viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
infra/state/stacks/stirling-pdf/terraform.tfstate.enc

1700 lines
111 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"version": "ENC[AES256_GCM,data:Eg==,iv:TONGWsyIV/b5mI1lFsXCDm1N4EOmeuWduzRKt3etMeU=,tag:m9CQfvCMHTxvQPqjnRl1cg==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:7F91nxU=,iv:k57qxpPFCD6kEH9vgqZGGnPurK/JBpWGhCkwlWT5Qh0=,tag:n5sZOPEtZ83NGRSYMeBZaA==,type:str]",
"serial": "ENC[AES256_GCM,data:Sj4=,iv:bOJGiK605ZWE/kqESRDdKp4ewuBSNe+wgPOxGAl1Jr8=,tag:5G1/FA6/Y2V2u2PDBKjqrg==,type:float]",
"lineage": "ENC[AES256_GCM,data:NLDPlQTM+MRMbtFuhQeevE65pHKqUs9PV1LWCZf3wH/orVLI,iv:fTVvYm1xjsk7CalRSyfjNzzfX9vVqNjJ43J8QDA+bPk=,tag:iFRjiSpWgUEak1FNIXnM0A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:34dYhvOlKw==,iv:aGa4nOuQr/mIU7QGolZcfaAsiUFaiJlJM07LJPSwrY4=,tag:BLIi+gwmjEaBr04frmVAKQ==,type:str]",
"type": "ENC[AES256_GCM,data:do03ZrDMSZOlIkcukI6OZPqtnK9I,iv:Mr79zz+pRwN0BZ7RGLZIs74U+xgOXYFOGEWsEUlLmXQ=,tag:KtWe5uy9gu+Kdzs+IBbQvg==,type:str]",
"name": "ENC[AES256_GCM,data:XAFBzjJJ+j+8ahod,iv:xAOo6CCPmI9EgW49R1KNOOnNnHnzZh8wIxVJ6K1fm8M=,tag:xso7UhFfhh9ubxxq5Pw6gw==,type:str]",
"provider": "ENC[AES256_GCM,data:gHbj8/jVvj5K4J5UR7eDpBOTxt48XwTvshK5PNkvgiweNwHII76rOUYo2ZJ+j3MVTFNMeOZu,iv:D+cIxi1ODt5iqi9KmlRLOaRcJHdh1ATdQ55Fp5HGBzc=,tag:5wURCAB0YrV4Cf2bKLo9Vg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:/g==,iv:+0RCq/5p+7Q5Ynh1NpPkP2c92k6cSE5D/lDPSrSu45c=,tag:q8WtQTduU7ulFCbywxDjKw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:Pv+tAJXkDUQsG+RQzxT4DJY24KRD+5+Tqw==,iv:8VI0AxiEYp8kZ6qmmTY1JhmnrDpQQeG60yH+QvSs5yQ=,tag:HhnEuNMthqbZIZqqDe/6GA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:Rbk=,iv:aWxufWH22pAMlNbssYbxTeDBVk2cnX4r6Flz+5tJYkg=,tag:nKFF4RDib2vpNhcCrUlUnw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:JOmovp0F80VOnzXz,iv:YRL7mDXBrn+1Y7nljiWeFUAlZJ/YY2QqLr2k6e1TTeE=,tag:iimxHNxaClce+yaHguymZw==,type:str]",
"tier": "ENC[AES256_GCM,data:6Jsimfk=,iv:WgZ3Qodug/cv9HM6uRrXnnAohZL+46BPsvK9mbq7osU=,tag:94oZFJrk5vrl+SXgj4iNeQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:j89HjZuesinRjUWq,iv:YspfUYV9PuNx6s8ZQZc5I9Bnd58BOGVs7sdkcOaVG3Q=,tag:XsCQo4TDZhQJbBMFd6yv0g==,type:str]",
"namespace": "ENC[AES256_GCM,data:yW+dCkjYgjZsDxYD,iv:TozP8rJxzEvFqHIQZNb6XVHvIkBibgyffvjVDKtu9AA=,tag:jX7H6wKYol/UECfdQDwpLQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:2oNQC5l4DdrW,iv:mLxJqRN1bY+16JRV9YvUSmZzgExs56TIn0HsmLOq+Yo=,tag:V5epPq3UeYQa6WZBF3cjwQ==,type:str]",
"uid": "ENC[AES256_GCM,data:QZug2Gzeakii42d8gUkRJBFwrKvLWI5kLSm31t26FCmsy0B4,iv:NikRGGtM6OBiX3ljhNAPI5flDl5U8Yo6xp4GnoSkwpA=,tag:33gcSlA5cj3BicA6htUCpA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"min_ready_seconds": "ENC[AES256_GCM,data:aw==,iv:35SnCW8wMOe8Ov2uTYyZxySub3Y1ypLKyj00rM9b8qg=,tag:08kcrIak9hl/LlsSBJ8+qw==,type:float]",
"paused": "ENC[AES256_GCM,data:kgzaluw=,iv:9C5REYLo1rm9FRCGrjbW4xxdWwU7SfYZlfNOZIi/DV4=,tag:w0Sa0LIyf2mWRiBj9BHz7g==,type:bool]",
"progress_deadline_seconds": "ENC[AES256_GCM,data:iPQr,iv:pRs/K7NIjkpnIgKYcpqFvztPRa+MoR3KAoGGI2StSeo=,tag:Cf2n1m0P5eO5IfxMquvN8w==,type:float]",
"replicas": "ENC[AES256_GCM,data:rQ==,iv:HebVL2iVTmHx1173E6FvVCgRJ4+Rv87Ynnb7PQzRWo0=,tag:ff9k2pdqJHYmj9miWZKz8Q==,type:str]",
"revision_history_limit": "ENC[AES256_GCM,data:dOY=,iv:0fKyg4OBCdgTvMdxpDAz0U9BKi243FsevMkeOftkveI=,tag:+ecl+b2s3U8qE0d+rK22Vw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": [
{
"match_expressions": [],
"match_labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:6ybbh5JxyOTnL1Ok,iv:J3FbEhmR2Abcet8p7DhhSvCd6SBjIFtgXD3rGENVlhA=,tag:gmHlGqN3qacDE2hAMtrzOQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"strategy": [
{
"rolling_update": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:N5LOXljevBA=,iv:8ilg3x4QlJhD47ug26ui5Qvb9gYwgQLOc4tCNREOlDI=,tag:onENIHhyAFz8cBXYA+SMJQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"template": [
{
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:QA==,iv:YkT/2jsrEmYPlVlFSb5jx5X5rKqLGDJWY3dYx98Rqhg=,tag:hTxNXF4bstY8DRM1C7Etiw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:tpbPpu4CyQp9DV8P,iv:oKCmCYJvs/Q7J5ZBRPlpV6PyG1iaUlDMn2Q63e166lc=,tag:Pb/UCcENzfH8aq7rIexR5A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"name": "",
"namespace": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:2g==,iv:J3Ijf+/xlH8acC/ka2V4/xcXYUWd/oe8QBpXSHEk+IQ=,tag:09KXubU+Dr56WHu+aTBw7w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"affinity": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:uHZUrw==,iv:xRK3pOy/NEPPjRUyspru0AzoSgPWOTyJvVTQtx8Pq+4=,tag:yUFxc8+ccFRt14GL4GpN3A==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"container": [
{
"args": [],
"command": [],
"env": [],
"env_from": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"image": "ENC[AES256_GCM,data:BqAhbhsR1eyLbIPAcxmWwFZIDmkNveBU9u38+NLFS7oN,iv:7n9FHZIuwXKvBkU0G9IkdaZpkr1sCPE08QzF0XB9BCI=,tag:vxAKWokhjCYelYMgMHTH3Q==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:ZX1ECT01,iv:avkuTsVIKX1ad69PTrwGsvNg7i6YuKfkchrHErHK68w=,tag:3fgmwkDzn9QRPgur9m2V9A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"lifecycle": [],
"liveness_probe": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:SK2n8jpClvXBSI0G,iv:xlxtjBKBuMt3qY9eyduKeFBrHV3pFgEnFlV/TaCZvBc=,tag:CiL+SPjgS2NrCTESubBktg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"container_port": "ENC[AES256_GCM,data:LNQ0yA==,iv:2DJ5O5Q6aOFIARNfxkPGH/SbYK0UfMowkRHVaCVCAkw=,tag:KOin1jSJZV2L50+iSs3qhA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"host_port": "ENC[AES256_GCM,data:Sw==,iv:hTiZhhYeZ5aR51eX95OzEdFAu+zqEsDn3YzLXOtR160=,tag:Td/kpKZ0ddBQTNf5T7ahXg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"protocol": "ENC[AES256_GCM,data:qgo6,iv:0D3qm5kPFSWR5oiMK5Cj8RV/oZJ9DRtmcJFpmTSC8oE=,tag:Chj0gSzgH50vtpJtkorqtg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"readiness_probe": [],
"resources": [
{
"limits": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"memory": "ENC[AES256_GCM,data:1VCPzVSK,iv:9GSbnzAh/B37g8+wIRy9vFgySmISUCVt6c8LYLZv084=,tag:FNfLWgXLHg5MBj2BuUAkow==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"requests": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"cpu": "ENC[AES256_GCM,data:R0Po,iv:XbFRZ7KwvmqyUSqOvJ8WE0/u8cRBtWLgBNQbbwWlF3c=,tag:RYaPEqP0jjToMDQ8pR4ayg==,type:str]",
"memory": "ENC[AES256_GCM,data:zfSRUtxN,iv:N7XIxMQVMFhwIHkw90eyWhFyUp80lL04/ILgGU4ybbQ=,tag:i9jHzxeQJvcacKisNERn/g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"stdin": "ENC[AES256_GCM,data:61Iy+sA=,iv:SdjGY82uyeObtwMBcErjS5t4FV5ZJBKgfp+QDD8cpR4=,tag:i5As3x8vLEaIdyUOVAx69A==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:mioS6MM=,iv:hlj8senpyxqVL0AySqVQnhV6nvGl794Bf7ZOEFXfSe8=,tag:SX7LzX0jisFGY7fm9uc5zA==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:TJEcUBYsx+FcqZNS8cu+PXovUgE=,iv:TtjwCun/ivud6IDAqUuWPftaulyOhbBgsPUXDOqi43M=,tag:xhmTn0kVgBvqPCNU5dhhxg==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:w3ZPeQ==,iv:A1/kMjmh38g7/TiG2vUh2h/DnPskqp9+hX0HzZj9518=,tag:tsIOwU0Czn4fwfBkI0NiYw==,type:str]",
"tty": "ENC[AES256_GCM,data:QMB3Tx4=,iv:igQ4u9fvuWHjT8+ywJFaG3hVosEPChUaT+SnxwwH49s=,tag:ct6YTW5sFutPrCDvHUTJsw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mount_path": "ENC[AES256_GCM,data:xo64nc3VjKQ=,iv:+EpL7RtdeZlaD40SldOQiKLRnAlhKReXMM9oDQLeg7Y=,tag:DeA7X0HchK/uv3LreW2yCQ==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:N6WLMQ==,iv:IaTm36QRHWGIeqJCgkq48uhbFp6R0eYpBjOIWlO82ok=,tag:O4MyOXvKSHJJH6XJk0nD4w==,type:str]",
"name": "ENC[AES256_GCM,data:/dJIiNXFQw==,iv:vTuogv33kuRTv201M+mtHJAULYAbzuSAjL9Y44yfUck=,tag:8qTq+idKl9BaZUn1BHnTWw==,type:str]",
"read_only": "ENC[AES256_GCM,data:LRhj5P8=,iv:H3NeoG/D9nli2kTLHhQGK6TM3Il3THvAIwmtv9ANiQg=,tag:uXwNS5hdYvbZ5s1fFwiZSg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path": "",
"sub_path_expr": ""
}
],
"working_dir": ""
}
],
"dns_config": [
{
"nameservers": [],
"option": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:sAD7+xM=,iv:POWwQK3OW1DeADh4am07WGqh31dg3b+SplhB3NvqlF8=,tag:UPZMh73ES9bbiZf7ts+XLg==,type:str]",
"value": "ENC[AES256_GCM,data:dA==,iv:hQY378zgmPF43MRb4ucsYAsvDEO7b+mSHDV1SUU42kA=,tag:FcQ3mMgxpAKDtrSXR28e4Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"searches": []
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"dns_policy": "ENC[AES256_GCM,data:DqGrx0LTg++DZOY5,iv:Yuz6G+SGyDXTyTDm9bjnNEgjq3AavP2i3aTpplVX0vM=,tag:idaAzKZCK1LBpNehf4lMqA==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:SCJbvQ==,iv:Q/YzWH/aKpp9AAQ2EARnmAyuckFnR1wuxW4GZzo8uCY=,tag:wllEFj2wq/ukJ0tuM2X+vA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_aliases": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"host_ipc": "ENC[AES256_GCM,data:o7mMZtQ=,iv:wsNHe8MaIFh3T0rm0P1a3La8MdhXy0/JdAJzp7h8Kes=,tag:J1n+wgx0NwtqOnvHGGOZCg==,type:bool]",
"host_network": "ENC[AES256_GCM,data:g3RPU9s=,iv:Ml5Ugf5k7ZvzhGgtfL1bS4SyTDRmoiFQx+lDYlIw+Bw=,tag:604PX6yklESiDQAnI5kVEg==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:9s2zogw=,iv:vtH71vzqVVpBSxDzQg/JRaZLN6vKBUNBExwf5dvJ7dE=,tag:tiT0NBWF3xRqbOPqbp7xyQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": {},
"os": [],
"priority_class_name": "",
"readiness_gate": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"restart_policy": "ENC[AES256_GCM,data:3aNCMGrW,iv:u/Sr1xgqdMe/wmI1C7UlmUpQq+aK+MwB38QZnpRrGt8=,tag:PpgQDUTBsuMyztXZGnIYLg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"runtime_class_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"scheduler_name": "ENC[AES256_GCM,data:iCn0zAcw7ae0aYzVk4H1Dwk=,iv:DTF1yjSklAWzkAU/g9MBiSFtSToN5M9oMJenFzgOY8Q=,tag:97YbNDgcegge1TrlVRhq5w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"security_context": [],
"service_account_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:2+rzA+U=,iv:TwbEWQ5UmEiwn8JcWa/ptT+IgJyL8H3IrPH9mYqqey8=,tag:nKmZbTmzps2Y5Y5miTXAig==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subdomain": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:PI4=,iv:hHVyDd5cULcg+yQb5O80A6YIfzZz2H7QY2agkEEaVL8=,tag:PdWGwtdwlFOrZIvypJeW9A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:Mo3FsP8inQ==,iv:4cvvJe6rMX1o27pZIwK4IkV7nxOlfw014eUHGAY9WQg=,tag:ZGQjcj/LPu79AUdMkTmojw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"claim_name": "ENC[AES256_GCM,data:K8sl/VYrzlg7YL7YTtOKgBMrvFU=,iv:3gpkPtbFYu4+3qjcrKF+YIqUofdzrYjTH4jQkdYJOic=,tag:7V+Dq2u8YoPqINe+9vy5ag==,type:str]",
"read_only": "ENC[AES256_GCM,data:gJ+5iKg=,iv:dIfEcCd7YHlzVfb7l5kPs8WFtay3SdYql4CufZ315Ys=,tag:1h3XoW72teOP/GAJk6a4BA==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
}
]
}
]
}
]
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_for_rollout": "ENC[AES256_GCM,data:7Qnciw==,iv:/fjTtxZlQBDdOgV0NVQBe2xE0m2oWVlWVrucCcXSR4w=,tag:foNE70szp/9tEbTZiMXOZw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:V0xhYEd6u6y9t2xAZVGqPoyXlRea+1zP5HMV6J813xb7a2s4LHmLhMSd3o/T9Femfzje2bmDq31IyWGO2VnEuBdkGYWXTHkLMdwWH7YE4g6Lrhy0qTGrEseEUe1MmoQwaIuJVLogNK0T4Nl06w8bCVttdqzvQDnr+vqeqDv5J+06bRifFG/TY/OwyTjEIcoGA4i7korcHaurJoJAwQNtXoikIDV+aNy3dGu1hg==,iv:ibQjPFYBKMcPWKV0P7QfdU08pKv/Di79l6RRW5VdnL4=,tag:Uf+iEAHwREIH4v0dkRY2SA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VJQSP2kYobtBHb7IOhUOmaWOdsVq8bv+cSegOWWUYALe,iv:r36HOPXt6GGAT18SxKvZs8S68cLvtN3F6hcqIdWXe70=,tag:roBMgiTIHzoPKjFgeyuL4A==,type:str]",
"ENC[AES256_GCM,data:3wecA/np8AgoQNesDntaBmtcJebJEcCZtRztksEtmJ4PtsjC6A7IcXl+a5OpQbh3bwwdhSsFQzbyYQ==,iv:vLtVZzLuUUvWrEp+M47v5uUvlGMVSrawBa96FaSJeEc=,tag:6ArECjpz/FwhwNy3T4KuBA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:efT78REf1g==,iv:SXHFZo/MGah8Auyw5QinxT7g0FQi8rsGk9aut3zdtEg=,tag:fPXdZAphIpGHZ+5MjmF6xg==,type:str]",
"type": "ENC[AES256_GCM,data:bKFDA5mnkpKt9nZklbNIQDkyQDQ=,iv:JbZ8pyTUNX97Xey78TFGhq64x1ep5b/eHyaw3lrRPAM=,tag:uQC/+TOkdeWeglIemGAPLg==,type:str]",
"name": "ENC[AES256_GCM,data:Sz5NGng3tKwqv76j,iv:CQoXD0nQTOajVMhTb3wC9llUBhkYKb1oV/pdUNnNuwc=,tag:DKIOTJcZfyuD2h3p91fyQA==,type:str]",
"provider": "ENC[AES256_GCM,data:Rx56Of8/T+9ohB9WHvGKbNz3ecx90dq31ynOeEksPZgM2T2QhZEaxLDQ5Qvp1zxCiM4PYxKn,iv:/YQy68gXS0c1J7/BSWaAce97/58FxP0SjRpJbM9pc5c=,tag:qkoYq6p8F1QuqwLYlprwhA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:Cg==,iv:d4z0NdHCFy6Hkg022WAaQ1NGj7kGzWxxNqsvhzlgw/U=,tag:2kc6OAk1JTa3qPebMfO37Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:rZowGTG9HPe2P/1s,iv:Sy+b0Nvf67/C2nX3yofqjZSu6LRLNJ24vaBSFOTALqk=,tag:TexzGGgBAvZM9+BYIB7rTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:DA==,iv:cAYap/KZvXXXaRSpXzlFdPwshPWOk3qlo3gD1JKwNKY=,tag:i6GiDScYKhjrmGgaICT7+A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"goldilocks.fairwinds.com/vpa-update-mode": "ENC[AES256_GCM,data:uG+b,iv:PvmcPAL7Z2TdMMZJyvSoZz9Z+/gNXOZgzW968wTG6cA=,tag:ZYKHCSb+s4CiChaRiWFJ3g==,type:str]",
"istio-injection": "ENC[AES256_GCM,data:TMVOS0xE+xs=,iv:yZuX7YTve+I54RaT9bLlGemKJF9SQ6l1AQjVY1gY4GE=,tag:DCdcdXF4so+160DLLkU4gA==,type:str]",
"tier": "ENC[AES256_GCM,data:Yyt2t94=,iv:2aR/x2ncKCWXf62Qpnz++dQBbj6HprREvXnNCgXKz9k=,tag:K8KLJn+do8LfatThIqp09Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:iw6D1pl0qV8tIsd3,iv:qqoxq6GDdOEoElYlkvScLayvMCitss0+Uc0AolhOjL4=,tag:GFEJgSYCMwrc1CwSQs15ow==,type:str]",
"resource_version": "ENC[AES256_GCM,data:9CJsd28aHXmC,iv:EKTUFNbn454C8BOUNE2seXcZfKqECq62OJnkXz3kXWw=,tag:dzpV9fFg/A7RlyOrSAzv5w==,type:str]",
"uid": "ENC[AES256_GCM,data:KmuyvRACUi+F9csJKscPZzR6CrpfhveoEpLn3hOY2H4aBYRu,iv:8+kf9/HbiXYT4sv/3eRyp75I46et9DMbwIXflyt7ZYg=,tag:UvT9+OtB29jqmHCbPmzzMg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:bN9oaO0=,iv:KIm7vQ9Td/yWyOXcax9p/301Ts4E9e4UPUcxcmlQhzY=,tag:y/7c6glt2EXkJsHMRuVl5w==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:jQ1ik3wRRTllfAPVwetTrf+TSVSfp6qv9LbhKcc+YUwPFnK0w/BsbWXfQ6VyjxmUwQ4LHJE2Ld00Y84/qPqpTflHRTwNuwCUWTQCZHTUDXkdUOU38lnhRA==,iv:9Ggj9FHn9bQOzj8EMfr16nDqGuUChrrKHpXdtAbGO/Y=,tag:bVHmm3EorHeP2S+GSAnqWw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"mode": "ENC[AES256_GCM,data:8yRtEiqo2g==,iv:a3LOom4nlWBmnjOW0j4bd+8X9Yn9KEqjsu3rlYb0wkQ=,tag:BC4FGbMSwpyzJhWjuYkBGA==,type:str]",
"type": "ENC[AES256_GCM,data:v8siNYzLv/BzM1RLVoOBImDN,iv:xosRjY47EyqDyGDW1lVkRMDQW7KYc2Rt7M5D4RgMfw8=,tag:acdBQGEAh9dy0PatPZNXkQ==,type:str]",
"name": "ENC[AES256_GCM,data:/q2b8Kc9kV7KESB1,iv:/jh+CFV3DQa7nBQWKDSDUcHTSguSRT0HtKA/RLBc8mM=,tag:gSTE8zWHyeRDUM5CItz0jA==,type:str]",
"provider": "ENC[AES256_GCM,data:ILso0gYn9Cmt0tPeknh3Tl24aa169R6+2VZe/KQxPxeux6VcbE6jWqnFgaYGMrkek7gyT5T6,iv:fDMOfUtV7jOkbDJsoMc12SKnxkGTZu10ewg1HHRpTfY=,tag:hGlQ13TqhVDJaz15zhwa3w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:2g==,iv:XzXk7nXSojmcVyFOvdf7KgBvhdJb47+4c5lQPhrwn/Q=,tag:Og2AAyhooubalhTur/Jolg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:cSt6Aubtv4t92CHKRnfo/VKiB3Se8vnI0A==,iv:oHGBGbW+Gim+lJnBo7RWwSaqvAYxaO6fQWeSiXK2vHQ=,tag:5dR+vf4j6GojWrf00JJj6A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:RA==,iv:LkG5xo7Ggm6HKCG0bSlcU3c1ZcwF8HEWMwFX1CKaeww=,tag:3orB1z3JyPTdeoBnpNLw2Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:Eo3QQchOgTSfMTt7,iv:yyPdAcAUC1+bHtSTDJMrcOP8YN55f3Bd5LxAzgfLPhE=,tag:Q7ecWTUsdHSAQ1CaBC0rbw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:i1whCyJCkkJxbfiv,iv:a7fVumXGgxwMNETjd09YtzWUK92kgi5AYJlYW60Lcl0=,tag:0KTr/Wo03k57tDQKzryrPA==,type:str]",
"namespace": "ENC[AES256_GCM,data:iLC/691vRwD5+SFQ,iv:UeF6JP9GaS/799vHHjQfkPljN+6bBtNgZX4utcUkCfM=,tag:LfZZoLP7ehKyP79tlnVnIA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:zTENx7wVOT6v,iv:sa0R9GoKD0YFm6XGRq5QxFElHK/e25a8m0Ujrg9MdTU=,tag:3Zn2QV5C1Iw4Ss9ha6zuuA==,type:str]",
"uid": "ENC[AES256_GCM,data:vtGwbFLPaUukR2bnWzgGp+iFUbW1O1l5OtM5qbqtRH6YA4pu,iv:y9Wzud50ZZEpLEdJ/gzfEHwh+Iru02vOAsweuc4ZYGM=,tag:+BQvoCVYO+oxSxZRZ6XI8Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"allocate_load_balancer_node_ports": "ENC[AES256_GCM,data:zlKJ1Q==,iv:3eztPb90JcPBz7tqVFhxb6WxnPmoMp/dcUXzsjz0JUg=,tag:PKs59D/SXVd2RVEAmYn0Hw==,type:bool]",
"cluster_ip": "ENC[AES256_GCM,data:rMoxHPuZElLAG26qZQ==,iv:bBP1FC+mAIUg4feUtX12kvFjKF4Kzu5t/oN342oenxw=,tag:6USSh69prV8oI3gTVnV25A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"cluster_ips": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:7JZTByZ/bcYWyZV4dA==,iv:mJwyRcK+h3Fqu0BADtp4Mi3mdn5Wqni4SKwu2UBOEcg=,tag:QSXPhsRZbNG1Wefq902dxw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"external_ips": [],
"external_name": "",
"external_traffic_policy": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"health_check_node_port": "ENC[AES256_GCM,data:8g==,iv:dATtk77nPBuv2k6RNxtsGmUuxZrrJyxsaiviJdHB2To=,tag:4YKc/2zJaYgGlKRq6EL9ow==,type:float]",
"internal_traffic_policy": "ENC[AES256_GCM,data:E34JessoDw==,iv:3B+uF110qR+K7G8XxLTeyG8TSuL+ofCAv8Ig5zlPX9E=,tag:4s+RlZ7VfT4xj6HWtXYfaQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ip_families": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:faOS4A==,iv:GRLQZPEgni+iRALGjk+Pzm2ctR6VdoKW8a5V7P/sYVU=,tag:nTIFE6mIyqjwiRPUn0/M8A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ip_family_policy": "ENC[AES256_GCM,data:nX5+A6w2YudQLYs=,iv:v0lfXlp9SLzK2+ApfesmXZ0hY8m2aJ3et8sXAXeVP04=,tag:AMb17eZxPLjekDTNBjO0vw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"load_balancer_class": "",
"load_balancer_ip": "",
"load_balancer_source_ranges": [],
"port": [
{
"app_protocol": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:E4IneA==,iv:3dzse7q2oKiSDx3RdGVOrBaVnEpFmi9gNhm+U2yUl+s=,tag:wJ4ZRF7hzkV+yBfLvo9IDg==,type:str]",
"node_port": "ENC[AES256_GCM,data:vA==,iv:enXy+doW9jiSExHDt3FjEkW7Qx9qox+fz6RTp2Tyrtw=,tag:CH1uJb3uQ78ZYEODtBeGyg==,type:float]",
"port": "ENC[AES256_GCM,data:qGo=,iv:8R7Jnr22GAP4CCdWUpzciX/2x/3NsavWxLbMOrWuwtg=,tag:fUeJF7PaSBTJ25Elh35Xgg==,type:float]",
"protocol": "ENC[AES256_GCM,data:mKAM,iv:pkYfYetrrTTGK21NGfFTlVtl/5dWYkiWnko9tKJ4JYM=,tag:pv64gtMV3JJcRxhfOjx09A==,type:str]",
"target_port": "ENC[AES256_GCM,data:HYERaQ==,iv:0JxiWcQlGmX9vHi3+WrNaU6OQbz/7NZj0cgNZGZ6kzg=,tag:rzsT2Gfg8wSGDJK9tVrGIw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"publish_not_ready_addresses": "ENC[AES256_GCM,data:h9WqH0g=,iv:WoJKvps0HEzXaMIuviy57i8gq6rAqBMk+LCnlgH8f2I=,tag:e0aHIzY4np5Ox6Maf+lCAQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"app": "ENC[AES256_GCM,data:PK4ZkzDN4CmvVBAk,iv:LtsuYxJ0JVwTp4BoOQobLYjmrlQLtEGytGCHSjPhztY=,tag:muOFn+7iJa4gxt+NEuW1zw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"session_affinity": "ENC[AES256_GCM,data:ajAAwA==,iv:0so/TbQw0XMkJsXA/pbalULSsdJok/Rx8g3L256TpSc=,tag:DC6w8GOiP37m1PkH8PQ2gQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"session_affinity_config": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:d9udPmrh1/ek,iv:3LKrylH1bsUU7KmA+UMeWZ6x/RHXH/O3ielSDm1PzXg=,tag:pbjqqtm9c+HIu3VTP0a17w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
{
"load_balancer": [
{
"ingress": []
}
]
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_for_load_balancer": "ENC[AES256_GCM,data:2J/8uQ==,iv:Ujw5BoJANKLpkblyCyvqjHWP/V7N0ojVarSZWxbtFJE=,tag:2QTQd5O0XfjMppOLPacqtQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:yRjNx/hsYP1OCUOrEe8PP/veFlIw9rSJ7Gb7WLtESBV2Q68n/zM5JTlGDnsL9y/dQ+g1V+OzmZ+BhlDkZVD+QsjeSDtD5YPpgWiv7q8SMZk5DLLaDT1FhQqUSuCNEvqXtZ/wrSxeUYbuE6cz3AQIkRxjKT4=,iv:JWxZKBGtjbrsTYowcrkiHtliBdc/wNOAHJMJc/+uNdU=,tag:qfrZ4nJ0W6BxvjIrCT8hjQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:+hXk/noeAN18MUw8DrX3BoykWS4RYnS6WnTafyClax5C,iv:vE+wRPmp3EZGXgnviyu2Wg1jLyhyePoTMZqNVasJYAg=,tag:6ZQq1y91ILLDzwcqc3q7vA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:qcNsBBd/Dm6BF/m5GPo=,iv:gKUvmBOhX1GcdNapR35+KMrGkMbE5i6kMcwRhNTqj5A=,tag:3xb9bSA9jNyHPyZbhXtvsg==,type:str]",
"mode": "ENC[AES256_GCM,data:AdUIj0S1KQ==,iv:xHu861QkD+FIiQcA8DvMCU/nDhRHOfvpNsuwEiqxWBY=,tag:tx0ez6V+60+PiFAgVqOhNg==,type:str]",
"type": "ENC[AES256_GCM,data:yve+HimTBzbBD+2M2Xw8IQOKlXR9,iv:ihKLXgI8Jh5xms+WZ0EDnBEDFYkR3Dc2zG0GK4pnYnU=,tag:2eaV3b6/LqaLE59X5D/HOA==,type:str]",
"name": "ENC[AES256_GCM,data:e4Xo8nnzW1N+MugEzO9p,iv:EsFrPVa6A9fAAWv1V37y+FSgDN9g6U9QfKlGQhfa+Wo=,tag:r9eQBB5kW6bAGs+f4Ils2A==,type:str]",
"provider": "ENC[AES256_GCM,data:WwPfGXZf39hG9904KrxPS6bvP7rjv02ruIoe7qoPcARW8QkGxZIH9kD2a7OyoBpeAVisJhOo,iv:0eGC+xHKG+XRY+rMfC+TU3YQDl20xwB5IXjxIY6Md68=,tag:Xn4fA2tEr+JdagWuz92Hlw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:GQ==,iv:O9s8pq6JUNuroL58pKuMk7lltBpieNd6MjLgsQbfpS4=,tag:CPKUAGXbMMs+BvN8hMHmWw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:1uz04kvnicbhit2iF2R/kHi7EgKbQBLTXg==,iv:1ACCjrKb9xRKrEYyvDN8MuqTkMmrfaUxNHT5IvtIzds=,tag:4omzAmW1HSLB0I/zxIrQFA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"gethomepage.dev/description": "ENC[AES256_GCM,data:0VCexiYoZjzw+6E=,iv:TOsyVBQVuBoERS5cT+7tTgMHJcHLQliVflXkVNF3p2s=,tag:jEmeOuLZBi6uyGJRs3JOqA==,type:str]",
"gethomepage.dev/enabled": "ENC[AES256_GCM,data:iPDdwQ==,iv:E4JmaGTHfhXpLjecBD7Par8V4o1kln0/Ez8wC8MJ348=,tag:jVQoKNOMSc8OsMQTJXF0JQ==,type:str]",
"gethomepage.dev/group": "ENC[AES256_GCM,data:rzPNX7AUBZeUfBip,iv:x7utgjdyZCL4OG3UM5ctyfTH93ffvwPR0PvbKBXFmEM=,tag:QqbbPw+MzO0f65/UPcZcLw==,type:str]",
"gethomepage.dev/icon": "ENC[AES256_GCM,data:VF+PxmFAhAUmcZkDcvUQ0w==,iv:h44cMOjyyaDAVK+zAn7JtOt+MEjN9vANCUMdMYGfQPM=,tag:KUz6sso/Zf4uN5wDzmzAVA==,type:str]",
"gethomepage.dev/name": "ENC[AES256_GCM,data:HBGwSuuRbI0pWhOy,iv:3DjlLIg+x8SLB506KPLxxheFuxIYRb30hHLsQUhfg0s=,tag:Vnmq800svXIP7V4XdVBjtA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"gethomepage.dev/pod-selector": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:Mfg3HdEalQZx,iv:bXCDDJR2hQHOL94YZBPwWw/5MemtNS3oxBIuLprwe5Y=,tag:oxrqoWepDaUQ2ooWmAylVA==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:282g02B2klrqnwtzy6DQZ3Z+q1tEzc7wd/ZXAv+U6FhX8niEu1tPOhAfv+ePHdzD7ANL1GZ6w4dYjRPiX5hpMh8z/hLLOQVS03VfGYvvW3mpwHD9aH5hhvRmnYJqvvzVwIsi+q5O/ynWmGXUhXsKcygA+Hd1Z6aMEmgmbYGOS+nOq9zgasKeLWfZp/IhbhlQIvn4IaocVpFbZbrBRzaI7A3xxLGl7ebZN9Zf49o3WGhhNORKU2pFX4nC//VkhbIkpovoiiguHJhYjmpoAswWFM0a82YScACcvJsJB8y6jGBGcyk7UzX6NpMHx/3xcy49UlVKlKxDjetOLasJbgODb4M8opRJOOgz6om6BTUyWo5isX21nI5aGomRF3YeQOYZ9phTokQLSQhyMujei/VELce9Q6zFiqH/IK7BNlkWJm3x2JdSijO+/U+Jb+1SqnqjMpxLVZK8WNo5WT2wAo5zX5K9NUTJUDktnvHG7ULd9NY8DQ3dYhPXXPR5HONQK+q7,iv:6THbqjua/A3WqGYBdH2/348TzYVhD/qbvK8hjPQFZEI=,tag:FUuLgUfR4j2/PxDoe4+1wg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:Rw==,iv:Uyzn+4FK8wJfkhyQDz9TJHEPhvaKLduhaw65ryYBIVw=,tag:6G7r1yCCF73MeUR7QxRB/w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:wwaITUJDenC78jJT,iv:7P9Gh0//OyCWxwRNLoV+QazqMCaL6Z3lD0O3+wLJbrY=,tag:Qlfdqnd9GSiBvWU8pcM5nw==,type:str]",
"namespace": "ENC[AES256_GCM,data:Tvbl1m3wRyrKMJ3F,iv:wLOFlN738bfl3Ir7bqul9SWuf34oi5TvsEFvepYX72s=,tag:q8bLxsfSB+NHIp/StXqXDg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:bVQWS+49VuVM,iv:71D4r6O1iU48WmaoLxE55DpjXh46McxGdeqsoTJZrB8=,tag:kpznhTfoyDySQYb9L872oQ==,type:str]",
"uid": "ENC[AES256_GCM,data:AhOfwFuZVb4LgV/ukPgvCI+ym/rLRIdkARLMvuaf1m8Bj2pZ,iv:8Dcs/uIlXfGH6A0TQXc41C2uwA/CP80hclUxFaKSXoo=,tag:hLGR1aYpYjvg9GYPNzS/CA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:PVObtL5MOw==,iv:6v4VcPpAjV193b1Xh5xY0cF8IFaEWvd7ISe3aR492Y4=,tag:GJp9f7Lo2I2mZ2JLSknXQw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"host": "ENC[AES256_GCM,data:J7XVkTjH9pFHhoIKbOyzn+JmUTb+NM6c9CjKGg==,iv:cwgHocQ395DQqpAFp8QiCi2gAV4s6CKKEAj50fGpyD0=,tag:Vw3WRULQVTxxhgyUWzebLA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:r8vMehVlbn+8p2j4,iv:QLjSGXsD4eeyYMYXJuBX6iFqvLOXmtdhCtmdgrij87A=,tag:72Pt2wiR4hVlhnraO77SKQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"number": "ENC[AES256_GCM,data:Vz4=,iv:LIxDFe5do50Z0azv15B5rWosyICoytqp96guz2wAixk=,tag:8GCtp5ImdpCnL12/+y6MDw==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"path": "ENC[AES256_GCM,data:gQ==,iv:iYx6D54usU+4HG42h0sibNdp4T2uSziniKVWFsy7R5k=,tag:OqmgbQ4uZNO1Cxgwq0Uy7w==,type:str]",
"path_type": "ENC[AES256_GCM,data:NkR1301G4ZcAmDoGQkeC4ZVbI13ORg==,iv:pUH8YuEXSdLSOcratkLDKg1gkXQ742gvCPtzTwyzEfo=,tag:DqGbwRY24gzYDnrspZvGFA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:4dK2nsYh4kvnuXrZhdch+BT50OeZxVU49bwGJw==,iv:h+HSRi1Bl4RZ2Tj/CU3D3BT9vnMYHtgOvTsXOxQ8Ucg=,tag:yIv4cUyBOT0g6U4wlvqDeQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"secret_name": "ENC[AES256_GCM,data:AkdnQZUndAUfwA==,iv:EyGEDERKZzFHRL0KdhomZBdPhgZRjWGd9OIr22xcW/k=,tag:gn4aPoUoEHLPD1rtJj4U5Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ip": "ENC[AES256_GCM,data:rv93985cfkV9G34=,iv:sfK6SNwmhrqg4gURtVSA7hG0G2krhT/+qA+DCQPCHLE=,tag:7Nk0sgve85/uio09qOwk4w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [
[
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:Z09Q43d2GYk=,iv:heEejLCW1OD4+NBMXBf4D6RUCjMJPgZgzkbLxDuqoX8=,tag:Rxk5bMSacSMHUrQJkUd4dQ==,type:str]",
"value": "ENC[AES256_GCM,data:a/V7qw==,iv:NOkkw/TW03dm/G6egeUNWaJDP5ek/mMzTf96m3usvlk=,tag:TIKR0nAQfZXKyxQKuAhlaA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:8eMSrZE=,iv:NbE+9F4T6lyty/c7HYv3Ss/6sn0p1XwcSqaEAfltHFU=,tag:lg5us8qPUnGDq84IX4IXeg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:6g==,iv:dc8zkeWDleXvtZUEIrrMZjrqNBRbVPuKKB3DT9+sq5Q=,tag:ohMpds4vROd5+2QYDlMSfQ==,type:float]",
"type": "ENC[AES256_GCM,data:K8J0KNKq,iv:jfnS8iZH9k1SBSY2mdmR9l+FZJyjdTw6JXSvEru/pbE=,tag:5Snn6Q6ELYLxVVdVfQxvqQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:56SM4qcLEbA=,iv:iMiu68iavBmoOkZCtYnqsmk/I/aR/x57qVLN04nQpnw=,tag:mrLjQWuaiSSJeGKaJJE/6Q==,type:str]",
"value": "ENC[AES256_GCM,data:u0rX,iv:CcfAeHVeWvhI6VCNJ84bLa3LDM45IpFbr6bu53vZg0E=,tag:s28+UScK/Q/NNrCRwhv/KA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:F/Jd59U=,iv:F7cCyEbAH+uQU4oodk+Ipnphhw5w0wJiGk6y8RAgR9w=,tag:aBlZeM81eo09UHzsB7gG4w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:HA==,iv:mk3J+3REanMmX+IjAhxPZ/LtFwJCnlrz2HkrrJYaKXQ=,tag:TPKoy4hAE0IOyfFiOhbxBg==,type:float]",
"type": "ENC[AES256_GCM,data:D70E8zgY,iv:LsTQfhg2Bqpe8aBfnMrBGqy+khav6pWR+UNPKs9VffI=,tag:JP1IiUAzUq95rFg2UCC8ig==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:rD+zxJnw1yI=,iv:myVmMu0njc7r74lNp0hasBZFyPJtQZiKr1SFGyW4dl4=,tag:NkmSxi8WDDYYVgkiwSrDjA==,type:str]",
