal-ca
+    name: internal-ca-issuer
     kind: ClusterIssuer
   dnsNames:
     - auth.home.arpa

manifests/core/apply-dashy-config.sh

@@ -1,10 +1,16 @@
 #!/usr/bin/env bash
 # Usage: bash manifests/core/apply-dashy-config.sh
-# Description: Updates the Dashy ConfigMap from config/dashy/conf.yaml and restarts the deployment
+# Description: Renders config/dashy/conf.yaml with secrets from .env, updates the Dashy ConfigMap, and restarts the deployment
 set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../.env"
+
+RENDERED="$(mktemp)"
+trap 'rm -f "$RENDERED"' EXIT
+sed "s|\${DASHY_WEATHER_API_KEY}|${DASHY_WEATHER_API_KEY}|g" "$SCRIPT_DIR/../../config/dashy/conf.yaml" > "$RENDERED"
 
 kubectl create configmap dashy-config \
-  --from-file=conf.yml=config/dashy/conf.yaml \
+  --from-file=conf.yml="$RENDERED" \
   --namespace dashy \
   --dry-run=client -o yaml | kubectl apply -f -
 

manifests/gitea/gitea-postgres-secret.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../.env"
+
+kubectl create secret generic gitea-postgres-secret \
+  --namespace=gitea \
+  --from-literal=postgresql-password="${GITEA_POSTGRES_PASSWORD}" \
+  --dry-run=client -o yaml \
+  | kubeseal \
+      --controller-namespace=kube-system \
+      --controller-name=sealed-secrets-controller \
+      --format yaml \
+      > "$SCRIPT_DIR/gitea-postgres-sealed.yaml"
+
+echo "Wrote $SCRIPT_DIR/gitea-postgres-sealed.yaml"

manifests/network/traefik-dashboard-ingress.yaml

@@ -63,7 +63,7 @@ metadata:
 spec:
   secretName: traefik-dashboard-tls
   issuerRef:
-    name: internal-ca
+    name: internal-ca-issuer
     kind: ClusterIssuer
   dnsNames:
     - traefik.home.arpa

values/gitea.yaml

@@ -45,9 +45,12 @@ postgresql:
   global:
     postgresql:
       auth:
-        password: gitea-db-password
         username: gitea
         database: gitea
+        existingSecret: gitea-postgres-secret
+        secretKeys:
+          adminPasswordKey: postgresql-password
+          userPasswordKey: postgresql-password
 
 service:
   ssh: