Post-X-Society/Post-Tyranny-Tech-Infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Post-Tyranny-Tech-Infrastru.../secrets/shared.sops.yaml

28 lines
2.9 KiB
YAML
Raw Permalink Normal View History

fix: Restore Mailgun SMTP and Nextcloud OIDC integration Fixes three critical regressions from previous deployment: 1. **Mailgun SMTP Credentials** - Added mailgun_api_key to secrets/shared.sops.yaml - Updated deploy.yml to load and merge shared secrets - Mailgun credentials now created automatically per client 2. **Nextcloud OIDC Integration** - OIDC provider creation now works (was timing issue) - "Login with Authentik" button restored on Nextcloud login 3. **Infrastructure Deployment** - Fixed deploy-client.sh to create full infrastructure (DNS + server) - Removed -target flag that caused incomplete deployments Changes: - ansible/playbooks/deploy.yml: Load shared secrets and merge into client_secrets - secrets/shared.sops.yaml: Add Mailgun API key for all clients - secrets/clients/dev.sops.yaml: Add dev client configuration - scripts/deploy-client.sh: Apply full infrastructure without -target flag All services now functional: ✅ Traefik reverse proxy with auto SSL ✅ Authentik SSO with email configuration ✅ Nextcloud with OIDC login and email ✅ Mailgun SMTP credentials (dev@mg.vrije.cloud) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-14 16:04:00 +01:00
#ENC[AES256_GCM,data:/eh4zz6uEw7qlElFH0QH6C78W+bwRwzUfrVw1w0+5poZOQl136b+6e4=,iv:t/wsXLGjDe+Lf3Cvp5R4VATw3olGLVJ1H2RUSFlOMF8=,tag:D7kzKpDHGtCY+E67LJeKkQ==,type:comment]
#ENC[AES256_GCM,data:VM0dHs+tOx/1Z6oamSlAa21A4M2He4KuNLXsPdM6/leqvus5M+k=,iv:61HeqUFJBEVw2Ge5jWps/hv4uuvPxz6iZaJrBONwySs=,tag:zi4V00IRiudBZujrs67bdQ==,type:comment]
#ENC[AES256_GCM,data:CH6F+c8mchwyNk9N9O4CB42c7nmpzMTE9we46q8lkNQk4LZsWbdrzp8+/gfrBPIwGKRaXtvJSi8=,iv:X3OrXEttqwjc5gu4JLf4S9DnK6IEt3kuFXChE1vpI1Y=,tag:V/H3O2pLnuEsUYLJOBSEJA==,type:comment]
hcloud_token: ENC[AES256_GCM,data:aqixVRwAcmqHlB0e3tbQOo2giawp++KjTW2hfK6aZ3VRtTHEcA==,iv:iHt1fY70cWTihiGfypUkhm6//+xfU+JFSkOBUGt1pAs=,tag:QpfzCsDdQR6rppemuZlUCg==,type:str]
#ENC[AES256_GCM,data:KpCylAL5gOarG+cNdmcL5cgmJI/6YT4mdIA7GlSqSJRfgNBVYe/xBgL1Hpiq+Q==,iv:+O4/ADo/OoYvMx50+g/sAqyjy+O7DmwURGMqBdDhLZM=,tag:PI42CwChPU6MVF/8/mT6Pg==,type:comment]
storage_box_host: ENC[AES256_GCM,data:rO/FEQp1Ksd824TToUh3q0WOVFY4cRk3W64=,iv:61Jor26LvSTKoXo3A9S5NTfgwuVcP8afUneKxSmyT/c=,tag:MrWsp91eygd2YvOnNNyanA==,type:str]
storage_box_user: ENC[AES256_GCM,data:KXUlMAixCQ==,iv:8o84GdNHZXKtBJwYop31YwqUL4HqhBNeKbEnhVLPl9A=,tag:hW5O9zSZ9dSLq0FORKqx3g==,type:str]
storage_box_password: ENC[AES256_GCM,data:SyzHuEXRbLru+wflZGkxauZpZtUDmo1vMuHmbJlh0yhS,iv:PgqmRC85bQqSreMaL2ibnmOL9+nkg07i0lDNJSEQoDU=,tag:+TVM11wz89TirKBesjKwfQ==,type:str]
#ENC[AES256_GCM,data:y+MWRmWUdPVOdaHk8vyZrc3HPD44NIWDZ4mr,iv:P6wh9kz8XcE2i/OVIOfvKRj49qizcQoYh0NZqpJk3bE=,tag:ZYgRx8zsILKp06ZQDn/4/A==,type:comment]
acme_email: ENC[AES256_GCM,data:cu9ReaF3xouE0eKZEx4PkiNmMfKOPyix,iv:fqgM8f3tMz7D8HAGCJ5ziwQ/Swsu3K8ZNkQ+p6Qc0Hs=,tag:pO+8wVnAMHSMMfeZ1dEKNA==,type:str]
#ENC[AES256_GCM,data:SX03vdRrckyWY15r//Y5pJZWXFGfaQSnNnJvA6k+AsutO1Vl9reVQMexQEU=,iv:p1LbT0qxIFfoiJPUerjGqlHD+fK0o0lLnFUvPhIyHdk=,tag:1zURmS+50zRThvHpOWJ0HA==,type:comment]
mailgun_api_key: ENC[AES256_GCM,data:WxrIeq1odexHduN4YTJSIX9+CaiLaGnkPNkEQpUwTou8PU7aMqJtclxliGl6YrYjncM=,iv:RzHQO1URtLPeAFRRjR3YF9+z//5WostpuwPtf7wxCZI=,tag:mi+mVIGGJqJaHu6cM3HcfA==,type:str]
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
sops:
age:
- recipient: age170jqy5pg6z62kevadqyxxekw8ryf3e394zaquw0nhs9ae3v9wd6qq2hxnk
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
