viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
infra/state/stacks/paperless-ngx/terraform.tfstate.enc

2308 lines
158 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"version": "ENC[AES256_GCM,data:Qg==,iv:I33UCiv8D4jwskZnCAEEqfQ8m2EsBOyQX0p4gN+y7Nk=,tag:e4BsJnpp50kRqaY1LbUMeg==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:3wSvYvM=,iv:Tok6K37s3Pa6V9OYDCZt7343dhPUIUKF+PDxWlf1UfI=,tag:SAB+SKitEPfqLMJVRsBPZg==,type:str]",
"serial": "ENC[AES256_GCM,data:VME=,iv:QuANQ4TJ83BY5BWswqeZJm7HRlTelfDCYCQlDg8cFFk=,tag:e0IczmXo0mqO/GUXXOFpfg==,type:float]",
"lineage": "ENC[AES256_GCM,data:ycmNRB1/OO3q5rYlAGnPwDgQ+FeFkmbdvQlixKG7cHvh9Us5,iv:wdJqSxuqKl+IxXfnBlecP4Q9XjNcRJezz6/QRvdklss=,tag:m2BnJVFRD35RRFLnFCQFLg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:w2YOhg==,iv:h0duk5xF7VZxblb1Be7rieKYFDzLF9Fgu0OLXNY/sv0=,tag:BVfFFrAQTsYoi05URfting==,type:str]",
"type": "ENC[AES256_GCM,data:WiQqTBm7PeZqRvmaQzfwvTo/,iv:biIPUQ3ZSkHCLg4rbI/tkKjOJOXQj7l34YSf5/RMAJU=,tag:C0+k530Zk7Mv6/dhqtFZIg==,type:str]",
"name": "ENC[AES256_GCM,data:jKisRFQM4g==,iv:6Z9r5T7wZ+TdniDQ2ozlc9wEVkGjwDjW6nVaLA8Sems=,tag:YPrhvMD1bNO2aph/q1jtbQ==,type:str]",
"provider": "ENC[AES256_GCM,data:hn/ToFAvAl628NBUt3zZG7LyIYn1euRmSQ+uadL6NWR0BHN2zZIPv61+QBEhDWIrnA==,iv:znBxuCtoimuIXbcjuMEPK3WzoOtuT4HtCiEf67LFc40=,tag:+IUxMCOgppH9NETjfsR4nA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:ew==,iv:1PE+ICD0YtLTYFLz8XhJhfrmR3kTS0a4fP5iuh7auOA=,tag:XWbgT7dzaYhOVjq38oFpbw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"created_time": "ENC[AES256_GCM,data:jUyRoiwZc2CRmDBGapAuVLcpz0Yq8INa6ILYK3A=,iv:dbkmS9EcP+75YzHcd1/KVIIUKBHTczsI3jruq11UrkE=,tag:uu6oC59X5X1XlESFYeuOBw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"db_password": "ENC[AES256_GCM,data:pgzQqFfuYFE8jBCp5TZtsuq2N97IHA==,iv:OGvFA39vcvwMv/u+ynbidqJ68VP2QPIJoWJZ983XHEA=,tag:TqMqABEDPNMNAQJGZ8y+cQ==,type:str]",
"homepage_credentials": "ENC[AES256_GCM,data:LUv1me0R/zNTEN/a6dQKw5R9wquRdeBkAC3HqwQHrnLLQP1m2/phoql2Pbyb4FdHgdsM1cuUHlesMBOk3hnY1kvHA5qt9jOJ0n7zJARr8u9jU9RTofvBe26xd8AOv93O6w1MFhfp9+YpyVUDrcpf1c7YgaxKrMpHkRyosDS1rWM3JkGqiiS8fV5Z0Gs/gSKtCPicXxNxxIhLB5lUANnh3LVOKAiyc/rhCim7RhXop/dsNP0J+jWzlakTKVnAxQZ9ulQ8T6KdwlA8P+8J9fC3lXW25a7quGfUhBCnS23ym+6ljZ6ZyDeDIpkZiWEHHcV355rCjQSJU8DVTcRfu1zqoQj+NAwKrOyU8Hl3TSPvKsj4dtWngCzxDI3Gwhp5r0AFTahpTFvyLUi691bLTozkWbPD1PgBg5Tvr+cEUClRZo+Xgjrb9IA5ATUh4fIxcBtwsTj++T5PCkDUKSyVxM46mrubiuUZk+RS3z8qAAiqzWuHXN3lBd1m1cgciZTmvwIjjZM/v7d5grNzRe2/A63O7xBtAvYSrRoVRyFdHunbSihqjh39juvf8Bn5z3R1a5BRscIfFrtOElthoijijGfR5poBgJqnD3O8aCZIupPrBOX2niZNZeTcWF3IW44knm3ovuHnL3EkCQ2dmPFMJ36EbxBVWOQ99wO7on4KZyHdXR1nXwSloRgiCYqaKBr9nwCWZBAl29D3wCmNt2YxJd0YAhTEreMRzAne/F+38kQKJdnqpdg4Jtga4vQI/TLycQgV/0PyUfST0AzsTiF3EWZAOEEOjzJR5Hv5/Svclysg2Jy8dZ5Yus9baJ9L9xmuWsXs7tYsFB5qW2RX4JcA3FAdLMiHBK7bvzruG37nF0SpwZaUf64PFnjMI7RzAezE2hpUL6cUyAoChBZ0Pue0CJdfLrT70yN11Ck3QZcP2Q3m0dkAKgXr8CQsXMS3AAxt35gLG7VF+GonMYrcrINvm54nfeAeweHfdM78Frm52nVaY+smLoGSaf1e/gAq72/+xWXl+wYPC9SH0iCCb9+9z9D9F+U5AJdDiNKU2E3jZvCWtGk49z6PeFNS8gZEnTCy+1o8mWUXS2dZJk2/byHJ4m2vnmnovxd+Onr1HRLdt+efVLqXa65sRMPiqISru/nKoNOB0ucX2laTFPWAkjAzmik7DvVpGxqE1UYa905krPgg1/kgXljVeuPJHBN1sOJet5YwJZfKY2/4Fj1cksMXKxKKcYKA5pRXJCVa9ZBOmNK47g8rxWPNfb/Sz03iQzmBce3lL14KIYHo3AF7rZCo87j7fJ6EWEgyKFP97DYuXIioqV2afA1DOZXDGZ+B4zZhjRFtsJ633ljZtXFyixJMu1IC7O1TYN34c1FTU0HryBAGsfTcG+rtLVuHIqEwvBLup0L0/GjDW4mBGAolUI5RbMiLde8l08BcMqmePAO8LsKGtWxTRiXutTCJk9pEYTWr7vQa/JN15bnbSd9CR606o8aQaQVBNVBYeeX5+96NOVgmAeDqHnuPeHyn+OtORKC/PPQvKFYyOa+WyEuzJXXVg78NcBdFOcSUoiQWHzzSNyqAIghTlk4ZHU+0fs1uzjUsgihJdFYFM22X1WBtY84A3V7mMzMjqeWXU6BdhK00+t1KBBNu5Rkv1hxu6FJ9pMBosIXYJuAKV/PxE7ZTWCG9hPuSr+OffSVwFNNvvTcGc/HoM9ZgdHWZMsUnFi5WZlo4vyYg+LehfRebyJR7avEXJ18fy0WwP2kLzj1sHePCcxo7wxPGRw396RfYTrFgpJHh7GbccsCMMOenQ8AUF6aIuP9QOLqdnC+YRERxx0SZl+ohGBtBBXYmnAhDafqfMnEQCEc9aXV+DgizCn9GfwJycp9TqqgyK4Q73WgqIHaIlZPJpf2vbM8qyi33F9U2TEUfyWN/Dq2sMWO1qz0r47agMtrczMOU/1c7NmyjBy/SlX+/b1kZm9R11ZFCWOWoR7AUPtGh1hl3o7SRHZcOpBjje7oBunoTJrDcu/+oK0oNo/iQks7UvuK6G5zEPe4gduB6UqHPpNTbate+coCLamSs1XTHA7a9mrSR4gcMLtyO4CqutlEeh60hlG67SjQzYMqjPBDV/0PDk50xwRSoX76kEW6cF2Bcixwc8dE0l95UVInuOFoG4NlU/cdmNGXTXHOY2+0OP8eMG97/DE8BtyH1v+nL/kIY+ojNLO73GFZTb2VKPTSnUixNTTDDUy2dYQq9mvY77wCJw9Mchu9SPSvYV6n/+qHYYChC3a/shzi2t1W1HH3dadvHhD4++tK0l+48204QliiO6/x8LH9lXrFCciqXDbP7C4rwOMeqmXPfbjS+GKaXHnENAuyaguhaQ0lMiTPjtTrfG9SUfPtyXfBPsZDwSl/RXKeDGh/cf9symugK5KRYEpRuNwouz6R0XtRrF6M6gGUuu663rFDJoRJ7f7+fkajkKLZf8+0RCDeqbfMvUb+mjhjSL2/p3ue2HG0FVFn4pKllrLwJGnV/Qun5DyfEjY0cfKpQAEtbWvwqQeqEACAHOUD6PisLfNPBhOiNuhnI4oV9zxjjmDGc0BdBd1Wh4EIhuLXn+ISY25Z2lj3DUN+BY3dDCtbmszh6AyByycr3Xdlzcl4hhdBAP0rCZnJ3E7PGZN8QgPzfKT/wr0k5rdItiOITzxFdIDpDlGXaxp/nnpPP+No6ZgyHZzfpHvP9Du2ZWjoBEvG21QoN707R/YXJAhgY9EEVDNLYdzMtZgYx32LX7g==,iv:kDJdTtdYyL/y4F2Y2HxSVRiYWtbLMSJTiuHPc/KExu8=,tag:y7MQLuKpo8l/lwVu3hYygg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"data_json": "ENC[AES256_GCM,data:3mi114u6umCQy4o4K9Wt3E/cQe4Xy20F5syVrsuadZGjR28roVd14E36OWC7MjkBo20JAR1OHziZt9rp5n7orXKPZtfZtDZxWs0muuIyVVLzoiEBA9+RbngcjTWInlSatabbNyY4TNefdaChTADHd6K52lqPOC3eZw+gpgtMCtjGTPHUGphuXxLsx+tE+Tb+NsztoKk0LTs8EXg1xU3w9ZhATD01U6Iv6/x2ZTF5TfQOm5nPebhqrWcO4RJBSb8I8K1DfpMptShdvprqh+alSgdlkmbfXxEasx86pcXJGrP9Hm+r2WhWCjE0JI7iEml6ePPs5dtyb3nGOB+nz36KO6lkZO1nvtmbSUYdtwyYbaLHkAZ0TDiPYw8oTw3zIgG5fem816/O+fd2MeTyr9HbsPscZLKu+8Bc+bkCFRWF5FhUYkrLr85MDjnVNtH08tx/per1x9EZknb+yTD4QYIj4gOVxqjOJYjYAqLYDPZEePIIa6KWq0BYsr9z7/ZHM7a8PpIbTdPq5R44gdTBDfCnBudw/kBDjU180Q1zCH72VXlEg8xbMtF09tY6hLavztMhBTBcBkT2jjrTUeiwmprogpUsyf0js3USxB/h9VDpZjDh5qjcqo8xgkNDrdPDYixoS7lJLyUka6UCE42KafDOEISQZUdH5IH4abM/NVLY3YeryZL9n3+XMpRBw7CUKZs+5T8AeDYlp7FVpFVudymqLgAWSIoVnzTL6ZhVnlhQ1Q37mMjgeqoTFL1rLvXuB5LlGVnEp4BS7DL5SYmuPkPF2RSGK1f/tA/4/+eiaOnik2tPFOrxvsPjR4TZtVI4rYOYIJH6vnn2o+kaEGwoz4zjqehcJO0tGTJnz3F8VIT+LAMAw6NUzcoS0zIAuXfUElhfPVBO2iNYS+AYNTg878PVM440mnGADtSsPRU326+RGslebZY9M7eyRE+u9ma1126mlEQxF2hbyv1/4jw/5gdf4IkZsB7GTHC2becaCNKfyQ806g0kXW1j3wLYSzmpNhfKnavXgMOOLEiP8sQNSzO8Y+/Uc3E4splnIG3mWzVm934pVlOVph47vdmwaklzcyrNegrFE8IdImTXnpeGwF0dioRuWOFQV5PmPgqlWdEr4SR0IGS7VAqgfl+BnNMO/c90Ox1KecVpMmFHLk1LfmBbDV0uNAVz2XDCCQaPyTCTQQqvLPyiX3FlTBSutrLuLV3LJN14hpcobTxfYcLaiAGGDJ3GVN4HdhlVdqgwCrtHnhcEbG82xF28lpGeOc58HRgfyai1RbRqDLW0d0OuHbqP3/iIZtP4o7FA8C/WrisSKg1lvNghN7ppB9uajYCIdqOeqgchBRMONe80yWg3s7kiVY9bBJ+v6OhoGSyhIrxUqc/NLTUo5clZi9BZdCBj+h0QsioZeoOrMxaNxEv8ZbqmEETYH7mijQDQly0yAJOqeCPsmw2v2FcAD3fhwzVwxGRzFNW9wt8XUppYu+phUK/Qt29nIbdPQjNnx0O5dDc7ORDdrMpNb8KCPBD8/6+Zjl+P0qnE+sHvKIgeiE8am7zqFucDETMylLcijoAPnBA8Put/6g1iwm8mUybnhHYUBH9yw2dNSvYvUglOkoK95ldCP260YPEYEszKEQn03ZSpTgtTkwyQhiAJPbSHJEQCJXmaQXRzMo4ukc0uFlzp4g/IKVRKcc1JFRfwIM84EVxx0DGTG4ex3KMUNlTcNTYmHzQm9KKol1gtmI0z0j662VxmCWC8vO1FAn6itbleZrJxw8HXCOtdYaBDcxq95BcUAwWpOzVYy9iF/pPUTuml1gduwlmSsyaFYuESQdaP33xM+CWt4GHxYR0HybMMIQnbITmt1qbFCHYmiCzxzuSLAN8971sLawZz3QVnjT7EZht81anBd7mQM8Ebh0Oc9qoyoQD3XIQQsjAePJB1ZscBovpeAdzg2MFFXJyPR3zc2Hejvmae0aaOkwRdYTjtcW/qCmwad3BIIpYAJtIDP4g8JFzaNl+Ar4ju4wKCKhUUHh7/THGpLcmEuTy8mz1GvDLuzrdWLN4U7WFnuwSNmWeSqHoEKvs6jA4sCIc3ls02o7zWjgi9RbsCIkE5FUP51ekL06erhPgBmBTlTfl56U2QsjEHHOhfkTUjUSL96o0br0ZfwSPdS0IVx/DLYZvXSty70keAWCkW27n/Zm2Jcn6/JgyKog4jl8+G7sxBmxZlALWv4JkGz/fNjfk7XRLLiVl/v1wMY82vwtarlS78bN5/IuJEVqcRKMaXJWb1gL1dGSXqTdlxvYsL1plLfkKAq67f4OZiblX91ce8193EEjcddWBhDGqTmPNcVWdeqzIHA+tX5bXWE8JUqUaFDspcKtQPXKEzSfxNcpo27/+WkH6ZGfADh24eFJC0azeDIM/goNVWn0TiITbD9nB/TDZ5G1dPU3KdN7EX0Q9p6+hAMoos509GjRvpWaOYT+hmPBwqTyDu2kZNUZWeDxOgTDuhgZW0a4474ocWT2AUKdYLyIXMKgsaetZTNXACmMFVL8cdTNY6I53qeTuzPqxpFjoL9zPBhBhjxmb6F/+pmfbG1df2noivBf89j21Dalq2fGnBmT3rInj1/G06GAh4r5iVP5xq380Qktro+DJQberlQ5lKcrXVmPCgfuruCcrkcEAU2qZiNmVdTIhpQYbduvpS1uPfZaWFhX0glQ779Vc40MM6AphyECOE3ptJWPDXesJZFl15Ycz+vkjBQFcbtlf5aCRptA65QP7C+J2Ytk0lRlPzTU1Nk/PDH5sDd+ODcnvYF2Bm3y3TisfN41ZsVPZX2nl4wDB1KoASD8NF5crIGhR4/lwEyjprZa2OYWyvK2DxDU6ENXBt1v7FalSLWLA8Wc9c6L6UzW6ywYhASrB1my//0Ert5hJK3szrJLq56BH8PCL3ACtBNas0CLONGc8LY3BoofzWb1wqdwQ7iNygCdx0vYf5c67W1eVtmPSPWfZt8UPgVd17ap1QpRvvXMES/LLjYSszVlGsCZ5jmBpIsATgsgjTHed4g7JZLCPR5zsOuVL37ghz1Ictnvs2arCB3rkuWXdC,iv:g3oawhfEtpdLM3PxM5bEBBI7oCVdpWx1E8JxjbDYSAE=,tag:jcnCZNqAh3A7+pjothZqMA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"destroyed": "ENC[AES256_GCM,data:UkqbPUc=,iv:jjlgeZA1pvVZNU2TBMXlnuoFFr3fvgN7ajZSa13pNAU=,tag:G1ATWwZxJ/CtqypVW5DofQ==,type:bool]",
"id": "ENC[AES256_GCM,data:/krFqq8EG/aNlNHk2afounUYquu1RYOslw==,iv:DXPE+LbLXwNk22fczVgRCbW+NheqntGY+FAkbsBEGx0=,tag:+BOi3V4eXzrNCePfPj96DA==,type:str]",
"mount": "ENC[AES256_GCM,data:LT7qihtg,iv:/p5dX/u8EUfH+BCtstml+O4iBS9x1/mcP3QomEH+1PU=,tag:IrphAOnrqr0Gb0+aMk7QTQ==,type:str]",
"name": "ENC[AES256_GCM,data:7zRS/kP+BUel0YI3Ig==,iv:bvhMED+r3T4h2As+qk3KxdB0ICs1X6DX1XxoL+1aNWA=,tag:Wos/gCWIrv8KEgtV2G4Tzw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"path": "ENC[AES256_GCM,data:l5taokWgMwUWBeNTfSf6dGRZPtYqyHE5nA==,iv:88mXBP3LIh06q8BGsnOnfwMSPSt3ewS1g/TTFFeFhOE=,tag:q8jidQcgGozXGcD1piXByg==,type:str]",
"version": "ENC[AES256_GCM,data:NA==,iv:Pw+ZtFJgmW1pc37gdsUtxJaB8u91Q7N9h324G4eX1DY=,tag:5iwCzt3KpFMup6zVZXbdIw==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:s+MQI/V79A==,iv:IEr6Uxui1nfEH01RHduP9sZAI5fM9ABfCggJn2z92nU=,tag:HAcwDHJpOj23HZAlRyeoNA==,type:str]",
"type": "ENC[AES256_GCM,data:DLsdT38ob4C+dntZwpzio2+qzml7,iv:S1EjkIf9DGSrmuaGeOXYTgWJvukqduv6n1HTmTFkYjw=,tag:DfJmLDzDXSgaQNdCki4mXA==,type:str]",
"name": "ENC[AES256_GCM,data:VB2Htw7zByo6KdyIwg==,iv:ehqwtKqPQZtzv9F7cRWROP+u21VCjZ6N++Naj1B4fxE=,tag:uEkISfDSI5YJAlkHq1VXNQ==,type:str]",
"provider": "ENC[AES256_GCM,data:eTVi/YVW5OlbC0OkywYvjhtu8PDg9lHxJHLSmhA9FBgR5SWj3unW0gy87eKRoGrDy4z0/pF/,iv:rMo410qwt/JtGdPFxWjjGqcgRlSJST00KfDEaZf9Cko=,tag:BLRmfuRAxr36RMZw0caxSg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:wA==,iv:VKt9/4rEdI20wq/Sli5HKrztH9/U70W4oY41hhe4dxc=,tag:kSFvmJCyO0mdyzs25l+HXQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:9Pd4TipQkRuXPTmf5xVvGIbAMl5IXD/xNPsY,iv:kx9vo4cEobAv5otk/9bFbL2vrWYviqV7BZ+8Q0zB8j4=,tag:JpfgQ1kiaP94e3Frp3CvoA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"reloader.stakater.com/search": "ENC[AES256_GCM,data:luxnMQ==,iv:0KcBYz7FM76OksBqsQwsYUGTlMNpYKgCmZL5ZJRtLU4=,tag:xKUMGpQF1yofQT6BnHTQnA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:DgM=,iv:b4KWYns9OV/ZJtxzl97VjZWWcgF3o9oK6ANuQMGrVkY=,tag:GezSGT92jgXja2SbidaLmA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:iEh5IUDmGCv+o6Q+Gw==,iv:WpHO/1+6wGKsDqo9A31CnKXl74L46U22GCwPaZeOD6c=,tag:i1wcXdDh7diFkEUOGVwzBg==,type:str]",
"tier": "ENC[AES256_GCM,data:bt8jafZh,iv:TXvbIDXDkBeZYLSTzHu5GX68Plu6d08oRPXkMlcu87Y=,tag:5lno+yQn5NSYjFQgVNA/fw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:7InwWgmys4jz+WYXCg==,iv:tqIE4TxU80vsiZqvcuW7ZXLC1Sldu9cVlJ0VDoiypgI=,tag:RT6AYqesEsK+YUjd7BBJJg==,type:str]",
"namespace": "ENC[AES256_GCM,data:Zwv/z8Ww0t9hoG3bog==,iv:71uCBVFNLbo/iou4NwHUyHoVfvyLyjGo/KgOCaz7TYE=,tag:wCfBOwI4y9KasWkTyCqoqw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:JXOAQoUUq5ss,iv:N1eEeAEtqaKJB0icV4wAdwSE1/IqnwrzYR6DIkBMYuA=,tag:U2rgaW1RCWF7kz/HbTRe4g==,type:str]",
"uid": "ENC[AES256_GCM,data:kNV0fZ1cbDZphWBH6Fc2EAeCihmb6lxqeihqM/8EoamtmexE,iv:CnKhGdsibKCkTCNiDuYd00frLQ/2DbNQ4Hp1P5tI/N0=,tag:Rbw8QDWij+A8yN+Yf1iJng==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"min_ready_seconds": "ENC[AES256_GCM,data:cA==,iv:eSJoy4TGQkVS0mQRZN18pvduzQAD3puT5SJT6Gwyoxo=,tag:B5kBfqB9DgsaWGkE5DOXCA==,type:float]",
"paused": "ENC[AES256_GCM,data:Rg/baXw=,iv:9P5giXIzBvMNUypFc+j1pnaYllxDcFRT5gWu1DS+2SU=,tag:8sd8zoi/p4V6xCSnZs0V2g==,type:bool]",
"progress_deadline_seconds": "ENC[AES256_GCM,data:KmjP,iv:5GNBMMu387SM5PvWLwO+2AoUK+E4Dh6Kiv7iPqLpZ0A=,tag:5o971bVUcO3e1KStA4LgJQ==,type:float]",
"replicas": "ENC[AES256_GCM,data:kg==,iv:u6qtmVJHmhPa4bfIY7OiYK239oNRHUjeVI9hW0/R+O4=,tag:Soy0VNxtmLxcgSbnQky4zA==,type:str]",
"revision_history_limit": "ENC[AES256_GCM,data:fEA=,iv:npKv2JFxPCKhj3ZyJMe0KbvX6d5oeypzS1tNyZBeMU4=,tag:pBcWTq5uzxv20Wwaga+N1w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": [
{
"match_expressions": [],
"match_labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:nLn5SVtlDxL9XUvUBw==,iv:n1gBIhrOLNw2+gWWZDsBnoW6+r+yC3919GSHzmPjKgg=,tag:KlVVgj8LOkDVJa1+pmP37A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"strategy": [
{
"rolling_update": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:8tr8HAgynbU=,iv:EQ190lmSdhXYVQnT+jpG3yNqG9NooutDzFCFtCKRQqs=,tag:G4R3LGUWt8KOCN7iOU1+EQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"template": [
{
"metadata": [
{
"annotations": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"dependency.kyverno.io/wait-for": "ENC[AES256_GCM,data:ZtCZi/ltigGmWD8SBCq3eJW+xmjUK/WOnYScXZ3a3HQP,iv:bmaWnSsAlKOdT6npQcDBMPqISWm56VPbqjiy+NzIZ6c=,tag:mECMs5wCRfd4UYlL4sGDJw==,type:str]",
"diun.enable": "ENC[AES256_GCM,data:sl05L4g=,iv:93anrGpnNTZxzD0xsd2tx+WPSS/Bs2gJxFQO8mq/1x0=,tag:FukLHAxTnuxbQnYLpXIz+A==,type:str]",
"diun.include_tags": "ENC[AES256_GCM,data:3MbTg20URd0zAWsCsHG40EdvQkq4tJDDow==,iv:E3aXI3SRZQHfd4h28Xg+bmq2d+IbB9XDNzXx8VcDBSI=,tag:VhGoNEyjDBtWIoM6FYwyMQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:VA==,iv:YBg/dAlW/icYCewHz95eOm3+7FaXNuK+15AE7VTRC44=,tag:jsb9nSHue4bUeCY2U+uQGQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:Gku1c2iE0kcf5LNYDw==,iv:q7OJqh/nDW/2KpzrCTpy/gP5nMmVH59U7DRtK4ULHBI=,tag:67tA6gVkzhlpMbO0cOAxRA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"name": "",
"namespace": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:2Q==,iv:ur1oRTSL72XzMuQ4lbmlIR9qamsjibllKZiEzF73RQw=,tag:bC2i1oH0y05BPq0mD3ycpQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"affinity": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:q4gEqg==,iv:PBF9H6NRv88M8YE/paTRnhPHn4Cl3DjZByBz8k1vRhE=,tag:1T+g2j6j0V0lD+nPClppug==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"container": [
{
"args": [],
"command": [],
"env": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:pQSYSOnsEuZWRuDoLJ+v,iv:VpNRVTXbU9gBJtrvn4JTpHrEdOEOWBM+wcKSkJ8Ca3w=,tag:VxcjtxT8cA0WQ8WbprdVzA==,type:str]",
"value": "ENC[AES256_GCM,data:XuLh775Rm0Bh6tbBP/uL1Cqx7kFaNbgcS08gZeDQeoNKF0OsyQ==,iv:Tpa9bVTgFMs6t0YsoPfEKD1bcon/iEVAl4xq89CWQd8=,tag:LJXlc0abqYieYB3RD/Pe4g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:6bqNLArohCKH5tD902EelcugkkbvSg==,iv:30OgIEThjW1WcEJ/9Ry0XzXDZkMksFBcY+Eiv/dNwjQ=,tag:NozlUeIxm4UTsC4nd0buQw==,type:str]",
"value": "ENC[AES256_GCM,data:dLUKXzy3NX0MaTk8VQ==,iv:S5wbMPF+1gq9TQi6ps0EAIuHaMV7m9ARqrd9k/6e9wM=,tag:PapA8c6z5BgeaVuPDro9EQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:xDi7R0Hyeb/d8c0AFgqhKAqL,iv:NCLaRjRh1b+Asf3Sprz+9Nbhy7mAfaRp/NC0D2cZKFI=,tag:gcOku1mF9FOf1p4o0WCnsw==,type:str]",
"value": "ENC[AES256_GCM,data:GEvAeQcWiA==,iv:XqQi+g/xE0+u+0dXFH1Pu20FrcBtxR9yxfwTXLkPm84=,tag:/aTUjHs5Tq+r3GrcvwnCxg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:5l33AFPia2WgE1rRWn+nIw==,iv:g9l8BgAQwY4fo60UV7iWY8wU2OPGnJpcGjtbvu7xnsM=,tag:XMdHH1TeaCS0HcyJgyaPEg==,type:str]",
"value": "ENC[AES256_GCM,data:SoSrAi/VSXUx4AiM18+gTZGSrqZVBYWayi2ayWI=,iv:C6h221OxruAheGnxfgRlgawCzT6IO/Yuxl3Rvg1erwI=,tag:wCjXcktahpj9rBggaLlF/g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:Z3u1qh2+R26AonAiD2ZfWw==,iv:OxSlSrbKlw4j3+JYmmdQEb2u3MmowpSW+s02pwx7TzE=,tag:h7YoNbvcveWWpKj82mMOpA==,type:str]",
"value": "ENC[AES256_GCM,data:+nexA81MxVTJiKZIQw==,iv:Ms7SOSg+0onC2A1M4ip1MG3Sz002+k+/DQf1e084euE=,tag:WGf+omUGqG00GBNP51ueZg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:5sefvdebI53ix/uLdvujhw==,iv:2lXOwp0TzlE81+kBN09PBkuPmA/++wbgFUB/vNVtftE=,tag:kqJlTzc3qTg+MDk5GEPuxA==,type:str]",
"value": "ENC[AES256_GCM,data:RcbjSjhwO1/Yt137AA==,iv:M/CywHxk1EQLJV3OLIV5XEt/Un6ln7podVk/7vONd0s=,tag:6IsdSoaJySSmRgdt5uCVKQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:UGb1IvIcwtz1KV+Tc+DFIw==,iv:KtcVXZJXxASKUCKTzlRrUPdx2P9bO/NGw78s/GhxQPc=,tag:6vRKVHmo3WlpNUvtApjPUw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": "",
"value_from": [
{
"config_map_key_ref": [],
"field_ref": [],
"resource_field_ref": [],
"secret_key_ref": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"key": "ENC[AES256_GCM,data:ul+XhaSvlKLMq8E=,iv:bmPzGkhfrgdBXaz9grEao7Lx1QF5Y1ZjBaUZJcd8+R8=,tag:q7CvxIC83/Vci5m6EbH6iQ==,type:str]",
"name": "ENC[AES256_GCM,data:5l24a6NDbLOmi8W+5zoN+WuTCL4A,iv:7PG/sjMTIXP2C/wo3qbdDxHFqrxAoRy7BnOmhRJPMHU=,tag:DOYjJYJVCj+MC/x7TEPFNQ==,type:str]",
"optional": "ENC[AES256_GCM,data:ww87q10=,iv:r2cAbg/g8E0/PvAC/ZmMFql3js5e719n2fjW0ZzV2cM=,tag:HCn/QB7JzisYC4hEnzvuHw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:SGwjo33gdKwiuottGm9OdmDdsfdL1J6MXpCP/6ii,iv:ydW5V5hqU4dJuPNljnrG81TcvvUVhEoToCoYdzWRZK4=,tag:qYU8m23SusQ7YSt/OvlMBg==,type:str]",
"value": "ENC[AES256_GCM,data:4FSduCLn87c+ffyuW4D1/ZJx/WL3iprW4d+XAFJfIOvlzHRNCWJOkLXYUCDySlU9JLO9kWg+2TxccWnle/6ME10=,iv:zErlzWnIiG31BXT2gnibuTrUnPI+nv+/8O+DyyHegKI=,tag:uGD50TrtXayz04fCeSFsVA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:G052GgWthC08aH2tJieQ,iv:0D9TJB4PpOHk5PnSG9oJZTFBargEcjD4OLBexMEfcmg=,tag:rJkfkHNboUkGAul3krdU4A==,type:str]",
"value": "ENC[AES256_GCM,data:CwApu8M=,iv:RQpkV47A8UurI0JYHuddDFPUunZnBCxplYql1/08CHU=,tag:TtS3zCcBaUGH7viAUTyAiA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:UigUtwtP4OBc7kYf0s8PqL1AsTc=,iv:Iq4oWfueLdn9BsmFV2ifkk/89EZESMXb+USU61ZMU2M=,tag:WbamTe56q7VHJUW0WyXjHg==,type:str]",
"value": "ENC[AES256_GCM,data:fDflEYwivQ==,iv:YoVDZMousF64gXVtNyymPQGmC/4LYaCX+Ktd4zc+uL4=,tag:xucWnEOmxIIPdWJJQs9dRQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:8bkV2jbahbnRy6FzfobRM7XzvXj0u0g=,iv:4+Xlc6VSo9cBmjdGfR0FrtFLV/UvDgsHj2ry2/3tyBA=,tag:mS0qfO3kSFgbQFnkPCy+kA==,type:str]",
"value": "ENC[AES256_GCM,data:oqWFVqWwtjffubEWl+tn4dCoMsRHb6U2nrOo/2cyDwEo9J6vliww,iv:382YpwzTJncszJA1ghsU0doGwXZPvjJFGMyEWrhpwoI=,tag:1vWZhgiBJLfXDoWYnWlsPQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
}
],
"env_from": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"image": "ENC[AES256_GCM,data:t2AnZQYPfUt5mnmoCB81FRA822iJhKYC4w4zmz2//B5WPp02I3ksauni,iv:aBKd2zwfZqvtHh9JMtTe9lad0uOXIJZr4chS79im/q4=,tag:pUJlkgAum2QpbIg9rN6zEQ==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:2NQvtRNq,iv:o9IeHmMv6/JhGU8+ltiwBwCI+cG9/BDyaT/Wpwky28E=,tag:gL/ucgr84QS46j4hz0lUrQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"lifecycle": [],
