Nik Afiq
7fbab2561a
Some checks failed
validate / lint (push) Failing after 1s
Root-causes today's Gitea outage. The official Gitea Helm chart
(dl.gitea.com/charts, gitea/helm-gitea) always builds Gitea's own [database]
config directly from the plaintext postgresql.global.postgresql.auth.password
value, confirmed from templates/gitea/config.yaml:
{{- $_ := set .Values.gitea.config.database "PASSWD" .Values.postgresql.global.postgresql.auth.password -}}
`existingSecret` only affects the bundled postgresql subchart's own credential
provisioning -- it has no effect on what Gitea itself connects with. Removing
the plaintext field in the earlier Stage 1 "secret hygiene" commit made this
silently fall back to the chart's built-in default password ("gitea", 5
chars), which got re-baked into the persisted app.ini on every pod restart
regardless of what the live Postgres role's real password was -- hence the
repeating CrashLoopBackOff no amount of Postgres-side fixing could resolve.
Restores a plaintext password (the value already live on Postgres from this
incident's recovery), with a comment explaining why, so this doesn't get
"cleaned up" back into the same breakage later. Removes the now-nonfunctional
manifests/gitea/gitea-postgres-secret.sh and its .env.example entry. Getting
this fully off plaintext would need a Config Management Plugin or similar --
not attempted here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
45 lines
1.4 KiB
Plaintext
45 lines
1.4 KiB
Plaintext
# Config for: Environment variables template
|
|
# Applied by: Copy to .env and fill in values; sourced by shell scripts
|
|
|
|
# Porkbun API credentials
|
|
PORKBUN_API_KEY=pk1_your_key_here
|
|
PORKBUN_SECRET_KEY=sk1_your_key_here
|
|
|
|
# K3s node token for agent join
|
|
K3S_NODE_TOKEN=your_token_here
|
|
|
|
# Gitea runner token for CI/CD
|
|
GITEA_RUNNER_TOKEN=your_token_here
|
|
|
|
# Grafana admin password
|
|
GRAFANA_ADMIN_PASSWORD=your_password_here
|
|
|
|
# Authentik secrets
|
|
AUTHENTIK_PROXY_TOKEN=your_token_here
|
|
AUTHENTIK_GITEA_CLIENT_ID=your_client_id_here
|
|
AUTHENTIK_GITEA_CLIENT_SECRET=your_client_secret_here
|
|
AUTHENTIK_GRAFANA_CLIENT_ID=your_client_id_here
|
|
AUTHENTIK_GRAFANA_CLIENT_SECRET=your_client_secret_here
|
|
AUTHENTIK_ARGOCD_CLIENT_ID=your_client_id_here
|
|
AUTHENTIK_ARGOCD_CLIENT_SECRET=your_client_secret_here
|
|
|
|
# Gitea container registry credentials
|
|
REGISTRY_SERVER=your_registry_server_here
|
|
REGISTRY_USER=your_username_here
|
|
REGISTRY_PASSWORD=your_token_here
|
|
|
|
# Home Assistant and Discord integration
|
|
HA_TOKEN=your_home_assistant_token_here
|
|
DISCORD_TOKEN=your_discord_token_here
|
|
GUILD_ID=your_discord_guild_id_here
|
|
SWITCHBOT_TOKEN=your_switchbot_token_here
|
|
SWITCHBOT_SECRET=your_switchbot_secret_here
|
|
|
|
# Immich database credentials
|
|
IMMICH_POSTGRES_PASSWORD=your_password_here
|
|
|
|
# Dashy weather widget API key (rotated off the plaintext value formerly in config/dashy/conf.yaml)
|
|
DASHY_WEATHER_API_KEY=your_api_key_here
|
|
|
|
PIA_USER=your_pia_username_here
|
|
PIA_PASSWORD=your_pia_password_here |