"value": "ENC[AES256_GCM,data:ASUiLC7OhYEXUTo=,iv:RlV5KFhXbKNh7WHsrtXzZ/d5Lcg35eNGJd1IRw/6pKQ=,tag:kW4itjSM5QFP/fHmM+G+IA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:gxEiJ7bZiPqRnep5LzctwivPr478q3mdvF5jv6psarHnsns0ol1hTQgkshwRdnX3+cBxDMI8DwGnkueaSImJT478bnZ/xEX6ivL/1xPs2F/nf+abSJaTE2jD5H4YXPWim6gDnFvAD4EYTipZY8AYlhfEz36pJTAh,iv:usCA5+Y6B+OtGkb35T0HVnbHih+J04fi5r2O+YBpXpo=,tag:73Esa8H6mHoy7Zb4J0x6hg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:hVTKXGIPAoslVyTBxg8j+rLc0jonUT8ZAxDYsNbnnfgo,iv:qb3/BetQxjR+6haRwXvs3gibZEYBuebtj6Ns4KDFxu4=,tag:6CCP/PeXS8haodCLuzDh4g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:L9kFQKAzp3yoHk6KSxA=,iv:TeheIdU5zhnlXj5U9a2y2Ef4LmaBmM95HlUwVRa4D4k=,tag:9dFZ09TZ9snpN+NiE4rVKQ==,type:str]",
"mode": "ENC[AES256_GCM,data:meKJiR2emw==,iv:oOvCiMTcTQF+dYThJ6i7hgXOsXXtCdC5CF9if3RrfmI=,tag:uAx8mcNWHPvGFwkY2kZfMQ==,type:str]",
"type": "ENC[AES256_GCM,data:ZKMqVcY9h0UwcL/vMLQzeoHByA==,iv:xYvOWG/L3NYQ0TaxqjvSIPXLw3hI49OwGaMJ0Lzo/dw=,tag:lqTdjEHEP8aTMrTZf7M+yw==,type:str]",
"name": "ENC[AES256_GCM,data:a5/pO0LtiimT8fPWz7SNWw==,iv:w9ADffT1r79Z60JPtEy1yD2tD/qUK/CDZBvK4wjMnE8=,tag:aXww87rl/hbIArnioqvZNw==,type:str]",
"provider": "ENC[AES256_GCM,data:s+miJAqCvqUgOLALbcqEFwSG4WjCHrEpmaIg36pKsqKOaTLIayYXLF5wsjGeeYUbvWdiaQgZ,iv:QhIp/xkXQo5KuV/rSrTDcCKnEtm42gupciozw7xswTY=,tag:yS0Osq9pq5udqQfGXKXI1Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"index_key": "ENC[AES256_GCM,data:4Q==,iv:tNPh1tLz/8G9tjO9U1c0PBmj74CA1IZyO8cJXwPWZ3Q=,tag:wOiJJXrZ3U2UksU6A0tL5Q==,type:float]",
"schema_version": "ENC[AES256_GCM,data:eQ==,iv:B8aDNjIpguzEYMMZ3CKVMJddhBSClilDP5brP4/x7TU=,tag:oGPs1XEjB46hCW0LwNfDWA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"computed_fields": null,
"field_manager": [],
"manifest": {
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:SQgKQ6ZWQ0v/V7EZ6X4/YODPCw==,iv:8Xt/XABDnaqQ7v8xwOteLCF0FdkPFNm5QTm71Xqgofw=,tag:dX3E+LI2R2GB8APgr18exg==,type:str]",
"kind": "ENC[AES256_GCM,data:VfV0x0J8OMDKEQ==,iv:H1QdtJ3Us0adBUoqnR1eVNveJZdWeVBzOwKX6a4udDw=,tag:lVPRmyxFEf3dtU1/VJr5Sw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:rob8CvJfsKMl4nPtzHaJJ1zJ7+osHEjYcuOsBAM=,iv:1t/IDqaVmE8av7k5idmrUgOnHtGkHkchTgtmUuDekjA=,tag:n81q5NHCJqdRH8kxrE5Qsg==,type:str]",
"namespace": "ENC[AES256_GCM,data:dRH1Fc+AWj0sztSB,iv:90GkJ4Zn3FIV7wqmX8jTVz/nX6cT5r8ZdEGjKjJm3jE=,tag:LSLSgK6dcfM+L7TegrKDSA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"spec": {
"plugin": {
"rewrite-body": {
"monitoring": {
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:MTOLyq3P1NME,iv:xg+T4vc5v3vf15INWCKcbfem4cG4tpktB/xuEwcikEk=,tag:FHsXRU0Jdh7HK+o2ct/Ddg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
"rewrites": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:JCyZ3T0TKg==,iv:xZLQV8QjwudZflQJyg0Jn/6zAjEG/Vd7c12k6HLIpco=,tag:9adVx6Xr88mxquJ2FMlIgA==,type:str]",
"replacement": "ENC[AES256_GCM,data:/kDY0wtP04P9bzHxvjLSZCYSiFaTvS/aV4P2dNPn62T+l9AauB5MyZXs5LxXVYflMsiKCZG+/CZCkDH2Fdd363rli7Y0RPgg6HLMsAr1jXDVWSM4EZrnWYdz04TziJQ3OM3/U6KRKF7AU6h7NA==,iv:8+RGnUUAZO8p0IhvUPd1Hxk+CC8f6acn3MlGVOvEpB4=,tag:dgbP8C10GuNSzTnOv+JlGA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
}
}
},
"type": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:AH9h2TPU,iv:UeyoCcLO/FvXLv89Tlhy9XFypw2Nn7GUWId0XAYHmRw=,tag:q8/bz4XbicKZyJtWCcugxw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:qDF49Cp8,iv:cvkmop/X08t3Y8aaa89VT2rK5i9c9NILrGra7Ml5lJk=,tag:JS8ynwARkwgP1PCTpNXckg==,type:str]",
"kind": "ENC[AES256_GCM,data:orIkoghi,iv:ZPkHL0C7OyUngZm40owhED+vFYS1SS9Lk2Fswu28JLY=,tag:bjN/keMRZamdHk/8ZBKCbA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:xJZxDz8U,iv:3WJE9/mJ+QMI6Lw3JetZlWOvJ1FoLGzlbxoefAjnBYg=,tag:O7TAE/7lQEeRFT8OD0Tpcg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:TpwC4uj0,iv:rdg9LDVteB3RTruxENsvb4N4j/07cQZ61BLu/8NZ6Ys=,tag:6d7lmUwnby5y4S6s0wOM8g==,type:str]",
"namespace": "ENC[AES256_GCM,data:GtfiGzHO,iv:uUgQv2PsCYYDMeZcQvNiE4o0qMGWSDEKTlioE1iyiOs=,tag:8nDXCX6n80Vh6vrxgWNK6g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VfBt9oLE,iv:bZgjl6e5WNcmHfYnRlMcKf9cwsS3mBrOk++8EbxFUAY=,tag:e0Kz2Kx/h+KXEKVnvPIjew==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"plugin": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:sbKoJuKF,iv:K9Ajfx/GBtS5ta7sDSCoJzlhV71nV3lrCjBxviLKPk4=,tag:gckMCyUL8t6B11lsgBhf2Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"rewrite-body": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:52+GJSOx,iv:Aeq21sW3kVfBuwlOpU0yIqNHv4V+cAZETpo5nlVQRXE=,tag:gNSAeyq39uF32UdN9rJ5CQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"monitoring": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VAX2jSwG,iv:gdsBdOjr/mgssmcXc7EReNq4nNUEnkaEIdDSAoDhz4I=,tag:iphJrNBetfC9k5KeSUKVEw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:P59B330=,iv:7EzTQw3c33Q6riyLkXZLhf+wxmjdUWBNfGi0IqJIFp0=,tag:8NmHpE+aAkFdbTkghBGexQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:2Zan05HT,iv:g7sTcQjIRtI+uQUBe3nnpJgBl5Bculp8lE27j4PtBkE=,tag:2q2lrju9SgM7c0JEPwRdyg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
]
}
],
"rewrites": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Nz+D80A=,iv:fXNbseibDMp3BbFbo5utTp7qx17l7vCtCuqewB50OpE=,tag:VYWB8Yiyow7WsDKxEmWYYg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:bJAOLFl4,iv:57DfntdAvecJIyAgSYG6ywXca7twW+lqNH2dLTnn6tE=,tag:Pki1LkEaQeT6zwmMryqWrA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:31Y4zW1T,iv:DpUgbUfR0yhPs86q2Fhif0BY7qTMxtn74VfzZF6JmF0=,tag:o4an9TLpK3lHabfLUnTs8w==,type:str]",
"replacement": "ENC[AES256_GCM,data:zs68o1dn,iv:YPmPjx2hwQ9SQZRSVcHuQcF9woT7gCGuF55L9f5ZC4E=,tag:c7LsHX1TE539di9YvJkh2Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
]
}
]
}
]
}
]
}
]
},
"object": {
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:radd3CCH8nHOxKnRS/vVPmUrsw==,iv:EYUNTxPI2fdCyJ5a25mePifMvnHMrmkwFesh1DAUDA8=,tag:269/XTgxjwhfoPoF+L6fTA==,type:str]",
"kind": "ENC[AES256_GCM,data:qjA73yLbt4k+xw==,iv:TBY75FF+dmKNVL8Mei+BwDBr8xT9v0JsjClHpVe8AvM=,tag:07T1gd6svXg9Gd8rb1TlFw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
"annotations": null,
"creationTimestamp": null,
"deletionGracePeriodSeconds": null,
"deletionTimestamp": null,
"finalizers": null,
"generateName": null,
"generation": null,
"labels": null,
"managedFields": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:1CHrawQqFYSlvyMwZMqID1ypCZtz2rVL0Dxt6+A=,iv:f6gaT3vJ2v7qPQGQxWxSr6WCowWMOKwkxjuZd6+KLzQ=,tag:zBYw5ZFavPXo0rxJqCQ36g==,type:str]",
"namespace": "ENC[AES256_GCM,data:1ecuOVPPRkjOQZ8T,iv:/o7LezInIM9yd9rgGDEea1PMmq1crNwzHadHkwAx4qg=,tag:DlKIpArP6ZydY7dQ3Jp5Rg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": null,
"resourceVersion": null,
"selfLink": null,
"uid": null
},
"spec": {
"addPrefix": {
"prefix": null
},
"basicAuth": {
"headerField": null,
"realm": null,
"removeHeader": null,
"secret": null
},
"buffering": {
"maxRequestBodyBytes": null,
"maxResponseBodyBytes": null,
"memRequestBodyBytes": null,
"memResponseBodyBytes": null,
"retryExpression": null
},
"chain": {
"middlewares": null
},
"circuitBreaker": {
"checkPeriod": null,
"expression": null,
"fallbackDuration": null,
"recoveryDuration": null,
"responseCode": null
},
"compress": {
"defaultEncoding": null,
"encodings": null,
"excludedContentTypes": null,
"includedContentTypes": null,
"minResponseBodyBytes": null
},
"contentType": {
"autoDetect": null
},
"digestAuth": {
"headerField": null,
"realm": null,
"removeHeader": null,
"secret": null
},
"errors": {
"query": null,
"service": {
"healthCheck": {
"followRedirects": null,
"headers": null,
"hostname": null,
"interval": null,
"method": null,
"mode": null,
"path": null,
"port": null,
"scheme": null,
"status": null,
"timeout": null,
"unhealthyInterval": null
},
"kind": null,
"name": null,
"namespace": null,
"nativeLB": null,
"nodePortLB": null,
"passHostHeader": null,
"passiveHealthCheck": {
"failureWindow": null,
"maxFailedAttempts": null
},
"port": null,
"responseForwarding": {
"flushInterval": null
},
"scheme": null,
"serversTransport": null,
"sticky": {
"cookie": {
"domain": null,
"httpOnly": null,
"maxAge": null,
"name": null,
"path": null,
"sameSite": null,
"secure": null
}
},
"strategy": null,
"weight": null
},
"status": null,
"statusRewrites": null
},
"forwardAuth": {
"addAuthCookiesToResponse": null,
"address": null,
"authRequestHeaders": null,
"authResponseHeaders": null,
"authResponseHeadersRegex": null,
"forwardBody": null,
"headerField": null,
"maxBodySize": null,
"preserveLocationHeader": null,
"preserveRequestMethod": null,
"tls": {
"caOptional": null,
"caSecret": null,
"certSecret": null,
"insecureSkipVerify": null
},
"trustForwardHeader": null
},
"grpcWeb": {
"allowOrigins": null
},
"headers": {
"accessControlAllowCredentials": null,
"accessControlAllowHeaders": null,
"accessControlAllowMethods": null,
"accessControlAllowOriginList": null,
"accessControlAllowOriginListRegex": null,
"accessControlExposeHeaders": null,
"accessControlMaxAge": null,
"addVaryHeader": null,
"allowedHosts": null,
"browserXssFilter": null,
"contentSecurityPolicy": null,
"contentSecurityPolicyReportOnly": null,
"contentTypeNosniff": null,
"customBrowserXSSValue": null,
"customFrameOptionsValue": null,
"customRequestHeaders": null,
"customResponseHeaders": null,
"featurePolicy": null,
"forceSTSHeader": null,
"frameDeny": null,
"hostsProxyHeaders": null,
"isDevelopment": null,
"permissionsPolicy": null,
"publicKey": null,
"referrerPolicy": null,
"sslForceHost": null,
"sslHost": null,
"sslProxyHeaders": null,
"sslRedirect": null,
"sslTemporaryRedirect": null,
"stsIncludeSubdomains": null,
"stsPreload": null,
"stsSeconds": null
},
"inFlightReq": {
"amount": null,
"sourceCriterion": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"requestHeaderName": null,
"requestHost": null
}
},
"ipAllowList": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"rejectStatusCode": null,
"sourceRange": null
},
"ipWhiteList": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"sourceRange": null
},
"passTLSClientCert": {
"info": {
"issuer": {
"commonName": null,
"country": null,
"domainComponent": null,
"locality": null,
"organization": null,
"province": null,
"serialNumber": null
},
"notAfter": null,
"notBefore": null,
"sans": null,
"serialNumber": null,
"subject": {
"commonName": null,
"country": null,
"domainComponent": null,
"locality": null,
"organization": null,
"organizationalUnit": null,
"province": null,
"serialNumber": null
}
},
"pem": null
},
"plugin": {
"rewrite-body": {
"monitoring": {
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:JEfR+C6kSzap,iv:8CfvlvUK4dGFdRrEiPaMLxmJf55uoTYK2a+RgrpUTX4=,tag:swzGcKIqPtRclK5ad/biyA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
"rewrites": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:tine/r73RA==,iv:3oEfLAwizFEqKax7llmM+e63d8wCedEzTXff8tQzpXo=,tag:4tELTBf1+XR5Z+pcr3+Fqg==,type:str]",
"replacement": "ENC[AES256_GCM,data:Hn/wWR7S9YaKDQwWnZxlYziVlO5xWXAKJB8Sprx3ShlVL4vrreYK3b/ei+jKsRmpeuRMyiyMGYST70w/bB7ZbUBHoUn/Q/x4k6VRGSRdwN2LQb5VtvZAb8R4kxQbue7WvbrIocJGxgFUliQV2g==,iv:a0igIncaNPJtYCUtXGx44AKrahtBSuoCB4Sqwqj2BSQ=,tag:/KL+cGXmv3aMbH8b1AU0Qw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
},
"rateLimit": {
"average": null,
"burst": null,
"period": null,
"redis": {
"db": null,
"dialTimeout": null,
"endpoints": null,
"maxActiveConns": null,
"minIdleConns": null,
"poolSize": null,
"readTimeout": null,
"secret": null,
"tls": {
"caSecret": null,
"certSecret": null,
"insecureSkipVerify": null
},
"writeTimeout": null
},
"sourceCriterion": {
"ipStrategy": {
"depth": null,
"excludedIPs": null,
"ipv6Subnet": null
},
"requestHeaderName": null,
"requestHost": null
}
},
"redirectRegex": {
"permanent": null,
"regex": null,
"replacement": null
},
"redirectScheme": {
"permanent": null,
"port": null,
"scheme": null
},
"replacePath": {
"path": null
},
"replacePathRegex": {
"regex": null,
"replacement": null
},
"retry": {
"attempts": null,
"initialInterval": null
},
"stripPrefix": {
"forceSlash": null,
"prefixes": null
},
"stripPrefixRegex": {
"regex": null
}
}
},
"type": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:lxWjF+wh,iv:5tXpHauevSE3Ta7+qnUkYTEijj7DNoM2RpES4Ho0k4Q=,tag:LQkQ1YPR6r91NlI3QV6TYg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:q3vQbJaM,iv:4gIgTLArB8BUztDtsjtScMEhR4K0BpSzG8o5Us60Fd4=,tag:1tpQskEgzxBYlyHEme9H1g==,type:str]",
"kind": "ENC[AES256_GCM,data:P6lZ8b65,iv:onBfaT+AsuvkmDjHUUb5fihT1XMbmosEu8QRnCDhp1s=,tag:ROF7hQbpWha4CDI6fP3TJw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:o0VfuKvx,iv:3XJvDoQZV6W3vJdz4/YFjdoPSUYvatM7RsGJUqyiOPo=,tag:3+2JYtMWn8j9IIqi07IKpA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:kVF3,iv:rgWbW/ejnGSB+DpoRPNqK/IG1ebw4lGmhLWUi/tNGyM=,tag:hx2OzD4xFfmmCma7Gh6COw==,type:str]",
"ENC[AES256_GCM,data:fNAcyjiw,iv:OBdebc/v6/H8WQOsnYBcDbt2zSmuwkpuZhJQl7vozOc=,tag:8G9TiXuKzIjBwNcjZo/MHQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"creationTimestamp": "ENC[AES256_GCM,data:Z/Ao7AnC,iv:2D7g9hNML8cR/21BmQyzbGXmL75ezH4LgOCf1dpkAnU=,tag:dOaQKQTqEc/zZBZy/SOKBg==,type:str]",