"liveness_probe": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:xUk119sPU5pEgB3oqQ==,iv:W9gL1xuP45c05FA0eeaD/tpHjPa+kdN+puAjcoK22EA=,tag:tLVfjnQkuRdg3Jx4EZ02Aw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"container_port": "ENC[AES256_GCM,data:MLb3xw==,iv:gCe3MT7G2qaQV6C7GWyK8wle7Sh7dAF/wOwo8SiOM8w=,tag:G3CCCYE7VGSoMqn4gL5AYA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"host_port": "ENC[AES256_GCM,data:cA==,iv:Uaf6sklyDeWdcD0lzUsNbTKFADKnzEe/YkahPPE/BYQ=,tag:upLEc6AoM64880VwOpucEw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"protocol": "ENC[AES256_GCM,data:dW/P,iv:Aip9bkWovsbUfQeTiSp6V4LWWJhsX6a8GtZu7S/8HZU=,tag:QpH6ejoq10OuIifT+Kiyrg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"readiness_probe": [],
"resources": [
{
"limits": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"memory": "ENC[AES256_GCM,data:DHUb,iv:Fz0W7j7nZPLfqCtEuw7W1j2OJzK2rV3AXssced2vzeY=,tag:TxEuhGJWaWBSDUxEuL34VA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"requests": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"cpu": "ENC[AES256_GCM,data:vVBS,iv:/iFgzP3SCXuhZR4xWzVYtrvxsmjHXBoGRb4UJOla0T8=,tag:ZobDb0vPnsi2XqDgkQ5C6Q==,type:str]",
"memory": "ENC[AES256_GCM,data:6IFA,iv:qDqnQUw/i+KSa2U0hcW3oCg3B/4D4CxEWqZ2nDHeEAI=,tag:EpLJuyW2lhLmrpJsURisNA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"stdin": "ENC[AES256_GCM,data:7ctBPRE=,iv:ipQ1NnNqCKV0FlAUF/MlEZV+RRohGKb7hTkgZnMP4ig=,tag:ZW8aUE6AAht9By6VbWUjQg==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:Z7FjJr4=,iv:+bcl3HGS1fHGIoLIj6KDtGc8pOK8qX7NT38eqggCHMM=,tag:JLIPJskQ7V1kH2yKOEYGIQ==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:y9s6u1dnkDK7ZlyyjA00FUp++7k=,iv:KinhwG1LawK+1o7svUjqGlRKYaYWl1X8Dzlp5LPjB58=,tag:8cje5G+ydnaOdAT0JDRwqA==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:VpoXxQ==,iv:wSI9G37dBF0KT5wB1Esy9ME4MZTnZaRnXP+7+s4z+20=,tag:Za1JntfoeOPI707/xYTPpQ==,type:str]",
"tty": "ENC[AES256_GCM,data:Wjf9Knc=,iv:3tH7JayIKBoOd6CVVWgg4zf4f/ubamxc3tySNHQwfhE=,tag:KQyVUOETkkyUlVSJWnWc7g==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mount_path": "ENC[AES256_GCM,data:L+MgPLZWoWg8Y8osB1W7Mffu0DS/WT8=,iv:b3zk8lRDm1TOdQC14WZ/KnPzlrf0dlOKEe2YR2+Yz1c=,tag:kXDhfVEBTUti4rwRjlX4Yg==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:7YuRFw==,iv:dUDSIDgeF7PaUJNYFsuvJUoK7h5r6QfTjomgmGFRR9U=,tag:RqYqvPI69G0ze7FZor3enw==,type:str]",
"name": "ENC[AES256_GCM,data:637VRw==,iv:xaSghzBoNCgd4OYJdd2IPR02y3N7ctHhZF4Gb09g4qo=,tag:abF0aVtD8Lm+lN+NogBJCQ==,type:str]",
"read_only": "ENC[AES256_GCM,data:v40ztlc=,iv:Um0SY7+ZYpaUXNL9k3uAMF1Da90jOT0gk3bZQFwLPOU=,tag:94E10v4b/EBUYhWIGjh5yw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path": "",
"sub_path_expr": ""
}
],
"working_dir": ""
}
],
"dns_config": [
{
"nameservers": [],
"option": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:BiZWdG4=,iv:Ug2pJs+2/zIhFYuOqxX5CUA7qldthzRtcmxmQ4Qv5WY=,tag:wWq9twu299swsNCIXO7HRw==,type:str]",
"value": "ENC[AES256_GCM,data:1g==,iv:G/3Om1jT7eqC/jjxPHSwlGJ/L3rr1n5tCr24VjJk0EI=,tag:hENLETQSXF6mIasaPF81Sg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"searches": []
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"dns_policy": "ENC[AES256_GCM,data:8rx5dvhNc79xBl/a,iv:7bXMEvaNvdahBsS6Sudc+eYM3sz4k/kOnqC5cH6yVTc=,tag:O8ev79RXY+nDkhF3n4LhNQ==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:crvIyg==,iv:LsCWRwuMFTB5aO9p4G+D3E3HP8gPOfk1I8ZDsddJhcM=,tag:rWutmHmZXVwJPbKIEPpv/Q==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_aliases": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"host_ipc": "ENC[AES256_GCM,data:hoo7Z5o=,iv:gu4i0ZzVDWT4VpzuaWJbBT932UNbshNoAtJg/xGb3KQ=,tag:YN5UKiAjofVLcztMHsHpUA==,type:bool]",
"host_network": "ENC[AES256_GCM,data:v51ABSQ=,iv:3SRAgVOcIFoTU/lkm90IhfT0YZfULmwjnOpdplYfZ7w=,tag:kR7Lmiy9HfPQDmpyjeF2NQ==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:gapWEUk=,iv:QT+Z52Nk0mKdrL42hXsTo4GXgV7UjDHHu7Jx4S3D/ic=,tag:CGQytew7C68zkDTlHP7HaQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": {},
"os": [],
"priority_class_name": "",
"readiness_gate": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"restart_policy": "ENC[AES256_GCM,data:ynbDgv8f,iv:ZXnVng9i79liHQMCBe73MwSHlcpeSm1zkvicho00w+A=,tag:Xrkzc/ADyIt00WlKHVTPMw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"runtime_class_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"scheduler_name": "ENC[AES256_GCM,data:/aSh3BS4hNoR6QtzMH75tCQ=,iv:XP6cx1Jb3Ty5SoXQe559cQZ38eSpumeJPZRaGeGQ2Ho=,tag:VUyrnFJULf3VHGO23bE+Ig==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"security_context": [],
"service_account_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:TLRX3bE=,iv:L/9Cz3/A3JIFvHMTajfyH3+siKpHMzLRv7LajIHU70Q=,tag:SPWNt/Nff1pkGSyG7O6T7Q==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subdomain": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:aeU=,iv:0Qq6exIxymPJFEiHUooUWrI5U3M6Xv6F/sxWXuahnAM=,tag:RsQSpAYYjgia04FE+jBzGw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:LPn1gg==,iv:hwYZD5F8M5H/yWkJG153WQCQ/53WPZnr7VEYFouW2sg=,tag:ntSEeGfGcCA0hZJBDccxSQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"claim_name": "ENC[AES256_GCM,data:jDQ9P6u2BamH5ubGPwJ6kb16,iv:jCGSlYzF5Zmy/lSXmZJXrm7sJTx6x4LsoM5xEHrM3t4=,tag:+fqdmrEpDDQNVXGEC9qJ+g==,type:str]",
"read_only": "ENC[AES256_GCM,data:15/15QA=,iv:5bc1XVHM5SVHPUthv0LQSGxgZIte99dGhzWm1x/DPek=,tag:jO4iBbBej4DnrVr+jQ+Jog==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
}
]
}
]
}
]
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_for_rollout": "ENC[AES256_GCM,data:jOwO4w==,iv:Tu/i7q2XBo94vLnD/GW0JxVOWkXo87J12WfsJJvYxmM=,tag:DD+nynRM03oQCRY7z0x5jg==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:ZtDsHYNsnh4gQt+ItbupuHn+FgLzO8W6arYOI/Agf6FbAHHLQq4mD2ApwtuqlY2QuI5DUfhfdJdOxR0zTTHt+YoO1I7yZS2pSPC6fIU1sEzrUKpSLEdR38Y94hp+03XvYIAP9i3rebOckdXiZ6Cjv3bF3/Hy7qz6FzOH32iA/6m3e2GHOeAfu5ZlEbG5TV5OLWdWDKlpDG4W50FLk32lvR9Thwsam4P/gzA5QQ==,iv:pUOiNfqQ+K5onrRX1r+ouejEfFgsQ6uMUkVrMedN9PI=,tag:yea+mljkwycSHiVQTMxkJg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:WMxGXn1rA143fbozRPAEfl+RnwAVImA9CsiKaavXI1MC6g==,iv:yViBKcZdmdFTjwNlDEASOfQWldc/KSFriT3/s2xiP5g=,tag:IIfIKlhoGsHH2zqE66huXQ==,type:str]",
"ENC[AES256_GCM,data:lBwsXfkFvD0odwRKN0+TdfdSWGUzzIhGAhcScGbqBc9UylIcx5ZSTD/SATwAbaf4Olq8NzezlQ==,iv:6+H6XwZ0yesjkcw7s/TUyiKRW/+owtrbngQnzul9Nks=,tag:dwlC9IoI1BAmCMUg0MiJzQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:h6NEIPo+cg==,iv:hnJ+og5HeAaFG0xT7clRfkhk/hrpV3c04utCC7XZ7jQ=,tag:znhIYrWzWhCowVYLtfHDvQ==,type:str]",
"type": "ENC[AES256_GCM,data:p+JpunCHcS9CQJ2blXijWDO7EQ==,iv:aOIhF97MH3a5liaNqScr7izeGR2GOQkPYWj2NfTw698=,tag:SiO3ZoHZhzEG0bUWOKcyLQ==,type:str]",
"name": "ENC[AES256_GCM,data:ODfGPrkIiGpYYs3XUrUT,iv:R4RWhIjlCTw8+grcckvMQECkBqMZYEeDFTu2CSTt86M=,tag:4s4cRD8sekphYwV7Yg/s5Q==,type:str]",
"provider": "ENC[AES256_GCM,data:oyUbqnbzPxV/BbQYaqfnZbYc3FDx9Y4IyXDJcFHr6sEjN/8y9ZNeV7lNTiIIo6Ui7hBEAGGm,iv:8YZP/4JKBiM2qpf3gko6hjSj/0td9tkZKRNMFhBPVFI=,tag:WE2yKArusKeXq5ppgn/K0g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:LA==,iv:Zl3nOHyj7Psy5CiIOhxvfvcT/Lr6p9pRA5cso2xd0qE=,tag:auy6qi4jigDf72Sd8LgrJQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"computed_fields": null,
"field_manager": [],
"manifest": {
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:PItGqkhDYtJuRcwr6QsC9fSi0r5DfEMFwQWs,iv:2wdZBnPdVQJOdcM38jba0cHFF0PPGpfB9xocpY1YTnQ=,tag:YJt6hD6Cb5BuN4+QzT/Y5w==,type:str]",
"kind": "ENC[AES256_GCM,data:GwFtoXxAFqqxvu+esps=,iv:+roR4OZbxLk1r8XAW4b0FF4MGII7MqbEq6/4vpakUwU=,tag:EObqiEeQHJdUqnKsOB/G5w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:m3WYNKYjYeynVOEiu16L0eHcHQTT,iv:MO1kujpJZsz+uzId2w5NXl+sf+xx2Mib6GzFQH2x2oc=,tag:3UuOYb4pNqiuIbGKaRrlMw==,type:str]",
"namespace": "ENC[AES256_GCM,data:e5/etAIk9ppJ4GAGOA==,iv:mRc1FRcNAi8F9hbRvCT/FficerSKWW5B77Fj0m1MCYI=,tag:hAEnhHnqR3oLlXpSWTcDkg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"spec": {
"dataFrom": [
{
"extract": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"key": "ENC[AES256_GCM,data:dBVvMWOOb0aLoFVFQQ==,iv:z4J2mrMsHQ08XKH7MKHnQ6SqaEi0MaNWHqv2ItYsgkA=,tag:H8wCxAGcMsDjGG0j+vWO0Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"refreshInterval": "ENC[AES256_GCM,data:liqb,iv:sEL6HeckUhfwhuKMT63NEue4DfxcM/JJqGKXnuNujX0=,tag:DH+4HHf5GOSZNPikYL1hfA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:kmf8Bpk1snRwAibi7ol9T0aC,iv:nwZqZutpseiAA0aaYnKgc40a0pRcE23H+GMn00bu3fA=,tag:iFmCapqBq/iJFS+mBF4OGQ==,type:str]",
"name": "ENC[AES256_GCM,data:dpqTqlJKHyo=,iv:DfaCvQH3V9Y+upeM5hgDRmyIEHC7g3xfPiwFeoaQUUo=,tag:qJVAMcyO5zY9HDehxbKl0g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"target": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:sPqWaKxCKIPP3IQQucoWebZccl/y,iv:M0fmd7erCv+iinOSa5uPPjUDTM9yOXMEoztct1fFVOI=,tag:Ruyu0kcspoUK2KI40fFKww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
},
"type": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:ZDRr+LHM,iv:KZ/9Dy/HzL9gfZOR0eFwB2d1wMAAXrqnlLPgWzy6y5o=,tag:9FwO3bpMDQSCC8+yjk1dug==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:N3QACoe3,iv:EnTPl1/VP+3nrOIjpXes7q+cZWRNZZL/QzQu/u8T2m0=,tag:HSewg4WkDjQWg0yfU2iftA==,type:str]",
"kind": "ENC[AES256_GCM,data:97RQwfgO,iv:mhf3yXdjGnNypOXCGnFJBCeQ3h0f04tyvribN/1yzHs=,tag:G++6DAFro5pPV60ly8kciQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:bsF/zseD,iv:XhqRykvN7CLLsGt5oWO5ItJXy7ntcNJiQQfEJehyS5w=,tag:jd8JZOhbcNv7LL1pw1KLVQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:o3O+U3NB,iv:WZ8C4YsX8g2Ui9zzg+5+kwuJpAA1eKr0ueBYToVgy8U=,tag:ETEa460QT5qM4MWQFCQcmw==,type:str]",
"namespace": "ENC[AES256_GCM,data:vAQZqrdE,iv:d7Cs+GW1AAx0zRmPQC/IDGxikYOS6Ihwx5kIwA1vKjY=,tag:SLhiEi3sy9FYm/xS+aAV/g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:AKP3teFz,iv:Gi6X/SbE2GS0FdTgPFI8jhh6nOmWhL10nsTNUJdnP0w=,tag:I5SLXsWu8IQ/+k/UDeFoEQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"dataFrom": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:MBNFePc=,iv:q0HTF+J1tkZ0BacVkObifj9DcWqilpA1okEQ8yEQQEY=,tag:4zikJDgRoIbb2gbpag2DWA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:tmc1FDZw,iv:lnm+NmkFIj0p4d0w++PxD734Gsu+3CAzhmfBIkyu5ZQ=,tag:Xo4lXSVaxImwcVui42WWsQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"extract": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:cw7HLi1e,iv:M9onG5G9vchXXQjHZdbc5UjHyPuBbT3vEl1J5vf7p+A=,tag:yR5fWwGJwPU4iAhqrEyOpA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"key": "ENC[AES256_GCM,data:WbcnHAlL,iv:ePmtuMXLCpRUr2tMQp6tzi4fsM39u9stHa3dY/zVfGY=,tag:ww0jqA1ROLsCH/9W9xISeA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"refreshInterval": "ENC[AES256_GCM,data:VYyod20R,iv:BEX8Jhu0U2XAMgYEmDVG2LH8gX8C0uFdPkp4s9G1m0k=,tag:COvE3PfVldOctuVhfl+cpg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:8e0T4qJk,iv:IcgKAXYi6E1IrtruGCoNmztwA1GM1I0/3MhewQwqOY0=,tag:tW+mUz0nW363bU0mqPTkLA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:3OFaZgFh,iv:I77amIyOm36GGL0cqbtyoNTl0vVX8vLjv/SuIOnCcJY=,tag:op4jskhEWK5/ejTcGVUrQA==,type:str]",
"name": "ENC[AES256_GCM,data:rD16dp5W,iv:0zIutzaiapM+BI+AX3qrWG23NEFIwA5FyFW5zhZWmrU=,tag:fwzwCWNqW2MpnpTO154abA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"target": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:txp3hksJ,iv:Pq5sKdt948rHEZiqFw8a+aMxeScjAAR/2Y9W1Z8A+ZM=,tag:cTcQvHU9r4cE6E7TL03tWw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:WceM5OIi,iv:dZsXSFiv2oROIthHS+FdYwDwH0WVmqNs3t/NtWK9gm8=,tag:AFaH7MHr2+dykEdsSgQYZg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
},
"object": {
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:LMnWqJD8BHkLcuXl3Q71PDclwgsaYR6Wo8Uh,iv:Tgc/q2OPtbPskXg5xPDovr67iieg/pOku7+kY8M4x7w=,tag:f9NjExr8x7qu/ikc8xmZWA==,type:str]",
"kind": "ENC[AES256_GCM,data:4MtzuO0BhSiIWubXIMU=,iv:JEYlBjroa8c6mkxMoHBBHe3lM0ewhT+HrFt2Yau0kSM=,tag:g3l0MY1wHv/9roPFdkmHIA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
"annotations": null,
"creationTimestamp": null,
"deletionGracePeriodSeconds": null,
"deletionTimestamp": null,
"finalizers": null,
"generateName": null,
"generation": null,
"labels": null,
"managedFields": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:0LYJb/90sHrZOSPBnJ0ChTDsrb6Z,iv:gtuZ5vS4plEsf4a/GKoiJGb9nmYKNo3Cg+UmcuRP1u8=,tag:8XVWvVbO+RSV+cmopAvn1w==,type:str]",
"namespace": "ENC[AES256_GCM,data:q5pY4T34s1h6XiDNxg==,iv:CaduSqMwLIMC4d+ZDIM5krdvvWF2X71Q/e6qC7qii1I=,tag:WCJe6btccNUXF1JKuEWpwA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": null,
"resourceVersion": null,
"selfLink": null,
"uid": null
},
"spec": {
"data": null,
"dataFrom": [
{
"extract": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:mJzMJfEGhg==,iv:Ua3qOz1FpTWWCugwW9hqfpmDYly4baX63j5ymnaS6Nk=,tag:B0nVSWELk8AKjbxvvd9WIQ==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:7cru4g==,iv:L7h71hzgFpcdxtdRrP4epuPfomPuUK2Mh3VRQoXLTRc=,tag:NilZTEi0G9yKL8ow2sbV7A==,type:str]",
"key": "ENC[AES256_GCM,data:eYD+w03GnjLARbEr1g==,iv:zWfTJg5Tb/5rYR7nFv1tllBTT8CpKeHcvevmYAdBqzQ=,tag:bzmqR7g6yqsCQKOOJdNT0w==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:h+rZhQ==,iv:NMMmvmiPN5JStYPc4GR37J+Dxh4q3Czz1sU8zdTnRTs=,tag:IZDI+1AL06W3JPaYNBG+fw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"property": null,
"version": null
},
"find": {
"conversionStrategy": null,
"decodingStrategy": null,
"name": {
"regexp": null
},
"path": null,
"tags": null
},
"rewrite": null,
"sourceRef": {
"generatorRef": {
"apiVersion": null,
"kind": null,
"name": null
},
"storeRef": {
"kind": null,
"name": null
}
}
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"refreshInterval": "ENC[AES256_GCM,data:MTNu,iv:1SNon3M0kUtMs5LUWOnNlOkL0Vg6tMCkGVaibnVjH3I=,tag:cLvyjM35c8qBIgQCBgSArQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:KagTa+2LSN29BTIVstYaCDC3,iv:YrpduZmI5kitGuxbpfznvQi+lk2AQDEv6uD7C5Kh1Tg=,tag:wBeqd7Isbsgm77pfkvBmnA==,type:str]",
"name": "ENC[AES256_GCM,data:N0I7ZHALeOA=,iv:EXwZDjew3eA+LW58BfvT5lKUNq3r3QLtwVlcxyl55+Q=,tag:QUzFsZfx6XKHmxRKT82dqA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"target": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"creationPolicy": "ENC[AES256_GCM,data:TfLhETE=,iv:HM4YfEjPdcC/mHclkisVAKZFRJ/ZQObEBSpGphIvkYs=,tag:DqNTm9zJfem5NWeY6q5fyg==,type:str]",
"deletionPolicy": "ENC[AES256_GCM,data:B3Nk5K1w,iv:Y9gFncA8EgpFRjPv86sVgpAyRgrXspArFS7J8wMfhQY=,tag:nOai7SNJJqyHVqDUNbgryg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"immutable": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:b5C8YmQiGpOwmmcpTeYlFq5djIb1,iv:q3JeSKHDuY4GWjZoffU8dM1UX6Z89ZOBRq8H8yX21RM=,tag:qtuPxfva6NpvA6RQgTywRQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": {
"data": null,
"engineVersion": null,
"mergePolicy": null,
"metadata": {
"annotations": null,
"labels": null
},
"templateFrom": null,
"type": null
}
}
}
},
"type": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:7yzATRIB,iv:8UFHn+vhhoZRJql6k0aeWCR1ctqtAFyNEZGBoY3j/VE=,tag:7sF2eDizcuvqVbewiH7yzw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:a+osL0QF,iv:qHlI5S4zomg4+bC35PBuTY+l33IAkcmV9EHdrc+iGKs=,tag:uuE8g+khYuRGI/euLoKuUQ==,type:str]",
"kind": "ENC[AES256_GCM,data:QosND39s,iv:bUTy7+6NdQ5m/JX+GTyL0efL4QHbjEKtpSNk8tGtRUA=,tag:+UhsZ+vpuLvP/qA7MG/LEg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:+OExCknO,iv:1aXasq1IGENk8OellzgkEMt67bqLt8JWg9Ci0Kmbro4=,tag:d746oKIglZc782dzO5pe4g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:MngL,iv:tf69UdmJbd+MrvXxRiRYCarnb1tK/IqlMz9Ey2GSXog=,tag:TJCYVJGUS4HJPbXMZtqQyg==,type:str]",
"ENC[AES256_GCM,data:9YJ9VfBA,iv:SmcgTGi6j1lOcFJclBOTr/v9IIbH3tCi6lUYMvUcTik=,tag:mpqPEOG+qfX/35qsMeM47g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"creationTimestamp": "ENC[AES256_GCM,data:7XxRbOfc,iv:23car9bXdREhavqcfk16QyAzxiB1deEnVZ4XfvVN0g4=,tag:98ckQkEStvTf0HW6nN9GLA==,type:str]",
"deletionGracePeriodSeconds": "ENC[AES256_GCM,data:VaOct5Vj,iv:2t4ta0oFRuUIpHr/02+TDvnOk3vTIksa8CFpDDC0oXM=,tag:wliDAVKFz/kgZJp6zRgV/Q==,type:str]",
"deletionTimestamp": "ENC[AES256_GCM,data:/LstMnKX,iv:hZ6+HTv9AqxUuM0596+4/eds3HgAVkjbn3eFSqAPSU4=,tag:xgy0+C/hzLeWQ6GRPP8NFQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"finalizers": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VeF1kQ==,iv:uFkRih14tRM0ahsPHpV9HNc5qpps2UuRVdg8g/Prz6U=,tag:CP09z+grLxAEvC/0iT3Z3w==,type:str]",
"ENC[AES256_GCM,data:v7kJ4Czx,iv:OAdDok+KJdR8AbyzTx7jSb+oAOiJVKeKX2LrkhPmdIs=,tag:GQl/pE7z3ww6XRuT7fuFJQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generateName": "ENC[AES256_GCM,data:lYoaCLAM,iv:Q+OkvqN3sS9saTqbMd/zkKJqKQCbN7DoScdRV6bTsio=,tag:G2Alm9PSiQeq1YXXITTNrQ==,type:str]",
"generation": "ENC[AES256_GCM,data:WJxXDpLr,iv:/VP/T2AOq3WlW4ROTju+qJhlHT2d3hsWDGcXYa5V4Aw=,tag:yn7V8at2ZOnw0YFmfMOSBw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:8h6Z,iv:zr5d49HnflrvCzqSjFrTP2pXuCw7uKZpHxQtBaCKJ7Q=,tag:R6GXZe/QcEotiLEFAbpKLg==,type:str]",
"ENC[AES256_GCM,data:D+RVNAAX,iv:raF65M3kD2vjUjvNljXOxOA5wLobdMhuCeiwAQQ48KM=,tag:/LI/fbfQR+YgjGM5epD1Ew==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"managedFields": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:/r+DYws=,iv:YA5xOlRS9p1s7C/27UD4TtXiKoJZZ+FuHzyJLg3WtOQ=,tag:5+603u9pOKyfAAC+kQSfEw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:gOIp7ISF,iv:eledyQpzaMWEdT8m8ACN9gCLMdkTfvbWbXOEhHCz2nE=,tag:k9ctsr2Ofy8NP/x1PbSwSA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:d0kAc6nf,iv:mkP7GT0ePj7PRQDYTaLRMSaDo8Pfb6GCkb9IPRL7wlQ=,tag:lNjCn1yrvQbkEPHGvuEVNA==,type:str]",
"fieldsType": "ENC[AES256_GCM,data:1dzsiGte,iv:A7/9XqMlTo76iUUrM4hGh3OQl+43rYQ6KObQxzWC6eU=,tag:XF9Qcwd03COqRF1cMJMZlw==,type:str]",
"fieldsV1": "ENC[AES256_GCM,data:8p68XUYZIA==,iv:3b37MVwS/MwPiS6hwdZZ06aV1AM48qE0Upxs48eN0WM=,tag:IrPSTjvGLW5raJ1hkYpm9Q==,type:str]",
"manager": "ENC[AES256_GCM,data:0ZJHApeB,iv:qge4ISQO1ZEZ8nIiboedXzaiF+421yfVVhmhCVAK/VA=,tag:SVVQqPT+fDqtrk2UPQ8c/A==,type:str]",
"operation": "ENC[AES256_GCM,data:AtUho+3G,iv:jU6qQnx0gLOvSqgHgeMISi5v5IM7vfU48pj91mdDMuI=,tag:1+Ll5LMZP7jyzM4zaxH/+A==,type:str]",
"subresource": "ENC[AES256_GCM,data:ACpo9aYn,iv:IGcswy6dVkCV5uyoFIyMOlKLlzQtjr1lsf3C1nykh6E=,tag:eF1zeabe1yCfm0d3N7iF1A==,type:str]",
"time": "ENC[AES256_GCM,data:P5SoNLTA,iv:tP6un3uDPvNBNWARUXcwfaAa8HWuM66IpJ2BlufI7l0=,tag:yM4mP633wbbAwLJ5kEgLsQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:85FNvI5t,iv:h0kIyHpV8ZiSpPakwzDBbLtn+54kX94ZHlYGg6J88CM=,tag:0EUx0bXa1PEtQ9O7jukz4A==,type:str]",
"namespace": "ENC[AES256_GCM,data:wkDMvZyG,iv:74N3dPqYMbG2S5pgzt9YcdSqlSVKFvAzT3gpvMaHuXo=,tag:a02P1ievGp5UKumURGJoKw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:QUOEBw==,iv:bQCh+5QxmKO7gTJCuuG/dV1l+S/GodNpua2eC7I1myQ=,tag:BSmkco8xkQS6HsJjyWeZ0g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:u9d/n5zL,iv:JPYznPuhsbZRncdEgpd0Pa2HMHtXIF3iRY8ex2Q+MKE=,tag:+G/ZS2Vv1zcGG8cTAA/wXw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:BlOvVdUB,iv:/Rxs4dltNX0EFc1tzAakuQ6uctWV5m4/6DQve3Zznao=,tag:vn5xcJ5ElpL6PHY+RNQGMg==,type:str]",
