Nik Afiq
e6550d0e39
Stage 1 of REFACTOR_PLAN.md. values/gitea.yaml and config/dashy/conf.yaml now reference secrets injected at apply-time (gitea-postgres-secret.sh, .env) instead of hardcoding a live DB password and weather API key in git. Both values must be treated as compromised and rotated by the operator (see .env.example). Also fixes authentik-ingress.yaml and traefik-dashboard-ingress.yaml, which pointed at the internal-ca root ClusterIssuer instead of internal-ca-issuer, the chained issuer every other internal Certificate uses -- causing untrusted-cert warnings on the SSO login and Traefik dashboard. Extends .gitignore for *.retry, .vault_pass*, kubeconfig patterns, and editor swap files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
19 lines
704 B
Bash
19 lines
704 B
Bash
#!/usr/bin/env bash
|
|
# Usage: bash manifests/core/apply-dashy-config.sh
|
|
# Description: Renders config/dashy/conf.yaml with secrets from .env, updates the Dashy ConfigMap, and restarts the deployment
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../../.env"
|
|
|
|
RENDERED="$(mktemp)"
|
|
trap 'rm -f "$RENDERED"' EXIT
|
|
sed "s|\${DASHY_WEATHER_API_KEY}|${DASHY_WEATHER_API_KEY}|g" "$SCRIPT_DIR/../../config/dashy/conf.yaml" > "$RENDERED"
|
|
|
|
kubectl create configmap dashy-config \
|
|
--from-file=conf.yml="$RENDERED" \
|
|
--namespace dashy \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
kubectl rollout restart deployment/dashy -n dashy
|
|
echo "Dashy config updated"
|