"deletionGracePeriodSeconds": "ENC[AES256_GCM,data:pXRJELr4,iv:EUP9hoRPj7qIomd67wmyZZlcw2K3v9I2/JeYg3Syl6s=,tag:pQ+BTdsm+Nq9WUf0u36hcA==,type:str]",
"deletionTimestamp": "ENC[AES256_GCM,data:NIC57G8B,iv:VKB7S2MI68Z5gscQQyecZKCvJG7DjGP1ACrPY9MTxZI=,tag:aZlcYHPJKps6QLEpHi5pdA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"finalizers": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:cN9Vjw==,iv:1B5z6S4BLiE+A1meoMpceuRm2/rV2PP27vUVdPaOFEs=,tag:tWjBMMQs2OYGoT30A2GAuQ==,type:str]",
"ENC[AES256_GCM,data:FvlHLW+2,iv:x60YPUGSLq4ZWGZHkfvWOVsAbqIT0RryeMz6vt2aurk=,tag:YOIftWuwN9QBn1ELOkzYpA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generateName": "ENC[AES256_GCM,data:bQvE8SSG,iv:GL6F+xOFTyv+2O1HzeDs401CdAT3EW4Zmb8v3o5FUZQ=,tag:+f7SgWjreEjJkRrJtkh83w==,type:str]",
"generation": "ENC[AES256_GCM,data:vYJSeB1D,iv:2eu3Bynha/5/X3YgSlQOs00Ux6A/+GplyiEpHpAf1Ss=,tag:RoyIwe/ogp32cUvafRyJUw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:vqWa,iv:P8WXwvfiBn1+7mPDPacUOBHMUvQb3ShRZa0STUB3Lnw=,tag:8eO5+9h/auixRvKUebBjFw==,type:str]",
"ENC[AES256_GCM,data:A7Rksh8c,iv:kf1XF0+nkrPDB4kSe3NVFQnCOmzkhtB+cy/hLJti2SM=,tag:DFxvrJaZSWt1rdLWpMyehg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"managedFields": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Rx+luGc=,iv:r4quGNfNuy7T6yWZcX/wGJE27w+tL3lJuts4ZF1fW1A=,tag:rk6Vr5DP3eB85vY2lEI/sA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:j0Np7Bxd,iv:MIr1jndtNswSuhxe4Tf1EB7E3Iz1ynAdJpeB+stXX6I=,tag:0qbohboGtJEemfsTrmartQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:NlxQgmP7,iv:8cDH/6fSzb9xd/syoODuJBMp/V7P7xOGCraD2fXYxTs=,tag:pjkf9jV2Y5NIsv7BwT7+Jw==,type:str]",
"fieldsType": "ENC[AES256_GCM,data:uDHE0VCG,iv:ZZfsJ4BJ0pcQDQngp5plY4YziJdOj3oE3kfeX6mlyAo=,tag:fwGhLUZJp3EKH1kXnEKWbg==,type:str]",
"fieldsV1": "ENC[AES256_GCM,data:OMBE9vlMBQ==,iv:2poVyJPbHj/1CHOEXxmph32WhrLdraI75XF58F4a83w=,tag:Mgmlee/hKyG3wEw2OD7aWg==,type:str]",
"manager": "ENC[AES256_GCM,data:aGOCskj7,iv:MfncIoTl7xZJfxI3WZzer+5El8eGIyr47VateNRX52Y=,tag:JlwTdb1TAv2JBEJL6fVeYA==,type:str]",
"operation": "ENC[AES256_GCM,data:9K75iNxa,iv:pUCPtF/uQi1+VQSqqDf1fvcdD49V9qmhzSPENIk5Nf4=,tag:GDQiDq+lJaeEyID/xNovew==,type:str]",
"subresource": "ENC[AES256_GCM,data:5nPP1s+b,iv:xGCOWLyxi1aTodPPekOuiw4NyHTJ3h4PVa/Q6fHIWLE=,tag:2cOBA5cHXD55AICL3QveRg==,type:str]",
"time": "ENC[AES256_GCM,data:fJaCofQz,iv:Cr/e9r396HFD2b/d5wKTrd6dZQoRhgdUIyCBntKE9fc=,tag:ydoW3LVLM3tVe3kMRWZsXw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:j6GwPRR/,iv:FVTr3c33ZxJHqbtYab0TTCjhlqNjQVU5VG0Qo/lvWPw=,tag:aRO/NVHy7KTXpTGiWmdrig==,type:str]",
"namespace": "ENC[AES256_GCM,data:DiVclDUo,iv:eCoqS9j2Zvp5lZl4yXbaNLTR+6MEF/3EATDL/0hEaJM=,tag:kmq2qG5kK95L1LHYr0MXEw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:rg89/g==,iv:aauxwrDgo8wVJa1QmaO/SNCt89DkMgbEb14YJiSjR0c=,tag:ehF+/+6NPZ4UwTHrF3zy7w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:AqUQ6e+g,iv:JGFeabu8T1jmb6R2zsesZ2asMHp0CRbajD+wiP0ELeY=,tag:GbzXrdbU9lY/K1C+UWCyNw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"apiVersion": "ENC[AES256_GCM,data:7FGV0/Lw,iv:czMhJtLo0pcdo/Al1uE+AH1y1E3nGXqyJUg9vB1HJfw=,tag:/TmzOE7iDRrZfDLqBMJRpA==,type:str]",
"blockOwnerDeletion": "ENC[AES256_GCM,data:qyyprw==,iv:WCDssV65nwv4OEmV5f4DGzgQHPo/tMtrrYXdK7R2wJU=,tag:hoUESDpN8FiREze07g3boQ==,type:str]",
"controller": "ENC[AES256_GCM,data:TzDVLA==,iv:92KnZdFYvnipIMVQnV/3SH08F+XJGjh053LMSF42i6g=,tag:s3Ycd5qfa5OlNU+zpwJdpQ==,type:str]",
"kind": "ENC[AES256_GCM,data:BJf5HMd3,iv:D1a+Csrz2bAo79SiaomdKjWkGMYazFBoN+hn8QGM7H8=,tag:7MdXGSaxV1KFL3fGNsw4YQ==,type:str]",
"name": "ENC[AES256_GCM,data:AdtEqmuT,iv:068z9Uw/7EPEiPzVjOe/bdOsVQHbppMVAGHtbFUMc0o=,tag:VLPLpEKQtnMHo8ak0tyUBA==,type:str]",
"uid": "ENC[AES256_GCM,data:xXRtsdDu,iv:InGkO0flTSh9EdWZL+1dCKEoxrLrYiI8LvhZCe00Gas=,tag:8GV5pbPFnwRGnjrthPUw5g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"resourceVersion": "ENC[AES256_GCM,data:fxljw6a2,iv:OyAiKtOoD72IcDWIjfyPeTsRGYPrKhvnYPuRXEDPrjk=,tag:pxKo08rLc//D6lWzyR6c2g==,type:str]",
"selfLink": "ENC[AES256_GCM,data:NPLs4O1E,iv:93fwEJX+SziSfBwNYEBwsiLTzELPcnGsNsfZKN0AI0Q=,tag:217PdJCa0iwQ9k6k+CgRtw==,type:str]",
"uid": "ENC[AES256_GCM,data:rAf8j17d,iv:C1Qv1+7zRpHhZESysH13PyqbjXpXb0YDK42P0uOwJU4=,tag:wXGDljR4USc9RTM4awYthg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data://G9Ks0s,iv:I2/vHQA9gxVnzqS6ncKEMCpIfTFVm3qcjornU8o9ysY=,tag:MRBUCDyFKWGob9BzHkx15w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"addPrefix": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:pCcO5mI8,iv:QMV2COuEamakCWNpHZnDUxVlqGLee0gksjLLipw+JAY=,tag:BiVvovZ5+I1zyqYG7lQrqQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"prefix": "ENC[AES256_GCM,data:IRovN65z,iv:H/huoClg055ElypwcRHT4m/DQw30w1a8AU+f39tuENs=,tag:yHdc38tm4MFT/HqQR0PNIA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"basicAuth": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:DN5TMsHE,iv:IQNcUlCNt5/I2El7mwK9s1r9gXTFJ0r2Cmv2sIp/ao4=,tag:ZSOGDeMt2Ms6KS4mZ3eSHA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"headerField": "ENC[AES256_GCM,data:i9h30kU7,iv:4oPLIfBpahTME/0oEqZbY9AcaUZj7B+dbAE0AIR+bHc=,tag:zuCHAoYk46FSwRw6ngtgww==,type:str]",
"realm": "ENC[AES256_GCM,data:cJXtOZoM,iv:4fQ6U/A+ytH5GePbw1SSHaldOLiAGGl7I+chOzisbIw=,tag:ZzfmfKq07ILgeOhtNewrpw==,type:str]",
"removeHeader": "ENC[AES256_GCM,data:7gOX+w==,iv:bjHwtOBMpkCq3PDlQ22GAIKF7TEXcV8RcJaRXHHE3KA=,tag:YmMexic9sUu+gmQcHUAq6w==,type:str]",
"secret": "ENC[AES256_GCM,data:XC/N8rmU,iv:6B50c2I7FYqojC/DXQtLpB7lfwAY/Y0ZTnuS0Jccw3U=,tag:zaS7dzsoNnv0A2GLb1gyvw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"buffering": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:bBubkTey,iv:fB15TOe7f+ne1X0tbTROp53oUMyCzjm9hQWAgZynvw0=,tag:tdAYE11hzTVpXyzMvn3kiw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"maxRequestBodyBytes": "ENC[AES256_GCM,data:nncQPi0e,iv:GhMHvfNV+a1mRbl/zRlewHkIzLfdwoUViGTTscTnmKA=,tag:9qQaSPuilfERRIECUpAB4A==,type:str]",
"maxResponseBodyBytes": "ENC[AES256_GCM,data:u7ag7XxP,iv:PvSvlFlKBRyLfk/0DN7D9JZHCtULyhgVLfU9j+abQIs=,tag:TY0uUb5X793cOhBt1jsMeA==,type:str]",
"memRequestBodyBytes": "ENC[AES256_GCM,data:KGUZH3zh,iv:GzPgWzHm5mGzGgBzqoTodIGTH23n+tMHyNILGZI6EQk=,tag:CeHrqcAC5XN04Keo0yxixg==,type:str]",
"memResponseBodyBytes": "ENC[AES256_GCM,data:Uiumfg51,iv:6m2oUImKajxsAK5LRdqphN6B1rDMQCdQRmacVj1IFIQ=,tag:NIyvO9Vb4WZVT5I7RApAuw==,type:str]",
"retryExpression": "ENC[AES256_GCM,data:ab/4eTmo,iv:HyK4mBR1fHGl7XVLO16tbLYGp/ZWjDeSEqQ4oZ4x/6U=,tag:YIz+1wtgv4KcHOeg9RH9mQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"chain": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:KEbJ9RfA,iv:9+RccUXPtUheS7SMRsYr6NiipKMY0UYm+wEf98F6/2Q=,tag:BpJ8HOekw3Bxs0FKLwTEYQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"middlewares": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:NOES6w==,iv:CHq9VpnN0KI71lzg1S5kZfkczUipd68O34LuyCncvnA=,tag:7hG0HZ7JdgLfnHQ3WaTJyg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:hSpHkoSs,iv:Y1vkwJUvGwZ+yL6ZXJ0xsUmYksiJTV/KkWKoo8VG0P0=,tag:NuUh/PiA5UHyyqDjGHtDFA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:k7ftzxuF,iv:Qv6yCUxiC/Ei4fUhnV7NWmfcPcrGtTNiSaa87ajSnP0=,tag:DN7sAuTHc6mvnkrtstSUOg==,type:str]",
"namespace": "ENC[AES256_GCM,data:JE5jKLrd,iv:QyWAcKVwufOTceMHVXSJojj3R88iLDqWXW03hxaPcYs=,tag:Zk1rV6uRP/9rLMlXWDUnpQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
}
],
"circuitBreaker": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Dc9iWsF9,iv:6EQzPLckMf2piu5Nity3jVNAkk33I2CBbsAPdab0MmA=,tag:UiX0kItTpRwLtdmBPRm1AQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"checkPeriod": "ENC[AES256_GCM,data:/xFRrszX,iv:KaVo72aHtODR8kfiJ3Pn/bsMcVXt4sqNI8HCorjcqoQ=,tag:EeLAox5shkvVGUpt9KfRNQ==,type:str]",
"expression": "ENC[AES256_GCM,data:EQk03uO7,iv:2EybBYnznGnM0AiDEb8V6HGUp1CKSLrZjtEFVBAvy6s=,tag:ancmwyc6PDhz8cA7qP1y/A==,type:str]",
"fallbackDuration": "ENC[AES256_GCM,data:Fn2fqsfO,iv:26zw4PBqZ6HM6fXKp8EkNtSEp708fzmafxVzmMAZJs4=,tag:8JjZfEXe6DgBfRNGp7YKjA==,type:str]",
"recoveryDuration": "ENC[AES256_GCM,data:DiUP6Rmn,iv:GZo+cGN95jww5D2yCFBYJTQs+CzofdtWmT70AXshtOo=,tag:+VY2dtc/Nse8D4b8tT4Kzg==,type:str]",
"responseCode": "ENC[AES256_GCM,data:5kYBk0uq,iv:hHWsxn0BULovaTAxucxJGQeusgAAOhl2ArZmGXoC0/w=,tag:6zNl6uX0R/o1gj6cihZKeA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"compress": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:fqJ1f/Ey,iv:1YWmFMW0//08Q66pGiinbdrhJ/ARtYlaKy5mG5+reDk=,tag:q0SahR3l2cjjAjc8odFwPw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"defaultEncoding": "ENC[AES256_GCM,data:MA6tdC48,iv:Z9EDVj0jJo5c8fc5+HEweQwpi89Qbi3WLjLenrKKiLA=,tag:yoT+sMDx2TTd3Kd6I9zq6Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"encodings": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:CYA8gg==,iv:XKQCdrydJ5sMyqFIzBxN0G1jz8DJQAJhEdmexUKrRAE=,tag:1SMLPVQlgsW4V2+vNUaxzQ==,type:str]",
"ENC[AES256_GCM,data:lv7UPE4J,iv:f9qmPkiU3qJpZGGblVqoB3dVg7W9b0UJIcMsz1O04KQ=,tag:Fv4cMSNgdzxgnvzgcM5wIw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"excludedContentTypes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Y0WiAQ==,iv:k7RsWRIBwMYXmpEid0eapJ8a1VgB+h1HGijeieBOFuo=,tag:JI5Q7aC4OM/NeSsedCS59A==,type:str]",
"ENC[AES256_GCM,data:Ymu6Z+1M,iv:azeUfNJbFI65MvXkrJQsFdcPd+4MG1jHrtzvXpJIAbk=,tag:tjbViUua1zIt4emk/Iun9w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"includedContentTypes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:iWOYGA==,iv:Ef0II1igxq4s6Esf2UJEBWBN7/w3cF2M8ZJnz6BMI9A=,tag:WCitoRuMfCWyYETuiJvvng==,type:str]",
"ENC[AES256_GCM,data:zhHyc9cW,iv:/8WS8kG/4yACivKXR7fi811XicdtRmD2EwmvRxjDeAA=,tag:N6pPmrKepRKOlJ7QeW+pQg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"minResponseBodyBytes": "ENC[AES256_GCM,data:2+m6mARH,iv:KOSAdP3oWlkbrPNCkHXAV0gN9zWGe3XBiPtjzGOC8Ng=,tag:5CG/HsNs+0JJgd1q+8zsTQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"contentType": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:WiYGda6I,iv:fZAW2ZJZMb239WljRtQYi8hqnH9ZtR5FCyH2MNXA8X4=,tag:ZFKl6NDwjJGLqAKCZjZMAw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"autoDetect": "ENC[AES256_GCM,data:jDvZUA==,iv:bxnNWkjJNtqvbIpFUiSSLqSvgkJHjaMecy0vPyvpJFY=,tag:fh3Owd1yJiRd+MP6pTLMvQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"digestAuth": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:iL+s/gVU,iv:j1EyE/4pqBwf21bgDQIJkuglYVtqQL2AHEWXRv0+ww8=,tag:wtUB5O0LH+ozI147hscRmA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"headerField": "ENC[AES256_GCM,data:EngKmjyQ,iv:0H7S7Dvypkt+hkMDZPcrH6I98lW45sYwIKhvw6SH9ws=,tag:cx+Il98pFgW5/qoXpXG5BA==,type:str]",
"realm": "ENC[AES256_GCM,data:09Jq7C/7,iv:rLY3cu8zIOAUNmHgOrwVZcHhJFuriaBEXMQ7erpz//c=,tag:HOkbVLABRNmKwaanRQQbPA==,type:str]",
"removeHeader": "ENC[AES256_GCM,data:yoYeQw==,iv:KtujqzR8B55JZhFjXCgsnSyKNMivHP3pjfVKDyZUO9Q=,tag:8Jvj1PoLhXHxcU9poOgEpQ==,type:str]",
"secret": "ENC[AES256_GCM,data:bVdRx2dH,iv:t74CzvbJC+rvYzC7TEAa4hVrM3AiMW2nXo4N+jkNob0=,tag:7px/TRTDIb2ef9vyywwicA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"errors": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:92mMENnq,iv:WW4Lgitc52O3yCf0jc7sgpKACwSBI68gnZ7/rrEyW/g=,tag:dClL16lfJtkIv5SJLwmkrQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"query": "ENC[AES256_GCM,data:XO3HKaCs,iv:aaAeLlQz4f33zIjVr02JC1LFOX5w1uxK5OF4D1qAeAs=,tag:FBfFveoic4BFK7VvV9H5tg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"service": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:XxsIPJ3m,iv:/5QQO0aTeTldwYJPX7jgUH+BUg9M+jZ5caoVoTqpWLI=,tag:n0W4W/DbZZ9iJALetLBe9g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"healthCheck": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:zIzAzJh3,iv:ffBoPs8jQNhfsm6BLzDa/hXRfHUiI3QYS7Xj1ogP0kA=,tag:8by3Ns9OSZKzhYl7FaXU+g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"followRedirects": "ENC[AES256_GCM,data:usdscg==,iv:Pl+sBT3NdWazi7eggNDE5ZRmyf0opMK1UMCgxGM6wz4=,tag:HF+79Ys6RjzstVu5LYLgcA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"headers": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Spyk,iv:U5WRHSDRLZKCaqAej0avV7ldolehnz8NiNU2ljl60tA=,tag:+Aza4p7dAkZyRnzsaDHaAw==,type:str]",
"ENC[AES256_GCM,data:aQMuPydo,iv:yV4NBTNNmJ3QLdR2gfgi78HiG/ACW6/5eLlfgjl/x4A=,tag:Z2LwXlibflXYjuidtwSVxg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hostname": "ENC[AES256_GCM,data:FTOZak6B,iv:9GccIcctzNwA3DYJiej4Ddt5rYk/ZNmX/nooVosPg/U=,tag:cKPZ/mvQZufg8gON23adrg==,type:str]",
"interval": "ENC[AES256_GCM,data:2D/RcsIr,iv:b2P3BUZJUhm/ykC5Y2JDQNqSMBxf0cTkOiXva0iLBmQ=,tag:7oHWaBhY65rO6jMlgV1KHw==,type:str]",
"method": "ENC[AES256_GCM,data:097RRDb0,iv:0pcOoTt1BFqtHFPI4rmmlaoeFxI63tm9hnYapddpvtI=,tag:GwB2lCqWaMTRixEQ8Rx8yg==,type:str]",
"mode": "ENC[AES256_GCM,data:2yvaeNuw,iv:3K5jnBe7J9zqdJf1TNJHQaNeR7Ar5yvJkZgmwSFoIfE=,tag:fvyDQSbFN9WgJ3VZ8pFKug==,type:str]",
"path": "ENC[AES256_GCM,data:1VEdix6i,iv:b36VfSfa6QjDirtuYMQ9CjVasw5vfudotNob/kZPQjE=,tag:5VV6K+8o6q3sv+aomarj7g==,type:str]",
"port": "ENC[AES256_GCM,data:KJ+gmnLQ,iv:n0PWhdH+BYlmWcnnVSb7ZI4wZvCaVFg1VNlq34iT1JE=,tag:HJiXsm6g4jyGm4FrR+JYeA==,type:str]",