"blockOwnerDeletion": "ENC[AES256_GCM,data:El4wfw==,iv:dHJGP3dgHfwBEGymnwBMIOap310+HD5FQs6BG41uHZU=,tag:o9skZyhMhsE4uCMTbKXp9Q==,type:str]",
"controller": "ENC[AES256_GCM,data:xVKbXA==,iv:H1jnIQ7e8MWD0q3WPrwYbDDVuByXocdwVejPRaMc2PI=,tag:MrcaCv08RDQuZhCroeXIQQ==,type:str]",
"kind": "ENC[AES256_GCM,data:LWcKQKXv,iv:ZToN8wIEAT28tAJO2NA1EyAuNCCkZVfp3qKF+b3GQ2c=,tag:OEKFD5Jy72QbUf2b+usENQ==,type:str]",
"name": "ENC[AES256_GCM,data:ivSCsu99,iv:lUEcKRCAb/PbWrPxLYOuAcXtlsKP8FgMQLkY32E8nns=,tag:ERMNKTvNP0a9iN36iaaBQw==,type:str]",
"uid": "ENC[AES256_GCM,data:QCze02pc,iv:6vdZWN657c+41jG32kXKLxriyzEFa7NEC9/IXj2mdGQ=,tag:QluHmqoLmxZqn8YcK9w5dw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"resourceVersion": "ENC[AES256_GCM,data:SKel8k9i,iv:amBOq0RuYkrhMxs1tX1KqyaGYJ6cf6v64zP73WMLJlc=,tag:SOEJGvCTqqHhLKN0o+0l1g==,type:str]",
"selfLink": "ENC[AES256_GCM,data:h0Ah1/2a,iv:hOdCziftiROxphTrMo8qWVO1J2E0NiGopFU+Yht5Fis=,tag:PUur86oorCS0durMwGz7fw==,type:str]",
"uid": "ENC[AES256_GCM,data:NBokyRY8,iv:O2pBGl0BEMQxhuZPiS6QfxIbTXDFs0hBszeW54F3sZM=,tag:BpYZCxSAkLaIPGDQYkSn4w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:YfvUdkgQ,iv:ZQoUpir7+xFoMMsLh7RmNyP7s4o2Sos+vfztyRptzG8=,tag:skmJhh+yWLabtJCE5ZvLCg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:ePcqjw==,iv:1s3iY4ZDr27dX5QzEBwMXA/cqtu/uQjN9lYyWcqXJzI=,tag:m77Ho9wHYVhVi8+FnXUAFw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:t07R0kH2,iv:M8JZSoZV525AMqaRybDvVpqolz8+tSzuHjMK2eECWwQ=,tag:8bToh1SsHT/J+Aeb2gThCw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"remoteRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:jrmD1hTv,iv:uDFt2iu9yTV0+MZsoZu92IuX5e7N9MZiZiGKhJn12tA=,tag:eR0iPkHl10PEpq3NcGTJsQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:wQpl2gGH,iv:aO4ruVPcDWIwUtx0FAmPQZwE38YzzcpGSWIWuPpzMEA=,tag:sM+eE9TRLIrbynZCNnxMEg==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:pigSP9ec,iv:e/D8ZjfGaPi1wSqp/HK/+n6FXcJ8xoNYRpcBpjc5vVs=,tag:DkLejotXFeG0uwC5tUBKow==,type:str]",
"key": "ENC[AES256_GCM,data:Bd9J0WaN,iv:8wDlX6qlzF7WZ1MLzdv285ocO83CI9m6Am3oTi+xsqo=,tag:QBc4iZHOcfBJvYLfrE5myw==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:60PIChOR,iv:IbDZbuOAhOLutiuTEMyLVC29B6ij0pC2/Gmg8Z49s3E=,tag:Yv6onoE8qXR3VRlYXXl4Lg==,type:str]",
"property": "ENC[AES256_GCM,data:JKNxkgJ+,iv:G02Mb4M/5ViLt3LitVugxG7T/UhRsVVnjuDFfVE5/NU=,tag:1IsR9i327+E7Pv9mcHH4Ew==,type:str]",
"version": "ENC[AES256_GCM,data:1mFNo5ne,iv:WE52tmKyA0YdDp+qlaevZdP5DgXJib4MIjIPSBiK4+k=,tag:tx+ldF5P/5J3Wbb1wb+Q5A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"secretKey": "ENC[AES256_GCM,data:EWSSUved,iv:VX3gkvF4gBd3waY3jyJiITMSvYdbhdtimj01GB+Jj0c=,tag:gSdsNwhG5jAIfKOch+heww==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:UlbO/Afj,iv:5+tf12p17O+PUKMa997LY3yeCdP1As9AUnjSNGgt9yU=,tag:O8IZeguw65KZBB+38rG7JA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"generatorRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:wqkwQjv2,iv:ApV3rUrUhMnp1TKeE50/E1m+8eoR9UypQosSeIVYCsc=,tag:MTbvUUUs5i5k+OWxP/r6+Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:pzVofyrq,iv:V5lRajMZSI68EjQ8Sur+YSN9qnX/J2C0Qr9mTChaEbs=,tag:LgxDlc4Dragr/haeZwDB/g==,type:str]",
"kind": "ENC[AES256_GCM,data:3HbRzWJ/,iv:HoEg7CT6DbsQMvlWSEs4MO2pJj33CzWttLqeP+oSqhY=,tag:bNFJmXc8aN5bHu98f1YA0g==,type:str]",
"name": "ENC[AES256_GCM,data:xLc8F+2M,iv:MK27upqAh3CmUQtYBeTJhOhhFAkCdoNp3lZ3C3aKt0U=,tag:yc4Qnyk8qe/taA/unjHS4A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"storeRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:0a8qw15B,iv:Wl/94oABjyw6PKGJHN5Lwu6TEweX5rcZ9wNe3ORZL6c=,tag:CwSi/AtmhlCAUa2f/kT/tA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:oSxAB1Kf,iv:kCYh+O6xhFhW4byn/dlLLIfs7q/BKyMqmp7iSVQfjEs=,tag:vPXkN2xeeUe5y57/5PFtzA==,type:str]",
"name": "ENC[AES256_GCM,data:3P/QKPnG,iv:RN5uqLeXqPJOQfD7sPb84JHiF1Cggw2fgiyzL2T70GQ=,tag:s49zQEa4x2NKLdA5dpifBA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
],
"dataFrom": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:nR/pMA==,iv:o3FuzIz7rble7ah383EeuFW6uQ85dslwrPyMIt6c+qo=,tag:oACfAOqYQDEHrQcM+B6azQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:mEYD0aEY,iv:dm12iO8/rrHtV22nXNXNPBTG0OzkTnLTJpYSP6rZ5SA=,tag:1IANOXxRakKWp5oF9cCEeQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"extract": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:65Zm+9qJ,iv:I0WUnpMzlgxh1f29M4MRFGxagKPWfWYgv5d6BHT7Hwg=,tag:OBX1qRrs/vRIaQfXJ0i0mQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:Zx7y5L77,iv:T1F/sJP8rMev3eqRk9XPaaiSyEmtgMD3nx9/qj/h7dU=,tag:FMmdzLXZCfWOAP9Ezs//8w==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:TirACleQ,iv:7MK5YgHEbzdXJqUUeHssAudhYi9aX6IB1AYNFQoVJk4=,tag:2k5wNEvGtXz03s9QDuv/DQ==,type:str]",
"key": "ENC[AES256_GCM,data:zJ6Gn/qW,iv:De9V0+NE935zCRZKFNC6Zzmt/iYNaG8/Y9qu4rKnYWw=,tag:lEuJB2As6qHImoJg6tQHgQ==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:W0zoZ1QS,iv:q0F3tGX0Yd4oqxkyTBtJ6zMxPfPEwaC2e9BUCKmel/w=,tag:EI53FSC8IKpi91qUOqGHXQ==,type:str]",
"property": "ENC[AES256_GCM,data:al8SEQ5h,iv:vC2MC+oqkqbywzThqzIy/KljINXLA0CqeVD4RRT/5aQ=,tag:XIJuQacasf4gDrixpzQRFw==,type:str]",
"version": "ENC[AES256_GCM,data:gvOc/XtI,iv:L/ha91KU1Gm03gy5OOdpT6PdVgfxG8dnl7Zd5yXXu78=,tag:FrnHU6Acz6Txvq4BxLcNIQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"find": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:1FlBkFh8,iv:0AW2mJtka7are+5yGZvMbSSwZ1ja/30ikHBLOCG+7m0=,tag:axuSLPBWMq/VrxVWAjNt6Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:fzqJe8HH,iv:uPH7LbFrogXLP2A0L86sXFTVReNgiOveVPIsdklMabs=,tag:k8doiDr4JF2Lhw1yViF7qg==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:fkrRDGIJ,iv:4HehljAkAXYxtTbLpv5Vnh2KUVnX3hiTeFWbZRjpc5A=,tag:z2C4J/Awwtq8tatSmNzh+g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:tUInFZo0,iv:FAe15kGC7F/4lEhH7aB6wfgZ5ALf9T9H7z7cDbrnHJk=,tag:C9o7g2N/86fBxFwDmMxWTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regexp": "ENC[AES256_GCM,data:DIFhVFxu,iv:7G0fq7rVh3r6Z6/TTnnjJdMRORURp5KNYcW4n/7xihI=,tag:mW8Ny/+EiQ8A9F4JovDjVg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"path": "ENC[AES256_GCM,data:eqluMUkq,iv:GoRTbuDCYW7OTobOSywuCaHex8qm7DflmWgzIaAO7I4=,tag:39UsmvyCuO8Zvc69PDk4hQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tags": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:42xq,iv:I87A0N0tsV8E5oYmKpNT3JdkxsiBhiSK0LFSBfObIf8=,tag:gsHqFTyr9aCElKMgrgC51g==,type:str]",
"ENC[AES256_GCM,data:pNUXKnde,iv:SHRXvNL2wcysUGt09PsrR2Rz8C3Z5VmAKsL+Y//DTvc=,tag:kZgHdYnoUgimiM3qcHnQ9Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"rewrite": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:GrkaZA==,iv:ygEmB15ArArEbQdGEbhAMZqJ6k5Ww8472WpIT45Q3qM=,tag:Oh3jydGSWc5i85Uw39VQow==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:ZIV8jply,iv:PfaJDRn/w2/GERSDN3L9P9AcS8NRafPM9zX4ifOROLk=,tag:ri5imEMiUEShNOOYQOIHrw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"regexp": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:mCRhO+5/,iv:AOmW6Ompomx+fjBaS3QDzvEwm5DRk5CF1fGyvKeMILo=,tag:hkD33P7Uvx762ojbxQd7sQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"source": "ENC[AES256_GCM,data:55hy1H7G,iv:lZZHYf1pLPeyD2XFJp+CyByXw9tj0ls+Szo4GbiW5Nw=,tag:vhSzdsf7/garhNDkXh6vuA==,type:str]",
"target": "ENC[AES256_GCM,data:Op7wJTEh,iv:RJR/T+5VfRiYwqZNfi41m/Aoe/RE2sDNA8jgNrMRFH0=,tag:x9huhOw3ysmlfREXGNvS1g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"transform": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VhKOyDYI,iv:Z+F0TvNYTHBIU6QZrTm5tqzOxbh33JKZruSyUypL5K0=,tag:4UW0UuNjrC9XhX+tNSa/Tg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"template": "ENC[AES256_GCM,data:Tkhor7aW,iv:nrGoOfYPXJ2OFC8eX/x42BrAoUo2vHWV8HZS8C+pPbc=,tag:xGtteUyPZURl0sPZ7IrnxQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
],
"sourceRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:h5JpWYkS,iv:SfaZaFg77yZPTrTEPXL14TwMaPYU0zU3YvVmA8lXsZU=,tag:+jHuTCTQ8e4NIo6BQgqiNA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"generatorRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:WVhnnotj,iv:KCPisMwn/JJPjBeG6QLYy7QHJ4h60xUVQIKimy/Om4Y=,tag:sShOq0ZeUZaCdqop4M2Qig==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:hP5P0bUk,iv:Dbz0JP/tc+sQqncHckRnrq3SB5eri06a5vSzlTval2Q=,tag:fnBa/PRsBE8vLtdQuu5pFA==,type:str]",
"kind": "ENC[AES256_GCM,data:0Tvr6q6J,iv:f3Q1WZ8yVrFFRxGWyANc9JwzvAqRoj/G4v8saWBJeOs=,tag:nhLPTlZYUte7fT4zBfeC7w==,type:str]",
"name": "ENC[AES256_GCM,data:ptls2DWm,iv:Xy4eSpRHBrlCjkghFiBVbDjTGno6JrJXbd1ilLeDRRc=,tag:yD6MwYrBAcvm0u+tr6Paxw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"storeRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:sQVYRyw9,iv:+m9bFQZjwPs0ha12uSMlAQU2OWVV32PGczDu5EtOvLk=,tag:pWvZe16JaFvdKR3OJUi9VQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:yygtSRK+,iv:wqRvQ1QJeQwL0FiPuUHqe9J+CNmhzfM7Yh7z06Ww91w=,tag:sL8fpFypI9av8R879ThlHw==,type:str]",
"name": "ENC[AES256_GCM,data:t+F9aEy4,iv:a/CEoC6qZ6oqX+lGG6vHizF7tIyhVKZ03h9bZ/LFEfI=,tag:p4rULQQ0bQGyKq9edswtAQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"refreshInterval": "ENC[AES256_GCM,data:9OjxRFQj,iv:AMOg2PeeCasgrOGRhiGdyA5xBu19ob2DQyUWWxm7lck=,tag:82jyqAwjx39DuVaW3n8jhA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:FmE9xb5n,iv:fL9+MQAUWXSHG9oPuaLJovIlmr4UZiA5QDZgZfy1u8k=,tag:oRmN83gNLuzn+e7n1wg4/Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:jxLTuS9r,iv:1es7CdpF80eyOsfuWu68jSQIHXtl94gEcZJ0h7APjSQ=,tag:4ASuY6od2B4VtZr2hRmy0w==,type:str]",
"name": "ENC[AES256_GCM,data:Y1c3O+NL,iv:OE+pVgw5Ry2vgbBUEooIEU6qaOtly3xEu2AI0dxSimc=,tag:PGif3jbYlvGBGwWSQyVjsg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"target": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:tpIxM8Ev,iv:UJzA4iDHAAQaTUmfKqOvHLqRa2WKEHsIoQfWwA6y9Ns=,tag:P3/iwkahkw32ljk3+DmoXw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"creationPolicy": "ENC[AES256_GCM,data:wOY4Ogpi,iv:gopCgkR0gTWl4bLSvscb8WaqL/Hd9Q3gco4y7/qZZvQ=,tag:iSM7IIX/VmSbthpzVd0obg==,type:str]",
"deletionPolicy": "ENC[AES256_GCM,data:sg2++Kp8,iv:U4te9PHqSPhm5olwKTTjC7RQB9qqT5wfcMIYtqjVHb4=,tag:Zx2MjnrUFro3NCv8oySf9A==,type:str]",
"immutable": "ENC[AES256_GCM,data:JorVSg==,iv:y7hVTujqIE+zr7qBJ52BBNXuwrHNuJlycc0OYKjR9T8=,tag:uiA45Tqu4axwcC4N1p70gg==,type:str]",
"name": "ENC[AES256_GCM,data:SZx96Vxx,iv:8lUvTNXruSgm0DSUxYe6XXb94W0NjFZ+9V+T/ar567g=,tag:GuzO8PZfpmLt1yW40zd6sQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:cZK/NRvp,iv:EOuzGMA98PN99Xw7r7EFF/kgG7Ta0HgRiFzR66SsSsU=,tag:BuQhzLp+W1T4IcQgbb+YsA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:y6eR,iv:YYGKjl9S9VI19yVkLAMkHilIEBuu2wLgZVcG+KKbMxQ=,tag:MHEaduCeJ2zoHtHh6JzkcA==,type:str]",
"ENC[AES256_GCM,data:uvCI1Q7C,iv:fOR8rlc7RVZBRf2u5NOlnWl+h9FiFv06ztwvq7tggd0=,tag:5pF+Hgf9uZTTF0rs/vlPCg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"engineVersion": "ENC[AES256_GCM,data:Y0M+nP2h,iv:cyh3pKlmN1j0lkf0OrbuV0DKTelHp4RHPR/CinlkOrE=,tag:Yd+63VJlR41CEDgw/O68Og==,type:str]",
"mergePolicy": "ENC[AES256_GCM,data:wpWqTTbt,iv:yKsz+PFx44GVh++3REV+xJMU1thMZDjBQkB9+bcZRDw=,tag:3HQ0rkywJ7TsQ7G1QrIKZQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:3h+raNre,iv:wwoocULp648+zwlvapoa92X+9S1MUDtX1zVsrmS10Do=,tag:hPF0cpjkzmdBTFmAXBrSoQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:qsAJ,iv:GCilPijUiU1a6ySZfIRxDJnXkCEOoNsoaqmkPJUYxCs=,tag:imP1hPc4O7BwDv8KSAHl+w==,type:str]",
"ENC[AES256_GCM,data:uSQ+H+mf,iv:aq97BZxM70yu8+t08tkNKaL6qOXufg3dE7DtLqF1nGU=,tag:znVW07LvwHWEtS7D8JZpyg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"labels": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:d62Y,iv:F4Ytv0KNcWh9BnvPojoDo6/d4JA1qF5AHXKZsPsmhqE=,tag:oSsRCkccF5NCcs1BAJ4miQ==,type:str]",
"ENC[AES256_GCM,data:XS60/L27,iv:SnFRjaEvGUbdIPgcrttOrzrOyNUCTVVr4E72FaHpT1g=,tag:KN9XpvnWbCUpW0nEy8e62w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"templateFrom": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:wYxL7w==,iv:M6J+8t5D3yn3weH8tJkaLUsEhHJX3jor5TYlkDl8E1E=,tag:I1KrMcAUP0m6HR0I1Vv8NA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:kyoH8f9z,iv:IkBm+odaNfRIZjw5oUdU1OlfKzpHjq0FgSKN1oAvBw4=,tag:rzD7IjAJ2vT3XcMW2hVWaw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"configMap": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:mc53OlXc,iv:g7BcpL6poxfGGoKnIKFecQgaCgbvS3LTepxQ5K4GpUs=,tag:nEmnW4bahtXk0/O/tKdUnA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"items": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:V/pxmg==,iv:P7xwnoHqEyENJXtj1F3pIwc3U78sHxDlod8Kwg2dK/A=,tag:v1kJQ6ulUHKvYWCczXzZJA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:fFhVicee,iv:7gGrF7Co0CI9e+6TFfLIN8l6AsG5P/LWr7vHV/BIlYw=,tag:FatGXawiwsQoBUvDmeOElA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"key": "ENC[AES256_GCM,data:oQaY89Gx,iv:HEGJZqmTenMOOOI5f/TzY6r4vBDbQHc9z9sbZqfAXN4=,tag:NX7pvcQNmFHlVXsj3cgbUw==,type:str]",
"templateAs": "ENC[AES256_GCM,data:mtNmN8/9,iv:y7RBVB3yfKHrKr/0hFI19Zxov/P+d0hHurwvnNpyS4I=,tag:m/E1Mb5OxlsTiY1gFdwSkQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:nVv1OR3M,iv:Wk6gL7CSoYNQu60glotTFdGLMyyhNuHYOxx6loV2o9M=,tag:ZQjrQJ68PhaP16uIjZyq6Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"literal": "ENC[AES256_GCM,data:JaSKV4FM,iv:yqEbUMylu15JNx33KI1ISFVE1S3YFgz1wqA9BuWu5y4=,tag:jrP5c6Bi5LFIfC55b/Rfhg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secret": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:4V2A9cJB,iv:K+Shfxs6PDyepzEXmyhTqqzxiaTYCUUY/UNP4ymTaqk=,tag:iowOjWS75J48SdaOG2Gr6Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"items": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:+rw/Nw==,iv:FyLBCN+TsP9AOzrqm2aGKsJsS90jIgyBml9NlqzyOmM=,tag:Zmnpw3c2Fx0rZd89V6siXw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:qmuiUDOm,iv:nh38XH0QAjqsCJP7EX/5w9TQv21qRZriegaPWOsTzmM=,tag:RWNSUVqksSQ4WtANzLZVCw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"key": "ENC[AES256_GCM,data:fzmlbkqz,iv:jRt6YO/r8EvmcWgZK7kndQFj0kgWHB7O3KmoDNm3o20=,tag:Yei9dND758CM8PHocGXacQ==,type:str]",
"templateAs": "ENC[AES256_GCM,data:ZsJKhkpy,iv:8HuLGxJaKuG3R6CcfV0zTJzN59Spv0RVOkDE8A/obFo=,tag:YuFrDzq5kGr/oPE1LvPTNQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:GsH4utjx,iv:ppCF7XT1Do7EZ47C+MLS/Q+0i0vtSVq2TU+MH0X/KAY=,tag:/0atSBacUYjNXAww0s0Fdw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"target": "ENC[AES256_GCM,data:Do8h1kGt,iv:CEO4YfOu9YnSdEC3WA/S7EenHDIlhsQJeeK35JlYmOQ=,tag:HKGDHpVVX8SfJyicWpGaDg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:mCygwaDU,iv:iBvm/e1JZS5+hFVnpWl+nB9HTQnWH+XJ/SzNhwB+IfM=,tag:Cc7sdfcz2mv6Ds9cpi0tlQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
}
]
},
"timeouts": [],
"wait": [],
"wait_for": null
},
"sensitive_attributes": [],
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:ldBbKNgcfDjMGOjb7cf1AO3jYivFpENdH24YH3N99T4ATQ==,iv:G6DFZLHzAWrZAjrJxrSCSgfzMOPaE44oXxcxY/hsfV8=,tag:FppSqcdnScp9ZGhcvb+zqA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:afXraVGa9w==,iv:rEgsa7brZfC2BRp/Iikvnk/EmpUpjn26o6V7zGZBTkg=,tag:OkN2wPBOfy57Z8+SnLKGOw==,type:str]",
"type": "ENC[AES256_GCM,data:WDCQcZcerEy+DQyMjxjcki/VlBs=,iv:haaRnLF+sJPLBlKhQ7ZHWh5ym8jyXI3JB9Pj9XGWXvg=,tag:FLK6Ijb+2EijChbXD9pg+Q==,type:str]",
"name": "ENC[AES256_GCM,data:Ckm7qSLIcwNXUqQ0qg==,iv:IVQG/MBImbuK2qJFnHdfkwnrHcIVN3GNOtI0OFG5U1I=,tag:UZnRP5F6p9mzeVBuaP7/Qg==,type:str]",
"provider": "ENC[AES256_GCM,data:BwUrKsU9FQfsHiiXd30GXISPvm3Py2A3a6S/Y0c5Oxliy6FDDl3U17WHhswbSxHssJ+wWxOM,iv:KOQ/4bZeTc/s5875jggUSCPX21/gLTv44VR/aA5JZmI=,tag:LPxYOlM+zPfVQRYR+r79pQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:1A==,iv:xH3egRtr94pFAfCLnvXY0O7NklOXNNjqLQSOG+YwHts=,tag:pC3nXfgGxosRp+UxQyPw3A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:4/Ff5XYJMubBVhG+9Q==,iv:LSRSezrA1KeOeJYAdhxC87awefnUkfQOdBM8YyQbshU=,tag:tMQuLGGB4MLpMm6+QZN1yw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:Jg==,iv:qfQ76EIYB0w5tmWc0ulO7DXMkZGhqDkCpvqWylO5Kok=,tag:Ve8FVz/A6UiIbMFybkrLHw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"goldilocks.fairwinds.com/vpa-update-mode": "ENC[AES256_GCM,data:kKq/,iv:Exf7C/n1yoatS5G/soqqU79fJrR6vr242kWi26qw8ZY=,tag:98dWuOZWDZGGJy1AYyCZTg==,type:str]",
"tier": "ENC[AES256_GCM,data:iOT/iqJJ,iv:MCamT1yGYYYfy0Q7qehI7lPnodHPXn0Mc5D2ONLSiHE=,tag:e0TdRDHHL5fUhg+tE85VfA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:ZR7s7GhYTdaVJJChjg==,iv:F54CyZdnQUoZNyMFV6VK8UpgMQkfVhbMNw0H2ahadnY=,tag:nH6N5mkbqjNi1lj7CxCQBw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:owsCUCxgORYH,iv:UBvHM0dOR9q4LYJOI5V0PxPyxTX1NS++lPUOLbXNnAY=,tag:YT2HCH7CN3BOucAteyzCeA==,type:str]",
"uid": "ENC[AES256_GCM,data:sHqWkT5vwE7aFIRwPdhUVO6wwQJ2yaERmsw3pzvo82iwnjR2,iv:R4BSFeFdD9DrbGNHG7dJ9qpfOU3H5FAsMFIpL+F6tko=,tag:TWPE4Si6ZdM6KxYEC1/CRQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:wtt7bOU=,iv:SEkNdTJqhOV5MSP0MuLQlgxl+VHKYmvj9BR9n8y61n0=,tag:xs+sNcTtzMJdvV2OIfbLnA==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:lSFbn+cx5P5Ld6/1Jh9VlyF5bj0eb7bitf4dfsoGzCj/A4rW8Bh/jJimS8EtLchvCSFsQZgaMj/5EDhMMvvGouYsM/4GjVKl3M02RjmIBB+ZYsARDdYflQ==,iv:m1QMufSYp4T5uVhVK+beE76qJ40mUyAVedM0xs5CCD8=,tag:wU35DdJbrig8mKVl9Z1b9A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:3nBf8bUE1g==,iv:ayhHjumwyGmL9wiao4GOoR83AqEf6Rap0r2+386sKoc=,tag:/qk7cplR53BYc+gNz3YcSA==,type:str]",
"type": "ENC[AES256_GCM,data:QpheAdE4SxrbBPm5/jeCbHJS,iv:yBy/hXycLaPQPNZuiyNCLwFQUL70WcNykDbNo8gkYyI=,tag:/moWfpx3P5hvRuEBOrMrXg==,type:str]",
"name": "ENC[AES256_GCM,data:02+oyHdGMHrIIeTUhw==,iv:gzqHnke6it6RjoG0V/m558PdjEdQp04AmOx/fxagxZQ=,tag:fnVt2fmBP+YB1zZSR/wU4w==,type:str]",
"provider": "ENC[AES256_GCM,data:CV3FhvkUWy/7HBzI+4FPLVPeklQLRvHyL4FdwbQ6JRZtgC9DUViRrYIwCqS0SYL0U8pWS8mX,iv:2zDaCfObGLgm+569MAOjZhseVagLfRtl4iRuPQ8sCDA=,tag:5C5MwyXZE4wc3nHnH+E8nw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:Ww==,iv:+rNkEyAa1N6kIko2zIhRhC1OkwJg8KbJPArWDeDO5jU=,tag:QEa0k8JJG/VmgOYonr32Bw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:j2N4dgCAjp4WHz4MfDY66BDFHDxk7dxczArB,iv:VgH5CFs3k+B69rM7b52Tqb7cMnnLbVKA2hYRWhL8Ths=,tag:J4q9l9k8a+dfgjXQTuHc5g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:Zw==,iv:t3TOz6dfNHnv/rwrelrJapWz4owmKopbD9wFjiHgYfE=,tag:CKrOYf6B5qDxQVcOsQ20HA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:aSkawL5ghXOk6o8BXQ==,iv:aBZVtxg/dGYkBJ8LA3q/uOjrubGkYQAzVJmGtbHZi9E=,tag:/tt7PtaeirTcNKSBcFU1bw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:B7DXBCK7QUyJdyH3mw==,iv:GsA9ovXOoIjw9lR5sWTMenw9HazZrycB7BOquJdOErM=,tag:+Al9+P/o292PAYffEM6Mxw==,type:str]",