fix: Restore Mailgun SMTP and Nextcloud OIDC integration Fixes three critical regressions from previous deployment: 1. **Mailgun SMTP Credentials** - Added mailgun_api_key to secrets/shared.sops.yaml - Updated deploy.yml to load and merge shared secrets - Mailgun credentials now created automatically per client 2. **Nextcloud OIDC Integration** - OIDC provider creation now works (was timing issue) - "Login with Authentik" button restored on Nextcloud login 3. **Infrastructure Deployment** - Fixed deploy-client.sh to create full infrastructure (DNS + server) - Removed -target flag that caused incomplete deployments Changes: - ansible/playbooks/deploy.yml: Load shared secrets and merge into client_secrets - secrets/shared.sops.yaml: Add Mailgun API key for all clients - secrets/clients/dev.sops.yaml: Add dev client configuration - scripts/deploy-client.sh: Apply full infrastructure without -target flag All services now functional: ✅ Traefik reverse proxy with auto SSL ✅ Authentik SSO with email configuration ✅ Nextcloud with OIDC login and email ✅ Mailgun SMTP credentials (dev@mg.vrije.cloud) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-14 16:04:00 +01:00
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4cGhtWTREWTA1NWZ1SE9u
UGwvNWM3Z2pjdmsxMXRFK2UwcHQ1MkgySVE0CmJsVDBZUWhnVlJjdnhLWkwwOE83
b3dsMDhKamJNLzFaYnZ4V2ZnS0VydzgKLS0tIE10MmZuc3U5bFFmeDFGNXhwbytG
eXNRencwRmM5ZEdqbks2NTZ5UloxOTgK3NE24DZp7QaDUIUQOQjENm3zKorckrmt
JEk2oRXoH6PGJHrZMh2AkmoG3/enh24U8PNQBpmYX6U2ZA7zfnjZXg==
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
-----END AGE ENCRYPTED FILE-----
fix: Restore Mailgun SMTP and Nextcloud OIDC integration Fixes three critical regressions from previous deployment: 1. **Mailgun SMTP Credentials** - Added mailgun_api_key to secrets/shared.sops.yaml - Updated deploy.yml to load and merge shared secrets - Mailgun credentials now created automatically per client 2. **Nextcloud OIDC Integration** - OIDC provider creation now works (was timing issue) - "Login with Authentik" button restored on Nextcloud login 3. **Infrastructure Deployment** - Fixed deploy-client.sh to create full infrastructure (DNS + server) - Removed -target flag that caused incomplete deployments Changes: - ansible/playbooks/deploy.yml: Load shared secrets and merge into client_secrets - secrets/shared.sops.yaml: Add Mailgun API key for all clients - secrets/clients/dev.sops.yaml: Add dev client configuration - scripts/deploy-client.sh: Apply full infrastructure without -target flag All services now functional: ✅ Traefik reverse proxy with auto SSL ✅ Authentik SSO with email configuration ✅ Nextcloud with OIDC login and email ✅ Mailgun SMTP credentials (dev@mg.vrije.cloud) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-14 16:04:00 +01:00
lastmodified: "2026-01-14T14:49:25Z"
mac: ENC[AES256_GCM,data:Fa/ssGgx28qa9rJ/6BVGisR6w9xzAD7UwqGcz2ufT9wau+1AjoolDCJnYlhuhufCLU5L9nhwjPe1UPu8Ficpvge3i+UoXbVvnSNuc1ib4Vqaz2KBuHdP+S03/dimbdqjbfudk55uaML94Z5taa9d7xtM9119oG/XZj/qlhA85kI=,iv:lsg/m/92NC/nOSAj/WS4EKlSD9yauyrzzrCpS0+oYO4=,tag:t7lYNzGXL6OUWz0ykVSLPg==,type:str]
Complete SOPS secrets management setup (#5) Completed Issue #5: SOPS Secrets Management All objectives met: - ✅ Age encryption key generated (keys/age-key.txt) - ✅ SOPS configured with Age backend (.sops.yaml) - ✅ Secrets directory structure created - ✅ Example encrypted secrets (shared + test client) - ✅ Comprehensive documentation for key backup - ✅ Ready for Ansible integration Security measures: - Age private key gitignored (keys/age-key.txt) - Only encrypted .sops.yaml files committed - Plaintext secrets explicitly excluded - Key backup procedures documented Files added: - .sops.yaml - SOPS configuration with Age public key - secrets/shared.sops.yaml - Shared secrets (encrypted) - secrets/clients/test.sops.yaml - Test client secrets (encrypted) - secrets/README.md - Complete SOPS usage guide - keys/README.md - Key backup procedures - keys/.gitignore - Protects private keys Updated: - .gitignore - Allow .sops.yaml, block plaintext Tested: - Encryption: ✅ Files encrypted successfully - Decryption: ✅ Secrets decrypt correctly - Git safety: ✅ Private key excluded from commits Next: Ready for Zitadel/Nextcloud deployment with secure credentials Closes #5 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-27 14:23:36 +01:00
unencrypted_suffix: _unencrypted
version: 3.11.0
Reference in a new issue Copy permalink