"scheme": "ENC[AES256_GCM,data:/WvnwOot,iv:2F7IdW9+Ojmlie6XzNwbGeKI3RGnKCEiNdf6DPpIOO0=,tag:rZ+KIly5G/+B7FxIt9J3XQ==,type:str]",
"status": "ENC[AES256_GCM,data:7BsN6OS3,iv:ZHoKpDi5ctjPl8f9bmIp8mEH8suY1V5IuFx2RJ8ZtKU=,tag:bR0VeDWNlZWhk0kp5dPvhQ==,type:str]",
"timeout": "ENC[AES256_GCM,data:lI1DzmRk,iv:JCaAP4O2IujVIjaomU07zRyOW9gyuc4f0OCW5AJQSRA=,tag:MXhJ5s1g1BjWcsLmgyEjDQ==,type:str]",
"unhealthyInterval": "ENC[AES256_GCM,data:EJRXXNpO,iv:s4eKCxfHdIYyc7QVZdeDl4hcR5nuSCYLApEurKnX+JA=,tag:FJD7M/TcZNv+w0l/Q58HPQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"kind": "ENC[AES256_GCM,data:yapX7gec,iv:OCgIHF1z9pYPp/3MXwV3QBfaMI4YgHWZ4bT0TWAR08Y=,tag:jqM8grr7wMpgSGu1v9MJFQ==,type:str]",
"name": "ENC[AES256_GCM,data:KyrnIoAi,iv:9s9dKusnqQ7ndNrTjrONiw+H1WwSkwzWqM702U7kz5k=,tag:3JtmpHg/uTTff+RkCPQIJA==,type:str]",
"namespace": "ENC[AES256_GCM,data:XmWusQlh,iv:wBYrG4Qw7iWB1Qq4dcyegNWtxLaL9DBRTB/G0/K/Hrs=,tag:ByoAlYdiedezElr7P9ijyA==,type:str]",
"nativeLB": "ENC[AES256_GCM,data:wvgh3w==,iv:SlsQ+Ib6R9Zd5CE5btXug+WBrMYvQGwJrEeuJtRU7GE=,tag:zJJa6y7e2qKdULUzdolouA==,type:str]",
"nodePortLB": "ENC[AES256_GCM,data:PuTi2w==,iv:YFWIoT+Ia6FwJcHJGa1dvZZ23pF2r+gBw4soPgRHr3s=,tag:6MpVOo3zTOhkLZ7h/C3Xlg==,type:str]",
"passHostHeader": "ENC[AES256_GCM,data:jsF46Q==,iv:I6YRg2FAN9o3xZprXAjFTVVg1rlBHKFgbb/JNJs0DbM=,tag:oFWaP1b0q36r9xIFMoqKSw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"passiveHealthCheck": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:5iUP6q4z,iv:+j7jCr8eJh9sDS1W+wlIPsuI6SjRW8AMOpMQvZ2ZI9M=,tag:sGQz48Fk6Yf1iSyeqC7NJg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"failureWindow": "ENC[AES256_GCM,data:lgLvhD3p,iv:5xvCVYy5xzaPbk+5jkUplqMCQsS/kZz808ljaOam0Ro=,tag:tvKmne7CxNxxFl2vyB7xZA==,type:str]",
"maxFailedAttempts": "ENC[AES256_GCM,data:4+k2bPES,iv:ANFRxiDCwLPyh82G2rH2n2SLlY0urRCTSzkGiks/2hA=,tag:cRHPBQ4cT98uABZoI8gyGw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"port": "ENC[AES256_GCM,data:2awS3FoM,iv:nNO3gq5odWQhS5foeuq66CGDzuMZMO4QtBN7d3vpEio=,tag:8GkZvDTpfs5xpJuxTsFNfg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"responseForwarding": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:b+60kpWo,iv:MUXel2GE18NzCLSTaBvPCsQgEcTCszOiSE0k+a+YEYw=,tag:IBBzUbAek490n6zUTi5BnA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"flushInterval": "ENC[AES256_GCM,data:gipDBmtN,iv:3oGeNOmnHBVwITRnQrpVieAVzUC8DuvJIWZRaNUplFs=,tag:f/INnRoNfsKJT3d5pgb1wA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"scheme": "ENC[AES256_GCM,data:ZV+Lksf7,iv:aVrou5bo84nvDIA+v7RtiJoG/9fS0K5z2ue8NjhKPyo=,tag:zgOvuI38jFsWb5ZXuSNGBg==,type:str]",
"serversTransport": "ENC[AES256_GCM,data:0pAbHVDp,iv:G/M0hire1eXvl3FXXo5muA59PXb8zEZKx4FOLG9lBsk=,tag:mrh3T4AyjTItysSZToOBCQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sticky": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:BwcFW9z8,iv:lylXBVzQG1HFVw6q6KXO5622j3L21bW3j8sjAJNQ4tQ=,tag:lfy5mQgjNxqnvJyfmq1dnw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"cookie": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:30HkhqXH,iv:bz5A+qSDMDJ00Vk2mK+a1NXx87wCNGDA3FbSHYK9Iow=,tag:kvtsjKqbopwAETc5hnRuaw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"domain": "ENC[AES256_GCM,data:J43zTDQV,iv:jYEK+vOKGS1inIdX9Ld0BcikygzIx7bkXCXCW+/WRak=,tag:h0ZD0Af1r/Mo7dKS0vWEIQ==,type:str]",
"httpOnly": "ENC[AES256_GCM,data:68Yusg==,iv:eCIjExcCJcNWWePZIALcftFixeMfQL78GrcW4nSeF1w=,tag:PHaUBz/6uRy0NFkRe6wYgA==,type:str]",
"maxAge": "ENC[AES256_GCM,data:g5utEwUu,iv:wi9VudYiMFOtPBxN3excFRe0HQ104X3Ds9bnJn4qd2Y=,tag:s4Mnqrtp5mFwBtzPc/KTtw==,type:str]",
"name": "ENC[AES256_GCM,data:306Cjex6,iv:ow+4v+xMqykD4NvaDPVmJPSpUY6Yv/+VSnVbMRBeEnU=,tag:Z4kS6L63WfXoymyiynz3Iw==,type:str]",
"path": "ENC[AES256_GCM,data:pTMLGYNJ,iv:MnePMjWjFdK2t4yv9QmMC5I0Tv/vQe9YSycQNbXt9Bg=,tag:jjhrLnRIFLz3QpDx7WOY4A==,type:str]",
"sameSite": "ENC[AES256_GCM,data:sL3gsjPr,iv:K1BdvRaawy+jZfWUui152iUC0XEpTrqgWOyiiVxu3uo=,tag:gQpQjI80kLYptmMOk9XOrg==,type:str]",
"secure": "ENC[AES256_GCM,data:4cbS/A==,iv:FfOtf65CQCi74GLxTvP/8Qj3BNBXU7nSXIhztr2R7BI=,tag:YEQwQzPPMOzUc4H7zoGmsg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"strategy": "ENC[AES256_GCM,data:yNqNHf/c,iv:vTEHJmcf4+CfxE9+igPbGLOfxAjyUgNSaCt+zA3H6AI=,tag:IDr0jvEJmfHtzlQ39w+fmQ==,type:str]",
"weight": "ENC[AES256_GCM,data:Y3qcqZ2I,iv:TaEXP484S69j2zoDFXQiYEDV+N1RkT66rQ5DvdKdhGQ=,tag:wxxYqagZoMQzhNLo+kIS/A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:cswCLw==,iv:6uLLf+L8TnfEPCH7F4SYMZ+aI1rKw+kGHeVQYmI9EkA=,tag:mTQ/T0n3lyzZKlgKtSUrOA==,type:str]",
"ENC[AES256_GCM,data:Eb0tuHeQ,iv:p210JCIIZcL8m+FSCdwjFPSJenqW0C8M6U+MXD2fqRw=,tag:z2gEQJSIJm0EywGeZZo7fA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"statusRewrites": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:TWH0,iv:JE1wUFeBQCzqmXmLGC6zyT97IDM3qp3qKv9b8+2+gFM=,tag:WWTmS93jbZb6LbDHIs/qEQ==,type:str]",
"ENC[AES256_GCM,data:qHjG8q6F,iv:sl9AtDUuMMcltQGE1fedtgbBgdpYZ4jGvmzsaNyFQm8=,tag:o7tuYUrjXdYsWQccQKyksQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"forwardAuth": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:c3e5BbmR,iv:Nw33IBkQw63SKmtCz5TleXHOL6o1D9CvPyD4g6g2OVU=,tag:+zP7mtaN/8n//w76rDEuLQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"addAuthCookiesToResponse": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:X9jDSw==,iv:o72ou6X1Y4reybsWlCJ6fG6ENsfyls8EVqb4Kr1i8Jo=,tag:SG12qiUWQc2VnOKwXfGIRQ==,type:str]",
"ENC[AES256_GCM,data:T6rnHsmC,iv:FGZ1T2uua2mU3Kka/Xi4eMVbfkpaDsjxdFI6T4pru9Q=,tag:TYlH9dkQyNQJcGCcvuQ3ug==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"address": "ENC[AES256_GCM,data:/n3bQUGH,iv:idWDUfnWRzOa/0eyfZm1Y+CLn09H5+cgcy/FSbLxPIc=,tag:TQ+TyecouGze1/hmLqtS7g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"authRequestHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:TZI9+g==,iv:xA8wPG6+9kVXs4zjG5AtDYv9b4OzwfYtBwLJWYfxwb4=,tag:0ktcwHJpNMh7/dYfn7Nppg==,type:str]",
"ENC[AES256_GCM,data:GXHoeHIR,iv:z/sJTw9iaiXch/f2SF1nLBFMbVBr7t6D4vuDuGQpc2Y=,tag:mVXSCqBTDtDsGWmRlZN+rQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"authResponseHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:7vr2gw==,iv:dvtCbzIjGPAFIKzDYD0PTaI0pQ/A230pyHXB+aWHZmM=,tag:MhtbwbIXIeWAU7Zsb8ps1w==,type:str]",
"ENC[AES256_GCM,data:77IZS8qn,iv:vqbQRb3CFy4F2sBcX9YcGQaKLryIAW42DCfZGAWRv/A=,tag:PdKy/Yt0v/35uOrxtG/ljA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"authResponseHeadersRegex": "ENC[AES256_GCM,data:GCf2ghtm,iv:MkRwxLoHiXr9JXN0MUANv95XfpnaWucxIZDuvTU7zis=,tag:wZxhelsnpQ0IHkUOhGJERA==,type:str]",
"forwardBody": "ENC[AES256_GCM,data:4IkB/Q==,iv:+mp6jCp6bpVmUCSQtK/QeXQPut29+Lz7MGqTM2rxKPU=,tag:Dgcec2D0cC8Hv4OzAIkocg==,type:str]",
"headerField": "ENC[AES256_GCM,data:yMtW8rlV,iv:RZKp0EEtOP6luVHQCRa1wcdJ3R4MOMT5FuvtLVbHxCc=,tag:QumjtzLY6IRiAl0WATbw8A==,type:str]",
"maxBodySize": "ENC[AES256_GCM,data:4epY2Y1Q,iv:/JqwqWuGK73Ro2257mfpoAmB7a7Fb24KzC7GHg+4hnA=,tag:mmQfvEkZuMik05mYx7l49Q==,type:str]",
"preserveLocationHeader": "ENC[AES256_GCM,data:KK7SRg==,iv:cLIiC5smXG3HC0n/kj2I39DqSDxJQBu3J7SAQFjAA6g=,tag:dNl2rYfVT1fgzlpnt4zB2g==,type:str]",
"preserveRequestMethod": "ENC[AES256_GCM,data:ENKeRg==,iv:Ikqer6/6BAwj32atmBX43VdoorSkTQKHouzxYEiGqN0=,tag:vC106jqJuWxN/o2G9UxDWA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tls": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:TwVyT20i,iv:ampwdVW4tOotVYlm/L3FEq9jyrKu0WgYCuPZClt41kc=,tag:OGRFI+vo2ZeMenmZPF6I3g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"caOptional": "ENC[AES256_GCM,data:WDV3UQ==,iv:vtCrzFWat038ZgD4sRr1+Nw8b3+AqI8EV8zevzcJi+4=,tag:N/bVKfrhreNDSVu2sMEj2A==,type:str]",
"caSecret": "ENC[AES256_GCM,data:6ic9914/,iv:nTjRE0VrqfbU0ENYvfk0tkORSkpg+MKIduYKG+vWyhA=,tag:e+za8qVlLgYPJwg9WcLc9g==,type:str]",
"certSecret": "ENC[AES256_GCM,data:bkeirUmS,iv:SgzFlrBlPp+DbA1OhUaJN5LJt9Hi3rDSmJWzz2+E4y4=,tag:WVNGCuy0bMx0fJFWTFNhXw==,type:str]",
"insecureSkipVerify": "ENC[AES256_GCM,data:e900uw==,iv:SVRmUGJAMTIcqE6PafCoHwopT8QiE6H3Xy5pk+OL0OI=,tag:fZdpQ4PGZVVvtqjWUsHO2g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"trustForwardHeader": "ENC[AES256_GCM,data:KewYEw==,iv:7IN3lMIah7c2S33IOalxnTS09KQMb5kPAnDji/H2b/4=,tag:AQHShQhwOr6Wa9X2A2oUiw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"grpcWeb": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:pRXK/NCZ,iv:IqSyA/UWfsB1AwH7Y6Bb5J1xGdFY5BWPeoPVA28yEb4=,tag:6b0qTjOdw3TzJGgihMDDlA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"allowOrigins": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:slnMzQ==,iv:qVyLNPO5a67ut2Co2ng8j9MZsSNwmF57+63Dt1c5YHY=,tag:QgApfMMoXow+P5UYNsfxtA==,type:str]",
"ENC[AES256_GCM,data:2+Nm4STK,iv:LHXre1Gq4YQINtgkwgfazbnDjzvde0WbBy8GLO1aKCY=,tag:OeuRx3MQPi1Qit1L93VY6g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"headers": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VZGAFYKv,iv:/TwERjRlmufE2HzdDLIsBerDXGixgGwx/i47ciWEkk4=,tag:KafAvUNsqd+F6cd4zVmXbQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"accessControlAllowCredentials": "ENC[AES256_GCM,data:fMAarw==,iv:lQYoV8HWyZiGKxaK+sLreKG0XZyfES0ZhJ4gLkWd/Mw=,tag:nE+m2yLDV/0nlQlRDjVqqw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"accessControlAllowHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:2bCTYw==,iv:krXqkMfN9+UEoyn0mu70HEs2o5xWKq749m+gHBPqDNc=,tag:hXb8JTihatnV3XAJaRekog==,type:str]",
"ENC[AES256_GCM,data:5aqyJaYf,iv:nYom2VNn5i8C+YcEC+KOC1UaF1etoEj6OxlZrMswMm0=,tag:STuOcELFIuPP3+eGI2pDew==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlAllowMethods": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:u1g9wA==,iv:FhwqJoYt3HbUuceh7eGMRDxnMGlggLr2zVEUlDqmrQQ=,tag:q43bZlhHb36QZgZqyCOd9Q==,type:str]",
"ENC[AES256_GCM,data:1lhprpIg,iv:400Phiatdxp+A3tbWQk3gSdcJ+2t2Ow8yhav4H6ytmA=,tag:q2MJYD9euUa6QgePNILbmg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlAllowOriginList": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:SWWNXg==,iv:fxgzWdpU6pdcuTVxA4xzAhnkkusCrzo8Y3L5unpa4SU=,tag:uqbc7OjLv2Berlowj72VJg==,type:str]",
"ENC[AES256_GCM,data:t+D/fIU6,iv:YUE8kcBoRcu6N3M1TNdEebW8bjwpNm2Pgpuds4lN1gs=,tag:dU0P/c/dbbyKcj8tik1/Rg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlAllowOriginListRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:MUJSCw==,iv:0m570xZpF8WFzbxKcxGyah6jGV4rFuWuQ/5CTds9SCU=,tag:pXZeYrcSYpRIdB0katj1wA==,type:str]",
"ENC[AES256_GCM,data:YhHiDxgk,iv:goLyu327y2kR8AZ/erY4oXzztcXm94ehE1CR8ZWw9Eo=,tag:4V4mFtokMeOrf/AtOulNRA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"accessControlExposeHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VSOldw==,iv:Bj4u8D4JThP1b9G1r1onCquqYMwZOt0Oh/QkNxtTHLU=,tag:CYbCl8KRe065O2+TBKTAfA==,type:str]",
"ENC[AES256_GCM,data:ovFG3nLr,iv:9gcp36vmS80O5IztJxS7VKUFrWb1OO2vduH0ldb5o90=,tag:Q0c1+XrGtE3U02DLtcoHHQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"accessControlMaxAge": "ENC[AES256_GCM,data:U4n1Nt/r,iv:coXWdRmRoCeI2r6JAtxmHo/BNIR0G/RKdmUkwmm/MXA=,tag:YuRVBjO7f+eAGe5KY+jtnw==,type:str]",
"addVaryHeader": "ENC[AES256_GCM,data:jAFRDg==,iv:AVPaSTZVT0vLhfbLghfXtnrYoUsi9pVmSaOZUrzZfbY=,tag:LTQ/a+iNd3TpB2b56HkXVA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"allowedHosts": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:TxlZFA==,iv:a+opW1uHdsrd07Yq8xkSE0eYWazbr+vSMbYuc1CUAfU=,tag:wbjX1etk+ZR28MPZjUeVqg==,type:str]",
"ENC[AES256_GCM,data:OVA7+KpZ,iv:yXVnPwJ4tfawBFmJzC1IrrDmvqWbe8nqjkjeAtd/wrY=,tag:EC0eT8eXBEybhoxCmh6s5w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"browserXssFilter": "ENC[AES256_GCM,data:XW1jow==,iv:H8fUuVtRzV2QOvZzxfN9hRmHVDgXmf6ML07Q07iLHTU=,tag:lFTUtlfb/THqUX6wZbMJLw==,type:str]",
"contentSecurityPolicy": "ENC[AES256_GCM,data:LEj32var,iv:Hn19vd4uRpKb7fFPvLzQYtmZSkUMTTTs9VnYSHI4QQk=,tag:pE0duxBFDnmecXaSJWLgoQ==,type:str]",
"contentSecurityPolicyReportOnly": "ENC[AES256_GCM,data:Kh6oXPQc,iv:YtXg8q72vr3LYRN9fEp8dzKsg14Zw76X62low9nUP7o=,tag:njgezmyYWghM036yYcDxpg==,type:str]",
"contentTypeNosniff": "ENC[AES256_GCM,data:e/Ij9w==,iv:N1jTQjk45ZYKluV2mLIPHJxlnbPq/GpvKXNpTL4zhCI=,tag:hBo1pHpoV7VbIQhW0e4bJQ==,type:str]",
"customBrowserXSSValue": "ENC[AES256_GCM,data:tDkvBHtF,iv:mjK5cKczo4RKFx3ypOcKaH4M4zbihAqDqBBF6U57LGo=,tag:M2vVpOoyLURkjiRfnvnhsA==,type:str]",
"customFrameOptionsValue": "ENC[AES256_GCM,data:c7Osyw1k,iv:XPKkVnuu2p1fCfQJJ8+myjHxU3pC+oGDRcypmYHfYPc=,tag:+KkCCylFqrBWniVpwlA7Ng==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"customRequestHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:QJOr,iv:JOCF9XHpdV1f/jzfT/POYAuS4Z4MFuPb8Z3lV0SyYAc=,tag:OlEPsh7RiXyehvqzGjxWNQ==,type:str]",
"ENC[AES256_GCM,data:YfhPg1EU,iv:tImrz8mS5tv8pbAiHp0vCDAAG/iyFpS69KqNy/ypNAo=,tag:7uVDcx4v7LAq9uzvRrcqJQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"customResponseHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:SBuQ,iv:uBwpucUWXT/8aIjTBeezLMp+SGcoO9iG8sibX5vn5Jg=,tag:ROikVCvgLRCWEabgULjnSw==,type:str]",