"namespace": "ENC[AES256_GCM,data:kCpM2cGshjALurXUyA==,iv:oeTzHZ8XcaHA2ceUykNhXSvsisw1+ArR7fZus4oJ1yo=,tag:m8y1Z6s1sbNb1RoTFRz4AQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:Jd03KJ1+ZrR3,iv:BcVRR0KYvp0U19Z6nq8D2lXza7uDMOvz956X3KpX1i0=,tag:rQPeDWNG3bvcBoUn3nu63w==,type:str]",
"uid": "ENC[AES256_GCM,data:m/K/uD9kazh6b2LzTFuddWhhf9dbdHRzuRiqWa91ooxBuhVN,iv:Kt21jrpp0iyDCnE0K3b+dda7NgsPZSPEu/tqvDu5VFo=,tag:zwjV0dCJLx/KAuwNPSCoFA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"allocate_load_balancer_node_ports": "ENC[AES256_GCM,data:aKK7hg==,iv:wV+S3oEXs5LNKdHfDUZeln2/ehzpr6RQghVPFgVxbjA=,tag:Cp9KMgEJVqFrzpXFksSlGg==,type:bool]",
"cluster_ip": "ENC[AES256_GCM,data:X9SiqS+P46HSgZCZ,iv:vDK9em/1ccO/XsRMj9sH4eEg2llQjetQcgl87hT68jo=,tag:aRtCBIsWCYSVM6q4uOx66w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"cluster_ips": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Aa+ODAuEK2/l+C2I,iv:XHOdRjKmM0gDfpXzIn6LPiSr42y+RHTgofxA7e4Cj+w=,tag:cBQ4rnI8GqpsLeM8e5xdSg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"external_ips": [],
"external_name": "",
"external_traffic_policy": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"health_check_node_port": "ENC[AES256_GCM,data:3A==,iv:/2eaocE4P+lO8hB1rMsYAjUKXZwt6ZDAN4rC6xE40eA=,tag:IPMC2UwUuHL+h95wodm53w==,type:float]",
"internal_traffic_policy": "ENC[AES256_GCM,data:AEhCpWHuvw==,iv:q1LZ/mTjSNAQ3Zf1TrUzE0yB0bbhU63/clj1n91oOXw=,tag:HbJakwjVgoSVPBztjqElYw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ip_families": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:ad9TmQ==,iv:JzlDkY3FD6NOizBIAYyhEzqguY2nzaBNihUwOUG4tGs=,tag:4Z7oC2vkB4pzKJIKqdi7Ww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ip_family_policy": "ENC[AES256_GCM,data:XghIxd5RuqftUMI=,iv:3xM+p2pdEFjos3y9QXg2sJ7SOBPQhsiWH+KR/3FA/j4=,tag:HTL1ZK2PyvGn5zGzPqSQdQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"load_balancer_class": "",
"load_balancer_ip": "",
"load_balancer_source_ranges": [],
"port": [
{
"app_protocol": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:6uh2zQ==,iv:7JQKGjZSeyH+/h2ZCkXkBqFuqYUnv0CBwA4CBKd4T8E=,tag:kB80H1BcY+MljTfOvF7vzQ==,type:str]",
"node_port": "ENC[AES256_GCM,data:FQ==,iv:uscj25CeX3oipVuCHJcAkZYzESf8F4Da3YzY7MNlRzc=,tag:X8kgYJ1Pdr8f1gzfYGCGWQ==,type:float]",
"port": "ENC[AES256_GCM,data:Lso=,iv:A/Afm4pwnkZ+1Ak+lyorecXFtnVa4jTpvUm77+DqPBM=,tag:12nkQ5BWIycYljtiD8vcWg==,type:float]",
"protocol": "ENC[AES256_GCM,data:glx6,iv:6/DHU7FhXE5zuSXfffHm0dr6MGTp+EmamhNgpzzuyII=,tag:2sxsbYinNgaQtIHMQKhTcw==,type:str]",
"target_port": "ENC[AES256_GCM,data:R3ZYwQ==,iv:am9Thj1iDezirB42wyQ8045WigqMU1+Z5ubCXfItY5g=,tag:HE4cEw6J4moK0a9hPwB7Rw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"publish_not_ready_addresses": "ENC[AES256_GCM,data:Ut9oGFs=,iv:Ik++/Ka+1JTeLqwzUGPYLPyL9K580nb14Np7aG8LAZE=,tag:4bMNZUyNpwPZYbPZJUSZ0A==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:pu/tsnOdfV/rt5PUPw==,iv:I1ADlv3r40QmLOJLkQ2fikQ1xxT9kyRh5f8bDTI/xbk=,tag:5P+zCbzbJbjSo6X7bu7QWg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"session_affinity": "ENC[AES256_GCM,data:oeNg+w==,iv:zmw0Tv8QjQaaZ3G1t9WGt4zAdz4Bs27OgJBTpVW1uIU=,tag:aZ3DL/ooeOnD4Qxiaxc49w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"session_affinity_config": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:DONpI0cTMvBN,iv:cDoMnJdNiBE4kSEWEFCzXg/8hzTgPN5TXZcybrOyIVs=,tag:M4Mf2bnd+0xT/gBcA4Erig==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
{
"load_balancer": [
{
"ingress": []
}
]
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_for_load_balancer": "ENC[AES256_GCM,data:sThD/A==,iv:G4Bkan9I9VwW5TICvsf01VKjTvzwNimUpaaDimd+itk=,tag:wKSM3rNJg7zKVjetPyOzQA==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:2fPtFoSEhHymJ15IaoBewgUOuJAD1xqo8+r8pjCGD42WKcNJuCcxvEz1sUPFMjAwlkxMq0+g3U5LpfRHJleE54rPFGma3JHxGPtprSURIffckio6evDd+0KdIB/BISlqOH57ekC1ajAhn/UDaICqmCNzPRo=,iv:u5B0Oqk20rrCMl5cWCF4/uhIweHCXsKLKpKAiqcqtQk=,tag:rk6o3S9IHVonYm62Jy5oZQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:aL8fPHwAPx+nE24xy5D+x0XUvnlvFqVPRXxNf+2+gkQqKw==,iv:KPq/cwkH9AtKtn566W/KJhQSUHjpya3OaxC+/0k4x1o=,tag:BZX+NfqRpky4s+DKT9SwBA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:euivNrtvLVjBAAde7DY=,iv:aSYis1NdHwA5+OQ9JsGAApnNrb6jacdEMg+mhanfg+k=,tag:ITXdLjsKi9zXpPsUWh1Acw==,type:str]",
"mode": "ENC[AES256_GCM,data:VzwamVQ9TQ==,iv:VJ9W7Rz/j4w8wUhR8UDd0Vf6+21vbhrpdJTYZ9y5ngE=,tag:ktFHWiAJLhGT9Pi8ygHHfQ==,type:str]",
"type": "ENC[AES256_GCM,data:HpzVjG0wEgPNanDJ758q0+KhU8RL,iv:su3U7P9JYpO9C0PEgDx+1MreRXTR7J4hnIWce0k1yEo=,tag:ZNi9imLMR8fifHRze5di5g==,type:str]",
"name": "ENC[AES256_GCM,data:Kkl8JjxcGmi8TFPs9W/j,iv:cH6ZmIlSix+gDtY/fz+IEhNlWi+VX2DrCMyLEilinrA=,tag:Fl5YGL68EAFchQFl8JO3Nw==,type:str]",
"provider": "ENC[AES256_GCM,data:Xx6o5BqU0iH1Sl7jcOvzzPgjjGYkenrkpO6TOCCQuOJMj3yXx25mBYS1FFF1zquZCA6/u6MT,iv:nwQLxi+mfjBLAu5mt4xCXTr9Z1VjIrj/t1woQ5uJfRw=,tag:oCIcOl3nPZ04l1Ltho2EFg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:Xg==,iv:Fb46rTC/SOLBWr/rrkE8U4FLsOnqY8+R2LNmGhVJmIs=,tag:oNVdjW1yTTthKbC+KfWSJw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:vyOlL4/9Dysy+7cQAebaNjQLi9bfqfOwj7z1,iv:jtq7wGc0YXi4+e5d8Jpn3M4adaiWgAfTdcXkPJRfLqY=,tag:C8FqQeefRu+GaQpqYbSIsQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"gethomepage.dev/description": "ENC[AES256_GCM,data:exHBtsyBIS9mWwaAQ7XCQA==,iv:WN1Nq4xmA1icak973jYVoup+Lr/h9bMHOsq/YI9o1bo=,tag:G4XhlQcn9Hi6fPsgptSAIw==,type:str]",
"gethomepage.dev/enabled": "ENC[AES256_GCM,data:+O09Eg==,iv:u4OsUxLaL3Huxl9UKOStmF2dKIX+kaoejB3/0De1FQ4=,tag:frkkXmRpEau5s190GNN34w==,type:str]",
"gethomepage.dev/group": "ENC[AES256_GCM,data:OBqk7yuMFZJGrrgg,iv:WGiO2NWEXazCv+pI3L062DOdMdY9ZjqEKkPgTakfxLU=,tag:MOPMw3N0F9M+jYUMpvwwLQ==,type:str]",
"gethomepage.dev/icon": "ENC[AES256_GCM,data:ZLlZOiTI8r5o9aip3sQB0ts=,iv:AGZerDl9FxdO8TE3EFB01Q6qH62SVkO/aevNkvdfNi4=,tag:4iWVUOp5CzQkaggaPpVIWQ==,type:str]",
"gethomepage.dev/name": "ENC[AES256_GCM,data:o4nskti1XKgOyOPsGg==,iv:8uNbSyvxNgTRvI42fcq9Mudyj55e/o9e83LickJAG0A=,tag:Kwswj7MuQuADXTeJXWY/pw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"gethomepage.dev/pod-selector": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"gethomepage.dev/widget.fields": "ENC[AES256_GCM,data:H8sRVd48ZBig,iv:LA/CdtW4CAD6jVuj4qypdBfLpagKOU5L+3ZruNzyMBA=,tag:Iuta4scByhppgZclhRmd6Q==,type:str]",
"gethomepage.dev/widget.password": "ENC[AES256_GCM,data:DLKtpTKw/8E25/8CMOL8pH7Hs+tjmA==,iv:9HxqTWM5AB268Zt0dnii72pPG3AVq1/BmQEf1eOhda0=,tag:QWiuPnkM/XAdY9ItxCup1Q==,type:str]",
"gethomepage.dev/widget.type": "ENC[AES256_GCM,data:1k7U4nSG7I81r5mh,iv:ixpJf/wi/dACjbVRCfQnTACVAJMA6kZ6nBM/9xutA5A=,tag:8qWAXLIff9ihOPtpvZ0Rmg==,type:str]",
"gethomepage.dev/widget.url": "ENC[AES256_GCM,data:BaUJaD/Q0av5G6GT+JfA2Z+QZKfo1BJIg3x6TNuo6viwy5vyY7Wr51B4OXbvbXcA8BaOKA==,iv:m+4F+5phhoBFwnbqq2bO9Wg2lm7L20NhR+73Cv8D/gs=,tag:KcJtb/SQ976pSXr18OJcAw==,type:str]",
"gethomepage.dev/widget.username": "ENC[AES256_GCM,data:BTuImw==,iv:jNfEEhfee6VPD7pAhg1/LybTTx4qBZ93rin784mK/Lo=,tag:Bzp94uafKmg86POGhCbLHA==,type:str]",
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:mVJy/BX/VJ2k,iv:6K/TFGpkzsAqeewSjPgz/ITUdm3Rrb69qCmX9m72oZc=,tag:ZpoGkYO7IRQ2eVfxePAh2Q==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:bsVFXOeUKxEr6n68L7rliOKOjeaBXGwbetwmH4NFGtjjhVHZi/xXWTXrxdv06aTiIfErJoOr/OTNWQJloyhWBNyQmOWFeybhZavslzLFXsLJr6V87mplWwVWVCrQ+qMlf9uD3z8musGCIr5be+2cAVA5ABF8iT60MbrKa0UweYl1rLKIGL4P054lrni3DPTqVahMJxnCEKr8doqa8No7mc6XQQ0fdzfD//0Xq2Mm1MSsbqEG0/31XELXzEv05qR9156neigP/CEg8L/K4b62JMQeBIzaeuZhmRttTHYJrR8Ubejol/Q1Sje63Ub3CqfnOo6KUuW9aR+RUAnyQ52EOZESnvLG52PkWZWEr7LU1IwmDGvQIsE6opyBRCQ4fxCCcIpcktFk+r82Twm2/qUXA+Pg7dY6ru8ANyH3x2899M9vyIvGfC1gWcdqXfU4ZN5ELYr0FtpmwjlqiYTlPq6lWk+Mb63BYc5/BilwxQ+92VjqbltCs2Zts+jFmZfB1/LAOhc=,iv:Q62Oqfg/tHghNrbWjjgGJ0942Y0tj/SbMubF/bBqaR4=,tag:BnJ1kZpD4g3Zal6771ryaQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:eA==,iv:DtgWczDLS9UNhE7dSfQ1Xda5spHllXFW3R85rdaaegE=,tag:5VZL4+ZLV4XgrkB0lHIxyw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:knp83vqYRSHZnNDn+Q==,iv:VQ5GZnzUfSe1cEdSeQ262+Uh41soDETngGBQVshjlLE=,tag:4TewMISRF1QHCeibdxzk3w==,type:str]",
"namespace": "ENC[AES256_GCM,data:wT3TZxdOPdobW/feQg==,iv:GJfkZskUr2YNd8VTHjmvvWEI08O6LIWXf+3FDd2pr9E=,tag:t3tPDPN1XPgVXB4pRAMzuQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:TDTvqTzxQL+O,iv:E1fGHV4XWxZVinOaGNPetQYlNQML72aB32hS9D5ekWQ=,tag:Q1+LMFLKCVRFMIAMmLid4Q==,type:str]",
"uid": "ENC[AES256_GCM,data:zxgIQl7YU9qm7Aj3OoMh5SUq27lBpV+dCDA5IqY0ymzahnVE,iv:QLxMXvt8//68MKoQSnBRfHOG1BF6tqcQdB5dAm2GTJ8=,tag:dYCOzgVW684y8lqpaOx4Lw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:UpYtvNEXLA==,iv:yhjGV4XK71zT4dnFZNLBUqrTWK8AKRmmFDF+qhGBL1o=,tag:FS9ICnxvQaTasDgu1v11FQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"host": "ENC[AES256_GCM,data:f19bJPt5Rz8R3wDqgVItAhLmhA==,iv:wsZ02N6agffPw/3/ksdRRENI0EnFBOH46s6wi39sp+Q=,tag:5oQ3ueij4Ipj2EXPhLtlQA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:KlBfpRlaQekOQQ333Q==,iv:dIz+mvm9vcygZtlHMCgsgnG9HkiReRiqvSnc7Ct1PJE=,tag:J49Jg4h5x0XARalH2P4BPg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"number": "ENC[AES256_GCM,data:qy0=,iv:XGzRACahY3uDHCD1FMa++IcxE6hoRSjtuGsr209OC7A=,tag:wuG52yJUVF7aeRqnv+FubQ==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"path": "ENC[AES256_GCM,data:mA==,iv:vOzwDz/BAQD5f0f4/j5tM2jAmIaRc4Q+jVanRcTIcXI=,tag:o8a2kDnym+NQAzkPqOkINA==,type:str]",
"path_type": "ENC[AES256_GCM,data:cgRxZqbVdNj1bCT201L734m4xIJAVA==,iv:RTiO4cM4I7udlc3owX5HSKxhERM6KA5GxOoKPrmTNys=,tag:SmOAn0XamYYwt4S5aDaG6w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:JLT/jmofwCM3KaY4fusoFhlnuw==,iv:vJREME+P8SDACwA+ax3hirFMUGKzxTQ29hZV4OFd42U=,tag:/2y3lOPgmNYjoHLv17r6mw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"secret_name": "ENC[AES256_GCM,data:c5LKhT0OkAgprQ==,iv:yHtSPNGMHKb2sFuAqFJ3LlpVbaTmLZKLCo82Qex5wTA=,tag:1wbamm9ccVvFiuHmV/1nAg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ip": "ENC[AES256_GCM,data:+x3sDKLUjF8HbUY=,iv:Y131N41l/K5mXWERMH4PoMQ94uVzQdfc9z66YBypk6w=,tag:/iNC2lVCCmrW09nYT6T+Sw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [
[
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:wRqeRoE1Q2A=,iv:jj8J4/htLF6mW1aE51rS1wB984ebEYN2hFNMnhjI2/Q=,tag:9lRCe1JqVYrySbufUze07Q==,type:str]",
"value": "ENC[AES256_GCM,data:Yi9PJA==,iv:uEkyv2a4hD4GevQPKdxFxurRBINwpjCW3sAGA0eN3DM=,tag:/E2MMKtx5IlsvKO//acQDg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:pA7UoRo=,iv:M/r+dOB5vN3bxRse/xzV2kLiKTeF/+QQa5FgjijC7Dg=,tag:6vj8e2P71k0fs6SSc3z9Fw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:Kw==,iv:2d/9dpHJB5v6Cx64p1Urye4TGqHA05AoNVIAJLEsvys=,tag:U12kmwZabJaM1YuU2YGBRw==,type:float]",
"type": "ENC[AES256_GCM,data:QSy6WwxM,iv:Hr5Z19XKV9Jpb4TOcodxvLT6vRoQBi+KgIpD8vb6ukQ=,tag:Rs8JpqFXjHs94yeWx8vQeQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:HYOo1MChcOw=,iv:SFzQ0pT4KSKAAYIBEySa5/L2Ms6DapRe6hizZgjI/TA=,tag:BipvAkE1W+LxyjWUJ+SKmw==,type:str]",
"value": "ENC[AES256_GCM,data:16sx,iv:OtqMlAJni/+KO8LN22WWzUY1ndMk7a3GhHuE2iuX4/o=,tag:+mZ4YviwtNLDiBToyJJ0sw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:wo4LovI=,iv:vsDo/2e8chjhnaGf+YnK/k9Opq0+eFaTyHZYjCtwaCo=,tag:aRgQzrzQKGGuBoaP16AU7w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:+A==,iv:R3KsJiqKvThlvEEw4T7vhhqz8OyppL+hjw1wexjU4/0=,tag:kMsUC5PdIuMjSRuzTHn7mQ==,type:float]",
"type": "ENC[AES256_GCM,data:j8qBuC0f,iv:i2vArbkK8Jy7mvxru5sN3Lkr3nPZYJJX/I0cdgv6nt0=,tag:4Nd+UAdP8UDf21E8FsXZFQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:cmKB1UPWPBI=,iv:yCuEK8+7HyqZr66skPtN3K0zyrh7TSdy2KB0zUacsPk=,tag:lP0jUBV7ETeI1NMF522Olw==,type:str]",
"value": "ENC[AES256_GCM,data:5dYU+jQ9PVybxfw=,iv:yZtEO4PjPEY7/5u5k6S0qRUVoywTuaiSGmghxmh2bJE=,tag:UQol1azsbMb2nmY/d/OlsA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
[
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:5NXbn5G9sZs=,iv:y+GEeGAeDHChXsR91NPHM2JusTcDl/OCLiunlWq1tTg=,tag:ITxzxRDhq+WgqbQVNnJtVA==,type:str]",
"value": "ENC[AES256_GCM,data:58Gxe5PG94g=,iv:oLXx97om8ReeOVDMzwaw4eJk6rS6Hnsz87mqjMSySFo=,tag:b0o/EImi/P6NkA1f7WZEiw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:xTgqOJc=,iv:dhDq8YSbb9M+2W/ynfbR+8lewqMWM4bpVDglKh19Wac=,tag:SFYZpy27Vo34KSo8o4/8eA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:Cw==,iv:pWKlPW8iysZPzk5i7XZ5BjG+bmTpjZmAn3LjC7M4niM=,tag:wI/JWiZSg/fE9kBUh2l38w==,type:float]",
"type": "ENC[AES256_GCM,data:Inpu10E+,iv:BR+2bBn+DC9MbnVHZ7k1Jbu9ifXgPLyY0t5//EA3Fy0=,tag:R1Tr/Fj4IZLkYcOC2RZmow==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:FPBBQryPVQg=,iv:/DdK0UeHumO08FPNbhY0+AlcZxu7OmQXav3N0uMkJSA=,tag:x2FKEWrvUcbn+7VECOaoPg==,type:str]",
"value": "ENC[AES256_GCM,data:YXVE1LmCOD6WnRs=,iv:ub7oiEoiCxJoyxnZXoTfPHzoFBuuL0vN0rq6tMVw5FQ=,tag:84tfHb/HNScK1IYj3v2aLA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:jqjtehk=,iv:Znz3Klpi1Z/JF4NaTXo4ZVNCq7iOcLYNUAKDJ0gH6E0=,tag:dZ3l0N5jmQe8HTqsPS9KbQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:BCBLtttQC2UPwczrnGITyC0c4ruZ1Xu1pGl2udCdQQ==,iv:qXfLmqoikAP9fNTdoUYha1BTI2vn7SeokeMUCU7KuIc=,tag:5Fnx14loY0Amey/qn6YKcA==,type:str]",
"type": "ENC[AES256_GCM,data:OAGdQJDC,iv:N/QkH3jl3A+3EJqj929+fABCiqGEQSuDq8DHcfA9caY=,tag:X1dakn0UZ+0F4bQdGIW0CA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
[
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:nlp6i0dlfGA=,iv:WTphhmIuQaoE86aGN70FN6imAPg0fv2++silGbBLEqY=,tag:VRn2YMNnGDOR5ie4ebVRNA==,type:str]",
"value": "ENC[AES256_GCM,data:LGHiOpm/kEM=,iv:eQUwzk6DTQ7/4eowuZiHI3A12RwqDhSZhejU4tPllq4=,tag:yrXLw/bi/0RnZb6m3ZJqCg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:9lgk44g=,iv:dWrnCY+aXcEx/IMQhX7YzLxYlmt9Aa1xNQdTVJ0rIjo=,tag:Mpjj65TTDU0RXcLIFQ4GuA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:1g==,iv:xN7YHIPx9skVuA1aMLLEQwVmzJBrSaxAwfZOd1HULFE=,tag:9RndZmzyADp0f7xOTIH5EQ==,type:float]",
"type": "ENC[AES256_GCM,data:DMg94AFq,iv:cdIns0DE2OLRtRx8umzQ53WP3LcgF2QXYyXInyI0kr8=,tag:wW1/aDSgxc6e7bi637GcGQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:aidLWog3mI4=,iv:S7079p9XRWEvpn0Fw3YbMqxUndmNVNTN2A61//oyyPQ=,tag:i/Xgwu9qJKOmdzprzOGy3A==,type:str]",
"value": "ENC[AES256_GCM,data:ZUUc5dkNjyfGqaY=,iv:Lqabw6LqHRrumGgcCrt24Af2Zzif5d9TTUA9i0sADBk=,tag:+6omVunyyGzsNyvW5nAC3g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:+C0LH88=,iv:YIf0D47UJZuZoC2dbuK1h3y0atp8cV2PMDORixkqorE=,tag:zirquZBld+JOqriNjhpZEw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:D1ekgSjYIZJsRioYwF4C8FM4MgkMsYDCe/X9AEVxyw==,iv:Fs06eYU6OzJ0o2YLKXA+utfVp4skf4ZNbQuvM64rYCM=,tag:O3ywFma5EzQFOIXAUZm0/A==,type:str]",
"type": "ENC[AES256_GCM,data:B0cCBjWi,iv:YJUIF9SGILr2S0eLfkGdjrzVmuhnWzup8TnQph9nDGo=,tag:p2TJx3Dc4ghSZWsdw3+kbw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:0upfrBcTBSqguhknItkHmQwsrIDJ/PYkgYmGAZXiSLYgB0LD5SYsLAjY7VDAu161lapgKNPsNXeyl5R+SyILhs1Hrxi7xGPkmZLgfhtlNvOZL6YPofh3CF8s6l8FOaw+AyT/lve2RLow/0vkeOzVg84vVJBexK6A,iv:DuUzMdqpsQvfvPltR5f3ZU/naNl4DYer0nvKs7VPi9U=,tag:g63kqQbJb0quDvk2UFNIXg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:paSDRNN9nSJb7PXKIC++43/aWbzkOJsRbg7suG3ClQ==,iv:t8WTE3/XEKepB9hU+zFMCrErOmwH/iMf5hCtspwTYv8=,tag:1djHLHgF/0+bUWFbcwEqHw==,type:str]",
"ENC[AES256_GCM,data:kDs4HUIYsM1vppReIBmdrcexCG1FRQhosmkwtgCdP3whdA==,iv:NSOLwJZtuJErPZ2J1K2ecuHLCCblqOFDIA+YXQBZsL8=,tag:IeYeBtgpSbD+mMH/EinF4g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:6T9Qr9+bmGlo3+OlN28=,iv:oPcIw1qjL1CePiWdUgJK60WpG5gTqMOgs9UaRnt9X4o=,tag:4CDh085/d3OQ3sd/AVt57A==,type:str]",
"mode": "ENC[AES256_GCM,data:jc36TUmAnQ==,iv:V7r6WFKHc5HgTdxOt0ERJkxKAjS6D9RGkttIdZn2Ri4=,tag:HY6ZAof4z+msg8K4Jobuxw==,type:str]",
"type": "ENC[AES256_GCM,data:31i1ePTPKPe8V5O2HfO09VtVaw==,iv:EEPT4Nr++2aImY8o+gbvRygFtWusb1VfCWmVCUzQzE4=,tag:v9S+8amFhKlllEdAvBCBRw==,type:str]",
"name": "ENC[AES256_GCM,data:buBhntrfwzufXtc4FfBzzQ==,iv:LEah9kazV9VC/PVfI6zXiHZgUymGMSELdr9E3Q0szu8=,tag:BfKvPThlMukMU6kurbNcbw==,type:str]",
"provider": "ENC[AES256_GCM,data:lwBSDXj1wetiijaucTNA3H6KVwejYTUiAdLbyWAGHXqojrfjjhhvFWOUv7UBOJH0jk7QpHGK,iv:TI5Ph+ZazynNUnAd/ShC2hukKN8Ig8GOWAAeI2mjO0g=,tag:9OSCqul1Q2D+9pSY/n6qUg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"index_key": "ENC[AES256_GCM,data:vA==,iv:YeZDa1Wa8sg0iUMPen3W29Glgz+GmKbKlfjVPyZ2FZg=,tag:R8YNYK7VB8ERRmTxR+HPjQ==,type:float]",
"schema_version": "ENC[AES256_GCM,data:2A==,iv:e0X1cvbn3PzLcf7eJyZH/0uwkCSrJGnuWInSa4MjfFk=,tag:n3konyGHPmWTgr1hjk8Hhg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"computed_fields": null,
"field_manager": [],
"manifest": {
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:Wx01J86pLtkT1et/AZ2SqG+8+Q==,iv:AMQKIRXMtx3SJbfj4SsishgYo5T0kZyeT9o+shRcPGQ=,tag:puFo5hVRVk5VUtp/3X6e0Q==,type:str]",
"kind": "ENC[AES256_GCM,data:JetjSCFKx6WIzw==,iv:ceEsenTvvfJzoYR5B1MpXc9d7ETrHG6KgpMXZ7v1Ygc=,tag:Kx8UiENpWrWixPKZVjnEew==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:rdnqAcHNtAzbncq8vUsmnMuSODZhQYt8H5yDU9xr,iv:5n3goMlgIJUAekZ+UyEG+KJxNf+0oiLBdK6XshERTxM=,tag:+fUhPkX7U6Dxqq6u2bdQcg==,type:str]",
"namespace": "ENC[AES256_GCM,data:N2tY/r4Uetjn6RSJjA==,iv:gY8iL2YQnQoGd14MKyuv4aWnImAATZX1TcYMLPxKt7s=,tag:EPhy1+LvlqXrjRHTekNMZw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"spec": {
"plugin": {
"rewrite-body": {
"monitoring": {
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:WDHx4IN0Bcqi,iv:Og1eYEZxbimzK7LY12GqqWm4k6BtEiUf4QldwVFWIR0=,tag:MRbD06XGxcqY5vn1dkjSsg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
"rewrites": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:+ONjH9zGXg==,iv:LsNlZhwQUWUOZhwGrbMY/8lEQUngSniF7Cj4d7DN3T4=,tag:7T5E8XAsKrShqjWiJiL7UQ==,type:str]",
"replacement": "ENC[AES256_GCM,data:yMwLEMR24fGnKE349U2Bfy1K9xVLPHqZZY1qEg6E1U2ODBOdqeghR5rNYOjqvsC704L1/IAdk5YVweCILf9YboPLVZPNQlKRL1Ft5b5ogxBeVNhLCPwnpblo4en//z3EfayTdiqtG2Tr68Z0vQ==,iv:IHe+EpWtiGv7UE2Z80NxD4/NSQfaUdjZoQxSmjew6i0=,tag:I9/+juruCd/DJY161deLJA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
}
}
},
"type": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:zYpc31PR,iv:2KxX1jD7GsX/NiGhFhFQLgjLEqD9YhSfdrWgG+daBBQ=,tag:qA0k81eDL8hu0hkwqo2oWQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:B1IetMEV,iv:lUzumXRIn2Bl0x2cNRCgkYwH6FnM/5EMBpnv3w9AOlk=,tag:wThNsvcl1DdG9RUzSyS3IQ==,type:str]",
"kind": "ENC[AES256_GCM,data:YsDpBemm,iv:u7mCDQ6SSzgjPU3+vhNJEJpDMzzOK0HqrLOs3cjJ5ao=,tag:2J9jMlZUjuToQX5QR28m5w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:/gwBbvYh,iv:V+6uT7hEVDmIydemOKhE4tWbdpCrISg3b+sIM4RXBjo=,tag:bfpEi4LdRV35tfbHu/QOIA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:lhds5rvA,iv:g/KGuB8JZygHJoWCYegx8feaSvHS3DNEYUGLp36riWU=,tag:9/Wd7zoSmD+GJaeOXt8Ttg==,type:str]",
