Post-X-Society/Post-Tyranny-Tech-Infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Post-Tyranny-Tech-Infrastru.../secrets/shared.sops.yaml

34 lines
3.9 KiB
YAML
Raw Normal View History

chore: Post-workshop state - January 23rd, 2026 This commit captures the infrastructure state immediately following the "Post-Tyranny Tech" workshop on January 23rd, 2026. Infrastructure Status: - 13 client servers deployed (white, valk, zwaan, specht, das, uil, vos, haas, wolf, ree, mees, mus, mol, kikker) - Services: Authentik SSO, Nextcloud, Collabora Office, Traefik - Private network architecture with edge NAT gateway - OIDC integration between Authentik and Nextcloud - Automated recovery flows and invitation system - Container update monitoring with Diun - Uptime monitoring with Uptime Kuma Changes include: - Multiple new client host configurations - Network architecture improvements (private IPs + NAT) - DNS management automation - Container update notifications - Email configuration via Mailgun - SSH key generation for all clients - Encrypted secrets for all deployments - Health check and diagnostic scripts Known Issues to Address: - Nextcloud version pinned to v30 (should use 'latest' or v32) - Zitadel references in templates (migrated to Authentik but templates not updated) - Traefik dynamic config has obsolete static routes 🤖 Generated with Claude Code (https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-23 20:36:31 +01:00
#ENC[AES256_GCM,data:2YMIFNKq+JsSJeC9Qjm5RwtyC3xK7kUoEcfZDvDl7UrMtSqKr8COUgs=,iv:iNYbG7vJdnxmQEKvKrbKT6DKpXRJasKP+sEl9n8u9kY=,tag:hWIJ51MZDWPKavBcPtfjAA==,type:comment]
#ENC[AES256_GCM,data:7hJjDYJ9YaF6I6b5Dvt+/dvgWIQjjj2AjYrmR0Kno+KKgcg1yEE=,iv:QzwxWutd8vEhusj6IL7xeLxG27PcmKigHnCwZRKEulE=,tag:Q1vlJzRxX7dj8wNrhi+Kfw==,type:comment]
#ENC[AES256_GCM,data:xtOU9wOXNJEMnPuJN0pxLxP4709/IRV0JhRFyf8BeA/QDlSt9jtyaumsuBuA9aui31+0MyhqvLeBbtE+acnTp9W0RzEo,iv:nUdN95nWS9w/UHTxos3ho58/s/dWBuFc14gWcKxPmbU=,tag:GPgBIAk9+/uNBU+9qbYhhg==,type:comment]
hcloud_token: ENC[AES256_GCM,data:8FN2vXof6ud4VolI+uPMWikqOKwTL0Lua4JJgGfGu2F8eFJAKNznNCS47X1HoDCu6ky0tl5jmZvx/RcZU6Ly5g==,iv:Sq4G5gDvoP5HpcsaZFL5bRma3iQdA9shcVjc9NgkUxA=,tag:ww1P2NFJvLyIi1Sbbf0PTg==,type:str]
#ENC[AES256_GCM,data:dV5m3Mtqq/apW8NLlEpy3KFVyQaKZS8uH4WPD3j0k2pnN3hxIc74p+/GS0V7Ew==,iv:etSVHDonOo9l7AGWt9uQCd9ye6u5yVDlM7BRLJd6keM=,tag:QCNmm+IuuaJZuai2CVBYbw==,type:comment]
storage_box_host: ENC[AES256_GCM,data:J1YKyjZ9X2x8mapgzhr57K1vZuQ2lCkrWdk=,iv:awswwnWl/ADhsG6flTgUAZGoA+e+A410hCOUQ1cvDZE=,tag:4J4oo0CKNCCNb3LrdNFh3w==,type:str]
storage_box_user: ENC[AES256_GCM,data:JIWh720v/g==,iv:HJp+Bx8kS+QnFXlqdiITPuKFOQRgpg08QPxMqEI3AXs=,tag:bDYryqzAgeuESbqCNJlY+Q==,type:str]
storage_box_password: ENC[AES256_GCM,data:/9eyEsS+sHuWfi2zzLawYwURHryZQ0ug+BP36SqSXgiX,iv:i1VaWheORGkrCZZiCpGqXsxE+lx4a/zEMczJ9hLRsmc=,tag:5OVE90R+e4H0xkI1TP8QjA==,type:str]
#ENC[AES256_GCM,data:AcDfSbReb+Fq5yDcIxTDVN1foKsKKs1eMTCc,iv:m1LZMR4uaLCHH73MrRG3qpv65JSkDFzvF7nIxMNJOWE=,tag:d2hzFSYNO01UEOeCMUJ/bQ==,type:comment]
acme_email: ENC[AES256_GCM,data:by2DuXwa5TmwKuoYB9rQWC7JQ6aJNgwJ,iv:nA/WnVsscIF8n955TOEJ4N6+bTIBesu8VBlk8GjWheo=,tag:RpxSJUt8XG3hrQ8yvSU8vQ==,type:str]
#ENC[AES256_GCM,data:oIGUDVmm09wiD9ftBozwyy8I2liAR+SvHOwD2CfePQ7y5aaXs3iCjTQGN4g=,iv:B68aM+QBRx8vDGKunDxUWSCtjWKNtoZojyHu/tAIy70=,tag:qg6uQjRcWuWQhU0u+FUZxw==,type:comment]
mailgun_api_key: ENC[AES256_GCM,data:xj31QEnmS8z4qGqXuWK1ZJUNXWk2uPOKV4dVtDFxGcsnq/grQTPUY7ZDsp02x441Wfk=,iv:Cdeyk4wSZ9T5tfq45VGE6fNI+PqqDTFf5uf9x0yxIw4=,tag:Qd3WGPtrg7ZNT2J/U4XxDw==,type:str]
#ENC[AES256_GCM,data:XGCm1nYG9utFEgZ08hY+mDzl6KUh0WzlwztGPn/ivn04BA9CXE27uwSFmQZIwtDDUm4r8SvHNmytvd4Jwg==,iv:fGx0xsCmVrRKKQn4YwGeXqk09zGiu421eSpjVlP7yaY=,tag:0dBzVVsASKgzok0wkT9F1w==,type:comment]
kuma_username: ENC[AES256_GCM,data:pvaYOaQ=,iv:LEEaIy1d9zeo/0J53G10SrCMWu+decEOJvQKQANpwMk=,tag:6B5uXYIGW9fg0nO7T3MIrQ==,type:str]
kuma_password: ENC[AES256_GCM,data:zE2zI+mrQ92I7P/zykqbx4jEACI=,iv:WQ5y/N+WI45fHolYZleoH5/N9ITlNzMTn6xtpGfPFlg=,tag:Jwh8CBShb0Nu8b6ksN5DrQ==,type:str]
#ENC[AES256_GCM,data:h5PCiXOXU3wcEAv1d5hT+ft9rDETCcDr83LBGwTeiF/PBEEVMHesSsv8Bkn1Icuj,iv:HSk5jzuX233Z6mBIwxcwBLW4Dcw+IEObUkrmkg2wfBw=,tag:473GFIBMhrI07tIBQnFZJw==,type:comment]
docker_hub_username: ENC[AES256_GCM,data:4UQe5HoWd0azh1BN,iv:KVAFe4HYtQrzpRVLhVOeVxtrg/VrX0tdh8BW+lCGqZ8=,tag:31NlEomOynhd61qiVwuMlA==,type:str]
docker_hub_password: ENC[AES256_GCM,data:qo7aespQMFAPhfXaKA9q8A07HAwwyoRKBuJy5Qm6zK+HEKiU,iv:l3vx7CIkL4fZOVnQ0CxYuWI1UWl+eIcuqfa55JTOHZU=,tag:jn7izsloBxoZ51Rj+vBdSw==,type:str]
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
sops:
age:
- recipient: age170jqy5pg6z62kevadqyxxekw8ryf3e394zaquw0nhs9ae3v9wd6qq2hxnk
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
chore: Post-workshop state - January 23rd, 2026 This commit captures the infrastructure state immediately following the "Post-Tyranny Tech" workshop on January 23rd, 2026. Infrastructure Status: - 13 client servers deployed (white, valk, zwaan, specht, das, uil, vos, haas, wolf, ree, mees, mus, mol, kikker) - Services: Authentik SSO, Nextcloud, Collabora Office, Traefik - Private network architecture with edge NAT gateway - OIDC integration between Authentik and Nextcloud - Automated recovery flows and invitation system - Container update monitoring with Diun - Uptime monitoring with Uptime Kuma Changes include: - Multiple new client host configurations - Network architecture improvements (private IPs + NAT) - DNS management automation - Container update notifications - Email configuration via Mailgun - SSH key generation for all clients - Encrypted secrets for all deployments - Health check and diagnostic scripts Known Issues to Address: - Nextcloud version pinned to v30 (should use 'latest' or v32) - Zitadel references in templates (migrated to Authentik but templates not updated) - Traefik dynamic config has obsolete static routes 🤖 Generated with Claude Code (https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-23 20:36:31 +01:00
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsZDdlWk4vRFZQYTFTU0RW
NDh3a3RZalFiQjhYd2NESjZsTlJKa0RvdkVRCnZLdHc1VlhYVHB1bWRmQ0lzRlNM
eitYMG5oc2wrdUw0bVJ2cXlpVW52bEEKLS0tIEtTV2s2eVN3bjljYVduZS9vMW1U
a1ZFY1NBNW5odFNZaXJSQWxFNjIzVUkKIs0FCN7RRaQBAFp4tBb09C+7c5iSlyLU
ZFNIXfMeTHtziiyB3eUtFbZHS0Mec6YijCR90WGm2Vk17dNVTu1Nlg==
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
-----END AGE ENCRYPTED FILE-----
chore: Post-workshop state - January 23rd, 2026 This commit captures the infrastructure state immediately following the "Post-Tyranny Tech" workshop on January 23rd, 2026. Infrastructure Status: - 13 client servers deployed (white, valk, zwaan, specht, das, uil, vos, haas, wolf, ree, mees, mus, mol, kikker) - Services: Authentik SSO, Nextcloud, Collabora Office, Traefik - Private network architecture with edge NAT gateway - OIDC integration between Authentik and Nextcloud - Automated recovery flows and invitation system - Container update monitoring with Diun - Uptime monitoring with Uptime Kuma Changes include: - Multiple new client host configurations - Network architecture improvements (private IPs + NAT) - DNS management automation - Container update notifications - Email configuration via Mailgun - SSH key generation for all clients - Encrypted secrets for all deployments - Health check and diagnostic scripts Known Issues to Address: - Nextcloud version pinned to v30 (should use 'latest' or v32) - Zitadel references in templates (migrated to Authentik but templates not updated) - Traefik dynamic config has obsolete static routes 🤖 Generated with Claude Code (https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-23 20:36:31 +01:00
lastmodified: "2026-01-20T10:38:25Z"
mac: ENC[AES256_GCM,data:4aL5GwxjNYoXaLBdDYtpQ2FiWz6fVPjNvlB4wMX7PedzSPb0+Eix7BK7vG6MHrRZVJzRbWQZb9xmnVzl+Bm8gdyS9ctPBfcZsv94nUFHMW9KLyavvsaf1F7asT0OuyNsHc3A7vfxjO3FT2oNOGOmulpPXKFQK2+87elL52bg80A=,iv:gQU//Hz9+Ku6X31S0ocLr2oQKvw8+Bagx9LEAqelT9s=,tag:f6P5OtH8bAyWt+BuEsdgWA==,type:str]
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
unencrypted_suffix: _unencrypted
version: 3.11.0
Reference in a new issue Copy permalink