"ENC[AES256_GCM,data:7ZkTMO0L,iv:J69C8F7nTVBVQc0Vyt2KW8hY2Sym9EZt+QWVSpDWv2Y=,tag:qSvp60BtqBVorwTRgjNSGQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"featurePolicy": "ENC[AES256_GCM,data:5eRBcYe8,iv:SBzBPcK8kdKHvDKvE2jN1T0CrCuFQHdS6on4R4ekUxA=,tag:/Wyks9uRsTOYrAK+JN6EEw==,type:str]",
"forceSTSHeader": "ENC[AES256_GCM,data:VOVmLw==,iv:rOiribSWy3Z2p9gKd/UgqRemFl3TkZSDSIYTXBSZVFU=,tag:Yfr/Zxw3jUcmT9/DaEZakA==,type:str]",
"frameDeny": "ENC[AES256_GCM,data:vR5L1Q==,iv:IghAttJFVCPSMRgAbzca2T6E2W790urms6heK63mBqM=,tag:P+ScH8IRqa6N+Qc4V8hg7g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostsProxyHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:aDZ9Mg==,iv:aPxAk+8rRA25cXR25EPuklxKdk6L5Jbwa+c7zLJIQVw=,tag:i8i2s+M8dRR3Aue+KPeSlA==,type:str]",
"ENC[AES256_GCM,data:A3/l8vaf,iv:Uozxbf1LGs3xU/Bf2vsTpO2XAcg/U2p6zuFBkdhTWA0=,tag:U+7eVDgmcQlPhBIc/nFyyw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"isDevelopment": "ENC[AES256_GCM,data:kt1wxQ==,iv:Wzl5k26rGs6mW3CBwHUuFZmINGVsgO8CDWERvuUs6aw=,tag:gy8Q+8i9oly5XOgd3OVLRw==,type:str]",
"permissionsPolicy": "ENC[AES256_GCM,data:KIM2y/XJ,iv:cw9NLYEyWKJJLrvtSdq1k05lFE5NJV3FjlKOBYBmwhg=,tag:4pvpj06lZq1sFbmOFfjlXA==,type:str]",
"publicKey": "ENC[AES256_GCM,data:p2h9xQX0,iv:bURjQVoDGtBS45raT4RvGkqjddmtP+heJ+IoIUVEUOo=,tag:sLq5RDvyRPr5rvmIlXInsA==,type:str]",
"referrerPolicy": "ENC[AES256_GCM,data:E8oM6rU9,iv:8wxPVIaLPddgEL9vioQHkCg/L9OWMkUCVV4alz7N1RE=,tag:0psLID4Yi3TqAQPb+WjVFQ==,type:str]",
"sslForceHost": "ENC[AES256_GCM,data:hRbcuA==,iv:Kd4GRb6CpkSew+23ZIig3lPtlDFHfiaTIKAiFduVrfE=,tag:dbr0xHw/tvvJWOduH4du5Q==,type:str]",
"sslHost": "ENC[AES256_GCM,data:oNbXxiP+,iv:Jv5YzqEniTeoD0Kabr7FkFzQkKl0rFDjulPG8sZdJkM=,tag:pNFY+5hDOOeIX9zQ8jmafA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sslProxyHeaders": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:bW83,iv:Q+CLFheJdIwPVE9uhzitHYae092nJX+sFYNKIL53e7s=,tag:Dg5ZYTyYQrHGF32QbreEnQ==,type:str]",
"ENC[AES256_GCM,data:Gx/feyds,iv:NRlqHGcEl4GzkqvLqMxtjzoh+SN66Va3v1iQwgj8sh4=,tag:aNuqw5crTuWkUaHX1p3bYA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"sslRedirect": "ENC[AES256_GCM,data:VS7sXg==,iv:crDAqQcZTWQTt5s+P8/h8c2z1BA6//+e27/jLdq+jS4=,tag:MZfgcE0jefMs+gq6XmNFLg==,type:str]",
"sslTemporaryRedirect": "ENC[AES256_GCM,data:ScbFYg==,iv:yB9pHEfP35FbTPnBgK5gtfdVzmVEw+WwDnDKEg0gziY=,tag:hQT3e0tTSnwS9zKSSx5nGQ==,type:str]",
"stsIncludeSubdomains": "ENC[AES256_GCM,data:DzjPKQ==,iv:F959KTC17KaZ+hYa5Re/WZUoLcWy9zikJdmHejksp0E=,tag:Hbi0YXRoFVkRiZ6kwlAdWQ==,type:str]",
"stsPreload": "ENC[AES256_GCM,data:7O3AUA==,iv:SAqSCTGaDLqVp006GP2dAOBj2hFIukg6M8Y/3Z7p6cE=,tag:TvUfz9RGzox2El6C5tccbQ==,type:str]",
"stsSeconds": "ENC[AES256_GCM,data:ZpFYfsxd,iv:G9JVYfA0cJVhqpnhv9wkIhh4alHGhdyhFTtzfNjU1uI=,tag:5aDrwLGo8bJn02Nths9QUQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"inFlightReq": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:mZr/x9Gy,iv:s0K7K7rsacwN9OrUFPhQvREO13CbJi4dQ8krc/cB4JQ=,tag:fKEd4XeWbZlXkod/Voa9yg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"amount": "ENC[AES256_GCM,data:57i3SAo3,iv:CXMnSvSf6M5Ngch5R4Z9FcIlinGF6HjffmsfJVacAwQ=,tag:QJrS7lzSrNhnyMSq+NCfYQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceCriterion": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:dCMQG8Ql,iv:jddp/q+ZZs6EiHg8uVehEDfk5UuUETm0Mis42aNKw64=,tag:AVDLnK95etNCuiArj5QkZg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:GGqtSHm0,iv:KxGFe2Yfl3KQ1kI1Ytd0JdVd2UR5jKTd9+DWM+ZuskQ=,tag:OY/RRxLJuW5tjk/1yOY5JQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:C8QI0ibG,iv:PBMJAtq9f0f/O7rP4KA6hbgnXREvD0F8crcihD0Wqb4=,tag:7AxWScpwRxNJZdc+frvuwA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:ECf0fw==,iv:6cNt7rHSJ6GVJgMSPkK1OW6+jY+2U2wUlC/6jASkADM=,tag:vFhYWV2MBuLs9ljCVje1gg==,type:str]",
"ENC[AES256_GCM,data:BbuFTK38,iv:JHfwdAbVBQusZFtFEvzWeP08phDcxdZQq+rN+4pjcPg=,tag:9wzSUQCC8InaTGz+ZoypuQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:yykth8WE,iv:jARJBsaOvqZjuspBJI2CPjkbtaGNvld/nMfoi8fbR8g=,tag:cm61bA1iqX/CP8MmRxRqWQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"requestHeaderName": "ENC[AES256_GCM,data:AQlttUgm,iv:TEHIGTFGcaHQiC6as5oQ4NWHWJq4An70P5fM5r9lMfw=,tag:y5jPPXmEf/kfL7VrjHD85Q==,type:str]",
"requestHost": "ENC[AES256_GCM,data:kkR7iA==,iv:yqIc5SK1W2pZb/8CgoqilopjoH6u3SNrj4DYncAP8N0=,tag:TV/xpqJq0g+7gikqkA6DBA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"ipAllowList": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:PAX9YSqC,iv:QwddLQdZMGvpwZehr9bOyg4Ut0ajD5bQ8Y1L6kT8jQ4=,tag:F8C5uC5BB1NZzc6oNgIjsQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:+OfGAMuZ,iv:7F5Mr8XkJstd/C+ereatTyMbg75YthH1P+nL3ptoyjo=,tag:IJTd24EfNLejHVeYoSCTLA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:oRfSC9Eg,iv:3h4soaa97Mpp76aqyfUNBjCTcuWRi5aLYtYg2jn2VLs=,tag:Gb8J3cR5PWwo8JPSdq3Mjw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:iyPmeA==,iv:V9RwSusMRIJk/CroSSdvTBQpTi6SQEHS3+jOKwNskpk=,tag:KAfMVLZyfRPmNyeSqMqOYA==,type:str]",
"ENC[AES256_GCM,data:ZrlwpLFZ,iv:qPgz+3BByA0hw/SMSRPbsEHIahAEC/JZUlvleewIB8w=,tag:+Uc+cPJfko87Uv7oKpAw5A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:BEgrGY/g,iv:prvW3H/slqdgLAhuOIAq2KTN4mDM7aCKdsbdZDDzCEo=,tag:0qibJcanKbpRGVhq3J7NAg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"rejectStatusCode": "ENC[AES256_GCM,data:DhlsBDuE,iv:ys6q/4S2KNnbIFWoz21OMoYiR0tfU61k/ZneQWAeAkE=,tag:vL7w+gMnN9WGHsddGyGeKA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceRange": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:XDc2oQ==,iv:YjaGfemlsgwseuvoZNFS1l3M8VzJk/VGPeItg91tKMw=,tag:qBjb1N+n9T9fDSQQDMT1+g==,type:str]",
"ENC[AES256_GCM,data:skaheuf5,iv:h0tc+im1lVKWgWsLzju3yqCmfvZEMuTR1niOAv1yynI=,tag:z0lj38nEYCxiwSSR5CSHIw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"ipWhiteList": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:dex8vuAR,iv:H9pCxnmMl04CXFidBSvk46qPV+H5WWtuAmMc8XlRGac=,tag:/pHClK27IPIcAmvoPrEqag==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:q12yzRIP,iv:Br/XuRkFwR2OoAWFQy8ARiXWd+edfhhC/d8lJn9/S1s=,tag:djo5y7TH5Zl7yhZ76AOPPg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:+yCGmiQ6,iv:n5ipP7UWOBQZosNswX3uu2DpcfZh7gc/dv0lgVbQzNM=,tag:uQWyLjRgTKE+UkqwqMivtg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:MIBffw==,iv:DLSJzx8hVD43B7hoXA0dHPz1uh6s+s+V4VkBelxTzSQ=,tag:+8M/+Jz0g6VXzE5BK5ELrQ==,type:str]",
"ENC[AES256_GCM,data:Cvmf/2/z,iv:UFj9gVec6ya3JHOPw4eewhlq+IPn2xmHzN+rbtw2XGM=,tag:f3Wx4B6HvW2OJcDUjsjNOg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:4PuC1Ibr,iv:eFWrgPJiednWPtLhIIRBn0pgTbwc7O+4Icmp9d2Wy1A=,tag:HF1DBWGRm02ipeS+Re0f3w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"sourceRange": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:xmZ1pw==,iv:3LAnZYk321KM0CNgzPycfGEJS8W0RAxz8LS1qAcv6xg=,tag:U+GIiUnAlC2iBlbEApK7HQ==,type:str]",
"ENC[AES256_GCM,data:9YWi9BST,iv:CmfeD6Q7JZpL33Hsm+3Rf7Pa9hLpWzfleZG1VmrsuFM=,tag:ryF0J+b2NiX0IqwbPKdAUA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"passTLSClientCert": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:8FE5KMSp,iv:C89tu70GJkv/3kaEYMOYh1464KiA9qnvFNbAG0rYk/k=,tag:cpmDdNsMb3Xjt06OuUh/fA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"info": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:R+igzJej,iv:NNIzl7Wi+UgZxFvTkqrNAhqL1Shngie4zDi0c3f0rnk=,tag:OEZPeJ8Ju0Pc6RJVDbWdUg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"issuer": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:2mQxuVyC,iv:SD9bcvV2faL0QFJl7vaNTYMgGP9gxGW76v7Ytje2CWI=,tag:0ewH+sNu//W2Y+9Sy2SO3A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"commonName": "ENC[AES256_GCM,data:HLF6vA==,iv:1O86owvMP6KE5lb557fQxvLRk+XwhYfrB5qaqm+ftFo=,tag:Fsr+ECyXRaBK2WgqeCFM8Q==,type:str]",
"country": "ENC[AES256_GCM,data:Md7pBg==,iv:DultW4T1O+PQqV8R/Y9h/IXniXUt+JboXGXqYeijl7Q=,tag:39UQK84vek1GpsPvehhzSA==,type:str]",
"domainComponent": "ENC[AES256_GCM,data:DSMpvw==,iv:j9WZgtoMBuedmEHyZqwolFrbQjl6Bj47ocFL6an+kF4=,tag:9qfN8XLnB5RoQcT7ZzMhhg==,type:str]",
"locality": "ENC[AES256_GCM,data:hT21JA==,iv:Oq/racvsH/JVZ2+4GKQfZpU66y9It5M7X+E6J+3M1RQ=,tag:01Ox9v2lRAwMF2xaO8tybw==,type:str]",
"organization": "ENC[AES256_GCM,data:b1jIzQ==,iv:FnwnxoSisKvec9FiRuv/PbEBjfZ42G0+N9GMBuDCO20=,tag:QnAQg6CMq8knI5U4NKOMtA==,type:str]",
"province": "ENC[AES256_GCM,data:nDYEYQ==,iv:/w8WLHM6MjzYwKSqEwYvpPb43Cm5aGibYrZ0kFUxgbM=,tag:EBhVHL5euO6OPwyz/7g+Hw==,type:str]",
"serialNumber": "ENC[AES256_GCM,data:ikpv3w==,iv:O13djDhRz4EAjuAWhuVMFQBkrH4lrsE1uTfoEVdrs/I=,tag:S+MrSGyA4Z4w8bw3eku+pw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"notAfter": "ENC[AES256_GCM,data:LmSBmA==,iv:Ny3ZvQin+9OtRq8XNTKgQs2/yHfIQwnquUyx7FmOP0o=,tag:RU6jL2vLBgnv/vbLFxGEWw==,type:str]",
"notBefore": "ENC[AES256_GCM,data:VbFxZw==,iv:aOUqr3Ce5k/gx5yPze0da52Tfzd8WGeeosMheq0JKcU=,tag:HQ0Sy8c6GmUmbxk9I72xwA==,type:str]",
"sans": "ENC[AES256_GCM,data:iwrwSw==,iv:gQap19N5X4cuH0Zi1cC6CFxF4zbyQIJGt4e0xkyMzYM=,tag:17lVjTUriDJVRhMflChONg==,type:str]",
"serialNumber": "ENC[AES256_GCM,data:aiAajg==,iv:2ft/3E7dmAYyP/K7wTNPCH+Jv07WBB0wzZTDLbp5Ups=,tag:LfbyJyU5aDs9xbdsnoQ0hw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subject": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:iCS3W8Np,iv:ggNJEUTUANJoMulPhudEfiP02D3lf4T5lpyGCf/WVnY=,tag:fPZBrQLxUT0cjrqWUubJCw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"commonName": "ENC[AES256_GCM,data:8X3CfA==,iv:plTSF7IoSIg7PWUsNEsIlQzHw1PyKRwlmA9WO76EF4U=,tag:prlDmW+A6C9K1ZBIUq8EGw==,type:str]",
"country": "ENC[AES256_GCM,data:nc0NUg==,iv:usFTrRk0LFiPay31T1qw6T9J1Bh65R+KUXJ4MPN7bXQ=,tag:8wjhOjzhzos/BXAdh9RA9Q==,type:str]",
"domainComponent": "ENC[AES256_GCM,data:2sxUkQ==,iv:s62ifV76Tfmh9DIsOI7Av4IqDu/PFIRi6bSgEYf28uU=,tag:/hCc3NikgtcmJiYlzfgI5w==,type:str]",
"locality": "ENC[AES256_GCM,data:4G8O8g==,iv:5A9feGBuagieyDRdfy4ySK1timHdnpL4Z1aMquTVH8E=,tag:yZ8/UpztdTzYdxSQQ+I5JQ==,type:str]",
"organization": "ENC[AES256_GCM,data:onpkiw==,iv:FJnyMiTKQTZRoLO2nCeyu0TAeUCkQOc/v/8AszRJe64=,tag:MfdFClNGys39aCDt9OaNkw==,type:str]",
"organizationalUnit": "ENC[AES256_GCM,data:dRDY7w==,iv:yFRMZ6562zAcvwRMLZFb9SsMMMZon/kq2KKlrhvMwss=,tag:Cm8ZR0ys9cIpjDvZyCBc4g==,type:str]",
"province": "ENC[AES256_GCM,data:GkQTLQ==,iv:r+O+316etmGaVeDwUQZQEYR47cZ22TvjvH6gJtVeKME=,tag:EU+l9ZJEiy1jKYiFeAwVhQ==,type:str]",
"serialNumber": "ENC[AES256_GCM,data:rmijeA==,iv:+Rxte+E2hq7NwUCc1j+OGgR9CecV4OADFFPT5XzdnVc=,tag:1oCMg/pxUzSuTw4HdP6fQg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"pem": "ENC[AES256_GCM,data:HPMWQA==,iv:Xrmsb6gpCoI7KsFyhVhDxnK/RctwMi30HMtMTs6Xqig=,tag:TIXFAzKrUTfkv+sY3/g+4A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"plugin": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:PILN,iv:4sslT+pLEKP2iXpvrSvj2dbahUqddx12kD64Prl3GoQ=,tag:9+kJhZLysKrdvlrg8EsGGw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:sO6nL5lH,iv:NNTIwprNFV6ScO4tNAnQH+KWWJPGMva4SrJIfkfib+E=,tag:H4wziposIsaBBgFGxKe/2A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"monitoring": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Tx4FEe43,iv:cA5nnuUTueXj687S6960HikPyQzoVq4u4k+fSkmf5Y8=,tag:3zABE4zdwLwIj8SFPXR7yQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"types": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:xcsivjc=,iv:6N+Qs9Wj4JUx3qU5CEibiW7wamiSOhJ6T5DNaI+DX7s=,tag:eTVwZ5Ql5Phi2/r5LxjLew==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:6g9I8F4i,iv:Z3GLMd8KQZXfGHcXOxwhu2aAVi2IcEcJXIxZW9k4/40=,tag:xVjeerZhoaIDaGk8d2oqeA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
]
}
],
"rewrites": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:lYtLjKg=,iv:giQQ4b0sXwY9IlMcIm2YuJH9MGgq0CjJdWSkHwNL/ms=,tag:qIlbi+LXkU3ucYrqmAnhgQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:kj+vuHzm,iv:IKDRAzYvCplyF4NgwNrmgBmAx2Rjoame8HAwROWe+ak=,tag:+x1ZuJm1tHh/s6TiCZDIfA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:OCFOX4gt,iv:RQQNJPe63Eqrc4PvmfW928BKA96wOmvTZY9WtiolKic=,tag:UbOEUFUBNdgYgazTAYTphA==,type:str]",
"replacement": "ENC[AES256_GCM,data:f7Jyj0Bp,iv:9MKLSZ/jJHLfZxKkxmxm3LqNQQ3LDwS/5E9Gg2W/g4g=,tag:dRR3NcY7qmx1Y2I58bGD4w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
]
}
]
],
"rateLimit": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:DXox+SgG,iv:FzKXo4A2Hx2Ban6Gpy562ZHGuINImmOk+WaWsInvePk=,tag:VPIEbJvzQIG2qLyc1Xn+5Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"average": "ENC[AES256_GCM,data:6iOrixbT,iv:Y9OFiOuEpF1yfE34XpgX9HJqXJiBN6FT/o/5SYi69R0=,tag:VRZbo8XN9b2JcqLW9W0IVg==,type:str]",
"burst": "ENC[AES256_GCM,data:PbI3cj0s,iv:7r6u7RfqJ6HrCWeCRG2lRhd7DB2G+f+NBzxcwMES/Uo=,tag:tevrYFcFgHbq3CY5KseYOw==,type:str]",
"period": "ENC[AES256_GCM,data:ojNJczBP,iv:2uKURyJcMhHF5ee475hzf0kbM8yJTFVErF+B9fJ2hC4=,tag:5pwnS9hcoL3mUYjqh2fD3w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"redis": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Kug95a7v,iv:Cdfuvmv1BPM0pfyuZB5nYmUGENRZJTM4UX2caCa8Orw=,tag:CvXRuZj0VbeAZZRJwysXkg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"db": "ENC[AES256_GCM,data:Ca4YtCo1,iv:7UKfa5N0wzl1ZVNgdmkzCY0Qs+ukKYqJEhtrbVBPl44=,tag:QlTZKCXioXVqyWf+2yu3WA==,type:str]",
"dialTimeout": "ENC[AES256_GCM,data:8M5I7/8c,iv:GBch2j+/tUhu8wF8jGBaHq/bJ6o0DMZDD1EcfJRcNM4=,tag:5dAfh0tnFORB/h4GRI6vFg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"endpoints": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:P1vfgw==,iv:zI8pEqmmS4GTyua/sVpLXuwLHE3LLhxbRzSKGahGkBk=,tag:xJxfvH2hBc81sRhlxPgBtw==,type:str]",
"ENC[AES256_GCM,data:jPfrFfg/,iv:slZMCp7N7dYpGBqrqWYMiuQJQcnPJGrZQlGunSvdKas=,tag:wrBoD4bmzfCQsploPaPXJQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"maxActiveConns": "ENC[AES256_GCM,data:cgnTJi/q,iv:XVxZE6OHRsOchnJlzVlhB4nkgD5CRAUXwyMoTDduGlA=,tag:jHlt8ZEKPNzkjTD7luexWQ==,type:str]",
"minIdleConns": "ENC[AES256_GCM,data:B2X1e80M,iv:gqmOnPSCGu0SwyxHGGUp3Acoc1nkCmZidjwCyuxn6oQ=,tag:SV7MjPFrbeNgwZg6VK6SXg==,type:str]",
"poolSize": "ENC[AES256_GCM,data:6lh1kYtS,iv:eKUZX4+yVRCDZptAj9J6W0UwNoWTQawltKEzVke+pto=,tag:mI08zcgObSqYWYZt//jcdA==,type:str]",
"readTimeout": "ENC[AES256_GCM,data:kWvx+FY4,iv:gtl/axDaRoUb+ZeB1khIk9HL5f8X+unaa4CwE6NT5Y4=,tag:k2+pZ9JCzpPD3dA/HzhI8A==,type:str]",
"secret": "ENC[AES256_GCM,data:G3Js4F4r,iv:V/y6OiAiXSaUVUPiwIru0ko5ViFrMVFfDqOruVZtQxM=,tag:FcTxTc7rn8XRCyrlLJK0jw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tls": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:OrI0tuRu,iv:VtJhUZNSwM3Bc6Z+oo2TP+d/08qtULaA+UYwZlSzG+g=,tag:dMjNhcr/gw5L4fi5ImB++Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"caSecret": "ENC[AES256_GCM,data:u5eyAPS1,iv:UAOdPHyDWHCpFRekItOVsFlID+DtxUfjlH82Q0Ii5eA=,tag:xMZCg0jRKmkgGmqscAeVWA==,type:str]",
"certSecret": "ENC[AES256_GCM,data:W8NClc0I,iv:MslvE3OoBhHBmHZBLTppq7+4ta0UOoc2ExWXVUSkqvo=,tag:eUGlq3e58cQiw49hLAgEhg==,type:str]",
"insecureSkipVerify": "ENC[AES256_GCM,data:ScirWA==,iv:CvWD6KJszDbqMoCOxc6ySK9Ye904xZdNTu+ykJY5qIA=,tag:m/0otAYdGKocYgTv2kB4MQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"writeTimeout": "ENC[AES256_GCM,data:DddbaohG,iv:8YQ4+LJpUxEgl9LdgsltCvw1sdk/AKvYArGYozqLlWQ=,tag:CKQKgEaJCoPSc/EmwFnK/A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"sourceCriterion": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Reba7UIq,iv:uy0Y5Ua8shk6aNZztDA6KYHlN9nVWghJSzHyll+DB7I=,tag:Y5qkLK+Emk5TWaWBixh8VQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"ipStrategy": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:GC5IK1co,iv:an1CHMpioVTkNT8e2nB6cq3V1D37GgbA07XQywEjeL4=,tag:++y0SGqgkqzvAvotabjZfw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"depth": "ENC[AES256_GCM,data:07YNlBgC,iv:q/DFj2j5sERV4xQ21SXBhdtmeQK5cxLkEvSqHDVgovs=,tag:6Z7CkgnNWGdlEyp2cuN+pA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"excludedIPs": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:MqqpTw==,iv:4ylf/uFTkJVak1PggDt4wbLh8U+UVd9GTbzfW5vXp+o=,tag:r5CGaIFaJC/uUjjyz3DByg==,type:str]",
"ENC[AES256_GCM,data:upxw8ocf,iv:ZavGF+tzv9kT45Z/U7iH2UrCpJ/z7chZdxgtOZU5pc4=,tag:0KA3fHxVwAf+2XnMhPMQkg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ipv6Subnet": "ENC[AES256_GCM,data:54jf9T4e,iv:cF0mYZC7NMeak84ISct6r8Jau6yEgxfcVAe5mWWbojA=,tag:9voV3/YNPfDAMVxzDW7dww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"requestHeaderName": "ENC[AES256_GCM,data:oSVMheI6,iv:X6lYnC7u9B1oDUbbcU+8HCU7Kwulf+GY1/354/FEPyc=,tag:V2fnA9uXh0vUagCein99bw==,type:str]",
"requestHost": "ENC[AES256_GCM,data:z0acBw==,iv:mX7YzGGfeVKWCI9RqEcbrOFNu+AeQN1ur99ZEOfyNBQ=,tag:EsnE7YfvcYno54NjHWf2ow==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"redirectRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:ctlBI4Hk,iv:mUQX+41ttGXLfQm8zmRyFtKzWkbAzCcZSKD8jZGsfHM=,tag:xJATTQrF6NuSDzSrO/+quw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"permanent": "ENC[AES256_GCM,data:RHVaIQ==,iv:eZrVNFRrYAOjLQmFBbqOBot/vtfDMWprlA1ZINEqQVc=,tag:rOEIv4vHdlE0EViUK2J++g==,type:str]",
"regex": "ENC[AES256_GCM,data:CrU8oGfu,iv:JiYZNvzeBQFHdlxpS2PFy46EJ6kZiwQsIOV2FjjKQ7c=,tag:9FjqtuFOXucBuUlyawq1yQ==,type:str]",
"replacement": "ENC[AES256_GCM,data:dp1aPUht,iv:qX/noA7PHLEVpySINAB4KNGFfAfXJTrH4IMEbPKIDz8=,tag:4nDswZxEYCbc9nlHT/MevA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"redirectScheme": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:XitmYfzB,iv:8JM0PUQXXLZAW0j8zd4Hb4xNcLszooyQcmZLHnc9KHg=,tag:NVDcQgh+C82oaQ2cbJP1JA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"permanent": "ENC[AES256_GCM,data:OnWN5Q==,iv:3lisbwvuC3E71ocxs5fUMtEigYqxcdT0Zcx/QhAqYx0=,tag:YXdUx6YvvCYUxWlqUBFWXA==,type:str]",
"port": "ENC[AES256_GCM,data:4FasGyf5,iv:ZjFtsrhNJmm007g9twpaUL+dJvaYu6gQen4oC+xtTXE=,tag:4E6hSKQroKKbOQFKicFmdQ==,type:str]",
"scheme": "ENC[AES256_GCM,data:Wez9IzER,iv:TFHaTS+ECKipIimgOMN6hVZjjdcFIX1FuUwmfznXCk4=,tag:gQH1ev0LoTIy+YHXX4DzzA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"replacePath": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:hjLBMWx1,iv:KBMyPiSUNDo2aZxq3ge0QphA/K8z9aL//oxuLnCLeMU=,tag:Kj3+eVE6AVzTBVy9B7DgTA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"path": "ENC[AES256_GCM,data:/mQDCwJF,iv:a4p8y3+nTqncbeapGkWpISt6z00KZtRdj+M8xV9CJaw=,tag:I3ds/mnojXqethrsQ3ic4g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"replacePathRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:+kHLMGTo,iv:r6WLlvFGujltOvLgaCmjvdS9pb8SoUijeFxIj9tSM/U=,tag:oIJHWHHiMaFQMWY4+iuJBA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"regex": "ENC[AES256_GCM,data:HGKmST7r,iv:mJujEf0G3YbCFR+dNXJdjAOGpaRRz4n5iRvkczQDqnM=,tag:pF4OKijurpDSt7Rlk2vW3Q==,type:str]",
"replacement": "ENC[AES256_GCM,data:9KNhl+4O,iv:xnXDW5BOX5HsBVu+FfjWo/6AHv/j0ksguQ5QbsX367w=,tag:2x5F1nSMDGcb6hjVFWwUFA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"retry": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:h/e9pdXp,iv:GhlX1vafBbFTDXo6uVwAzip1kSx4jZ/0Ly2mVzDw+fE=,tag:+9cIoYyFUS1O3w00wb6PmA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"attempts": "ENC[AES256_GCM,data:7D6Ci51y,iv:AecYWwWExFTCmnz3N+ecLp7f7Fql3VdwqLFJSXtWq4o=,tag:SaoPV5/Rd1mDJ7IncOqPdQ==,type:str]",
"initialInterval": "ENC[AES256_GCM,data:dC6AFwix,iv:riDVDfVe6NkCRI3Cf0lif2SOY+0617+wV9jB5sF3LzI=,tag:6RMsU/bHQuXjnbMYoZjxbQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"stripPrefix": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:VvomQMoa,iv:jqCi5WB2SHiKXsmIc+F4GlQUGGQB37ixLT4fhmOLiQk=,tag:I28RvmapJLB3r/1cn1WEXQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"forceSlash": "ENC[AES256_GCM,data:Jx5eWg==,iv:5q3iFDOS17BCQidPJdnMMQKwh2+F2G0YoiLj0Pvdt68=,tag:lR3IPScGEg3o6zFDW1dv3g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"prefixes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:Hj3Z7w==,iv:PXgNWx9PF+Z2Imo60Hc/JjJevfwY7VAnmSCMlcOlgME=,tag:UrVhTrffalhT+olKMr8MyQ==,type:str]",
"ENC[AES256_GCM,data:AWREnnNR,iv:T2/P7zbN9fgQkFWt+sfgYgyj5yfk6Dks4axyf7SfdmA=,tag:i3+x4MS3F1wgR6O2OTpopQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"stripPrefixRegex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:HguYh405,iv:4Wb//Gxq1Vq3/MfeIKp97pLaqi+Kl+jtLGJyG3syZCM=,tag:tYczzvDRJifLybT6UbWvAQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"regex": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:UQ3m7Q==,iv:PyEhE5hnKK4I0Q1kV49YpNz8y5xo8n890GXSM1BdI5E=,tag:S8TJwF3kzvktwK1M1B1UgA==,type:str]",
"ENC[AES256_GCM,data:CJFDgMJQ,iv:Gz6am7o5snlC7J9FN9j3WfAkNxDHa3VR/DBOaKk2TH4=,tag:vYz2B80C4w5zQ9vFNMdjNQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
]
}
]
},
"timeouts": [],
"wait": [],
"wait_for": null
},
"sensitive_attributes": [],
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:DDCim/xZnaMgHEZxQH+dxAaf1FDGYKm0iqBO1LoI7GKl,iv:3zzYVjL4vMOE1FfujuHR5bcAYyp1YMfuHFBjf5l4/V4=,tag:Akjaj8ojKGl8AqrkgH5wOg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:6QCnuFKH7zIOfnuANCXpTZr4,iv:/ZrXSnXZ3pFcXZvAt8+3angz/s1BQcbPpiU5ngyhX0c=,tag:O614ykU8Pyv2FPVdHpY56g==,type:str]",
"mode": "ENC[AES256_GCM,data:EcX35pcsUw==,iv:cYO5JxZ6C7obYj+VCzVpZEJCFIXMoXZYZnMOJMRUfqs=,tag:N9EYKRsD5/5mqhKf2shm5w==,type:str]",
"type": "ENC[AES256_GCM,data:3UhOfCXVaPl3aWfOhMUg/8XGiZQs7ulCN2WjfA==,iv:MErtGczsglVvBlbsT8eXbqBqRr1AVlyd47z3V1MrWV8=,tag:mJOikDG+4X7Am2IIbepIZA==,type:str]",
"name": "ENC[AES256_GCM,data:N+BRJw==,iv:ayMp4YeX51QVnMQnVRuLnqGa5SeagNbuajoyXJqnNmU=,tag:7Lx9Oru5pajerpPew6Tsog==,type:str]",
"provider": "ENC[AES256_GCM,data:NAwZKM+/1ejMzhRSUBW1HKDp5dO7qouty/UBe78kpimF+zVr8hemqbrwi5KbpZMTncinY5A3,iv:goOJ8h+4/24JenLpZPahk/iw9XNhYEJp2AsMWwudhYc=,tag:fe2Mf60eeAk375R8rNK6QQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:1w==,iv:Sk4buql4g/AWaaieU+2PJNXM8effc2IHcrOyIIOZIOs=,tag:fi411BV2MMGXSLUxywCq5A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:jZWo/OrSgcSI06g3rVbEe8yclwk=,iv:rM85ltIxwvHTeS5hpTIa732Mxk8TsgjYjpwc8vId36c=,tag:/1LYc0GTSJHxq1yrBDldeQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:iA==,iv:dmBiffNv/TEROdQ8pK+NopeWjpVM5/f3bnTwpN+wMpU=,tag:1kth6/1UPp87LUm/oUJLkQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:jWNMSS+/DZyE7MYcJ0ZBp/j2X1I=,iv:Ez6vbLJycASXjT8CbAvw8lsbVJfJjo/JZWNfHMYEyMs=,tag:OSnyBw52mTpc2JcEMRhwTw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:MYxYcrZtWHp7,iv:4UoXjzlZBUQm5PsHaS59RuC3RzPGPY3CCpitsO6hoLU=,tag:g7bzeKJoiMyh1hzdBsPPUw==,type:str]",
"uid": "ENC[AES256_GCM,data:6mESSLDdZJcCbJiXKbpS2yXn39ApIZ/ZfiwItM5dL6pcwVGw,iv:yFWhBfYM6mridVqZc96eAXf6PBqjUtQ23+GiPYGrmTo=,tag:4g676vXwYW7s4sWOwMNwvw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"access_modes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:DRfWAolhIh0NN/Og+g==,iv:J8LJf/MmITGNe8t0J27pZMg3Lsy1bsP1J0VyUROjB7k=,tag:RsEUZ47diAe9Yr4Ru/F/cw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"capacity": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage": "ENC[AES256_GCM,data:t7Exlg==,iv:Bg34DB55vkPo65mcpJBCg6vgKJhcZWw9ySuPSgcOqn0=,tag:gGqJOzyrh0WcS5JH/JRPSg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"claim_ref": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:ZJGyofQiRS8IIkw1XCICR0OqLl4=,iv:aNQ/bmxKxEPTAJhDoLb/GW0dZOomJhfrO0P56mlaIws=,tag:Y5T+CNwN6njg1u37q93dbA==,type:str]",
"namespace": "ENC[AES256_GCM,data:yj7fN7wsjNXn9NBB,iv:sz1x+VJ1Q9FMXIZvPT7QoYHcmDZnN4qv2Lxc1T9OzfQ=,tag:iOHHpRRMA7yNJ3LA/XyprQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"mount_options": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:eiM3zr6c6YPB,iv:95OGYLupgnnRvKqdedH3wS9zzdPWzFOf53ZqVxMm1Qg=,tag:bIY72oUv6AlR+3A8W9wmOw==,type:str]",
"ENC[AES256_GCM,data:GOnK+JCZuPbQ,iv:tSsqDx6aZ9VLlslv/2SWx/lQ8URPsuyplY6H8X1Pl9Y=,tag:TCcyM1n7t6Cvekk+OefRqg==,type:str]",
"ENC[AES256_GCM,data:RvEdPw==,iv:REoxMgzqrmSzaN40CKW33FiMhBHMh9DzmT/tSxXBvU8=,tag:Q3GCWRdXdE+siIe5WnKYuA==,type:str]",
"ENC[AES256_GCM,data:OyR6TPuH9p8=,iv:wjd0sTcomG3jx4kRX2zvywCTBAv/wMHYB9GTI5WKS3w=,tag:iJ093RhNK4gDoIJudd6dOg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"node_affinity": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"persistent_volume_reclaim_policy": "ENC[AES256_GCM,data:v80Uxlcl,iv:D7HDAX38yQ2TXo6mSivAqZj9WLBjeN8UJAnKEDM1cKE=,tag:F7ETAzwMUPcExb7B5ZQpzA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"persistent_volume_source": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"csi": [
{
"controller_expand_secret_ref": [],
"controller_publish_secret_ref": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"driver": "ENC[AES256_GCM,data:K8TdG3qECRlujdeW28w=,iv:bmCdtUn1yK1XMxDueMknucSRGwsMn5t6Xojrg+6VU+M=,tag:bW+zNNPec5bwhz0ZK2zqFw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"fs_type": "",
"node_publish_secret_ref": [],
"node_stage_secret_ref": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"read_only": "ENC[AES256_GCM,data:dXnvJVg=,iv:XlhuLOnpyJELJh4PEBCDKJf8uMzkIrCuq66pvSIm8Cc=,tag:I3TY8XH66/BiR6FFCPbqTw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"server": "ENC[AES256_GCM,data:dTR6DCo2LHAj+w==,iv:C0aiw02iiMu/JT8nmnvzXoek88nUs3yZ++3P2M6jc8k=,tag:knU9FZgU8mSe3ZLiYgtlqA==,type:str]",
"share": "ENC[AES256_GCM,data:8AFJ5rtmTOtvNH+j7bF8Dskd+Y+6aw==,iv:q/BNF7l64h6+KGF62hroQUEy0TZh9ZLwIy665lSl1kg=,tag:36y06GpJSFP+voDQgH/ZAQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"volume_handle": "ENC[AES256_GCM,data:fNHTTLVoKk4IwLnMzPzcmoQLWQo=,iv:JewmqWMkskvBalLtyPgAavoLkUHqHvMti318A8/pkPU=,tag:fSxO5zgUjiV6r2UBSk+olw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
"nfs": [],
"photon_persistent_disk": [],
"quobyte": [],
"rbd": [],
"vsphere_volume": []
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage_class_name": "ENC[AES256_GCM,data:x4PxCFJtFK9xqoY=,iv:NSKBckaluJV0x+3hLkUu85cTkTXBfqeB6sOfk/D5058=,tag:bvAsyaCivhoKzNkl7u61Vg==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:VTJ1B2K4xk4+3Q==,iv:rUVOlCnfbSV6mCiVcdWJ5jwqNSFp6bM9Ep2HjsEW70Y=,tag:oyF3N6QRsz7lLVao8nZAiQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:9xFyDKXLIlelE+86bxLiRrOXYOI7HUNW6PcIiM7wxgTHvdHknDAeJnXoVFkh0L+xH0rKKlZ8X/pOpXmbcIb8IaS8CxA/V2TldoQuDe/ZPh/ZJ1fcX5xj6w==,iv:upiBAydrOu4wbuCHE0MMSXaSol4FWzlF91uXL/9cdX8=,tag:vKRfiD+ZobfMHv1gU/vsLg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:qGW5KOmnDIBigbSOxC8uvHyL,iv:jKZsAgjod+PWeV/YExIZJmAlH5fgooyPtjKismFjqag=,tag:ziycqGZhWgKE3DUJRWIaXQ==,type:str]",
"mode": "ENC[AES256_GCM,data:wp14tV5pcA==,iv:Eoad8yS1lhdxNTrnA7DMT4zVeKc0CmQVl+vdliGx1kw=,tag:rSzOF1SW8pjuKIule9hHjw==,type:str]",
"type": "ENC[AES256_GCM,data:Zj3j0G+xG/jnn95/PfRQH9yQOilmidZvcB26neiRq3Eq2g==,iv:K6htx/nZNfEbXcHRA4bOWSjuooQ+Qw8+tUhai5qxMWQ=,tag:tP3zf+x4GqhJZDQjfJhWTg==,type:str]",
"name": "ENC[AES256_GCM,data:0LZ97Q==,iv:QvBidEtLwr/bJQ9yise5Tm4rorPkXoCAncaKAQLMkfI=,tag:5iWpyiz7gGt6k33QOeXVgg==,type:str]",
"provider": "ENC[AES256_GCM,data:M1/k9Y2/BfAdckoSHBzdhyiZNMGgSSgogTyRappWurEvTunPw/jBi2ejVR14VcNhAJla5aFJ,iv:kTty1BXIa3VCdPESoeYDs20iXbJG91le73FvTir2Xlc=,tag:vAkfRMi5bvPwafUHK7oFng==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:fQ==,iv:uuQwBpJfuCxozC2TrzwsZTjVCainGlFPm7eElZFZ5Oc=,tag:am8NniySWANqoW7ZZdTzRg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:/vtoxYe2IHpZpJfrzOEwOSl+s2gB/EaZ3lz0Cmr8ebE5,iv:VBDC0mjzRRJ0F/7ejJ4Yn0GxR1CJ3tM6N5r8T29505Y=,tag:fTPZjsz3TGbwiNNBOdKunQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:iw==,iv:NmUaR+xUCR84UGabRxJ/nEWwC2xjXxtk7F57nuyZcRE=,tag:RvkYVZhsG5kN79img1WKtQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:V2cpHWFYwm4XH9pMhyA7ZDfHqHg=,iv:S+gFY+IzRITBtC3tKQ+k9HxHoVKfhD7xY+Tz3jGSUD0=,tag:iXfx6ghq6wUiGy2PjKCjUw==,type:str]",
"namespace": "ENC[AES256_GCM,data:f24fF0B5D5w6aoT/,iv:m7qb7XDhpx+iv+1dCkYqrdKZt2qV8T9+di5tWHW0IKw=,tag:8wTxlHd4QlzKgnT9KXAGyw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:CPyS7XYBomrk,iv:zIaBE4e9k/+rC9bQyWj4k2KtQ2eYTi/x4CAiW8P8Weo=,tag:wMatBHFKKu+cvRvIgES2Pw==,type:str]",
"uid": "ENC[AES256_GCM,data:FjmXNTS0g4S3k1yNJMZaTve6tD+0XMfFmSDBcCuCHpNiiuXg,iv:6YC2nW9ivEIDXkNhH5SIR0EpKYS4Cw77eg4HLT7EkwQ=,tag:FE9R44HOGOEY1jjQFbouBw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"access_modes": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:G+tzZKK48havgb8efQ==,iv:ylDGKhd3ISQhibfy4ML1lAM/mj/vudY68Qp1cgIEXPA=,tag:gEHvloqVOwtVGJpC/x9HXg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"resources": [
{
"limits": {},
"requests": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage": "ENC[AES256_GCM,data:WDAckA==,iv:GyCnG/N8DiJ6GKoHfBF6TGASXVH8Eb92xZTjHYkvIl8=,tag:qyGe6P+wyzyd/zte1z0xcQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"selector": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"storage_class_name": "ENC[AES256_GCM,data:+uJ7v3Q35gfc0oc=,iv:ymWjWjsouXiC2n7ymsjsZeI5DdKfHlILDzLHowf3u1Y=,tag:taBTGKTg2BEXLbefsRfN+Q==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:Ptizl6BiK3o6ZA==,iv:HymniY79mcxjYOiEBgNpNJR5SbYJjemls0CzvG7hkrg=,tag:DjY/teKmK/imaLkh1/I0NA==,type:str]",
"volume_name": "ENC[AES256_GCM,data:7AjXM8lWvroU1ZvmJlDlc/Cz6B0=,iv:8LW3aLzIfCI+KQfqdSkJ1xPD3t/dZxqF5+qArOYe3go=,tag:HyeotGs3mPHQxJ+6fs8K/g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"wait_until_bound": "ENC[AES256_GCM,data:g43BwQ==,iv:RPHJ+Y1PRSCx+t/fogOio3lVKWBiP1y/fXVswoFrgNs=,tag:wWriNPiNK5AoQrTzKrsb7A==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:4k06sKAq9t9c+lHJIKKqO3OIdcDTxnABKK/3G25LhBqD5ECVvlPsM0fBO1kQYrLjqw7mtMC8SSK5ZrZEwMfiUem6oCv7XOgo0rE22jynIMFvnSdwYBc/2g==,iv:Sx1CxdlJ1mSAjYI+3eTAu6qPy7nLL7Ywt/+RWI8H56c=,tag:ai9O66vRr1zI5XKdIZDynA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:NvWUyVz9iVLe3i1uRLXiTIIgs9ZHbuMTvBZ+4ffKLSMx,iv:CYXIXMhmCYiIFNoiETKjuuqjlNJ/dHSA6Dtg50/PsfE=,tag:o0zCiub84aInoz5/2Ptf3Q==,type:str]",
"ENC[AES256_GCM,data:BxZydKdxVI2WI4ETtp4LLjlR2o1ZjPbXK9carQ+5rej22nqzVsewofw6txzXIFkSNCk6rQ==,iv:I4NP9shcHn+C6FvBCxwsI9XxSkW8h68gw5AlyVa5CBs=,tag:5Jzx5N8koRCTa5tLVUiwbA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"module": "ENC[AES256_GCM,data:wbO+g9zkZZO2JQFu1eiBvPY=,iv:ECoLv0IRB1Ph1S2z31JUO0bat2lTOf+wWGpGel0PmJ0=,tag:rpYCqxBFg7KGEcxmbblGkQ==,type:str]",
"mode": "ENC[AES256_GCM,data:GumXZPAOBQ==,iv:wQIUFouV90nfTe4litVluPEoXqIhcdEu/OlW34U8kww=,tag:gEKssL/BkUvQ095kD1zFMg==,type:str]",
"type": "ENC[AES256_GCM,data:RUJ69saBrBGHIMDdppBKcus=,iv:rR4SMLDucYs1EJ2jaw4MuySyN4V4mXrdpN1CcvOp1xY=,tag:UkWgFfgqq2JxNDP2nhYjqg==,type:str]",
"name": "ENC[AES256_GCM,data:XDzimBBBYyRw2A==,iv:qLWth9E/Z68LfvToeyrB0YNCUBHzXiuDu8IZtie7jVk=,tag:ILxQq1hw4SXT6k4ODgkcew==,type:str]",
"provider": "ENC[AES256_GCM,data:KPBCsUs9y5tzpHpfHiLWZirhtcJAyhy+ynl8zs0SMuRsWAGgqgj0prvsKlLSOzQHw6sdUDbA,iv:KHYTyMMcNzlTGIqR6Vk2GIKU6nysOrXTBZaE8jfWuLY=,tag:ZAhVIUpVvsVi48Nrm7AtNw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"schema_version": "ENC[AES256_GCM,data:3w==,iv:5nxqOOpqNIo+Jjy5C1Hf24c2j1AYUJA5yAFkvSLHfFM=,tag:N1nV1SnoESoNxO00Fl2nLg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"tls.crt": "ENC[AES256_GCM,data:jOdQENWoCkkhOVjcm1CSALB2mbWM73tylSKOKNwos+CtllhTE+F5MCFWFR1EDeuBnkWlb33pRAVGvFqelOaR8DdBLncyFpSB7qgejq8uTYCw25bZ/bWeUXs2rK6Xt1e1HEJNdkjPkAPGRlPLNztxE2IgWU0MX5f9/jFzUJK7IDr1DNHlJmZXn9TYWPuVOZ4BjsqhrafgHPnWvmFMn0G90OSYaFbvhDOnbiqRCR6GMsTbo3WSL8h6Ls1AzIGHfKrG60AL1z2ASe6acGpE+k1pJfl09EbkxDCCRsBpYSEVzdLYVWJ6sQ9L0pp868hmy4AZaZUgdWfu++CP2niz7z1l71SmqNtyjCIw6SFlRA6z8btwdGLokeR/aty8/zN42wgip2saYd6e2sh7+MJTjCRkcoZCO8V0Ofy34KYSq3484OPachkodtNSszHFPaXzofuf+htkhngtqxB4ykG47ixg3J9XY1/kcdBsgesSTB9okKEuKDWkOpBF1YYJVDDAJo9FxUS8Jnor0Gnso0CnWiUx110ypMaTESTqE+htW+yrWeysNKPQfE32QtqgFCpgtPSUZVVnf8tkwhNSzzhmSsiNxkv6lnHG+DSsYxKwmPRQcuCzM2yM1CWxm/ZNRvbhYp+POii2sSqwThlQlUvMkFmgHF5Bk+YnZ07E/8OD7sjWnKMv8mEyf8gr+3HlnjRYoC9vpoYA7j8R7qgw+U1gjkJudfSo2qTYP+Rca38xJO6lEshQgi+64ZhfguufKN9x+AwAlSKsdh8gjE8LQpvdWyxyTx81hhoG95m1Zgm9Up0ynn9BDbhtgEFH4cbozA9907Y++52Q+569VBKRSiNej/SEOhnyj7DuTl/jIiRf1ptdXOySgZ0HnkeLcMibwC7UTHqzRkIcCyoozt5ES+O9eWq8t5IAugVThz0ZvWrr1sA1hfnfoI4sVe06bRRGppfsgB21zDqa3Y4GB+oP6HM/OzGM2yTfvTNNl6EepgdTi7/s06Or7G2tLcrx5JnDaK8PIAUBhFVJHCUDdRGDwyeB1vfjxch/xOCRHiacS7MpWOep9fecYwQbFrBCeImxg5EhT9Rs5LSMgN3WVKfn4fpzld6eR+axQnhuxOsrmigdTqN7Q014XDv0X1L9Rgrs5Tkgu4v876VaBz6GTGvN55oXbrf3wCsUraqAxGzQEDTKai1utBAJMIGxjACRTrSBWwunZeOpnVlVLOyNIz6o7jjfk076X1oCSx9K7qkfZzHJhyJp+/A+c0XOaTH96pIG1XVSaAXboXv1wTMYzt5sNcxu8K9gSmTbHUrCBOQRbL7yEQsA5wIIRwgt2BzxGKwqUrq4adrcHY8fSsSFPJL+ojyorpmsAORR3NfH5IafVD6kWB8+aYisPF7av08cwNEkQqel8N4fPBipid4E/VXKDS3qF8BGbVhkj7BfigbLN+RaY6Mj1mlVIGRyDGVvWU5l+S9tfOeuUEc7R79UtLieYfIk5/iI6rwb2ewCyd9vhRfBM8wE7WoU6/nioy3DRyz0PG+8jkZ93S0SZyeXWzqnRd1+JGzj5CmwS5uZvDfJFGAGl6RevTxyX0DZmAOhqn0BhsfU0MRyVGG2K8cht6N/5JjIu9FuA7PEeQfcg8CCoGTYYc8rXYO8wfIjKRl3Ln61kQzTYyX9vCPfuBjA2V9bMVykQpYJ06YXsdHdSMqqSk3eiB6lOrTrbV+Smrym55+5A749EsNsvwD4AY4h977om/jIzceWs5Dw/GsuYl08uzsLzvowIjViAkFWwo7NL1gQFe9amLQd+iF3JLUVK+6DFjk3GTxZEobbnjMzM/rYOxNP59P/qaHR7vZlyU84rSbLqY9etaPQXggawzxZ0GHfBmKXdm9IZUi01ArYcA+aFhvtGItj2CGXHFryh4tUSf2Lz2CFKJmnFDXkcqYcVY7SdYYVgGWQvG5hGpMKhQaQFrUmeavWNE+ptoaLWqn1IkEr56a0bMeIBcpDhdbWbjbsBRF3nGt2N+DNqdCl/J9fvPThySvdGcVRbn6r0/1OpC+fnuUMtkGrzGFVSLa4vAgoYz6tK1P5GZRRnh0zZg0g5Abr/z7LmdAjO9LS8NwKvav5fUQJDsiwOn7QeWj1CFuVomfhlmS4CYPbAGx/FdEAcW7lQjPHK00Iw0glvKB8k8LAxIO/6nc/BU/x0n0EQIH43isVLzlaH/tve1lfeNKTdNL6Uu7wA0VMplVGLfkmmvp1jsew5YJ3v60oQ/ZZzNtf60jwrUpzCD+fLvfLJf9snRLKmaIBJvesfeDq6g05iQj+GBDk7djp3VbgDjKeWwfQouubG2lriS0hXKQ6yzrupOiE3A/k3++4FZsUAUETXD/Rg2Mk3QEKeLbSAahEHdPlSWe528PF0WCjX8AxQO3nOzqy0WOMX8CpzBVd649FOSXxtfeN2Y+wdG3nQjzq9rHl0KV4uf5yICO40w4nFhpXR0/GXspQF3RvTl9kVlxAkVsg/V676I/vsgqE4yUTuPijAWwVwAJOfVeLIvG/hffwymb73keD504Kpg9K8uBxWsqM0xuCc4PCQH0cXIBVfD8WPUYR4YjeapHBx4YSFPJqlrD71Is1ZC9qLOy7sl6ADsIdCYLZNxR9TXA/Uxn+Ij75s3k47dqj1zveSBVJXR2unG+PU0SFsp0GR/eslsqwBvGNER0M5vFug9S/SfLUtMCJxJMfc0Saygxlw2JIXm8CbeW1Tui61wNhjNVW1cjZCHUR/zFyd9DfE4gRbMbZ5QXK4jqxqXplv9cPV4Z3Q+AM6vUjZMhTziu7Es3xeZh8sVviYg32POH6WVoTSeiCWDkJpRd5yHFwFW/eNCmLaElBZThbQIdAu3BGt4vk3w5BXBBXRrBDMlJpH0ly58zuP6XtpNUxTHz8+IOfJNUMlghJoNkAVWhkD3C9iZcNzfZgq0BnuzJCcsNQ+4Bm4UMATluHQ+sKUkMT/FtOmOdnfAcobxcEDAMWQoHm0SxZcm/dkODNq1MhSrE5tSePB4RdJJt9DkFEqJYe8/hNJQnMhB/pXZSuGMZrn18sHJuJRebfz2e774WqhYG+I5MSF+27JVc/kUq08KUVQxdsfhcwUV13ZQE+692iRostjoGXZXP79+B39emS8npik5/vLO9MCDludqN7FI29oyweuc+WnwXDJqYEIvoJodh6X3Fv+extQ87zhMs1q5vyL1/OjNXjOL4Io7qMk07uvWGWWGan75/WOfU5BsB8NDcS/kzoYCxfHlY/xRvtMzS3DOBol/8EbjBst/EDvUJnE5ByuBsliiU2cSlN99xFTwoObsXjSeDVnyzsahzYsAPB49yZIJsKHZlg3qj+kIJw0oKpEAvfYjwRt9Gg30b0beRy/BM5ew2QVdk4848uI5+QW1zC+pTIvuvgMTSVdIPkIlkpwA8lWEcbjyX1szJhANyyL7l2Zf7MMWxT2yYfRUFO97RTJsligvR8DDsD84H96LupmrXhUK/heW+i6+1AxTDeP4ZB37J4Sh4W3Qls7opDHmb0bRhKGQyh+rAZcPMzi8ebKsRzTszEPZVRrimnr1JXHBuB4AWg0ztrFQQWHja8MEtg7b+QcKSKaBWtejI0QDshCdfL5JJ9sC7OJ6HO71vZpYiE4aP/dgVDqgJ4ZblzSmw3PWmUT9jkVgXesCmCTepSBkH6PeoN9uUOHDwlOUaFi33AQ7jESEjbu+9GayUoP9GQBOhmVbU1cqCtka/Iiv4b8B0rYVEJiyAFzvIVUj4hnj4W+ssSL3u2FDzI+nLOFkDmNcy2pUcjRA59inp4s6DmmxGc1BmndWZ5dCJ4QERFlHOC,iv:I8pI+6qEhjeswy7lfHu/werpr2A2Zjty1yg6nQXt/wQ=,tag:9OcZgUj8qevRx+fyPvRiuw==,type:str]",
"tls.key": "ENC[AES256_GCM,data:jW0rpdndRYpxlXrfDYfN0t8tmMcFW/iKlEvuRZO1pD6HXxrq2I4bPBf7Naeq9tcDv2qLfgkGPbidgR3QoBm44Xe0usMB3cr1AokLbaJuhuvqwe2r+I8vpV7HtW5BwKZYqbGyYGjfxkN3YauVTdwzJl22opkmSgrzMveeBNhHO8NxcT74VZdvQiqorVp7G9LF2fOcWa9nkHTkHCvMKymSENZIjgIIjBmo7zueK4CJjlhZFonfIrCAXGzoo3257vrfC5hKmNhl+j3Ok0/m1sHttWQVb3povGuf7/rhgMAM2uEJ4I6LNUCTwo/MP6EHg0KZ/w==,iv:r9yHW/66e9sXkJpFmLQdtVe4UwKltXkyK26AZt6K8XM=,tag:kmpF/ZlXG1q2dIUxsEAvBA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"id": "ENC[AES256_GCM,data:HqNzJ4cBQYcW/MAvpmdgtzyjlsVoHSg=,iv:2B/ocLHZas05M5up/0UZtGzwlaPXxcFacQP2BBJAQoc=,tag:IXAJy+hpfToZXmyyWjwv5w==,type:str]",
"immutable": "ENC[AES256_GCM,data:C7XY/qg=,iv:8r4GynwUIvmu4f0ghworRwEHnOzZXH6JkIRE0lOdthU=,tag:56dLhDr3CmQdHKBB7Udluw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"generation": "ENC[AES256_GCM,data:VA==,iv:BdVlgKLqTzl+lZ6+3LTJN/hojV0Vv3fFPEMPQZF2Djo=,tag:trQ2XkyYny6vnCCnca2MXg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"name": "ENC[AES256_GCM,data:SQoSg2CMRt4IQw==,iv:vLe7uH5DWAEax/49RTJ5WYWnGghONbihyz7GVuwS9C4=,tag:AkkoRoL40oX3rUu5ch8syw==,type:str]",
"namespace": "ENC[AES256_GCM,data:imiAZyzXlpsQFD49,iv:J43Ghscv2fbfEZJn5oV15Yv27HLe9/LsraJsboxcj1c=,tag:xm2s9rui0b+eANuav1KyuQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:t5khQ8jZUez5,iv:KqlKWUpazRiJpfKQyG/0l6q8m0Y3Gwr6b5g18t4NotY=,tag:KjxVGmOMWTXfEXC9blue9w==,type:str]",
"uid": "ENC[AES256_GCM,data:MPK1GmpAGE+n6BdjoyrnnbNTKja5PpnNoIwJBqsYbCUaGITx,iv:57QzszvmW1uiRdxm5QloY8gXTrFEhY2C4IGtJ1iS8a4=,tag:oYvRtPZ5NOvad26HlRhtVQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:cFfTqohBYsFyBwcm60h4pxw=,iv:nialD95Eodq36enL7lUBiN8DYcSzYHF4CzI5RYQFOz0=,tag:5lyWBg8PXz+pPqN5Ce8jrw==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:fcit6A==,iv:o7DxflLVZy/FBdCJggThyeqDD9D0xz+TgZ0pTLeXkpc=,tag:U2tm3i4JMAGdXN0oql8iDA==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:rVtu/tLmhFA=,iv:jiH8Jg1dRiRH9GBu3Ufh4sQ08AqOMwTzb6LO1/eY8FQ=,tag:T8qbAxugGGnvrclSNvMn1w==,type:str]",
"value": "ENC[AES256_GCM,data:i/5d8jEtyDY=,iv:19QYm78Uz9EoTsn2BrgpVG2HPZmMLFBXD++xLQJsxPE=,tag:AIw0Ywc+EU/qguG1c1tsAA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:AoJyOxg=,iv:vaI4WLpNiIstgR29Xrq0CDghsqpldsescVogtb4mSuM=,tag:s3g1RQle2utZhPGW9vqDEA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"value": "ENC[AES256_GCM,data:QA==,iv:gKtI/02CtmIuo3jUgW+McAiAjB8XqNIaP0IhcLhI8ig=,tag:/KDX4SjpaXh+jnsR7ZIZGw==,type:float]",
"type": "ENC[AES256_GCM,data:I6PZL3Rv,iv:4l+7OPUZYussiKTV0NxGFdy61+A3A925fAVos/JYGvY=,tag:pAx7ShbvLNusL20p+MpgLw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"type": "ENC[AES256_GCM,data:Hfy2UYEyboA=,iv:m3clxf7PKuc6+Hc0ptqau9Fxpg27gvQSQPpP4xf1vmw=,tag:GQDxdhprGUUE2moLTwK4XA==,type:str]",
"value": "ENC[AES256_GCM,data:0UT94Q==,iv:4BR+TWGIwC3DoFRlnL5Ipj8yEVyxUgucdWiAkmDeW+s=,tag:R16u1ijGpRM1BGDvze6yHg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"private": "ENC[AES256_GCM,data:r7yDKzzC+PZjCvKgL1cIrtFJHXAa1+AcfgvhKpopMMoYedPNTCoxedUt9WilyKGN/0oL1NUX+5/FKYFkvV47Tp3z0q7Lz3eQyjHuK0hF5DACkDUO,iv:0aPiF8ml+6v+KGxrITK6GSnXR+foScYN+vR0N3DpbE0=,tag:9lFd8ZvN+pFIKYWog/ga3A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"ENC[AES256_GCM,data:WG26ea2zTH3OgVp52Jy0lRrU3b7CEWXT18u151WGMmcA,iv:B/BdwEhCVybOkw5VCCN/PvAsu6Qdn1IKo5CYukUqvtA=,tag:rEXT9Bw09+/luQzyE1QJRA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
"key_name": "sops-state",
"created_at": "2026-03-17T22:55:19Z",
"enc": "vault:v1:WLFj7CIsTJcT6xpy9vfB8LEbaTJ6Jj2OAiXclQNDnK/5581fNnfzuTJ4M3OUVWrf8NynJre1vK3fyJQn"
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVd1RmNEQ4dXhoUjlna3hs\neEptRDNlMUFGRExtRFliSXUyVDJKakoreWpzCnlzMVhQcXVDRndCWlM5Z1oweTNl\nUkJCTmRHaVN3VDNmKzBmUnUyaHVQZnMKLS0tIFk1ZGMxYVhrUzlGZFdQM3p5QU1l\nK2tuSjhJRnlGaGc0SE1VaEcyaVM5b0UKPFGUkrBUFbc5ABmppA4jAtYO4DgIeJj/\n/yNdqq601GZvbBcG3SMYTgA9z2NUwHoVbZA/O9Y2WHhIx+mmrNLkKQ==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkNjZnOFRsM2o1OEswdUt3\nSHFTYVpDaytsSGJQcE1RM3MvaWhPbTk1aG13CjIweXRaUHRMZ2swYVIrRmhKUG5m\nNExVeVNlakhJRVBpWjdxZVF2REhNRXMKLS0tICtvVmFLRDZQenpDVzNDM0RjTm1l\ndld1c01kcEtWSWdoNFozQWFDeGVxc00KwBIX58LgSfoxm1A2JP7AtAwMNa6Vq28n\nyMtwGshK519ze1gdDrFQyU9auxako1Aa60GvFSuky6ikJpT4O8KpsA==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"lastmodified": "2026-03-17T22:55:19Z",
"mac": "ENC[AES256_GCM,data:m9/z9D7R/4yTt62dhvW7xtcc7v57DIrEpYH4XH/keZNzVhvms5OdSTC+sTSkPQTCCpcAcdnP5sklzDq5sRDBcDLZpFk7js6HtqgjWdB82jJX9f5375kTtyxjC5GAlroQBHySzpJS+2pIe8xsXLcVEoElnpW0vLetwX0uILuHECM=,iv:51ibHuClOCj0RVJ3o0hEoNP1FUxgfunzpAmRHYQaecE=,tag:vC54liP99HvIyIeBF/zsyQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink