Post-X-Society/Post-Tyranny-Tech-Infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Post-Tyranny-Tech-Infrastru.../secrets/clients/test.sops.yaml

36 lines
4 KiB
YAML
Raw Normal View History

Security: Remove exposed Collabora password from docs, rotate credential Security fixes: - Remove hardcoded Collabora password from COLLABORA_SETUP.md - Replace with placeholder and password generation instructions - Rotate exposed Collabora password in test.sops.yaml - New password: NX3NEpOMogUOcADjB0B2y1QGuRTSeDUn (SOPS encrypted) The old password was exposed in documentation and needs to be rotated on the test server. Future deployments will use the new password from the encrypted secrets file. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-06 10:54:14 +01:00
#ENC[AES256_GCM,data:fxhCWwDUr5EYw+nAVvL/x0H9/ucDwMOGFg==,iv:junDUUMdayNcNKl6uZNvlTTQtq9Qb4usiXvS0lYgBWY=,tag:sgd3N0R9UsATkSFDY3U8tw==,type:comment]
#ENC[AES256_GCM,data:hcSTpiyfYyZiWj5nIyM+ZVeZEg==,iv:IxFr2Fcn4uZJxhHx5H/RWGI/qNF2pTX6qNxo7dDnrSg=,tag:Dbk/tpmhWeOQpEu+7g/+1Q==,type:comment]
client_name: ENC[AES256_GCM,data:ZlO5Tg==,iv:0qU3rqQzfBd5gqnVqECW/5HsYlf7fMYB3hCxqShmVbw=,tag:DzBhLpBPSXmrgKcS2rMB7g==,type:str]
client_domain: ENC[AES256_GCM,data:ss7S4v5dshscOhSofzFWDQ==,iv:CsA+WGJjMfrka/0NhkiOb8S4l7LxmpyX4D4RudmVKaY=,tag:VUnQ2THSqP3dsREDX7nibQ==,type:str]
#ENC[AES256_GCM,data:nyoZwpLgHh1c0K9bjB4F,iv:0mNTGknTy4lX3OC0QuBS517VSQW2BNfHmIHV+gZUBbs=,tag:iAW6rpwI6jcZIA+pT8ioLg==,type:comment]
zitadel_domain: ENC[AES256_GCM,data:ftxxjcaPYXG/ZvNxEjwSBxK+zpCsVBhA,iv:mCA93Qbn8OnyaZNVBxkDWAEwyxnM33fM9xf5TXmYifQ=,tag:Wb1OLdwi+pcMv3ic2eZS0A==,type:str]
#ENC[AES256_GCM,data:qWUq73IYbHXkE1ce8yNXXw==,iv:4CoJpkQ+NRNVJexDg7rm5xlU7EDI3gDHYmvVAYl14wk=,tag:yvw55ouDZMCzJq8y7qyz7A==,type:comment]
zitadel_db_password: ENC[AES256_GCM,data:YMsK52Xneg6NeEBVvd3t4zp2dn9dPWd6TKMZC7mSPCc=,iv:Ux4jA1ojRnNhDJzAYpydtVhSaccQ5Afw4AuFI2s9HkU=,tag:t1hPDbS2KsbS8I92Ai+9YA==,type:str]
zitadel_admin_password: ENC[AES256_GCM,data:F8eA/DKng+piFvsjDcAQ7xPM5VN1rw==,iv:/6PId6O4ftpKHX3CfmX/dMZ+7KehoyfEnKhuU0XHeq0=,tag:xEsWAYNGSY6NWA5v9ubxGw==,type:str]
zitadel_masterkey: ENC[AES256_GCM,data:8j/TfElTNn4uT8BXA7tp7pSsqh/5MO5D2xmc5eTcwDY=,iv:klzqQ0ByWDybUQxZJLt2zR/wSILi9PlcbjkDBm93epU=,tag:VPfZ9W4Hpe4o8b0Gf8KDTw==,type:str]
#ENC[AES256_GCM,data:3EkIPZ5DRcIdlaPVxb8tMe7f,iv:TtdB2gYgmXksIp7JFmMIjXxgqg8B8E3nGdSPzl6T5NQ=,tag:wdHRZL1Cf7jP08Xcyrw6tQ==,type:comment]
nextcloud_db_password: ENC[AES256_GCM,data:9LGHQ1cxgCwEn4477xuC13zy74tC3acKQShXCfQIus0=,iv:E6Lw9iR+QGzFKOiYEnXOyM3KPe/Zj/eyR67tE+ymyUI=,tag:q2IdpWCDYRMoO1S0XUmYrg==,type:str]
nextcloud_admin_password: ENC[AES256_GCM,data:aZ73IIqVH96LXZ80O7jI/Eh2,iv:C/6jiRLj94Fv4J9p3/D2+Yqmgg+0WLUYO4wz0V88yWM=,tag:oOM2NxeZnRBdinSp2ZhoNQ==,type:str]
#ENC[AES256_GCM,data:PZuMRsvBARDlm/ey6yj1JlI41Q8ALvrpmA==,iv:8Ty/lTFWNcFm/HzpuVhAjPNRpvHvE6clYgq80vD79T4=,tag:d6XKL3cis9tAEyAFR+0vaQ==,type:comment]
collabora_admin_password: ENC[AES256_GCM,data:hWzcxRSwXw+X4O5rBoJ1pOA+yFQAwsk0VFzHKgwQoIM=,iv:vzL/Jtg/k3v+Na5HlFeCLWk9MknTY6qKmeVB2jBZoII=,tag:kRvj0zyOLSzd+YO5jRctHg==,type:str]