"namespace": "ENC[AES256_GCM,data:9H/JJ/jh,iv:0frrr7bfGsW33jew51sEoIyVFBx17795yg9B5iBA+q8=,tag:fs8XiOSgcjenkwfGtPMgqg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:smWF7gyB,iv:8MPE+guJL5LTe4eRVs9v321f388sYhF1oySKyEwX2bc=,tag:DnAZypXHX5kkO6SaZ7zL9w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"plugin": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:rBv3QHig,iv:TmMvTLbkYALOLnl8PdU8nRCfwJDvrOVgZI6nUhGgCT8=,tag:WlwCog2HNt2ynrgb+QfE6g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"rewrite-body": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:HvmH3uhq,iv:+gT7JIYC4qrQEooeTjfzIRitrqd9o1DLs9aPIM0xg4M=,tag:vK3145EtmiLBwCeMbfqVvw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"monitoring": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VgwjQv7b,iv:Zj2x7oY7UwXQAseAKAfJvm6G9xM0i9Qfr01Amx4qc60=,tag:0B/T7MRO+pXuUhP3YReRFw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:eFOGoBE=,iv:1m1TDb1NtPSQ6JKrMivCABZW6XyvnjTkeCBg454FZEI=,tag:o3J1ZNYsk0ugWvntaEd1/w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Wqy4gnno,iv:cfVYYjrhuKX3hhYhH0iyTg/DrJ5qARok/GV/VQWCYO8=,tag:BuBNF0Q5+mlLX/l4a8RlLw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
]
}
],
"rewrites": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:2Kn4uxU=,iv:pwFcoE+5Xh/qRXYlm8gGHLFSZCkHMfkArbcRbpFIdoI=,tag:OhUsTGwX+DQve0xi1ADmcg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:CP1LKbPB,iv:nzOBztsb8AK52aiBUriGTkshxO5SkW+XUIp2XwpzzWU=,tag:6kdTAlkDHquqRExTcxYiUQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:4dEqxHyh,iv:vPsc+dS5XeNeTh58vLnfc8wA/l29qK7FUoJtXjzG4Xc=,tag:nwRfeodTLk96uXNsiTLBpg==,type:str]",
"replacement": "ENC[AES256_GCM,data:HFQ5A2Kw,iv:x0sfh5IRtYFHfiWxqGcMnGAJDueU0etQM+qNIQz+6YU=,tag:z/A+68+8dwl55MTUiCAX2g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
]
}
]
}
]
}
]
}
]
},
"object": {
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:uRtkxz1y56jvTBW49SRc8QVjFg==,iv:PidDd4+WrdGsa9x97nLcfjr9rmjwrRx2brZvHuUbnDE=,tag:OcyhmBWRvy78QeIAVoCYAQ==,type:str]",
"kind": "ENC[AES256_GCM,data:aorC8iezE7G8SQ==,iv:8Hagkzg+e3p5ZrwfwuOJGE/ZSXOPhaLzEph7e+spwu8=,tag:ub0eMTtGDRWosgTS90QIDw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
"annotations": null,
"creationTimestamp": null,
"deletionGracePeriodSeconds": null,
"deletionTimestamp": null,
"finalizers": null,
"generateName": null,
"generation": null,
"labels": null,
"managedFields": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:S+cM8wBLjiPQgQay4BFj4R6hG7rPElwiE/SZO0oG,iv:mO8BVBm2EwOCwOimRaq2FXkC2miXdHwrPiuHVxEUymk=,tag:L1IFiiTKkPKEiiKIjRKScA==,type:str]",
"namespace": "ENC[AES256_GCM,data:wKTrNBQFhylR9sG9sw==,iv:uZmtexR4F8JAwiKNl4klIQNnXp+pTZgcUyTXoN37sq0=,tag:ZLdPuke9TJZnsH9Vvm0TDw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": null,
"resourceVersion": null,
"selfLink": null,
"uid": null
},
"spec": {
"addPrefix": {
"prefix": null
},
"basicAuth": {
"headerField": null,
"realm": null,
"removeHeader": null,
"secret": null
},
"buffering": {
"maxRequestBodyBytes": null,
"maxResponseBodyBytes": null,
"memRequestBodyBytes": null,
"memResponseBodyBytes": null,
"retryExpression": null
},
"chain": {
"middlewares": null
},
"circuitBreaker": {
"checkPeriod": null,
"expression": null,
"fallbackDuration": null,
"recoveryDuration": null,
"responseCode": null
},
"compress": {
"defaultEncoding": null,
"encodings": null,
"excludedContentTypes": null,
"includedContentTypes": null,
"minResponseBodyBytes": null
},
"contentType": {
"autoDetect": null
},
"digestAuth": {
"headerField": null,
"realm": null,
"removeHeader": null,
"secret": null
},
"errors": {
"query": null,
"service": {
"healthCheck": {
"followRedirects": null,
"headers": null,
"hostname": null,
"interval": null,
"method": null,
"mode": null,
"path": null,
"port": null,
"scheme": null,
"status": null,
"timeout": null,
"unhealthyInterval": null
},
"kind": null,
"name": null,
"namespace": null,
"nativeLB": null,
"nodePortLB": null,
"passHostHeader": null,
"passiveHealthCheck": {
"failureWindow": null,
"maxFailedAttempts": null
},
"port": null,
"responseForwarding": {
"flushInterval": null
},
"scheme": null,
"serversTransport": null,
"sticky": {
"cookie": {
"domain": null,
"httpOnly": null,
"maxAge": null,
"name": null,
"path": null,
"sameSite": null,
"secure": null
}
},
"strategy": null,
"weight": null
},
"status": null,
"statusRewrites": null
},
"forwardAuth": {
"addAuthCookiesToResponse": null,
"address": null,
"authRequestHeaders": null,
"authResponseHeaders": null,
"authResponseHeadersRegex": null,
"forwardBody": null,
"headerField": null,
"maxBodySize": null,
"preserveLocationHeader": null,
"preserveRequestMethod": null,
"tls": {
"caOptional": null,
"caSecret": null,
"certSecret": null,
"insecureSkipVerify": null
},
"trustForwardHeader": null
},
"grpcWeb": {
"allowOrigins": null
},
"headers": {
"accessControlAllowCredentials": null,
"accessControlAllowHeaders": null,
"accessControlAllowMethods": null,
"accessControlAllowOriginList": null,
"accessControlAllowOriginListRegex": null,
"accessControlExposeHeaders": null,
"accessControlMaxAge": null,
"addVaryHeader": null,
"allowedHosts": null,
"browserXssFilter": null,
"contentSecurityPolicy": null,
"contentSecurityPolicyReportOnly": null,
"contentTypeNosniff": null,
"customBrowserXSSValue": null,
"customFrameOptionsValue": null,
"customRequestHeaders": null,
"customResponseHeaders": null,
"featurePolicy": null,
"forceSTSHeader": null,
"frameDeny": null,
"hostsProxyHeaders": null,
"isDevelopment": null,
"permissionsPolicy": null,
"publicKey": null,
"referrerPolicy": null,
"sslForceHost": null,
"sslHost": null,
"sslProxyHeaders": null,
"sslRedirect": null,
"sslTemporaryRedirect": null,
"stsIncludeSubdomains": null,
"stsPreload": null,
"stsSeconds": null
},
"inFlightReq": {
"amount": null,
"sourceCriterion": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"requestHeaderName": null,
"requestHost": null
}
},
"ipAllowList": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"rejectStatusCode": null,
"sourceRange": null
},
"ipWhiteList": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"sourceRange": null
},
"passTLSClientCert": {
"info": {
"issuer": {
"commonName": null,
"country": null,
"domainComponent": null,
"locality": null,
"organization": null,
"province": null,
"serialNumber": null
},
"notAfter": null,
"notBefore": null,
"sans": null,
"serialNumber": null,
"subject": {
"commonName": null,
"country": null,
"domainComponent": null,
"locality": null,
"organization": null,
"organizationalUnit": null,
"province": null,
"serialNumber": null
}
},
"pem": null
},
"plugin": {
"rewrite-body": {
"monitoring": {
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:EtkEi8SVgJjf,iv:uB13OzWgzAkf1ii0bHjMRPLQ0istVmSpAQmSivmPxPI=,tag:t2Q5fsfCMSbYxnl9bkH+ZA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
"rewrites": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:Y+yXopPdHw==,iv:TqXVYixHxRIkC5qYLV62f1V1HtoP7BiOgT1QM+M1o04=,tag:q2Jlu02Dfvo6pueA5Xesnw==,type:str]",
"replacement": "ENC[AES256_GCM,data:toXQTZETLxGQzxX6ZFu3iEVutHsxCTg5NFdAlqIJeA3kiF5seOP8DmsL+Na3u1Oljy5a7TEl5HVVQLRw3bd18OREWO5XkNEhtIaNEX6ngK+2lpSdKbhrXJopuG2ziGY1+jota9PG0MXv6Zcyuw==,iv:+f7X2zK+tkN1x4FI5BO7Yy+r72th+gQT8G5OiXeFR78=,tag:HfwLe90NZTF2dZUz9ukXqg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
},
"rateLimit": {
"average": null,
"burst": null,
"period": null,
"redis": {
"db": null,
"dialTimeout": null,
"endpoints": null,
"maxActiveConns": null,
"minIdleConns": null,
"poolSize": null,
"readTimeout": null,
"secret": null,
"tls": {
"caSecret": null,
"certSecret": null,
"insecureSkipVerify": null
},
"writeTimeout": null
},
"sourceCriterion": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"requestHeaderName": null,
"requestHost": null
}
},
"redirectRegex": {
"permanent": null,
"regex": null,
"replacement": null
},
"redirectScheme": {
"permanent": null,
"port": null,
"scheme": null
},
"replacePath": {
"path": null
},
"replacePathRegex": {
"regex": null,
"replacement": null
},
"retry": {
"attempts": null,
"initialInterval": null
},
"stripPrefix": {
"forceSlash": null,
"prefixes": null
},
"stripPrefixRegex": {
"regex": null
}
}
},
"type": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:THbS/NVk,iv:PfwMNABn3CqziwRzxtIw2Qu7lzxmE0irkEUtJI+3DAA=,tag:10k0vIg7iTx3rC0Phfe5kg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:rlIjedy1,iv:Q5gmX9dQIZSHL60M3YwtSXLytRzMQMS9km4LCmDTr2o=,tag:BQl8dtYN3zqLPQOtlEukRw==,type:str]",
"kind": "ENC[AES256_GCM,data:abztGYWp,iv:l77vRTl1QfHAvUbrnlf0rRzFAES7PdqX2lbHHnNt8pg=,tag:SGgDbrTV2u8D2bfYqz2PFg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:SOmhFc/v,iv:fnnTCqar9e0rEb1hRQbwsMDVqQphhy7ke4bCKs6EHkI=,tag:bCnkoIWlOfGIWCs5PypdRg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:zNI2,iv:qJlCr+loKTDowjEr6tZkWmUbxDS8vTtzLzwo+mInXc0=,tag:XLHO0qPJ98X//R75i7ZgwQ==,type:str]",
"ENC[AES256_GCM,data:8cODA89R,iv:BSmIV6MoVn2lLEthHaPTaY7HHdImhT0LP3E4qOjGqec=,tag:ABzbpIcWWKIOgxOELQ29ag==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"creationTimestamp": "ENC[AES256_GCM,data:VTJaWw/e,iv:XHzSnA6lh0L9i9NgbgtCpfZ4eom7lzbTO0leinfzfcA=,tag:JwDJJbJkKUSeVMGk7k4I5A==,type:str]",
"deletionGracePeriodSeconds": "ENC[AES256_GCM,data:2vK5Fme/,iv:BXj12JpGZzak1I0mE2X0NhLD21hJGUD41MddXRjH7C8=,tag:+m3ijdCWpBHnNga2/IQpEQ==,type:str]",
"deletionTimestamp": "ENC[AES256_GCM,data:YE4OWUeZ,iv:XAeuyNlyYPw7HtKE58/aVyq6Ld7ixuFaxCD7t29nmWo=,tag:VXOhR5J5fvGoyb1aDMgPDg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"finalizers": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:UHwmqw==,iv:vYUeE5XeAMWTx9+4qVil4TFtnpvD/rbRj1IWA7KD9IE=,tag:i0701zDXci/4Ojfyxb/09w==,type:str]",
"ENC[AES256_GCM,data:Wvd3lObA,iv:W5T2GLRYJen+uvA8Qxn6FXMInSkKGgxQt+cMTqeL9y4=,tag:JEPwbn4IIqwkA7fd8xQzTg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generateName": "ENC[AES256_GCM,data:Betn1Frb,iv:Iu+cfilmh7qe4xvI0pf43siFyAWjHuiJvp7GFoAaQ78=,tag:wK5fqzpkv6n+qGEQoGptWA==,type:str]",
"generation": "ENC[AES256_GCM,data:rohFREI3,iv:wWTswungHnonEie7h/tfZxgJJFnAUVhMg5PenzXHuPM=,tag:zZ+86D4kiRA/i6xJYDngSA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:6q4q,iv:IPyZikCwXc5lwqBOVD8AhpdOD4ki9OrhCmUHZgTvH7g=,tag:GSlQKusQchlwliUFmmik3g==,type:str]",
"ENC[AES256_GCM,data:TP3PEi+A,iv:TNEhn6qnGf0Vm9Pf0AAp0p66qb+GYNS7xZT1tb/KSoQ=,tag:Q6+B/wQi67rIsjEMZkki+Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"managedFields": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:x8fA1ZA=,iv:LQFgwlOR8XaMFh9pxSIlP4l3qDJV3HL9OCTaAoaPikA=,tag:3lBaE85AoWpZf6i+id4FJA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:7P2GI4wt,iv:keDwSK4eL6VnOUvssz5oXgUni//Ruj6xm8EXC531KEY=,tag:OTX214r+U4iAe/rZjOIs5g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:QYLTSUE7,iv:3dPhz2XTnVGl27Pn+RhtkNKePvWQGbs59D3D5hcFyXI=,tag:V08P0BlgBDoE4JD1brL/pw==,type:str]",
"fieldsType": "ENC[AES256_GCM,data:C5mOBUed,iv:Gwd7dlkfK5g7djXK2mPWKDh7N0uugUdAkVuGKaGBZmI=,tag:wxByDnrUjSLlV47L0H23oA==,type:str]",
"fieldsV1": "ENC[AES256_GCM,data:GT4DzSOwmw==,iv:Emr9cL+ZVlehbDY8LPKK4RIqCmMVcip69kTXXFrbYVE=,tag:axtk0ONK+oJj6AUpMZjGpw==,type:str]",
"manager": "ENC[AES256_GCM,data:qgLHXv0K,iv:PVuZ/bHyPtHMh2/HCLjkBzyEmPPW7Op20FxwDvjTVM4=,tag:50kKsZJ+Qb0vG4n145DzYQ==,type:str]",
"operation": "ENC[AES256_GCM,data:G5A679P7,iv:+pZeOroJJxL4NNWXAn2CjR+SGWrojN30qEDBpxQmRxM=,tag:2X/S8wJBzGwKXlQF9XF1ig==,type:str]",
"subresource": "ENC[AES256_GCM,data:srROqVs7,iv:TyPHNzHExTt+ccmqSPkXrAa4kYZhu46Bx0+W+GUAnHw=,tag:TRSfqyEhhp/FixjlPc5yDw==,type:str]",
"time": "ENC[AES256_GCM,data:bAryQHRg,iv:2MkxvwTWNmH+nawic2BQj46m0M0Snr5tfyGFqQM7mDI=,tag:LyO4JX+5Iy4RjcJpPKZJVg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:oP09p4As,iv:N2x9UAiq3zfa6sMqa0UueTL4IozuGBVJO+Vf1INDPoU=,tag:28AjWpsmsbe5lXM/oCikQw==,type:str]",
"namespace": "ENC[AES256_GCM,data:C7M/16Mc,iv:r7X111e4M73JWjIf6C8feivfLAmjb0zOQWj3ioAH9e0=,tag:H+LrhxV6AaVKkxQ8O9u/2A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:jf7pmQ==,iv:VkpsAfwvy5xd/yVnSC3afdUd3wYctIBVG+nbUlr1jKw=,tag:/b/EYy+2QCnhdXH7yuYLrQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:9F+69dbJ,iv:5WzQtfTzwRV7FeDv8qCCRBXOA2UB/dAPjuZuzNwiZUo=,tag:38HDgRgtMsm1htLpRRVFvg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:mU2GGIvQ,iv:GfG7jrkA+Mt34MlvhNzxBBlF4+TSW7vCAnIkj7n/PHM=,tag:9lz9rMT9XhI6P34oJ37Mrw==,type:str]",
"blockOwnerDeletion": "ENC[AES256_GCM,data:CoCEMw==,iv:7S0y6lgNMWNJI/E1CReU42DPccuSs8fVH3QhENx5Zos=,tag:ye9wxCBgmwURMw4VMbcVUg==,type:str]",
"controller": "ENC[AES256_GCM,data:BMTBQw==,iv:YtBKZx8Tqv0SeV3WwMMaJUrQLga0y7iPdE0wylOv7zg=,tag:rwyI1c5PZJINxB87n10Fgg==,type:str]",
"kind": "ENC[AES256_GCM,data:cXoKYxtr,iv:H+MtqN6tRFH4SZE/yQ911AqEJNAIq4mnAZoLcqbF15E=,tag:yNYdMpTEXQJwDAIu7jqF4A==,type:str]",
"name": "ENC[AES256_GCM,data:Qfw0DEr9,iv:gzilzroTRNo3Ary7MF6VTE3fKnMC835KRGAQYn3WBR4=,tag:nnH9MvTis2sFKamGggCJog==,type:str]",
"uid": "ENC[AES256_GCM,data:3bv8NS98,iv:Fx82MG/gYB8br5LXs+vbrpa2aeWEkiwKSH0kkAw14wA=,tag:nLjuq7QnjNY7eZoFzUawnA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"resourceVersion": "ENC[AES256_GCM,data:TOHwUYNn,iv:6dzmPlNbBHuekxM2j9jYb/ntbAWzM3q7Gz/cIR1fg/Q=,tag:gFuF4lSiUJP9mPwAS727pA==,type:str]",
"selfLink": "ENC[AES256_GCM,data:tz9/GoNe,iv:o7Zkmu/OuvoFWVhG4AKpD6u1HAmlw5hmfHihtQRiJdI=,tag:xURn3lFApfIguWC+lHLmaA==,type:str]",
"uid": "ENC[AES256_GCM,data:DB2HerB5,iv:7zrQtQEAFWG4Mrx/84Rur2yV13agMsYU9OuqlPfAMRE=,tag:zrVGRRu46dvnD0d1Qc5j/w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:n6RwULMx,iv:7b6+cCC86rgrQUd3Cuqvq1nX5kJSP7TmamePpDrEdbQ=,tag:e0urK0BWe8vW+bu1aHhDSg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"addPrefix": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:okIPhZxA,iv:yGnGJvfqpR5s//vSe2uJawJx7Zv2kC4igMfJ3uAfk9I=,tag:DT6Z6kaIJRMe/Yvh4Vz1+Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"prefix": "ENC[AES256_GCM,data:Ee1kWA52,iv:8n95twOf5QzIDT/GwCH6FSnT3WSxmR3CyTit8dFw8q8=,tag:EIX34Hv38S5XVuwO2IjUCA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"basicAuth": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:+lZlpO5b,iv:zRifpe7Ihy323ql91Vkr2vwl2ONcFxcPmHrM9vA/iTk=,tag:idPRO7rx7CIIM3lpleoIdw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"headerField": "ENC[AES256_GCM,data:h2F0048P,iv:EqgDvMQOj0C8QskiCLJzmri6SwG4oUnaqEY3r5KWmMU=,tag:4TZtWry9zA4iLk7FCMZ3Yw==,type:str]",
"realm": "ENC[AES256_GCM,data:sxbIY/K2,iv:lMwnRj8BkPX6rarknqzhrsupmnmMQXzLH2VSXpkPIMc=,tag:Jgm6kuCzODMeINUCC5n5bQ==,type:str]",
"removeHeader": "ENC[AES256_GCM,data:emud9A==,iv:oMaNy9XgJcSWmNdW3XLAmpPpc/ssm7TGmd8EHuegP50=,tag:/BDIsm9UyvBBNGb9UE52qg==,type:str]",
"secret": "ENC[AES256_GCM,data:ALiaJVAo,iv:YjhZTveybcdE2XOcKundsHu7MDUKReaZyAfmPKnDEu8=,tag:Zavy5pRohqZyAZjwlsG7Jg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"buffering": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:EYxNssBr,iv:7EDjDxZyKC/WEhkrBg4NG3tgMHDpYkKzTRT987YvRJw=,tag:ptEYG7SqcMsdf4YbB5cyLQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"maxRequestBodyBytes": "ENC[AES256_GCM,data:ZB2eJ4Kl,iv:E9TrUJME3WcfEHmmKjaofGlwaGY0dgirUkQxadK9nqg=,tag:0BqYeEuz6W+EGVKFxvA8zQ==,type:str]",
"maxResponseBodyBytes": "ENC[AES256_GCM,data:n2qo4neD,iv:21RY4UKX3l/g8F2r6mTlph9TLOlfr+SUCkHz2MIP0tQ=,tag:m3c1m+Es6DJehdtn0QfMvA==,type:str]",
"memRequestBodyBytes": "ENC[AES256_GCM,data:F0+HfLJ/,iv:eoJXMvtrr2LDvpt7bH7WmZSAjjtYFKHSl06qLegwr4U=,tag:73Fk8LGpQQPbukCJjLOurQ==,type:str]",
"memResponseBodyBytes": "ENC[AES256_GCM,data:LUrkEtYy,iv:0e8Utdc//HUbF5TtWydhGcoM0BsJ8lwmmG2oyMjOyMY=,tag:k/0I+yQmzUubyLSkRT4Ppw==,type:str]",
"retryExpression": "ENC[AES256_GCM,data:YGB82d0I,iv:n4Dp7S2O8aiwVy8Hn2D0uDMrXm5cFNFV7ZKoYYgWO/0=,tag:0MHLca8j4QRCnUgjSpUJwg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"chain": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:QzvGPuuO,iv:DGdE51Ejdiz/e7VPeyvcgj7eN137IzAnimgF4pNXHmM=,tag:G2qeyUUiiL8iD9AUs4ewDw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"middlewares": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:F/aPyg==,iv:dTGt4LEGBYAEPA7Rt84gkMBz4Ruo5ufqeHs5D0MZJGY=,tag:r7re7VBT3BF9FVQfqQ4rMA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:fMCtMo6A,iv:W/m0/FwiT+dyyUYESSLEplk4B7jXSPTE3RNsePtEFv0=,tag:zIr4HR3IucZ0gj1iYZO7Jw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:osCL9vpB,iv:UtJziKnVEoAKZavu3PG3HYUHm9xBAoOgf5Sn7ocWRsY=,tag:AuUmxatgpBG/WYJ5OkFZiw==,type:str]",
"namespace": "ENC[AES256_GCM,data:IVe0U0Qd,iv:vmdFFwMxW0JSI0liDI8xoIzSr1OPXHrBwqQTttkfNNA=,tag:0hYDaLMz61rLpDD307iiuA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
}
],
"circuitBreaker": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:SSj2odDY,iv:auYuWUfd18R3qFNa8ku4eWg+s+xaDpZr+e95VYKVvPc=,tag:Sdwg1171BHLml308OLr74Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"checkPeriod": "ENC[AES256_GCM,data:OGoTG2eg,iv:8PwSiN3sXKAbzco3Y/V7k9ghxax9Njgp3xrNcyxp6Hc=,tag:cWSgtx9bEsfMfbgzBtI7KA==,type:str]",
"expression": "ENC[AES256_GCM,data:EOvO4ELz,iv:HO0ZHYooqvYJfbGvh3OZUt4FPsvHhJOOnXl+CJ0Wmv0=,tag:siGRzs3qJ57rkhM9BbS0Fg==,type:str]",
"fallbackDuration": "ENC[AES256_GCM,data:LwDXc46D,iv:3o7KB/cHdMLRxFpcmuiZlFXeqOv9tOaLHmhSMFMd/UQ=,tag:c5BymE2jYzSiiusDOTcFLw==,type:str]",
"recoveryDuration": "ENC[AES256_GCM,data:02mBz3FB,iv:X4tuE8z5Y6ggrdZ6bltBXhkUiE0+S+JUymyl8O4Ro6M=,tag:aO4oYzDNYNOq7AjwawWLcw==,type:str]",
"responseCode": "ENC[AES256_GCM,data:fy3s0mSq,iv:meMlav+ZJ8JmXLGYTzP59vQ9drj08ijEW1Fw4WzFeII=,tag:b/yW8EF2m8rmHU7YHN3Lzg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"compress": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:OvKQgTkD,iv:uUtduwqxRKkWT9adkeae2bKBA/WYL/MEsKB2CDnLV+s=,tag:4VI8Hm0ftpGgBfVIbEQyQQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"defaultEncoding": "ENC[AES256_GCM,data:7lcwwtBI,iv:ktcEcrSZX3NXRczQXB7Klt029kvaKappFIpplnsZr+k=,tag:kVVvayJAn5MGY+Nr+sQEIQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"encodings": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:8NJrQg==,iv:2h43/o8DkHACd3M+qK5PCYyprfrC2O9/FTH2l7pVzkA=,tag:INjSBHBn2m9cH5VPlBq4xA==,type:str]",
"ENC[AES256_GCM,data:K+gvTn+s,iv:fkTU/F0dfVfTfmQcc5+uMlxv6xh0fmKpI3D3yD5LyX8=,tag:4xzLVJU3pNQDlCZs3C6oTQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"excludedContentTypes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:r2vCCg==,iv:Gg4SBLDbeM/qy8WKNauUqnI/pGxnMbsXZroQOvTSxhU=,tag:bVgYrspdwafRVzxrneJ1OQ==,type:str]",
"ENC[AES256_GCM,data:t3VDujCF,iv:yJ44lUElfRfBHLs1JSPNNhCV87Zs5sF3m1CJDjW1A6Q=,tag:39HWn9ACPwTGOrgDod6kaw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"includedContentTypes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:khxJMQ==,iv:rJHqK7tzPtMMOznTXaDsUCADo9iA5eaG0uU/CyD9gs4=,tag:ntrcDl1Miq0VMZoVQ7UwDA==,type:str]",
"ENC[AES256_GCM,data:YH4gmv/Z,iv:r3n/nkSNpIS045VFEk1ZyjYbK1XETFSzgH3BtJVPQow=,tag:V30NKQV1w1Kng5oPDRFPuw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"minResponseBodyBytes": "ENC[AES256_GCM,data:SGsbzyve,iv:tDubRlF1IIQHq/vuL60yoDLeO7gxJ72Gwc7o/fYIQYs=,tag:L4K0Y0APmwvx1h0lKCh9Yw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"contentType": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:goUcSu5f,iv:ingc1GA8RsieVfqGGOfHKu+07skvNCTWwzfZjUTVSFo=,tag:43hn/e6jjZwBFyIbOHKdsw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"autoDetect": "ENC[AES256_GCM,data:Wl9CHg==,iv:jKNl3SILhKcRnHsclqCJsPbDVjpLu6DJH8AgVR98ycw=,tag:5SGgGTeMSCK+VA4Kk3bDgg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"digestAuth": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:PTue5oCX,iv:pksG8fODbtljP3jCebB2PNLXtQfMRHlQtvv2zqpcf7w=,tag:G1UrRz5Kv+/7n+4sicw9EA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"headerField": "ENC[AES256_GCM,data:7LhBifzX,iv:AtJFwUKFoJoWBZo7BJFWXrO0ktk9MmA+Nk5e57C9NEs=,tag:VMgM4D1p3/7FYws++L2kNA==,type:str]",
"realm": "ENC[AES256_GCM,data:7VGBeJAh,iv:K7Rgv+UZ8zRCEA6F3vQjNd8C9EaWr6F7xsmSiAgJAuI=,tag:u/InKKx1FxwTWBLoaVJaSg==,type:str]",
"removeHeader": "ENC[AES256_GCM,data:PzTOeg==,iv:SzxWy1YQQMrFlIRCcnl+INI1e5EEhW1WPHPKvyhNOyE=,tag:gFahefexyOeUf/RX+XLL6A==,type:str]",
"secret": "ENC[AES256_GCM,data:zebisNCs,iv:A6l98Y283OoXqe8JEkcdTfWBzyLLS5lXtlQddtgrXtQ=,tag:7Pq9c02++yqhUWVtWsE0WQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"errors": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:4tL5DR7l,iv:a9qTJCLrYY9Nro3X3aHXMUHvjPV4BO0YaacCjqb+xcA=,tag:Rh4Lxm/hoNpVYh0yhy4SXQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"query": "ENC[AES256_GCM,data:3dOxnhNx,iv:aTSVsNgCJ238dOZYiohCsLkzxgQg3UO7nWjWJ4z2UDY=,tag:14pgOxooVPztBfxDo0oUSA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"service": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:04zNVaR0,iv:dAGN0qVkJ+INKKg+bA53HEuFJQcoh63S+20GZ43b9+o=,tag:IjoK4zRZgJV2GgaLVMLCUA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"healthCheck": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:0tINg+cv,iv:+q7cuUxml64BMvqec3FzC3ZT8pXdmvNhbUv2E680Qqg=,tag:KJOJTpM5oUo0aJWd5GI4WA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"followRedirects": "ENC[AES256_GCM,data:HkasnQ==,iv:d3rDP0sbYTvmKZOlfJKIruFULtOgcGjqqjmdgX2bJYs=,tag:Q6n4kCLvdFUr/hfgzjYJyA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"headers": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:+8G0,iv:1UTBfB648AlBzBeHnL+n64Sww6nHQVNPYnvM+wqsjuU=,tag:aCH2yDQS8UA6CC4Y3BAfFQ==,type:str]",
"ENC[AES256_GCM,data:K2DDHONq,iv:zC/g/S2fuLAandANkynndKsHJFFbj5muZJ6XK1TOSNg=,tag:XScNzuI48hHUFtY0ip3LAg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hostname": "ENC[AES256_GCM,data:SQBShAHE,iv:a/5DhQ3NlXNSVv2cQiLOcSTSTfFh996UPcXuwvm9O8w=,tag:xRxz4oAdlGtKIZEmsGa6yA==,type:str]",
"interval": "ENC[AES256_GCM,data:Uh101VHa,iv:fnx7PipSaEzdczBKSMgx18kyRTRfngUl5+TohfqAI1M=,tag:YATHGtGpaZbzvq0Zg0WUkw==,type:str]",
"method": "ENC[AES256_GCM,data:7kXf1KIx,iv:tmi59y+yZcbAqg6s+eWTNw0c5OI5dkGMHr72UCJ0fVw=,tag:PyaP3qaElbFea02qtAomqQ==,type:str]",
"mode": "ENC[AES256_GCM,data:kyd+8Y7w,iv:8PjriqpopoPNNb6cYGp/JnA98nkeCdQQdRY3PDQz4rI=,tag:3CpUHU3oFmHm0xi1vM7uug==,type:str]",
"path": "ENC[AES256_GCM,data:n/sDUTqu,iv:jvoszmJC+1EUi6jV90QzQN+IZa/0mwnyx1RWzeRcp5k=,tag:/1il5Tur0k1GJm+vBr9Fsg==,type:str]",
"port": "ENC[AES256_GCM,data:ly6p24Ay,iv:PRn3UvFb7BYt3T6MtvYPYy4pEq3aKKuFCSFGQaSpolE=,tag:t1+rD55VfW9EJfExMLScQg==,type:str]",
"scheme": "ENC[AES256_GCM,data:ZGpH2Viz,iv:dJgZxcgVG43c0aJxcconOf2Be8xXvafmQufbqFLnHjg=,tag:hn+fNlYjwW7Kv/AjFKBLnw==,type:str]",
"status": "ENC[AES256_GCM,data:To7bK7fU,iv:A02Dm/uTt+Ios7k5OpZjjHNf89sH+ri/DYIasqZHFIw=,tag:hQL29ScabMe+Agqd1tXupA==,type:str]",
"timeout": "ENC[AES256_GCM,data:10v3IFAD,iv:T20SnttxBsf2K6c3V9KJ91hfbFX1eGP6sAtABUqTcMw=,tag:O0O0GRygk76C85sVV1036A==,type:str]",
"unhealthyInterval": "ENC[AES256_GCM,data:Os7R1hSt,iv:pf8EM91Iw9PGvi679eQOuaeOFWBfAbeunbqF1ZDmIIY=,tag:lfJKstYhpN71ZAu+EtIxPw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:ravFp8L2,iv:sJPzY7TGoJTZPud7AtkN+ULjI7n16xmZXtwqOVgU2Zs=,tag:bKvU6/0ETAgJesIO0CsZRQ==,type:str]",
"name": "ENC[AES256_GCM,data:sy81uWSi,iv:YOej4QXpoTp8dRsPj+qsbuMdp7vSbFbESw2DlSrlOq8=,tag:k1nJiNX/t+/x3IAJePRmIQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:BWcsHJX6,iv:sgk0gUDN0oY+yyAfQWEMn54CAEZ/kcIx2wfmo6tSOPM=,tag:4hGZiCnA8crR5ADy+g8M9g==,type:str]",
"nativeLB": "ENC[AES256_GCM,data:Jis/dA==,iv:LqAs4bU4RhZxO3O4W9XrbZqUfmQTIM4Ev4uF5XMaeIc=,tag:qBZUQlyj2AmA4ak7/LwNbA==,type:str]",
"nodePortLB": "ENC[AES256_GCM,data:JmHawg==,iv:Usvgu/fPlQTllcGXNZ1Iqm7/Il1tRkur3r6cekI1p4U=,tag:O3UnAN3adc5HL285rUfGjA==,type:str]",
"passHostHeader": "ENC[AES256_GCM,data:QEYfDQ==,iv:LL3JVNzG6m3Re87+stV42GFzj65mSoaP1qClYJNNsL0=,tag:VHWSxeYujSl9NfwWAqm2Yw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"passiveHealthCheck": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:0OcO2H6I,iv:ghuM+M29Rq3F+eHOz1ZuGvAF22V7ZwVo5DUL7wQDgso=,tag:CmCF0tN7CJTnbpPINvYUNA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"failureWindow": "ENC[AES256_GCM,data:Kygt+beT,iv:OBiSpIZrrVGdzUWJUR3/Tqs9YSufVLKa01y/IA5lZ3c=,tag:St0/t/DZDsH4pL9WI7EX7Q==,type:str]",
"maxFailedAttempts": "ENC[AES256_GCM,data:4s7NHqjx,iv:yzBveN8f+umCcNLzf/ODKwQ6wqDRO28Iw1j74bmjVdc=,tag:lII7ybc8RlKNfkgM9uj4WQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"port": "ENC[AES256_GCM,data:XttL479C,iv:xuhLbCLqEvgaofotR1uEJKfFZat7BanvGmzdmS7wP90=,tag:MO+QAvcBFB40lcIJ1A4UTA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"responseForwarding": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:lZ4Kq0av,iv:fO5KTccE61svvpNtuUPpwtEcNeAnzKoJRnXrmdOc+UI=,tag:Jm0pbrCWDQ4YNehq3LZ9WA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"flushInterval": "ENC[AES256_GCM,data:4McQwvb4,iv:FmIoQ28NMjSQpKrqTVgDyDqEE24ILj2fL8/1nJ/exBA=,tag:IKsz2jdNQGrIwQziSntK8g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"scheme": "ENC[AES256_GCM,data:eG5OeRcf,iv:Bx+TdG+lNuDDo9NcZ0Q00PPfx+6k4gtAbFK5R8EhJ48=,tag:gwxucMLyggstNGAv8slarA==,type:str]",
"serversTransport": "ENC[AES256_GCM,data:wbVD9zKm,iv:E38J5rcn8qXqheCxYOsZBh+/ByUTWiCVpVdG4rcpm5g=,tag:AH/gia/izlhOylMgLKdSIg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sticky": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:I3ImOTqX,iv:4iPX5K0pagK0q81FBw8q01rILqhHBKzuS8vkr1MDeCU=,tag:Sx181Ner1qXRyFbqPTCRzQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"cookie": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:HyvxzRTn,iv:T6lfRC4dzcufaOEARpfgyIyBWJqBcqmER9izfx+7ES8=,tag:+gSzQ+QnBP+fb9zI7jK0SA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"domain": "ENC[AES256_GCM,data:pTcnOZdt,iv:LYdLbQLayUzGoOnPV12kOGQ0w6u71ZkHkRkkLjU5Ryo=,tag:sITvnf7zVJdddQ9DtTSAVQ==,type:str]",
"httpOnly": "ENC[AES256_GCM,data:Em2tNg==,iv:pXnQSpf2lkWTin3eyhIWVZslgZrzgAtQr62UsSHRAWo=,tag:Na1etVzr2YVneuAbMAft8w==,type:str]",
"maxAge": "ENC[AES256_GCM,data:7x+LdjHU,iv:mvHEIldIGiw2BYceY7arkZzYr5qTiQmAWO38/X+ipYA=,tag:IMavneSMWmN9hzUjrlgcQQ==,type:str]",
"name": "ENC[AES256_GCM,data:HNfT18q2,iv:k/lfnSijk5Ga5Pli9d2kOs7YCqQgpxg+CMwAOur17CE=,tag:zi8eTuOSvkGxdArGWN96Dg==,type:str]",
"path": "ENC[AES256_GCM,data:J+Gmp6t/,iv:mASe1AAb/di04HToHWJQ9zy/ZI9w+6eJglAv+c9gffk=,tag:zJdZvMXg1smbgmYy396Pzg==,type:str]",
"sameSite": "ENC[AES256_GCM,data:atNuzrRH,iv:G1yFLakAxhs9pcFVNot0ymLb7nwOpbF+yo5FZNG6N7E=,tag:n9aa0ZCdXG0M+KXHbCA3QA==,type:str]",
"secure": "ENC[AES256_GCM,data:SEY2sg==,iv:MbOpYPXd/OlcI02BMMl1sYQb0HYSaBm8cZNlx88evdo=,tag:w9Y5Ir6pNmOoj60/TUwthQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"strategy": "ENC[AES256_GCM,data:RSvUpxCN,iv:9ZFCOxXiOLgF/N6AQsGl2Qb7yd4uZ6+xw4wx9WcIXnM=,tag:A/K9FCz/SP/dNXU8o2CHDA==,type:str]",
"weight": "ENC[AES256_GCM,data:zxNu8jw4,iv:eE1XGPBOADfbR/v2dM+aZqin3+nhpzQ7XMDp1F7rPrM=,tag:qWD932HO804KSpBdvIUzYg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:10f6+w==,iv:wKBAIkQVXdVRfOzhQ/V7hbEmrAvtCf4C1+P4Jkz//mc=,tag:zZvXMOea8MFCokwZE0UbMw==,type:str]",
"ENC[AES256_GCM,data:AuXQ/nb1,iv:0QxuaQoHhiEzfFphoDhligUnyIemZTB4SGWnnrXkkng=,tag:2eAbLx+A36B9JbYdO5k3Kw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"statusRewrites": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:KE1N,iv:L2hZvGc9w38c9A2vYlIbCb83BJICAI2tRjRZ35X6dBs=,tag:ppvzsyM0JjlgLaPJ5oYNJw==,type:str]",
"ENC[AES256_GCM,data:3+cMOyTb,iv:OCIhyY+oyCRIWeo9UhOkAEvRvP37biOhSnHf5+CRHcQ=,tag:wu9EVFY1A7l+qlLFci+PbA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"forwardAuth": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:10zJaXR8,iv:EkefDPILvUic28XTpluaEQ9YDn6Zd2Q2DqNIXobKues=,tag:LuM7c732Y3cd6LAWAn7cHQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"addAuthCookiesToResponse": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:DyB7uQ==,iv:tpFHwFj8o2nw4yPZRCTPR8J89Ay+5EZlE7Hy8e7Je8k=,tag:Xc3nCqIV4MlH50QmigEVFQ==,type:str]",
"ENC[AES256_GCM,data:HxpK58cU,iv:uY/PX7Y3+lKL35f6IsaBGODsyMPipQ2g0IDmypzgXBo=,tag:M2yocSAhXPVHEtfxr9qsCw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"address": "ENC[AES256_GCM,data:GLjUqUdW,iv:nWOaiOZhlK7dZiq+ylH9ML0Gs2G4r+R3b7g2MosTn7E=,tag:RTDahkEIFsHRqVByBc9i7g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"authRequestHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:0xn1uw==,iv:XHMTi8lasZyMVO2bh+1Re71yrxqKQr5fi3gdDJghZog=,tag:0fx2Tt781r4XattJ5O85IQ==,type:str]",
"ENC[AES256_GCM,data:pDXWeN6P,iv:ZJ+/57r02C/KNYxaWFSBG5QDqaIzXgyK2xMeRKt17ik=,tag:Xgmp2B03KMnsTEjyS0Ckgg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"authResponseHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:BqnmrA==,iv:t3OBLEsXxO9TWaVKXOm6Bamv/48/B0t4vX2MGf9VLxI=,tag:5yVAa46+k+W3pqUAINCXAw==,type:str]",
"ENC[AES256_GCM,data:7wEZrm1+,iv:JoPnpdYu9pzVUp8PXeOmFkqtMhDjqblumDYuT54mfps=,tag:VzSdhOUk0CrLeFoaUPLfIQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"authResponseHeadersRegex": "ENC[AES256_GCM,data:BTihAyzB,iv:9ZLMADzbRDDmVkDLgqUzaCPQIwS5JUZpguS8obplze0=,tag:WSYd7hSSqWfKuVV4+JKbBQ==,type:str]",
"forwardBody": "ENC[AES256_GCM,data:wQbOJQ==,iv:xvIUy940INPVrivM6IkVGfDwgh1stUACtmtl2YaqC7E=,tag:NVY4rCUN7zrD2KG+fpR3qg==,type:str]",
"headerField": "ENC[AES256_GCM,data:yYlct0fi,iv:HhjclO1MSsaAGja0fXPeJw7bd6M5iDtPHjw49jv2LNg=,tag:/R4svFg2nSk5XNmIJTnVmQ==,type:str]",
"maxBodySize": "ENC[AES256_GCM,data:/9lQOTu1,iv:A0h4nebRrubqFH/0zGAXev6D31NOFgp8Yxe/dQOqqO8=,tag:D9dmOQ7eD6tq+FGcVR2HSQ==,type:str]",
"preserveLocationHeader": "ENC[AES256_GCM,data:IyaTGQ==,iv:RT/C+gtOBlBv81mEKnSVHDGsfyfB6eFUEd/0QRPKTjg=,tag:NCIi661gE2bsAMaJOeWnug==,type:str]",
"preserveRequestMethod": "ENC[AES256_GCM,data:JIJfaw==,iv:6Ao4zuKia1wkH5Ky0tKs7ZLZ5DLiq3NB3he2ODNKvBU=,tag:1lsnk6wckklXj1o2rwWjBw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tls": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:aUswesw2,iv:8bWlksvWk4NEjmY4G2jqVEpaX7b7SbttHn6Ygiqcgn8=,tag:UvnMjiryaepj2owuAdYjfg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"caOptional": "ENC[AES256_GCM,data:Svbj9w==,iv:paKJ+4qIuDFkaEc53907AEXLiKdb5YKmvqNsup1rY9A=,tag:aQc3OgjKn4E97iLp5nuTFg==,type:str]",
"caSecret": "ENC[AES256_GCM,data:tLJvaeKL,iv:VwJp7vwqHSFctsu9TuoPp36+VP4YwAqABTtX7Mm8WZs=,tag:E2OGbKvJJQ1QbYDZ5ZTiOQ==,type:str]",
"certSecret": "ENC[AES256_GCM,data:n5q8Lir4,iv:NYBIjGhMl0N6Z3dWiTLBhA2hcesKMrLeA/F4L0ysvBc=,tag:lMtbKb5kCGvvGS4l8tdH/g==,type:str]",
"insecureSkipVerify": "ENC[AES256_GCM,data:3yrlzA==,iv:jzLyiAsiZE8wXkMrMJCKWBpGUKYALpdbGUliq/iR+BQ=,tag:g+tClaD4/93DgoCLn2ynnA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"trustForwardHeader": "ENC[AES256_GCM,data:QsgeRw==,iv:2FgL0QZcZhYok3zvgIfutPK+GRhnEtikkvZ9NpaghZc=,tag:xe08mSpyc32KDnMt/Jt4HA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"grpcWeb": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:0u/qr+7C,iv:cn0vN9+bMJoHEXIkPwF6zMIHjO9bb3ege0sQyrRjrV0=,tag:WQ4cZU/pHGuB8YhoHHpTug==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"allowOrigins": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:eVkWlA==,iv:lLErxb/bn5YiwL/su+4CETIS2WtNeM3+14ujBY+xE0k=,tag:TouT3hCL/8XwLUgM9OYiVA==,type:str]",
"ENC[AES256_GCM,data:FF3sxm/v,iv:sHnX7hK9iP1OD13LIEs8svyuhYIvLhzJDI1Ufuprssc=,tag:UFAx+10Y1uXPFRb+Obir3w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"headers": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:cH6bxUig,iv:fCnQ0/6m9lFuo+Wwuy/d70Nf9zrybhCNrDPqX6B6NRQ=,tag:OtvZij0TIF8d055gY1DqzQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"accessControlAllowCredentials": "ENC[AES256_GCM,data:rIKk3g==,iv:kSOknsvwVj/cwQ4/lW07E1cIajl2g/cwz+gWwRaQFOg=,tag:Lm5BRey1u7jiJYHHvbPNVg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"accessControlAllowHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:87+tcg==,iv:1gvwAHkv1ezmUX/5zprBlzfahnssOehRaJBbH73ff6g=,tag:KupPaXMhg61slHGNW6KMxA==,type:str]",
"ENC[AES256_GCM,data:UrXzjQ4w,iv:NBwztQFCprkSXhmjCgjudflJCj2nlJb/VowfRvcgPp8=,tag:h3lTF+fZya35tQRW6rB6Ng==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlAllowMethods": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:LXDd8A==,iv:L3sbXWqVwnPsB3a1nu4O+BUzSUybi1pwx8bts8YUHeA=,tag:GGlxFgKjaHkC5F9M7EaRcQ==,type:str]",
"ENC[AES256_GCM,data:3ng/W/9z,iv:zxI7cuDyRnfpKUQ1s5TduT7hCV9hXvJltIUkBxGJUCU=,tag:b35G7GXSRsDUZaXTbLOfVw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlAllowOriginList": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:u4Gj6g==,iv:69gIWw+t8XlF7ZzoZW9fDp5HIQt6hvKujlpjEpi2FTE=,tag:bnsBo79LAOTchiOena3EDg==,type:str]",
"ENC[AES256_GCM,data:laRauWEi,iv:tGnZIbAenG2mZk8Frnr3drDcKHSvbBnherTL66vBTIE=,tag:yRmgL4J68AD78E6Sxc8/ZA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlAllowOriginListRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Tv/VpA==,iv:GiJAAqFW+i97boTDgqu9meNDgDt5CheIDtlJQYFxDdg=,tag:aQDZIlyVZnI6UJ73SAtl7g==,type:str]",
"ENC[AES256_GCM,data:wgW5RT0X,iv:DOnSYeKuUztpn951CTn4kmaPsI39yJ5ynxKPjCUoxLM=,tag:Vg+E6goMkHIccXjS3QYIPA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlExposeHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:0dt3ig==,iv:KJFSu+KKClHPpgPH+AuN0FZFz6a7Wh0VuGCezImasFg=,tag:rZlZdBCmFlskdd3ILYMTxA==,type:str]",
"ENC[AES256_GCM,data:X5F1Nc9r,iv:kH4H4f8DmjhiNFtlv1L1XP1p35IgLObraMsI/sscnFI=,tag:xlA+fVKbOeCoU5LAGCR2Fg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"accessControlMaxAge": "ENC[AES256_GCM,data:XPYC8RCK,iv:ztG6m2H4A7X4vFe/7SD0FD/RqCKKaiia7mzt3B0zhH8=,tag:p101jXdgnXWLVQwgCJogug==,type:str]",
"addVaryHeader": "ENC[AES256_GCM,data:PbR9+Q==,iv:RHwvkOFUe8MkH8U5/8peY0vq658oOigVRfp8eZfvTcU=,tag:pBrHduJ6mcL8v28JjBUXZQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"allowedHosts": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:2Xe/xQ==,iv:wrI0RnGFAHqpOAACuPFL48aZ3w1UlftqeN74rP70C30=,tag:FlXRBksNH890gq/yNqQeNA==,type:str]",
"ENC[AES256_GCM,data:iOB3k+6I,iv:NXZnaOtLTP+umlAMaEoMLY8iR4b/Nkti1zpN8RGx+J4=,tag:BkBd1yjGBG/J1yD6Nkzo+w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"browserXssFilter": "ENC[AES256_GCM,data:JX9D4A==,iv:kzb1uRSTMy+1q0F95TMRtWqYfk1KJ60pooFcQE5+B9s=,tag:Qlhdzi9sB75F/Q0SuXLHQw==,type:str]",
"contentSecurityPolicy": "ENC[AES256_GCM,data:W2SSiJAH,iv:s8U2hTSuLxwu38UYdgnigQqwjs7cCFN1VM19LEvugYs=,tag:YOE7IV4rHwrEEJ19GrTfKA==,type:str]",
"contentSecurityPolicyReportOnly": "ENC[AES256_GCM,data:MyRkeHGJ,iv:gmtXyUfMYVOnxeO4E5UvVrqWLzh7ujln+vNBKYJ9frc=,tag:1MjxhxYg19bAkQ8YnvPiRw==,type:str]",
"contentTypeNosniff": "ENC[AES256_GCM,data:uJ7AXw==,iv:oy2gP0k2viaQkt2gONNJXafIC+LzBd8LZvGK/A2nNJk=,tag:CR3B8ZXkdCivsrnFjT/+bw==,type:str]",
"customBrowserXSSValue": "ENC[AES256_GCM,data:/SEvj/RH,iv:/CTaqem+4eHkFrbH26Zv5ptEnKbi/4O/dS4/RUNZzyM=,tag:6P/NNMmI/HXflDZ8Wg4pxA==,type:str]",
"customFrameOptionsValue": "ENC[AES256_GCM,data:lpwrT6U3,iv:BoCTW4PpZg0Uq7DAmX6bK6oiuDrNlfxyO6BpP9vbxV0=,tag:LxlBF9s8Vv+94b9pfMC6Vg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"customRequestHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:K1d9,iv:jzwFw8isq20+vastlNnAcdopBdmbJys4v+2BQF6zdaw=,tag:3M+MwSoCEKSEXGU7Q4jmaA==,type:str]",
"ENC[AES256_GCM,data:eBnpllRJ,iv:R7GCm9j5qjY77Qf+vCYtPaTvdgBUNdBttRqEg+01Hjc=,tag:8WEgM83RPZ+eoUgUkchM7A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"customResponseHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Rb4x,iv:2r/SFbFxyYvMnQPko2Nns2m5p6HShoITrm4RKGSZ59k=,tag:/ghfHMDhMGVzUDTKmUH6Uw==,type:str]",
"ENC[AES256_GCM,data:QU80PliB,iv:ZyzTlO8g3wX/FcpGlWBCvRyND+BCkETZ8i3HmpUFWLo=,tag:Q8757JO7cbn7jD9PLhVWkg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"featurePolicy": "ENC[AES256_GCM,data:OvBMuh+d,iv:8xCwnCQ5hvZjssAnrBHIhYP3gg+C3FRiKD8lyyJFsb0=,tag:IkNYCLvHZPMVCHesBh3y+g==,type:str]",
"forceSTSHeader": "ENC[AES256_GCM,data:Q5s2tw==,iv:b8gipBjy0sS0cF76zD8BJ7dvcMCcTARZJ9QTT0cBFMY=,tag:qQ3qcfioCzsTVqJN1lj9bQ==,type:str]",
"frameDeny": "ENC[AES256_GCM,data:oSGpKg==,iv:T8qf6yMucmY7dOB7km6ncPEdw+S73+z8YhrW9Hxtuyg=,tag:S6DCad+69l7d6nNnZFeYwQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostsProxyHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:jFysQw==,iv:NrJWDN4qL7Swsal6oeTKFsCwmR7ATRktCmdhK7SA9M8=,tag:LLp1XWBozdeJdQfaTrEOhw==,type:str]",
"ENC[AES256_GCM,data:uHz5KVxb,iv:pq/G0U6cP9VBT0mOzOfld3sVML8Yl/+ACHdFQItsutw=,tag:8K8TY6Efm9VLT4k+3xLICA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"isDevelopment": "ENC[AES256_GCM,data:3Bomow==,iv:bCXzmneoWxf+0mmP7oS8BpPVmvymzsg+04qyehLXChY=,tag:aRkrPJ3pXks79HUtJDzhxg==,type:str]",
"permissionsPolicy": "ENC[AES256_GCM,data:sc5Hr5Cg,iv:SoS+1xCqutIyEHXXBft6sH7J6nE5QHEQ+DWAUtk5npg=,tag:ugma8RYrUWpU7y8vXPvDcA==,type:str]",
"publicKey": "ENC[AES256_GCM,data:4QLTh6WX,iv:ARJCYfSusP3Y/U+fuzvIAGxUaeCHNL+FfzASxz7/Pt8=,tag:zhLY7tEUfkytaF+hPsa03g==,type:str]",
"referrerPolicy": "ENC[AES256_GCM,data:RZTdVe9d,iv:Ngi9+5XPNsflvbedzgwQug0i+9QZBskf28mRMlU3Y8E=,tag:a9gZebxGy4y4X73MRckXBA==,type:str]",
"sslForceHost": "ENC[AES256_GCM,data:jtgPLg==,iv:qhY7f7CJEX99n+c0jKnjV5iGM3p89w197iBLDI+kvMw=,tag:vMr4YNf8g7Fvt/1HpW6DZQ==,type:str]",
"sslHost": "ENC[AES256_GCM,data:RaF2kOaZ,iv:0xwaWDrP8iQK37HLBM42z80whGoJt1Pvfo0CE5xCkMA=,tag:LQ9tHbs+gaXzURUqdiYMeg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sslProxyHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:7LhZ,iv:Mmb5kn8QAz7l9zOic9uZamjdkJbZ/4N4DSyEyktNFv0=,tag:Eykr2LGu73/c6U8h7G9S6w==,type:str]",
"ENC[AES256_GCM,data:vidS4lgO,iv:MMd8sx/Bn2PE5I0+Jjhfmf7hP0uffZIR4nVV7cDeo2M=,tag:sbpKx8wNPuvhbtsRitvGHw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"sslRedirect": "ENC[AES256_GCM,data:3+6wmQ==,iv:qcbXFkrcZKr7W3FWquSge9AlFIfQ79OJOmlvqUhBX7w=,tag:FtNypaF7TfgPf4hbcLKLsA==,type:str]",
"sslTemporaryRedirect": "ENC[AES256_GCM,data:WrWABg==,iv:WpH+jOQ08d9eWSnK8cfIO+mmM+MWl1Cfh/3QtqI8aN0=,tag:CC7VMPlI6iq9lSaX/FUdCQ==,type:str]",
"stsIncludeSubdomains": "ENC[AES256_GCM,data:yzjIHA==,iv:hX6sIxLEYqB76NtyRt8ukzpBrrVSufBccVzn6Ilqkbs=,tag:yNS2qPHrpKa9FA3uqqXInQ==,type:str]",
"stsPreload": "ENC[AES256_GCM,data:oGY+wA==,iv:pxqnqiF9+lvWFYK96ilLC/wG7Yu12gyXTckiMfV0CfI=,tag:2KsvKINNQOaIny0aSEmuNg==,type:str]",
"stsSeconds": "ENC[AES256_GCM,data:zG4AKWUl,iv:fNUP20V5NmJaS34oNIjFvDAuHSK0nayfZ/J6h8BhGC8=,tag:hSCtMMAvynU8/SvkqlxNFw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"inFlightReq": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:doFaTFHY,iv:1ZF5shNVVybmEepPe7Bf1dcndLDkfWp4UmGlIiKx36w=,tag:uiqPV+hl5WaC5ZkB0brzCg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"amount": "ENC[AES256_GCM,data:AH0cZAfT,iv:XugEb9ot1x6fy5luP1EJSIKiNNLcaz0AXReRJSaNLGs=,tag:bztUVxCungXL2oL3gM1MbQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceCriterion": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:hp/LvAPd,iv:NpbThI/ZJSZ5jK8dG/17Gro9SDTieiu3rEz/aYGcR5Q=,tag:cH0I2EgGeXATGAYNH3ThlA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:j9NOI96o,iv:cAysY/XNowjSzJP03s7crFIPZYUv0FfjolX/1GMl0VE=,tag:BO8kjuOTcy080kWF+Huq5Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:FQ9IUojE,iv:4aYURMFPB1SxhwJlEB09BB40096/fO7ppmPbubEBW38=,tag:q/cPGyLHl6QVF4Gw1qjOAA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:cZFnag==,iv:s8O7PLM1GL2o9+dUDfKhtQoMtn+uYy/QuNYVFo4hYLE=,tag:GQesUcWhyMmrhiEQxtqykA==,type:str]",
"ENC[AES256_GCM,data:qQqramBY,iv:dfzaXmUh6PkBA+x0raVB3XJnSGB9eIkZfBZAy015kpA=,tag:OpKR0NDwxxOMxLajvHWxSg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:gCJtEvb4,iv:jA5IlczvfMYe/rJqpmV+LCLP3JlgPb9wzTkFhQmUt8M=,tag:vw+yNHRgRfKJO9CNGjzuCA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"requestHeaderName": "ENC[AES256_GCM,data:byIbG7LU,iv:ks+i1Lo38Xa4awgCdOkMwEnSHhdVSD5Vw8pUhT1PCfA=,tag:ch6DWs8qTLOVGzLg7rzxQA==,type:str]",
"requestHost": "ENC[AES256_GCM,data:TQ4igA==,iv:JAlkvncCvLB3d6VnKNuveW8Kp6IkBbaL7SxZN4LGmPs=,tag:R2VvHxN60hxJIb2LFRYHOw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"ipAllowList": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:PZ1cvV3K,iv:Pkxdt4tle8RVvJ6aGGSS6ZRSLgzBAYTPncFY8DRdS24=,tag:O5pLzUSLmwurSDFLrSTC+w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:uDYYZlSL,iv:GWrBpoyzM+oF1QLsBodQbL13Vsp8VEnghhtegJomqfM=,tag:oGswhT2zzt/R3sZn8EGGZQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:addl1E50,iv:opVJNAFMV0Dxh1sT2auMN/zgC4Pn5CWWXTz5R4Wxhe8=,tag:W6WrIhAJWMScgVT4QokWzw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:I0h8iQ==,iv:qHv0yeqx79apVfCsBjZljeNb8K1IF+GAUIgwo6Bd1TA=,tag:HgPXb7MEgyPpKjvKOMw9pg==,type:str]",
"ENC[AES256_GCM,data:THberOHj,iv:KgnXc4vi2POPiAtA5PdiVzzifvbV5g2nuwt+/Z55x3A=,tag:xof2HVKrake7fNUm0m6b2g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:pfWDDGU2,iv:Y5KwW863fegod9NDcQUd+rpk2+23uLEzRXtJQyCbAuY=,tag:RTOxFVl6jDStEUE55LU2Yg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"rejectStatusCode": "ENC[AES256_GCM,data:I3aFCSXd,iv:wbu0mvYBwXaUVb+Nn28vAEhpxlYWFuZtDYL8LYoal9c=,tag:z3vVt0LfDFk2HLEgMduUGA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceRange": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:v95MGA==,iv:D0lnzfTYWpUWB3InapW2rWEwo2FM7E0dURkiuTPfc3U=,tag:5qVbQLL8upDG8NNCc20/lA==,type:str]",
"ENC[AES256_GCM,data:ZK5t9H59,iv:WRiF6GZNCvZdDb5VLg5hfX4+A649J9lvaaxY1wfwLeQ=,tag:hE2SKiqDlyvIxZDH+jp6Jg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"ipWhiteList": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:JjGKi5sH,iv:4tbmHS5E0AMmWT9buEOKxq1GAdJO0QSO4kRaSbl38m8=,tag:a2ZdYFSy5KO9LVvz4kgdTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:sppmhREC,iv:hnxflkIeQZu7yxYzvc5gZ4X2DHMWq4r9A2HpJJpOdJY=,tag:evN2BjrzDoCit+0S9NIOEQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:ZczAtoSa,iv:F6DDIQXCvHBrCqMQb0q1RH/E9GNOtSn+dR5rMPAMjoI=,tag:DODBKDs72DY+U99+Y/I2xg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:AVwpdQ==,iv:Otmvd9yoO59Xu9GdaFG2mbZn/A7uZ6P17QCIbaB1r2I=,tag:cpbFgMQVSo6AxvPKjFLWpA==,type:str]",
"ENC[AES256_GCM,data:M244T8lx,iv:7vt2H95/UukxNB+U2e0NYhMGv0gCwmYLLGKkEIPAUns=,tag:ZMNHhWnuIXZJMx4+ojn1YQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:QXiJ/dm9,iv:lZC3xKHr3KX5nqIPbSxLQMHqTqW2ieDY6eK9sjENi+o=,tag:bpQiPrdFEu2L3IyGY7PuKg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"sourceRange": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:fhTeEQ==,iv:aCWoJ/82pH45WyGz/m8hEtsCcTuQjfPm/7S3KyS/x8k=,tag:NBuaASdp6//TI5NBZDf4IQ==,type:str]",
"ENC[AES256_GCM,data:n74kKFZn,iv:vuP1N5b6TzYNNuhpDnd0/W0VZALh6OW4SFBve9WO/D4=,tag:tDebXSnwYYYogb4680zYTA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"passTLSClientCert": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Vbk1VyZ9,iv:/HjwHzQ6N0hRpEMvMnhiFCD3sNjiWMm4vA3hXo9BOLQ=,tag:ERO8DoOM2FHNd0X3SIcZ/A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"info": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:iJ8pI5lz,iv:7uqYvMYDVXz1OtWvcVjo9ASmuBP0e9ZUPc9h2xDeJ9g=,tag:AMm7KybotQsOQQ6XHCvupw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"issuer": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:B1n2YDJd,iv:e/SzEEd/CylgRGvpf01p1j6lvrMxoPpLhJKDka9Sn8U=,tag:RsgU2VvygzYfFd6R9r070A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"commonName": "ENC[AES256_GCM,data:jjceGQ==,iv:98Ub1jiRpIWPk//zZm3puZV5T9uFu+IktKGm15CxXdI=,tag:0utvstpwCe0xbb/MGOBnww==,type:str]",
"country": "ENC[AES256_GCM,data:x0BQbQ==,iv:8r4J2ILQ4q55+MizfegDEK6w46jnJH5aD0KDYw8t/tg=,tag:OcVVTjaA9KQkhRVOQflvXg==,type:str]",
"domainComponent": "ENC[AES256_GCM,data:EviYrQ==,iv:x85fxjasH5SO4UUAsj3P+fJKZjTPgb+gWaRYbstGA+c=,tag:XuCB07Gz1WsnOHVIWIknQQ==,type:str]",
"locality": "ENC[AES256_GCM,data:ih7elw==,iv:F+tyWjtoO1BJDNgXurSOZ5QQfvoRlBan+pp4oTGqLTY=,tag:/hcDKfNlTa0Lzyav0tx/SQ==,type:str]",
"organization": "ENC[AES256_GCM,data:n39VMA==,iv:NINlkk3pbmMwkYxSdrdD9TyGpn0u/sV2UWgrNc9tCDU=,tag:pTqHecrzVB6RTOhXfjGi3g==,type:str]",
"province": "ENC[AES256_GCM,data:YIcHxA==,iv:0zyboscTKH8oxk6QFxiGVKqDWCOeYNqVpMgcA1twx/o=,tag:gqRcGenzhuBVpIC5zb4DeQ==,type:str]",
"serialNumber": "ENC[AES256_GCM,data:aGzrmg==,iv:rULHv6+z3lbr4EDYkcZlXMo6I0rwEG94ehlpW8+6JaE=,tag:Gzg8NhK2N9nyO9hA/pwscg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"notAfter": "ENC[AES256_GCM,data:bt5iVQ==,iv:1ujJt8rt/fyFSFzWNcvT5tcffCOBFfzs1CLuw2vn28Q=,tag:z2td8ZA1JuuuWl92JjXrXw==,type:str]",
"notBefore": "ENC[AES256_GCM,data:m4NrYg==,iv:V1a3Ogq15/xFkU24SXV5FbwPOn/+GlFZHRWVlh1rYhE=,tag:LyDey0pT16DbuxCAaB9K2A==,type:str]",
"sans": "ENC[AES256_GCM,data:5tmb2g==,iv:kDbsNqEMbFkRDxd+yM4gV6YkhglTvPvjcbCscJ7ghzY=,tag:EAnApxhikmx5aJ+JWKepaA==,type:str]",
"serialNumber": "ENC[AES256_GCM,data:O/QgIw==,iv:o0MmvEntg/tljSeZvOMgBE+3Xd06PUJRkDON0Hk16Is=,tag:OhJnoiaks60Ia+e7Ch78KA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subject": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:sUx4Z36v,iv:0R+VjQjew687SH6erd8uA6di/pmVwDVyj/4WR7tt/E4=,tag:TPc7nSkcD4MoOmFSMRRwVg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"commonName": "ENC[AES256_GCM,data:kLShTQ==,iv:Nff5yFiLyQ/os3aAP6KoH6GMzVqrQFkHdqknnsUQ2xU=,tag:jfr9V8XfvlIXd11YGeBBdQ==,type:str]",
"country": "ENC[AES256_GCM,data:DSKqyQ==,iv:03QsDtJcqgDua5DlY9veyjnR/JX4abGtJbBEih/nfrU=,tag:QMf/vfg1WVGhUqjZ1AonJA==,type:str]",
"domainComponent": "ENC[AES256_GCM,data:A/0ZxQ==,iv:UQuIhcxis7kNADhtICpH+gU+suGr9hF+Eht262YhkM8=,tag:VN4UB6xucGT1ibKJ/01v5g==,type:str]",
"locality": "ENC[AES256_GCM,data:a4Qovg==,iv:Tni4nrOk2giyhLCSiD05N0T/RG5PahC2Ystta+ZEbXw=,tag:14CkcvoyUoNbWBM2bNdsfw==,type:str]",
"organization": "ENC[AES256_GCM,data:eQScGQ==,iv:RAwZNyiuL8kn5RJZpLTIBfJAKEwMCj4FiDIAOcKdvg0=,tag:3Bf2553Nsr7gtO4bUoXs9Q==,type:str]",
"organizationalUnit": "ENC[AES256_GCM,data:UA7J8Q==,iv:7y+D4e2XMxEOhPy23DCx39I4OVZJ+WK8FJ3zr+3+9Q0=,tag:/m1r9aCU2pwsMLUHTk2UiA==,type:str]",
"province": "ENC[AES256_GCM,data:5+c7Fw==,iv:soo3g9zz4lLm1MO4dDNxMOYUYSqGl8DscFMUHXwwTP8=,tag:IXEQoQ9u3ZO8jJonTK+IfA==,type:str]",
"serialNumber": "ENC[AES256_GCM,data:v2X21w==,iv:T/aJAImvqsegdGYM4dvhJ9pPsnXFiLwy54Bcd8qo1Us=,tag:BHL05sw3Ro21TB+3vLCKrg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"pem": "ENC[AES256_GCM,data:pR9aYA==,iv:G+UapwoDxB9yV68lwW5ApLzT3NbsY6tSxvh3+0Is2vM=,tag:5s7q4UZSOnk3VQAa5LioTg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"plugin": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:5EJi,iv:N5J/1pQKHDcbG9LzADMipCvZP9HJhHwm/pCAO71vsJo=,tag:b28BaN6c+E+TG5kV9CK7+w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Rj32HhUF,iv:zW7jX6iXStYIgX3YpfTyQSu9Du5VAHah46CdhbMQcR8=,tag:vnR+u6yHbbaGZrcqW3d9DA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"monitoring": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:5awMlvuA,iv:t415A2keUOBu5sNYrdGRJCNILi1m+ywzUrUJCG1fKUE=,tag:F+VWQy1DVoxSRK94NTtf9w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:8icsutw=,iv:TaS/zrLRtQzvYHMvQuj7bPkN0FdM+itTquKAs29dBH0=,tag:O24b6wjNfvgR0Os1Tatb4A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:zWaoD8kO,iv:3ATF9kSsllPQ312+Mfv5UFjJtlvCOf8EQvjYdXNPdLs=,tag:CbPA0K7Ec0xv2s4ebtXNRA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
]
}
],
"rewrites": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:I/CRa48=,iv:vvQCdnc9ZHS8bZUlj22vgc5LVsWnSf8yN1qa1eC/hV4=,tag:KUglElMT9lFaxQXSkknu7w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:vBzAV6pg,iv:gs7sHBJwbyEA7fa0P6J8x8mMYXhC8uZFDdJqPz0qGLs=,tag:sJLeNr5KGXDH9RpjAhuHhQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:qQl4h/t6,iv:OUzNH4k7Tcw/SNAx3Me71eD6HD4CzUCag06XYjQ316o=,tag:vPFuH8VrykpNCjBmVe+zAQ==,type:str]",
"replacement": "ENC[AES256_GCM,data:A4xvqzkH,iv:OWyEKv9o1HrbxGyzVBjCVQkyky2yqJC9Vr6qyuBIi58=,tag:v6cI/p/O6bZzfoEXcsd+5w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
]
}
]
],
"rateLimit": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Cu7QPAFl,iv:WB/xpU/Zxdy0Ot9tFNZ4uwtz3rTcad3swb8aOe6Q+NU=,tag:c/wc8XfpXfnw4bMFU0kMgw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"average": "ENC[AES256_GCM,data:+9K33NeZ,iv:RwfC9dee7GRlagNtMYe32syfMzBRfgxefSfwgqjhLgE=,tag:LBQgqRPkRzkwIP19wQF8/g==,type:str]",
"burst": "ENC[AES256_GCM,data:uB45hkj6,iv:3/aBCk0vIv9LPX+DX+VN5CNpCs7b4u3MW94iPSE+9gg=,tag:DtV4CewIRE3LlAc6seT6Og==,type:str]",
"period": "ENC[AES256_GCM,data:gGURaOfD,iv:p5kpv9uC0OvpcaA5eUT90CIJEiJmHZtQWJX2T8p4HtI=,tag:1nbkG+UcHrQZlWHiLSZiVQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"redis": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:4HX5Un5L,iv:77RVJL/SrciW8WNOuZgQe2EEyyTXTlXFmRsVdkaQ1xA=,tag:BHiT+DZ7JqIwwBYO7W5D+A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"db": "ENC[AES256_GCM,data:uLWtxJPf,iv:Sh/nNh0EhjNVVptjIw4H4g6f/QOpEYMGXc0rxJWov8U=,tag:pgIb240K4QrmTuGEocFK7w==,type:str]",
"dialTimeout": "ENC[AES256_GCM,data:AM8Yk3rf,iv:PeeGg6sInlyMN3F+uknW8Qnpgc/MWZ1Gpcw0xZ/RPsI=,tag:ZtGY6PjNiZIzHS/zz9iVkQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"endpoints": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:4x9K8A==,iv:IyT4nlxN5hKeaOmHg7t59xS5A+XipbSnnAuL11piQI0=,tag:TMwWZ72G0sqcgFXKAQZfTQ==,type:str]",
"ENC[AES256_GCM,data:LNPOE+fE,iv:W/HFz+fnPVu2jK1idYM/sl+esw3F8qJItV2qxh6HJps=,tag:DDdbMt4QPu5u+/IjOw3wDQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"maxActiveConns": "ENC[AES256_GCM,data:FTLKaMO3,iv:1xFyTYLRf5KUZc/+L6Ys81UN+GHNTNjs9slEGnbrJCg=,tag:WCJaZwvgRQjZQhKQIFwRFA==,type:str]",
"minIdleConns": "ENC[AES256_GCM,data:2uALpjj8,iv:d91iqruPPFvr13vW55TDJM0BjFDC+sxES/LKUWpu8z4=,tag:qc4+bnOP2dlTkp36X0ptAw==,type:str]",
"poolSize": "ENC[AES256_GCM,data:Ufn/K68i,iv:uNME3qGzwt1sL7ZMz2bFFAEfXDiWGeZEbN295Ej5yss=,tag:W7HoiSTk6AifNyyW1ZyOZw==,type:str]",
"readTimeout": "ENC[AES256_GCM,data:QfSlLGqa,iv:27vBJgJW0y5Os5VP6+OyvO8B1UT0R0++lj5kWUn2rrg=,tag:S47UmAWMw9Q3TcxL1ujHag==,type:str]",
"secret": "ENC[AES256_GCM,data:cMIHMHkd,iv:5426oXjCwNl46aX77G2NM/YOUYX1b2zm+uV54vbin7I=,tag:jlV73UCgwAgYnrt19wzXXQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tls": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:JHyY6t2A,iv:jnN5pM9EZtFMwvFhfOXWPkGw3CJumAkMxwaALEwU14c=,tag:BXo/pjGDPj35D8YNgVEewA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"caSecret": "ENC[AES256_GCM,data:9TcbFB5C,iv:d2aRL5tm4RsuudZ2o6uInXLW9hxseH0ot+LgRmjC9Wc=,tag:12EXndWHc1BKSSK0p2b+Bw==,type:str]",
"certSecret": "ENC[AES256_GCM,data:za+EaRPp,iv:1sI/XcHZOme+SQCHFEU9W2JbEtCQZv0PiXIKcMYEMAg=,tag:6JuRmkg7Ayc68ch3QJztpA==,type:str]",
"insecureSkipVerify": "ENC[AES256_GCM,data:kzbyHQ==,iv:OjupB8gTUn8M5Cub6zaFuI7CXM+N2SKhvtzIXNuofLw=,tag:i92+jTtlhBv8lGLcqg8q/Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"writeTimeout": "ENC[AES256_GCM,data:asWVoubu,iv:LEjvIKH+P9Zl5ccS6XLHFuATPy7dtIqDkaW7FNvNxbY=,tag:BJec+32Q3bY/IUd4imJLrg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"sourceCriterion": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:QiXvnqMW,iv:XHfDe6O8roI070AA4sP9WLBT0t1dGEIU+dtljwNaKuI=,tag:ob1YT2Da1Bo/mxdEsS9v5g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:aHrohm+d,iv:DGqPDeOXWsfP7u52XlsDcagvN6U7QP3jwViiBHsOCH0=,tag:DaYeHXS7ArWADxbO9+Z9Hw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:F7CvNJ4Q,iv:B5OF84ipoglKH2YS8d3ePDIRv5KiK8nco+aG70ml6LQ=,tag:7IlPZkYAIYL9aW8MCO5aXg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:i0F3rw==,iv:jBsdzIMrfXyHpD7DxeCDcfp6Hj/GeZ33lEGrkN26X5M=,tag:rMukzC8BzD60CtKyo0FUAQ==,type:str]",
"ENC[AES256_GCM,data:seywdJJP,iv:iKHu7UwUBgy5AMLEwR8PADg/fMnsCwEX44ZCgOh9Lxw=,tag:RzDGfNOLS+CxeCkRE6wr3g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:8kUKzW8Q,iv:LcruO4NoIjMomAzoUOcSFSof5pi2To92yPvxqcOTg4Y=,tag:UWgGdbGhD4VrR8sylxcLmQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"requestHeaderName": "ENC[AES256_GCM,data:lrxWzhzX,iv:kGHpAuKLympRefn+z7WVLIl1wJf6EKxggafefzb+dm4=,tag:DgD0JV9rV5ijmhrjyD8+Rg==,type:str]",
"requestHost": "ENC[AES256_GCM,data:tC5vRw==,iv:lHk4Et4Liu2wzOj3uBMlsaweH8XX0HL9amOVb4C0yS4=,tag:rk2AMCBYz97cavGk4WI+hA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"redirectRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:mMiHmXdm,iv:V5IW+ajZR4GK3tbMKrdttadPwY3RaNpr9jSSfFBOqmg=,tag:+LWSgCe+rJJ4DAfOT7mLkg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"permanent": "ENC[AES256_GCM,data:gzP3Tw==,iv:RolOlEgADBnnLi2VFjbeoOIZ1aTezeJ6eug8SGks6ts=,tag:ny59UI3CdkY+6LvmQ9UjZg==,type:str]",
"regex": "ENC[AES256_GCM,data:IYgC/zZ3,iv:gdeboS2yB5/8zMSM23nkp80CMGMpEzMFIl0HgKkDNqY=,tag:Y3xmT2XA5iaKiPkons0asQ==,type:str]",
"replacement": "ENC[AES256_GCM,data:CMfBmpm9,iv:7SCMs4PVieOdcimZxjTh+R9b6hJEYaIqvtVXhPHzDso=,tag:AYkE6cRd6j3aD1E90yF1Kg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"redirectScheme": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Pc+W92c4,iv:bkzGCEOSytKc7QGmY6iuLDuU/Z3Jfg/HIKuLylON8DE=,tag:3cVBTjdAEohhrEg3KYqThg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"permanent": "ENC[AES256_GCM,data:CiHLsg==,iv:84woSQJw/YCW84DApeeVvz41zmovr725h5IYyO8P3WE=,tag:zvhXFsrjM8OQf1Z6M2rZVA==,type:str]",
"port": "ENC[AES256_GCM,data:LQJslW9z,iv:PqMlZti1WyJpG06DrFo08hiFNN6WFNUzs5orqBWeBNg=,tag:Bf3jDSRb3gl98zpJuKKGuQ==,type:str]",
"scheme": "ENC[AES256_GCM,data:zoJuoDwF,iv:AuG/Y8BcHzG8/KbD/CjwKC8r12PNAk09mMYx9eVdyV4=,tag:jzkUsc0EW9NwptqYbe1PNw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"replacePath": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:KyDA2PhZ,iv:zdvHKZHoMI1P3dbyGXSsJAm+oXJYRV04jsphzrrxyhU=,tag:bjXVr6j/NzLW85YezOpKUw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"path": "ENC[AES256_GCM,data:e3UToyLV,iv:+h7pnEvmYQ9Q3voyZKedyHvWajxcSATTFIbhN58yvyE=,tag:DGJz1HJyspF4zb9sbl3Axw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"replacePathRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:OHnG0DTg,iv:uVYSwrQmuCIXuD4EspkUb5FZaFGAED+9WJ97jOGqPkw=,tag:Z56vHmJcpA1e5x2OdfMQVw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:MJU+wJpn,iv:d8kvEkiE3+bRIPyxi8qMoPrY9HmVgravpCF9GYOeexM=,tag:KHXUCH9hscgxud6RZZpE3A==,type:str]",
"replacement": "ENC[AES256_GCM,data:/ay63iqv,iv:OpEn9X9z1Efy/BUucC4dOD3VUwmF+xnDahazV5AFYBk=,tag:faO1cu5hv2fVyLNhI76KiQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"retry": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:GwEkZnAo,iv:B69T1UIRvWlCpAXVUsf70vKBd++SpUO93Z785+Rej+0=,tag:BkiZGA/K4fUJrHO7y5j5cA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"attempts": "ENC[AES256_GCM,data:RZUJqf6c,iv:+8Yp47w0cw4UW0BE36E3UPy1hP2ZFOQXAbYgtIYVWvw=,tag:hs6mzH1dTiSHHYIi9ZiecQ==,type:str]",
"initialInterval": "ENC[AES256_GCM,data:kck7C2d8,iv:WjU8lQ7Oda+hLy5Fp5/UUZinpvqWvtvoHcAEAiD1wUA=,tag:If+/JX5M/XWGXNMVc5+Xyg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"stripPrefix": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:b2GH9vhC,iv:CtyDWe3/qSDCfroVvdSwM+Qar6rS0hI1DSPPNdXl2qQ=,tag:mdtjrrEWkzXc3TeIOtPEIw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"forceSlash": "ENC[AES256_GCM,data:uRfvSg==,iv:t0FQXVbI9Ccrz0uyxwg0PMiiPSYpS4yLlcda8ZNBBCo=,tag:55LU9ZpnzaYzDL4x1LDLBA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"prefixes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:YthZrA==,iv:r6QFVwHBouKCWScjHeV8Eex4bNN/KOisStWeQCCRj60=,tag:St9FpUpDrOVMF2AW8sSEzw==,type:str]",
"ENC[AES256_GCM,data:5avVISVv,iv:uDTNOggKU23sDfer/Ph14FWluMYxWHYRtZ9m2WcYRHo=,tag:TfgSvbe44eyeFJW4IjC64g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"stripPrefixRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:EdFCmwGk,iv:G6y/Jd7DbmBodEXu3mhahC4VppIJv6eEnhvorX3NpFc=,tag:+Sz9SLYu8zMSbQWyFAwf6g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"regex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:vmQmaw==,iv:eTlNCtBWBWM+w4l5GWZfh4YWRlcccrbiVHN24TRIbe0=,tag:sawMU0Xw/8AgDZgCkzdKxg==,type:str]",
"ENC[AES256_GCM,data:9n9h58rA,iv:J+YgmB0YaCWx/D9INrzOK8mRrWG9weDuy0RlEoA052M=,tag:Sm+mo2g0x/igWcW+EYY5DA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
]
}
]
},
"timeouts": [],
"wait": [],
"wait_for": null
},
"sensitive_attributes": [],
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:DGciVVWhBd6vrMEwYdpg+9zTsNbg4rWx0x0dXOT9HCG0pA==,iv:11d3Yx8Ud8sUDXd5T7f+nK8+7Ndh/v5upSb4bpGVBk0=,tag:HZchN7JJFRpn23bYoeHxpQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:D5J0O6HPHKN91yVnj9Gp,iv:wELiyMLVt2zslJO8yuIuoALoHP8RS/AqQcbe53l7AxA=,tag:vGLiVjqG8pa01/OJyxupUQ==,type:str]",
"mode": "ENC[AES256_GCM,data:fe0sy4jyEA==,iv:pJrUxYUZL4UfJdNTcvkFUZrdU7xvMbQoz5hSkitljAw=,tag:I+ogAEWnwxDT94EBy7fsbA==,type:str]",
"type": "ENC[AES256_GCM,data:xCjj9PVWP1D91akR+cVNBeTJHKLwgAYLJl63vw==,iv:xbrk4qkhtJJbNCNX4gUotZWYO2qoS92y72AvF2vIH2s=,tag:lzA1VqS7IkJPgoqDC1xIMA==,type:str]",
"name": "ENC[AES256_GCM,data:b2GweA==,iv:Y9po9sqZuyEiktaU6FBBgYvQWf22f1zL3AAVnzSd6Rs=,tag:0wRBd+QoIoSi5HZD87KHYA==,type:str]",
"provider": "ENC[AES256_GCM,data:c4qy+K7ZPSe3usC7bLR4TxPUZnro0tny8BJTQh3GKaEt3wttJDKPN+RzOwUdwLR524/HW7W8,iv:YTfr3j6Io7P7kRoeMqUBiqvl08EBHGkvlgoI++82fZ8=,tag:qpfmdpezEwShbSVbqZwIyQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:cQ==,iv:FIQNdT36hK/MRXE20ZMr5ZuokSIb29Ay66uK1xJ73Hk=,tag:4gxa88PvuD1oqFkWum3lfA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:/ey0ftFkJFkVLslawocQR80r,iv:lp9tfa0wURPCZec3/DKI+LPi7VCrMmHXrTULW99MjHQ=,tag:JUfwOABqh6n9fJatw9YB9w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:GQ==,iv:5D7Vn4MooO3Yv8EbfzXYYleZgiR3ZSjQ1YJy39/ZgpA=,tag:1VS6Nqam8tJS4Oc3rTva/Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:4uOg1qfOVojrdHMTjOA2QqT/,iv:9mkW8td8znDn3lKhhEkeuuJzw3SfVZFK/FXyYfKS16s=,tag:rGejbCqkqjYwib+m6idxAg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:Lt8irUcrsHBs,iv:46ej0LnYa5YtIPCA39uym7sGVCBHCqCRpsZ0oYemAJo=,tag:RZub8Z5xvAuZ7TNZalIqUg==,type:str]",
"uid": "ENC[AES256_GCM,data:qWxFB1BGYoAwYV7WnUynwBb0YH2qkG/7g5Vm49Vp1ICLGPxr,iv:W5P6S2E7Lt7+moYWmTHVP6Z8Y5IEyZEGUDxpbztbHsc=,tag:zobOgOs5Cg0kKUtkE5lNJg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"access_modes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:PPuZEKT00NlsfwxhCA==,iv:edj/2Wz+5JW6gs0npMqApa2RbCzF0hsKkw9J/Yw8lfA=,tag:No2DFy6pSf7QwzIB9G2YpQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"capacity": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage": "ENC[AES256_GCM,data:HkwQ/A==,iv:zYZRJY4L/opV0/5N8vv0ifbtEHD4boWneVBT1KGOSEs=,tag:Qw77AUXKsCiiys/V1xdWvw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"claim_ref": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:AYUVCe7GdiEhBlsLkSX4DjcN,iv:3ver2p/q+blLt0BAIcQgS3EUPgU6TO/bp2prXVqosZ8=,tag:3jnZJYiCKorMpUIj/jCvpQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:8dL2vlIZ/cnft65XEA==,iv:EmA31D0v5nV9TPZ5mCozqjrTYNz6JFHGH55++cAbpzI=,tag:1m7ApjYc7EQqsJBwbpKMKg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"mount_options": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:YFvwwtAZ2mXP,iv:wjM/iemQeSXMVozvBxZHMquHDhJrV//n3xb65M01+GM=,tag:oOKZYZT2Ac9gryAHMpaLxA==,type:str]",
"ENC[AES256_GCM,data:0TnmYWNkBiNC,iv:N+18F/eC9AWSI3s5pV9bKUzYt/DtvXD7/xhwwThNlmc=,tag:owiyvXoiHdjivsyQ4KNAwg==,type:str]",
"ENC[AES256_GCM,data:+REOkg==,iv:Wx39Xh2aMI6C65qJ4qB/OqzhOTDzIoPfOuT4Q7vxWcQ=,tag:SEx3ubq/eQC1Si51lFg+AQ==,type:str]",
"ENC[AES256_GCM,data:rXMtZ8XhSnA=,iv:GSyJxRo9/w4snDYwJXYs3KfIYfQa7gTe3auWhq7q3m8=,tag:YqwubZAtP766G52CTHt/aQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"node_affinity": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"persistent_volume_reclaim_policy": "ENC[AES256_GCM,data:kwRUwqMP,iv:RWvMTWAamrM5zPdUWZOjULZlv8T22yhQwTchx9wSd5w=,tag:ep4KGRwxkZuha9EVL4J3ww==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"persistent_volume_source": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"csi": [
{
"controller_expand_secret_ref": [],
"controller_publish_secret_ref": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"driver": "ENC[AES256_GCM,data:auCgeWfQnC6spOCd9io=,iv:M3/8AvHKANEmx7rdEsmXSyg7kwvmxafDXW4dB8aluRc=,tag:4YGcRYaPD5xiO89ySSFvlA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"fs_type": "",
"node_publish_secret_ref": [],
"node_stage_secret_ref": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"read_only": "ENC[AES256_GCM,data:PAHBxHo=,iv:qLGcAb14Q1wwa3ZBi8BG7hFQNoY5IbCpryvBTy4zN0E=,tag:ONGa6Qd2OzW9d9ji1sAl+g==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"server": "ENC[AES256_GCM,data:MgSi0ifCTOy1YQ==,iv:PbrNN+cOhKoMdaeIQxTXNad/I33NwyPa29oGSqiKQ3Q=,tag:AkLYx1ezIMhTZdmEDAO6zg==,type:str]",
"share": "ENC[AES256_GCM,data:45ATdbm11vt5czgXagy92lvh6kZ+0F8=,iv:xMxdFgcSZV7K+tDTjhHZ3oCTH1mMo04/4RXhA96PIV4=,tag:W2115ibHZ9vFj1iXboRvSQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"volume_handle": "ENC[AES256_GCM,data:zCpZfHQ78iRHMczo1lamUXZ7,iv:CuXRvWRO2o+oRfhuKiM3ndFXvcLNKPE8QK+YpJ62M+c=,tag:BF20zTs7DygSGHFgoY1HBA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
"nfs": [],
"photon_persistent_disk": [],
"quobyte": [],
"rbd": [],
"vsphere_volume": []
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage_class_name": "ENC[AES256_GCM,data:BZbFo9iEqPypvFI=,iv:FIfwMnC2Drh55sSbSd+MZP3gf1yj36QNzSA3ZMk5UkY=,tag:ksy8zBvBLoO76WiTLBMRNw==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:0Rg5yG3o5lju9Q==,iv:Tbn+gO+MqaWJNiTuaZ117je0INah3lzKTQi00l9swjk=,tag:oIustwuQ2Kf69a50kO/zRg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:Ph0wpxpd3FVK+EP6SD4EsB7DZMOaALwG99DD2gNw3PjbmaU17IGNOnhVNLjxKYcZwwK2ZdqWE6+d8RP5YmQ6rRV2i3yMV11qSJYNHmuu8VFgDu8mHI16PA==,iv:vFktZO+hAklQeDGc4SB9JWK+4PXCCD5BgD75mXDkBWo=,tag:fRXygA38okT+MNP/Er79Yw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:wW2T7Mjr5pZEd9y3Yxom,iv:A3BBKZq2n48/8BoFEyN4N7mDjmQvuGmKr2FKfUP5KnA=,tag:fIXf6rrlKt7oj1aacJfDgg==,type:str]",
"mode": "ENC[AES256_GCM,data:wVNrfHTTiw==,iv:cKhLHPp97YvY8AQw062tuLkPVhHLdvWzcV9uWOyZSTs=,tag:Hl/Ei0PTuEErV93tQHPoWg==,type:str]",
"type": "ENC[AES256_GCM,data:VUZsu5KX+EXZP5b+DEbjRQGsWQXMADR5dIGzi1170m8d4A==,iv:a2lEzikFHEiY10sDSUv1OnOt4xiEaDWfEDMd9jndPk0=,tag:clP4Q3rPFyTkevbLHaoS5g==,type:str]",
"name": "ENC[AES256_GCM,data:tvtclQ==,iv:aa/o6HBeE413df+9LUeKe5oYMUd1AVaRLTghcMPz+eg=,tag:cy4pwnMchgv8hZNA1Yq/kQ==,type:str]",
"provider": "ENC[AES256_GCM,data:9B+drwBcBNOUE6SZLeQUUl2uze1khdivlCC0K4GFyN0ILdBWvvk9OMYbzzjwoOtAjHLF0zCP,iv:tng1hHXhAutmuYXdljmmKGZ3eFjvvMZQt9MfirNdzCg=,tag:9GqSV16zujtWU/K+udzjQw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:pg==,iv:oUpuylOhhJ3kGiV93dGdCTQvHhleFh7yLExTZo1tw30=,tag:BaPtCMwn6b59nIa7jxdIjA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:W19FD4HOqPGHpmpM8WsqU7rgQBiXNJ1eg4mKgA537tY=,iv:GgzqqpVKP/slqnQ9Oeu8OuvidNkGqVdrtm1EgG2XTF4=,tag:aHX/HXGx/Y7CWlf4g8tQ4Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:mg==,iv:E91WmA1roWZ0CYxGQAlkS+jip9xB8Syj0TsXFg5fts4=,tag:dWjJkdH7/J2U5CvJrsC4gQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:1naKA27LzrLA6IBTDVdjd3/6,iv:AvB14VY6uXK9lWB2lqZITnrfnDtOAYrMPTgPagvbZYY=,tag:w2b2H0Mp5I+kZEHFtHORVQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:VSoUXVykuRdmcaYxzw==,iv:DryZiZBUz3cp0KA+7NspdggNgdKh6zQ7McHVCNwxMvM=,tag:6WR9zNd+4dvw2zcAqV7yiQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:atTlOWzIpSAA,iv:rybYbmP6BCYz/Lggg94oRqUcohh+TZ/dxZPjzxjj5BM=,tag:TQuUGcnlNvv/HxdnJ53jPg==,type:str]",
"uid": "ENC[AES256_GCM,data:GO/I29UAutGyHffEBugjLPNw2KHmN7E4eQYfOj6qTQp0AGTC,iv:K3C/+3+vJQRYDwpy0ozZMF5Ddv2JHgcP+Xa99LsjiHc=,tag:DFKeD0p7Yu4ajvuaMnpteQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"access_modes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:KlsPvFb1uFsPoOzPdw==,iv:/sNTQOmMgDU8acMA6HP7lZXYA21Lhb7EqiAHeY5NZcg=,tag:zUAVs9+DiArsVTkKGoEMBg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"resources": [
{
"limits": {},
"requests": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage": "ENC[AES256_GCM,data:auLk6g==,iv:i+b0uaNS7j/bBuSqAvqXTdEvMpd7hnsWf5SiekkcXmc=,tag:e10Gz3OJoZOZ3Fd2UPaV0Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"selector": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage_class_name": "ENC[AES256_GCM,data:x2L8B79e/uLEWoY=,iv:sdQ86TfnYXv8Ea+HbqVYtOKc1NKn1GWMwbDABeSmsGs=,tag:IKBQ4CWl3xGAoh9m6hGB7A==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:pDQMqqvBbdEqTA==,iv:hJNCThAuN63p7ZBlMHZ3aSTZE1N+VCu3PrDzodHMYMI=,tag:Qg34Ev3DlxGyskPgJZINRg==,type:str]",
"volume_name": "ENC[AES256_GCM,data:Xm8PrKMaF27tXAm8u8ZzAjeh,iv:OmwRGshdmrmmKH2l8B1vZUoJf/Q0ml5kCgOyz4yuP5A=,tag:EnCa2Rw7PBB3LnD2Vlv8Gw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_until_bound": "ENC[AES256_GCM,data:xBzzlg==,iv:Iuyd87mcInEf1ZtJg9xPG1Jjo6sqvibleUhCfiNT8Rk=,tag:WXp6b7WXpO1zCVgVCqoXMA==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:Qx6ELOULACgBr5dsVj/i2+2QHccfCAn7rEyfXW8SCGXfNoJTrw3hFBQp62k4awlPhHhSfXv5XMXJMSruFtcLK7QIDZI624svk3idJzSl0UVTpOGwmfR5aQ==,iv:BM7Dg6rgl23QZv+4nyZaTxLnjQNFI45bLijuUxL2fFE=,tag:EGquOenj2XNDgCeKFOFs/A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:KxHm9OWUQHJHCD5b+EK1XKI7k2zA9dCoz8UeKEdbyao3kA==,iv:17FywNCmzqsyuY9udfjASBZ/nDiC0LPV4zUeYTEZi6k=,tag:hA3OyN0KnT3daopXF2+jpA==,type:str]",
"ENC[AES256_GCM,data:i7+NFY7Io6edUOcAZpieLN31Hhh62eHr3Cx8zB0y4BUfw2YwZmw67NViNuj1jc+rJA==,iv:48VuixJ7bnqCxDwHn9SZOYGxdm8uKt8lTAUPedZu00s=,tag:IoBBX6TuYyi09OEzRuWduw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:A8iyQ/ngytCTmRQYg0oMIMw=,iv:ynwTsYusC+BtFnsbQICkplJ8v6X0xOIj09u18yanCfU=,tag:0Uen7Btjj9BCu+BLjKhIpA==,type:str]",
"mode": "ENC[AES256_GCM,data:uEdZjVRZSA==,iv:Bj0F5MAuHHFYk2zywwJzmC1zq9mZ61zEInuM8ZSs8cI=,tag:TkrB74nFxPofU7+kHaaq5g==,type:str]",
"type": "ENC[AES256_GCM,data:xFOhp0uhRLO877byLaP0Rqs=,iv:yjqfRe2h3fp8M42rQf1s3sxdv+36er+KbVxlb8bo8kg=,tag:xe7umdP5xm0znA9P97Y8Mg==,type:str]",
"name": "ENC[AES256_GCM,data:IE18XZfteMt+7A==,iv:WJsenIqNUhX52URDrDyJH23HLPtlEZl5nlVE42vIUmA=,tag:V+cLzeokxEChBRLbfseJfg==,type:str]",
"provider": "ENC[AES256_GCM,data:1aYY2v2WH1mhUy1oIDaEIrAeBNRTgxbudEXoV2QqSj4MlaX0v2cnU4dLVUyoOBSRuGhJZJMG,iv:dWY569l8oiqQoe1bEu2DPlw0a1rl9iw+v16SBijZLXg=,tag:QF8amp9czkkhCQBzKpBF3A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:Aw==,iv:z8Se19ofV6Y4hU+8NFXhNz+SN54T3VYTQEcXecETZx4=,tag:BSCEMMwzysghdPQkKiVmrA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"tls.crt": "ENC[AES256_GCM,data:NfqnuHKX1PySBUVIA6RoZMy9loCAchVYOBE3WyEn4DwvUJdpYtSCrIDmaN8hjONaMGs/LFB/Zo9PW/EvW7wsbmScx/e3/askaQiQxAt09f4+ma7a2i2Nt88oOHHmLYj7MVmFj9l3EsLdP+9P6w4hUU0zdJTvjyGP+FQrfb3UG9CEdxHG3kgMl+GA2ehqXOAmDCGhxead/4pdxCEELUEH3hioVQi68tCsX2Eeuyg7MKcY4DJwO3AUn9zwUhhBk/0s+cKov16uzycCmyudr/6jag1LJ8Lx3rPFfsUEMlB0QfKZd+XbaRJfl0JbMF1BQiQUYPqyILiVK9lMOp3kT80KWCzJD4yzcXOnxvYlbz2s0dJzrkA5UGqFMe+V7xjd+oWUJIEcMwMN9lI9XD7yYMHKkJK7vmz6ymXBpXjMnnhtHWJQUOCDNxPgPIasiEq5v8jObt/UNOU2CQO7FcVCmYLMj4xx8uWyBJt6pGsr1NXoPx91T+9W7Ltn+k25rWVJWzX3clf83DoRNXRhTIhgBR2TOLEHCHN2wWaFuntzk+s4oRi7hhmGhbqD7qrKkgfNxQtoVvWTqO64SspMmGCdtaHTtOggkV3qk1CNgw5n8URfLs0tGtNM7UWVkV3phhqRyCw/66c9TLESm6lCUY7yvVPJ70jRyLsP7JeTU5XSKShPaQy9bQPg316lpn4HlgLrpXuxUk4oUiPmfp/iEeEihxoH/Xu4Tpiuxl9hHzQP34eW7Znq7mqxUCjYJng6rAiPQNY90qIRQ/6iRJrsZm2PTvh0zpN4J7ws/n/t1EjJ0v1P6kM//u3x37gz0cTD9klWv1TvwkmdYChPEz53qSnOsQO6vOsuVwJrjyFRSaygKsXEGf2Q/Xlg/rnNbfWjBZ50YLJKWfUAww3A2w7EP9aO5Xu/JMdpt7GQ8TAW07nQI2YdaO8pxR+CIFQlqL8Dy1UPUlsWW36B5KiwXYy6/FEH4iA/C07xKoBmD7m9wDwuuzNC4NbgjwuvmsGzlsE85Hof8NJXJ+xgvbDbxtTXS2jRiGZEw1q2o1W4BkZ9qVG4oJr+s+7QflF4L1WXT3i5p2v6+SSri7fDNGG2hN2cqM4hjWCfxmFvq56WnWRRqFJ1OPTGsFszG5u4skcXyYXI+UkpIvT/K/0xjz1S535EBJEJvofmVg1AbdU/Xa2gaCW7OBaizAqeL2J6hdZpGVDTRuVH4s7VP0GqqYYQVYndNiwfR9xwsNPPt+3RebDG4NrxEIbV1zKsnVnEpxIMSl3gr0eq28Z6CYgsIAovrhhF2QQHl/1l1EsTsuO8bCPt3t5v2eJZF3SA/IR3Yxg0JdnN8DklYGSQmco2XrTwqyue5bcjTpBa5M88n5peoOJGEl9Jbxj1b0grqM9rEAAU1Yg5W+L5Cr2Y2frGz60sh343xEK9Wt3ZcOhh/skevQMKxNtRuZcy1JJhVH7/Pp61tCGm7nIXCvOIdhNHeR9eRAU03a0ovOOZwqaoTx2+lhvekQNwJB3ui6bFMOfLEOuwgqJfNDeyEUTNnFmX+ySfRUDVRKrrQ39OaILO13v0ZHQ8J8gF3zch7QhsxhBhKnmmp0cQaYEAL45eLfBhs5J2cxLrj9XjpsiZ+kCTD3+wFtDzEEc8kmPmqpGwruFD5d79yUSwzcDG3b3N0HfeLt8HoL/BWEb8vw0n+jxx6tPxYLNhbp6EBhBtE71rpMiCyhwh6j+udlEF8MjZJCPXVWT+Cf6NPlmb1t6ff5KJrh8rfGlKNj1JdoSc6RBQAAnc0i5aZhgCeRAjHvY/dSwcPTVBDYAh+6n66m8x1qEP2QW5P/hw/gm3nQc3OvSfqKR7WC/TCogYWSYcWROEDSD3Hr2MD5zrgqrGuS0npRdM7E3B5xLyb9jn7aj/Ij38dPu2L0njjQC01X7kVN3q5R+rzVz7TSIyv8kA8qQQ1lf2Dj6sL1WhJ7YhU3+WO1OJQ7sXK6Ssw8JP9yrq1Bvo1+P/I1HGZ31CUUS1HB4jiByaDPkR93nKwGnit+hY5kcyUznxsWENptGn+BI9tdmC/3x+5tcxwHuKV9/liZJqUcMwskfNBI2y7dgoqZVw7S4luX2ey01xUVedsKCdmIyVrcd4GcWfxUD75SI8HgS7G6rQw6nKIaflMkizXaqzZWsPA14NnYe+op/KhPDlG7QrMqrVU+f/d6pjExW4mogMdSnavQPKxOKheDasvtUTAvJ6NwFRH48BScXkHAK2FTMi1bRUQqk+AeYIJJ1vkRsd+PJo9lY9dupCfETZGcF36ORvQW0FLZ+HzKTNb+440norzxUD6OlF0bb6CogXIAMCxtrSORUcd8xqIOhs28URvJz+d/a1JWnidggM0PqEk15ePGCxE1G7OiV3xJrsPvPIDlggUa+LKtPrS/0UuqJIkgSkbdRcpGwYCJbT9WAD2Joijwt9jdVq804htOZFxinB/FhSRpXtswQY+FPgVQUfiqCzl/sno0WxhZWogeHFQsV/sGva0rR7fbLHzcJMkuZE+u+mPgi/AVTuJ3NYgWjYq/G4ddynStfHpXP+MsEfWJC6f3FEkvPL32XCa7uKLSYbiKZ4DNJW1zNJW49n5st2Xefq3DRbwgTv5SM+iOZo24Vbf+hyBXw0p/2Vp8xzlxbLntpqP0dYJWl8lsRJgX0BtTmIjBxKrkOBqUdWG02PXQFj6BjGiitoYDTqrSMCEP1MOZgj4zBZ4tifQ4PgbgdWVxGY+QfsGId4X8UCiXKQjXYmGoHkhuPPS93RpnrAZmPowmazjwkmwOiH+CGbn5wQuvF1ueqZ6126tZ7CEWKpod0R0w+Y9mGd0fhMG8W7sKg4Rx9Au0v7gEL6kzCOCfUX6BdDaBc9o0nFt8G/ral78Sncjvtg0G01CBYScJEgSsbJoxO9XyPLw3lhGLHR7+/W9xZJBCI2te8Jltc03sBlI2Umog/1XwcvXkFhxiN/Bc6HZw1Q3ylzRoGBnCt9168OlJ7hUkWeMxXN7DeRbtbDQTOYeQf/DUkQBBdCK+6oG/wuwSWnDKfMLaA6Vgk3IYK+Zm5WB6G8LHkp3j4ABBUwMcief+9v/T9+iNOVgLPAsrPVtiosTnECROfmZ5DOHnFalTcg3kRv6T16UqdTOrouhkKyo8EfRemgHZTvD2rvSzCEI4gCl64yVwCrtaBQ4QYVTOgCm6dGJsu1iSlR6tbpnr2cEiDwHo8wXi+5EKPCip1WkdnhuFlFx2MI50bbbK6Bfzsh77MiRvY4S0YlT1DcC/WmfV2K5Pb1k/mzGbZb7kw4Fm7xdxwBZTziWFH/9ih4aoYYLpdSdcT2ZMU10XzUdfg77F4EuwBHbKDFQs+0xf5Q3TDEo7eZAkPe99sBGGZr3eIRqul0PJHT6IYCpz6f2EvkKzeY+497b2ocf5XrFEI1qENCyT/hwPh41FN5kfyqq8Q/i17HiBMO6lWDwPjpnyJDoT+eCfsYCn4fKR8FEBVNsTS3s3enSQx16QOyIil6IYdvbbwfyI803tiAHPrWfvcqITvEA43ZwSgEsksfWEI1wq5Rq//+mFnKHJnGbeFd897bcylWvTf9367rbu1fITY3rtGVMg6bkFHtsJkNj4AX3LindwOSLTuiSL6tqQ+Pq7TqlnxdQohYAwKqvZjd2CYdvSY0czXweWql2/Xd5SiOg0q3lVTeb2DmHuPohOVAXFYWnlA3Wu6pAptCKr1Gg03yAknV0ZPpCum8LodE5S8nEGmsx8/A5/U9dS/Eu8At/LsTfIwRlt2V/iHTyyTz8hOKAOu8fCN8L1G06uqhLS00jWYkm5YuJJQppuwEE1PJo7H9AlKo,iv:/dX1QhY6awjsu4qrW+gDqmcMgw0gPhrqWnd1Kt/OOdg=,tag:CRgGafpfSxzNPBxDBGm/Vw==,type:str]",
"tls.key": "ENC[AES256_GCM,data:XsTV0xAHTZkztlCOhqFDmHXouwwkdZCVIUsrbqL/3aqYueddDeiqrDDhNBR0GRB5IoxAsh1jnhSkP8TiL8EWD0zMSy8QdK3GYAbjYaD7boQzWhU2Y0QF+jhRYNcaGpA2gbYCnINIoUruUdvgLXTMB+CUSUq+Cm9JBPkre7NeE8tn3TFxlxn1MsNtGxz4yzggg9NJ7Bw5937IS1RRV2V6ChPE+kz8Gb3B50qkJX0pxMoMRPVYbCEZZBt57fBIMfIf8q8n7TndyS4LcjqNVtkGfnzz9/JUDF+RuH43ZRCjo2aGnlDu+lgV+qtvM71t+GLBhQ==,iv:GD0nS2sPGUekmYA+ScIRi3W+9KkmstULWy7TQBjlP48=,tag:r7+OKRAZdXzGSTKpRNesbA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:Wzj1StJifpSXDIQcPo16cf16xEzsPrfJ,iv:DGxYPfNqvmQHjItMZ6Bfz/Owaoba43bG34MxR+5FFsg=,tag:TJ9FQVaFsLX3X/bepjbPYg==,type:str]",
"immutable": "ENC[AES256_GCM,data:J+wHEsc=,iv:fJO6jr4aawOuXSB++SMoxFIvAw0zhc+wP5NlUxsU568=,tag:WuRgLxBJPCcenH83vr994A==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:sA==,iv:Ekx2v4PBt2susBhQkn9mdhGvmf5/F00yPmNI257zxeI=,tag:IG33jT71iIYCIk+4Gm2BhQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:9pHKfb5I984iMg==,iv:lWckk04GRkjZTVfyka0AizyNOPXnn5jfHUcw6tSmETE=,tag:Xy1zcy3qKIGmzwvyn7PYDA==,type:str]",
"namespace": "ENC[AES256_GCM,data:VfGGvTfsUlw61dLnrw==,iv:iglrcr8+65xFtC8rM8OCfkj2VV4uD+aDe8vGeZrXvW4=,tag:OZiLe7Jd66abKB9NomWq1g==,type:str]",
"resource_version": "ENC[AES256_GCM,data:eKuPGB3vbXEA,iv:+4fs5bNUIg+ug723BG2ZyYJe2sRP4Q2jYBhbK+M9pB0=,tag:x6OSLGc1DL3XDW4t/+fEug==,type:str]",
"uid": "ENC[AES256_GCM,data:mcxEJJqq7YxBD+KCYuQUXrN05pDrJOI5s3KBXcnDp5KDeBqR,iv:O/eDTkVVzanBe0YpLXhwE/D7SzpizWW3SRDzgCGT3XI=,tag:WDKlR5lNu6DVBt+XwNR7VA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:vF4f2zwRl1l6dKaqv/eD4mY=,iv:MyEpTLqx2eWwlzN3E30urN0OvRp8WTCpc4iCVp44FGQ=,tag:6tsujmdkR7njEpptaxyYjQ==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:V6qEsg==,iv:uJ5rPbMuxmhMzRoEbCPpqZ000nZQcDpXPiYNp4Suz58=,tag:rJsHeiKEcvN8NjLxCb53Xw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:IfZpdF0+C3Y=,iv:DH0y+FuT12k22iYeo6FsdY//3LhcpdY48ceNW4/QKg0=,tag:tV180k/IrMNe797w82+nIQ==,type:str]",
"value": "ENC[AES256_GCM,data:x/+KX/4UTkk=,iv:bDlbQpdtr32Z7AyWE91f9f1kh5S71rth1NAmDzbXSsg=,tag:x+XRRrcfq5NO5jGuohIDwg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:lr6RoTU=,iv:TZ/VczyMhRR8/O9vGWfhGCX/fFuF3+t5iYYtWDTn+Nk=,tag:PjYSXyz9MGq8hs2GuPMIww==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:2Q==,iv:ShLRoJLOQpUobwmbanrbNmA7KRIsBBvrQKWGErYQVAA=,tag:XiVGNqnYJfkGMzXkSV3RVg==,type:float]",
"type": "ENC[AES256_GCM,data:cGU25PaO,iv:QLNTmBued0x/RPWB5dNwkNx22i/SIds4ahWE539sBvY=,tag:qL4CvQsV1BcuYghQ33obUw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:sTB9DTWK888=,iv:48ezRCOPOkEoSK3UmVk6pxQMoO1SSLRDAXnn3WeZxH0=,tag:Ws4Z/U83Ufl+YCaCnlHHCQ==,type:str]",
"value": "ENC[AES256_GCM,data:gkVEEg==,iv:xExww4DEVOSl8WL+/bZ4ogIWtIX32KOTbpx//vugGNk=,tag:UWNm0iq+2j2V6vFxr5nl5Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:vDl2tIOmmHEizNC9ssfWVqvWAEKLHOgTIGHWeJEIIVHycGsKLFcpqcubN+fOOocNRHOoADj90f3efZNylxgvVrP86wtiUIXKX0ZrAerLyNEcnCqP,iv:V7cp+cMJMUlXumTd0gFbZPdGPWM9HEnDAeR0dMgiOZU=,tag:b9eENWd4UoeiPnlX5J9K2g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:srqWKG1q1kXeCDtr1+vxtGUcZOthD/APjlCrD5twt3A6fA==,iv:2muZSdjPyoLwGEMa66hJyPH9JC41z2YfjfYx3/ShhQQ=,tag:3QWmXtRqVNxgCpLWTtmSog==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
"key_name": "sops-state",
"created_at": "2026-03-17T22:55:17Z",
"enc": "vault:v1:UIJ2B+HHd4gNKtSCuJKWFFX0/i6+AuGJbgZoZs6QHF74qbmC1CUa9AD4f/F1Uxj4desy/dMaxKxIGNz+"
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ZFNTTUxTbTQzbGY3RW9W\ndzUxQnFRQXF5Y2JWV01xUWh5aGNFclZ3V1hnCjRWdEs1T2ZSd0lJZVZFcDZ6UXRE\nQkhpSDc3SVFmQ1lIRmV4Z1BOK3NMQTQKLS0tIHhpVFpIMkw5cG40V2Z6cENCTGFj\nckdOOVpPMzRDWnp0YkdQNGRtZ0FwaTgK/vwO9KiZKZgv+M4Y6Te2harIeaoHG4q/\nJ6grM1IBiP+/8KyCWDWwFuofHzw0KU2uHhoOFx3VknQOKr5QtUCgXw==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFMG9KaGpPZjl0L2ZjUGpM\nOHRmbVphYXRyWW9FLzBiUUhWWEhjSEk4cVVFCjh1RDl6Z2VSelBjazg3VHVlUWt3\nWVpUMThtWE5iNVBEVWYzaXdGMkFCMUkKLS0tIDliL0JwRjQvdmVLSUtvZ2FKU3Fh\nQ2JFQnNVaEVaTGJ1cVhWU202UWRRamMK4Ss3Py02u/zOSUzmd29XI7bnHJIPTxSR\nSk+314vXO8/Wqn3zn2ahWZL3OgLcg0z1dS1zQWV2uIrTxDeqSwnG9w==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"lastmodified": "2026-03-17T22:55:17Z",
"mac": "ENC[AES256_GCM,data:PlpmlFo5War2xsihyXb/+sLYAOhWp7OqtVr+knp+9648h/F0waZqiYgPx97CqBE5rRX8HxDeW4HOfG5Olcu67K4GPtBBNPGZpz/GR5g7f+S+0kVxfrASO2r5TzUVAXpnRoIX95AEFv2f5Z+xYVsTuIjXOrNcsf69bbyIcLG/E/0=,iv:XmhR7SfBZsUldnr+/onr732ZNluQjdC+/RoJy3qhp4w=,tag:XGgI1bmA+ZxwsASdwPkdZw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink