Nik Afiq
e6550d0e39
Stage 1 of REFACTOR_PLAN.md. values/gitea.yaml and config/dashy/conf.yaml now reference secrets injected at apply-time (gitea-postgres-secret.sh, .env) instead of hardcoding a live DB password and weather API key in git. Both values must be treated as compromised and rotated by the operator (see .env.example). Also fixes authentik-ingress.yaml and traefik-dashboard-ingress.yaml, which pointed at the internal-ca root ClusterIssuer instead of internal-ca-issuer, the chained issuer every other internal Certificate uses -- causing untrusted-cert warnings on the SSO login and Traefik dashboard. Extends .gitignore for *.retry, .vault_pass*, kubeconfig patterns, and editor swap files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
17 lines
537 B
Bash
Executable File
17 lines
537 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../../.env"
|
|
|
|
kubectl create secret generic gitea-postgres-secret \
|
|
--namespace=gitea \
|
|
--from-literal=postgresql-password="${GITEA_POSTGRES_PASSWORD}" \
|
|
--dry-run=client -o yaml \
|
|
| kubeseal \
|
|
--controller-namespace=kube-system \
|
|
--controller-name=sealed-secrets-controller \
|
|
--format yaml \
|
|
> "$SCRIPT_DIR/gitea-postgres-sealed.yaml"
|
|
|
|
echo "Wrote $SCRIPT_DIR/gitea-postgres-sealed.yaml"
|