#ENC[AES256_GCM,data:H6EGdY8D4snkPL0qls71uHBDbPDgvKJneYiy+uyvVazRyg==,iv:TYmoqO+vn8Mri4N+ghgaKAnQi6DB65vBNZBYt59e2iM=,tag:OP3m+FP1092Np606hrj+ow==,type:comment]
restic_repo_password: ENC[AES256_GCM,data:OoT2lrkaz2EXk7BsTJnLUpiGbKoe3ZqsC+PDks8kM0s=,iv:rpViNgtwRyDmh+Ai2CsG5Hyjl+rkIcRBNbb6RCZ64Hs=,tag:ipNiGjoEE9JXZbGWPlBNCQ==,type:str]
#ENC[AES256_GCM,data:W31o3A0cq6hRY1ZKNBiC2KOdJOgst9jyALRNIWO8Dxmv0yaACdTWhwbNiK2WfYC++64rCSPxEwZ6Eit80VKyHLTAqjc=,iv:JPnMUXXbUYjNsz+Zig23j7LGOdiPPDigJUAA9YByP9w=,tag:BCfqqhAevngLYYIB3Ww8YA==,type:comment]
#ENC[AES256_GCM,data:t4OT5lJ7WbN0iuGRybhhT4cnFC6oHguKrUF9Pu8=,iv:TvIwFbwq9qVhMRAzKIm/m83lh4Cy0NzKxSV2UU+wOus=,tag:I8aywh+O3qDxlh/0o4DNKg==,type:comment]
#ENC[AES256_GCM,data:gk+cv5mp0Q6Ddl/0ktTSXmO7ASTpXxclsGxYwCp/z6NL,iv:2XzWvk69TeNwYCgFLSaYGPIxKXytiqIFTRk+1BDsyXQ=,tag:lB/q8hNEhoDUrV9ryhWkcg==,type:comment]
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
sops:
age:
- recipient: age170jqy5pg6z62kevadqyxxekw8ryf3e394zaquw0nhs9ae3v9wd6qq2hxnk
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
Security: Remove exposed Collabora password from docs, rotate credential Security fixes: - Remove hardcoded Collabora password from COLLABORA_SETUP.md - Replace with placeholder and password generation instructions - Rotate exposed Collabora password in test.sops.yaml - New password: NX3NEpOMogUOcADjB0B2y1QGuRTSeDUn (SOPS encrypted) The old password was exposed in documentation and needs to be rotated on the test server. Future deployments will use the new password from the encrypted secrets file. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-06 10:54:14 +01:00
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WDYxbVorQ0tkditJeUpU
dGlWSFVNU1hDK0pFcVJJN3o5eEZKMFErc0N3CnQxM0xFdmlRemJOOUczOGFLYlZD
NWhEWVZGei8zQ2tZL3RKSnFkS3ZaWGsKLS0tIDdVd3NES1A4TjJId0c1WnZnQVJS
Wm14RGp2c2VlTmRZWUZkeFZCQVBFREkKKNnLI8C8KSZKu4bSFAOXbqpr3DtLTscD
0i6jil/AlzEatD17Y3YxB021jDoMVECgCHmVfei1PM1O18gINglcHQ==
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
-----END AGE ENCRYPTED FILE-----
Security: Remove exposed Collabora password from docs, rotate credential Security fixes: - Remove hardcoded Collabora password from COLLABORA_SETUP.md - Replace with placeholder and password generation instructions - Rotate exposed Collabora password in test.sops.yaml - New password: NX3NEpOMogUOcADjB0B2y1QGuRTSeDUn (SOPS encrypted) The old password was exposed in documentation and needs to be rotated on the test server. Future deployments will use the new password from the encrypted secrets file. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-06 10:54:14 +01:00
lastmodified: "2026-01-06T09:53:24Z"
mac: ENC[AES256_GCM,data:nvR6b3yUgmL3Kl6iUP2/DvRdL6V5mW5Rne87+cXaP3w7uFn9fKrMnLon/HsT/A4CZZuLEXhQy4GW56m2QfbaFg/M3CWRdGOBBJtlJZ0P/1mDyisTkgLxAemH1UuRo+cCY7WOZLA2Rqp8+ozUMwN+lciCOwvMB9T8tZXE5WCh5g8=,iv:Vgu+ajEldRRVyAYXqGq1x5fMcPgFBteMOCNFX1HeePE=,tag:81dJoCtMM0Tzk4mmzcOxbw==,type:str]
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
unencrypted_suffix: _unencrypted
version: 3.11.0
Reference in a new issue Copy permalink