viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/state/stacks/authentik/terraform.tfstate.enc

1103 lines
161 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"version": "ENC[AES256_GCM,data:Ng==,iv:hh+75La2myeod7ZGRdRodvzqMWSeFbIb1A+dm12X7wE=,tag:l81d3Z4/1v+y+s660XR3Cw==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:147Iy2Q=,iv:6IfcsAGz7EBxBs4Zot0fn8E/4y1SSbxVAO5VtDeDvD8=,tag:4Vm27qlFVGcmyCUuTeaVNQ==,type:str]",
"serial": "ENC[AES256_GCM,data:iA==,iv:EhlyggegNAuaQz/XOLqRZOgW9UL7X2P+y16JmSNsFME=,tag:LC3RxUB0OFBU71fUYQ1d+g==,type:float]",
"lineage": "ENC[AES256_GCM,data:SZNHNY+hG60v3V/vydfekMZfYmUolgQ2jD0VJ4TzgZ+IKolD,iv:2C36eSTVmjGwr2oqfAp6XeLO+sNd8ufOnNikA2pQzNA=,tag:z5TwAoR1Mok/vHYlF+PwMQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:tShrDg==,iv:7lfAy2i88Nz93Vj3wXn6/IIf7rhue2I21WZP6M5JzU0=,tag:EApQ9AsBgzGypuHMlGWguA==,type:str]",
"type": "ENC[AES256_GCM,data:pryYxn3hThZt253YLVcgAkFI,iv:aHgOEdv+v7kVqMzFcaYDaP6ADV9v9VDgmn84/VE8Sho=,tag:u/HbN/S3jmQda6FLbJVc/g==,type:str]",
"name": "ENC[AES256_GCM,data:EbYZhgcOZQ==,iv:yKMiwen/lwFWuRm0YbRPamks20hKAX58FDkAJMRvM+4=,tag:JeYoyLgVOOovZhVt9eJWEQ==,type:str]",
"provider": "ENC[AES256_GCM,data:KdnUMNYEdvn+O2DEBYz4qOXvu6Zvl3sWvI0kgQpIMY6NoJUi0Om9xBZfdKupQpPyrg==,iv:wXR+kfynth3dVPmkcqLwbo0iiUC5d3V0oPxEAmUMXno=,tag:u2QgedF2TnTEYg3unOSKAw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:MQ==,iv:2DmzUUb7HuriOvAz5+VJgAuakvav9I+M2XevGZnyPN4=,tag:U14NpOSgFNvlEj6uDjOW0A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"created_time": "ENC[AES256_GCM,data:Xn5HUMeoOHzBkNnAFG9XQS1GW3575bJ9nek1NVss,iv:3QpzUInAKPp0ZX/r0pu/5EHgA8r8DR86ACsKgzxGrLw=,tag:4MNWeCN7+ZGCmxoLXO5mqA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:IolJDYNNfyDv/JVH2ES5Qfizmu8=,iv:aTOYQHTr0WxFf6Q+2pmHIeA13lXOtD6yLsPKMctK0DU=,tag:ld9m2cQCSw1QUxvcLfbWeQ==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:24+zIpQXmmctcB4QWhRYgSyS7unBU9PM+grrVhMzB33FnDUeFHo577f/6ZOghQwyg9FwKRkSGgiXMjjnybNxRgBsBNjlHB2AZhjnqzjiwdEv,iv:gi2RFSC6V9DeYkXn+da0+ihyzcv0gP3Ah4yhwb7PUfc=,tag:AWPqQjeqe3+5HZ5frzFYZA==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:4wZZAIEYnbjPNWNxD5kJU1nCY+Oiu1alJa93Uo+WSy9JQ1rvAv/pv0GNKbdiw8ucIW1E6XdB+FKIIni+AHiNZcGf,iv:yHphMUjzNHpfyDjg42dPa00dzcNFpcJxjmyyuztlihw=,tag:TM8sY3hMjL+dejrnUIaDQQ==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:NSVzXhYzv99v5e/N0NYvSw==,iv:2sKx4qNCAVH1FE3NnIEOWAsh0VRJT/AEMdePS2qa4bo=,tag:PkacP0yLx3NAuVbrB1qsdA==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:vq4wDoLeKMynb27vTEvvfvTLs41XPe7CavguMPEjvvvEjGVimFv2nalh6XrkS1m0btGL,iv:BVIQy2BkIoOmpuL+JEDIk4c+Ha8StEmGOcRSrMc3C+Q=,tag:jpZZm35p0YX5SLycMwOC+Q==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:O7sIzQj3j10C6QrKUVZlHf5Zk6ifG5Kf7NeJ9KEO7YKSBZPlzw==,iv:eITGIJFg0kVZTAri29TNQ2Qalsicpg6Jqf/MAhx/5kQ=,tag:fLNtQMeoK5YDoOZWhKOEMg==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:eBSU/Qm9/nIN2SP2cePMFBrO6E++QP6qWO6WH3Ab8q2ymcpe4yliY/Cza7rnXJB51tNeoisxhufsIvNv8kGyaDlKuxMTISi4E/tdWk3+J+LRpafkP0zZxkufmOmK2mI4a6iMcq4Og9wAX7jfJ97UviAavXfM5G0M8OKs+HaHDbdjU9VJEnSdaaDhRo2OB45rQ+X+TvoDhzvJxVO93HLQikEx2HR3d9ZjfKAJ1lWSBy9SBv3XZlYKvg==,iv:4G+pnw2/2MZRwHvQsYil1hwqTaQnDIqLB9dy/KL3m6Q=,tag:nyuQAxfsxY9qshrk6DlYow==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:fupUfrfijYaa8QUDrg3Zdgl0F4xuLO/uSSpm1srkMs5k6Qx8HNF5SXGqmg==,iv:hYbjSP8jGRgBD/Wt5JlIPGY+gLwCm2u9fxRX3Yi4fWs=,tag:12oOPGE/fekuPWaQGaxdRA==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:GMT49n+fjW9f0vK4Aazr/kAViS3buY7IRokV++A=,iv:XqyNXRGr1y7h0/YpkjxJT/EWs43vgJmCKxdS+vgV+0M=,tag:t4OZjFjKaS3IACw0i/pamg==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:k8fAphDHsgUKF+xnjG3WCyckYL+qzjUgBjMwTPV0DYIoXbFdA13K9YotsR+mRMMenf2o5XHViC7gPfsbek+5lw==,iv:AwFL2+sjANBnridER+SZwel8/+PKPozuRWwNRslCM2U=,tag:+OZh87onrKx+YASzqLH7gA==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:/m3CVwtaKXO9o8ifFrs=,iv:Xvi6g7IS0vlvEMMxoRVgDiNFMSmTT5sbK/vG3+FkTb0=,tag:ZVnjcHSlonaNBIWNRKcycA==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:yo0blh0fb9OzCikIQznLEbkPZRI0w0Gc7w==,iv:OtSKZDE9rX0BtLRGer15crQXr9fSwxVtyT50p3eKVxQ=,tag:feTadRGlsvoqk4/GBD3sTA==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:+RzOhFHGpDSz2QYPUXzyxR1Isx3PM794tgy8tvBcnJ4=,iv:p3H5njoEcNH5LzBSm3KZAjlDKQ8RlsvcI47JIsKZ4Tc=,tag:aGAKmVc+rU7CeuZNkO8pAg==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:DuPX3nKAPvC77Pt9PotZc8pUFclS5gCi0EI=,iv:F/uemJRypudtDJbVKtTJ7dHotCsi4erajbrsr7wBtT8=,tag:wF4bSNCiCp3S2FfVVzQ8Cg==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:dCFzC4rNdHrW21Wvi39bwNFH9G/XJXGL8OjlbA==,iv:qW5gfVdeoOBnp0nVcE+uBtyNGdTGsELXvzRakAGZyOA=,tag:sUPLWcZpHzYzWxQ8ai9jhA==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:KlYahQP0rQa4/ryGNHnjCLTNLKw=,iv:NA1NRx4skCSTuwvgB2f28a9kfn6tFuE4gujveKYZ/ws=,tag:Ur2K7ueKRDGxXKRztB4qlQ==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:2VSyoMNVYJMBClWoJGrlSLjQceI2,iv:FvXRZv2Tz6P9+Y1aDK6R8ncSws8JrdtKoETuOJLM9yk=,tag:6upPXbTxbCkbVte9VIeRRA==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:G8Cfyc/uThEmCIsx6hhw8JojRpR7PTtzOZIPgznXUn7WijD6RK/+d0/qC7Fk+/Ez+D4Mt84ElBtkBIN6Br161jxIQfPqunZ4ieah4yy+BXGn0s9fXSHCQnSBqSUGwHxJTdBoS514TkigEdfP/lnAZ/tNdqHAaC9VE5/WO5R2Ef3rq6ej0qIxdujDCEx1mbYtdlaIXCzWGQu0we2IF1pU/6nY5ODFBk/rFBnr2LOkH1JH5BZQWkRi,iv:aQENr+j7uw2HKZQDEXjwQGoyS4R7tq7Nhe580so9Ixw=,tag:0Bb8lQwWQF9Tj4iZQsJViQ==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:DEs/yV1bl/2wMJCO9D2wLWQUJ/5vXOaASlhO8TOIMZPCZVIcseTL7zqvSKPUqBzgr15he2Cr/OBW7SSmjRC5lV5vfcD7QwUGw3nw45ZNFsHoxZB2Rfe7Tzau07wt0GVdiooHUs7sEblN8FctPAgnAMZIn6RxAkZ9CxQpVc3R4NmeCsuaTZHEMGdq32mtLqERjGio6LZ8xyAnJSCKrXkKeL0RvBJBj7azJaE0KbazTqyd2YoulUh7dkplhi/mwJCYsFPzDPTFPXXSQ+91X2wK0bWJpdg3VEefNe3PBbLzzsYqnIqQc/8UDdfTpPxNYF+lvzi2TUxVRUymICCBNCfwsc8hzVcNvBB6WXudxc0zI1+T/Alrs2EKhDA/ZdV+PqSF7GY4+2xwttbKbj1t1ALEt1JLfE2l1gGIqHzsE0dGv7Iv+ACnntH+uKPR9pyWoW+tmFQyXFqrqzRfYUVUbvs5V4bL254ijubM/WiqPIcfl57lTGVbSR6FY+2PAQBCIItqFsdWlWNfpoGEgDfs6lRyH2bQOTh4NDcAtMzJzLtF06mK1ZgNukXH/fNfHV2MZHze/iV9WTuJTe0GjwcBmLsLA6XXw+XhpC7MqmmhnIeJc1141FOLkezeE112MxeuFYlKGwQrCNiMKgC/lP7vLtroPnSqHfEEVqYyeW/wxUmVTpzEUr+jSIOOUdNE8JRPA0rb0MmCCYLuuQShf77dNYs/mQaQBUAHA4GmBQrv0+3B9Oyznq3MnC0TQs/anYu0kOWvyJK1qeh+LpdO4dXK20LXD2JHTS4yUllunNO4vv38JE3aDeQtI3MPiXTwM8Qm8UXY7H3L8fOHidAAMgnHwJU+yQY+Gh6Hhn9k4uLX5SIrjyJMgkr+zqC7czx68fLNMMWGqwi5rIX2Lh5HOjXgQj0SfrWU4K+KNPuOZYxJT6LLXGOmtZ4Xny8/OIVbjypmceWWAUXXiSCvJEwWyJFCqDDa5EsJwSp0m1sI7+3k3HHaMmhG2dtzCuQKXJjMX+D+qjerMuKO2PX8Zr4Y3X5AV1iUoc/eeQKyhgPUjgyyKqB5KJxgDGrt6jN8SrIfnlKPRopiXWJ6MM5QxIiDghlndbV5gqP/daavQwSa+VM8bDvjFecKf6PStYbHmbH+oagaERalz2Ff7AaS1r7zRDrfmTbXIKsMozEa6nEDy/AzkorIImwtWJZwbwAK5DoBe+gXjfKuwupxjSwTvV9SBD5RgTVvHcpRI/mY7SoEv6WONwAeZEYX4yEIeCoqsUr0VdZz60LsGFJwZ0ZTiG2SFAXBb67Vct4UozK2ciOvV83+u6fGTlDuKU1PEJRzOxWi0MQOyGoFU/j3J8b+GTeOJq+0jmL8wnwdoOvwmqWKqirWB1eiHKU87/AaZzkkhuSOakUEK2TCGmLkIJwwGxQxP/8kxiaVMy0ut3sDMNDLmUNqlacoSan1JRwsZrHrda9UdhO6PC4MjayGR/+POr+fYusOGSq9gv1MOe4ita/wMsIWqo2uJ1gPViFiWrmVFaU4GWll2Q2Ws05cxTk1mZS/QA+kMiJfdtJAMhv+BgHBnElJn4juuqeUY0wtsYIm27URL3pCMYHogHm6slffUR8ltHFWiahCBkiUjMCg7b3urWFblj0zFsvkQ6upIl/DdJen+4qlLjjAPKyJWdOuJsBc04rLTqIic1W2Zn/X7ySbnzC9EXDiWxwiq1mzSujJhb7CX6MlnD5Hqbv7e3MtuOWoHoS/RjVM7E9Sam6X+/b/cc8jD8z13SIHKheWEy5x+MipI/j6tK3czKmzui6CQsCcNAZVwRZojo7T3RfAM8QWBVfG57m01TFctr/LnSqCzu9O37hL+anRsWo+aHK9xEI5Tjh4YS5R1ZelsAnn9rmn7r1xk/hRsuBoObwVomGjhC4Em4nJ4jsG7dfX+HSxQE+sNlc2KY9nVbRSJBgiBjivIQLmIlQf3QEG6o0mm5PvnNomXAOiOYvSsDxVK5ImCkbw+FF8G0sU8VjW5w7/ICF4ANu3mxIV+c9kB2N8JrJ/41dVgeAyVTpXcOryLZ1PNhgZDSgHc3QmeGOOZ43cfBJRMg+PXZblSCwt5mONAwJIun8wHnTAOfM946bfMRGD8OAGVKpgb4/wV+C8afd9c/xizAEEzKNtHd7+9DuZqZeYmArfBIkx69r5e1ccjbNPnwCkCYqSwSMzN3PhR9abOeF5o+nHWUDv1RHd5O/q9gHLcxVWl00HY0RMMViDtrw7NjSc3rCS1Gvuo1Dat/Lb1e3iIUHbbSmBYzO3PHQau5kV04dXrDpSSihUgtH7Yl1EL6BHM9JIHYvn8HiG6rtxPQwXpF9jBTb0MzqBG+bAdfTxQ77BF0UraSDYBvQxK2JwKAmAKdJa19Vja9mBllZQK6ylbmzDEVVvyTyoiEk13voLgfzPkA9pbRk4lqByBkIT0qVQiVcLlhLcG8EG0dDxoH4nXEAngN6gUw5XUxwpmeG9b/cif79rVlSz3ayKeg4ipRdXEGFkMJegS9yMo99KI2Pu+A5rnOnAjS7NjBSBd6DqMhTGfpckjNH5Ph/wwglWx4EiqqCJQxAHdi7LNtUJAipHq1u99mptBzZAanGWCoOtEEkraDydBeVZgf/zGKKgX9+4I+dKFv5H1ER1b7l3ne/DLXFBPrTkiaL9awIT+zPTCm+3KkwuOmFstafRb1dMAvzV61RQsiE25pSaSwMUeS1msMGXjT1q4ISLnXwcmLHuSaEi9FCDTW3tU0vTEY6a9tZXHzMvABHT1qkR2suYiQwBOMweul+PFdvpI9vcJdpeRvACOHShMLtQdfXwla6IOOvpCmvGGGJ0iJ+0NQdI1/cAbT7QIj8kt4o115oyMuEkMrKKNKv1Ex3nN1rh5s2cU5rp6F/BBa3oXxjo3ELiVtID0Vi7OiUZENd763GoPM1/OqGxzy0PZ3e2rverEIs0NKGAeeH+5kmEnO9b+xe1gmcIP0RxHpW5C0LkJ5W5wnwVzVsiB9eHxpQERDhs067oXxPNfiAv6ZV1QWgUDPzuZ8fOjYS0OucdPYKjEFLpgy/9txyN5gLqKJBXLbzcs6b9iH79EUMr3+LI1Ucjp+miCc1iDiNSxtNTH3VJLUzgTdKHyf6aq3Qjg0ZnNYIkgcRjQg7bjAIoKlfWq6Y8tYOsukhYUJ916po40dXtYZJzCzDtw82/RxhWcx/NzF/UFhx74Yp4rI0UyWfHCafhI19kuYePJP4S1KmvHQ4kzCRLeMn49fSvAqj7eo01XLkJHBbWq8P0e96GLpKIDurB1vx/nWlluC5kwW9AtNy76uTNINpS4+cVLqrBdTvBsq1D/W3dD5WSayOV7VBH012iRmwri7IU6jE2rcMtZrPQkJG2Jx0l9u4ew31BWIoSZgidAoEtaTIvM4k4N51dpyDfTnRdCyP1fD499x1Fd4+HA6+3nooFBC6yx1VfmdgrZbTN9+3I7ZK2GuEh7F/4VQsSJwUhlFsK3bL9KbW0jusDSY4zGWq+LlMa4p2r+kQgoURt0jE4p44lYlFH8VPLZgSw92nKuSpXAnm1Iy5W2ZVISgkNwpc4XbwX9JB77XInEoLuxkoVzmkViTaftA1gW2sjhOsYCWpqgz476ZfQUiW6/xeHf+QkZggZwPqkNceFNh6/FPfJjudyYrksnNGEX2BrtxDAT4offC1/iN8raD4usG93Dqr8Vmj42BRRC/XQ+NJil/BVPc7jJKSGmZMl7k1/lZLh62fnNBj2Uj4wAX0MIqKon4JrIbxf7qBsfQXP9pOr0f19HV+nPiU1zK+8nEKenAsfeluMjsROrUpnCAmp5MjnJ28CGMqBECbCQfoUjUfrYr/sNxqTorQ3h+y5mc3U3DNDFSooWTGqcHI+G8VIR3/3/TamIYNvjBc44UGM2SOOcHLtb5Mnu6dVY6HstLGf7EBsL1vRsqXOXnuOSVcqJBRNUnP9y47UFQfUu7Y8DU9yH568l9sq/fqbpKRacvA50A2Ue9Fcy3hIUDIP620n9MydDwUs6xU9CPuK7i0gDk0+kkkkp1fyqTGR9x
"headscale_config": "ENC[AES256_GCM,data:EuGGUGoxk97RHart1mGNa/ML18IlhXsU671hn6Um24jPLnuHCb/wM7SiXBs7rPVyJ4LpJtsvXWJVzWyEkwqPeSaL9M2+bfY1ltaBtooH7xrbjz7D2fcX3TBsR/yV6s1kU+/HztK/EXw8huCGqE7qnF/9Y/DXOBow3F0q28Bba4VYfoKE8wl59PhCt0w5eoCWwtpZlIT7ZlqKG7H7IEdAmw2Hz/mjZgq/QNXqBAZ5pTt7YwcBeDY9CN5+Am2h8dvZkRDyopCy9+5gXdNUL6ZeT/AjngJi9fYD97O1FCvwYJ1MSXXOqSc2USCjFHFKAcdXN0JEiXgn1mHg/hPJE1UGi6k/3YD9y/0GqSJpatyFXvhjsndbSNL4IwbAcFMP6AO4VFqiFwKtqZytkD6F+OxfwkJ7jUYocuJ4yfm5op2/WlfLpLtOjih8ubwmNWc0ZAKk0ApAl6KqC5Ut89vfhk/yp3C9rJdjJ/dud9te5Rt8TBw/58Dyyf9kjnR4gA4nUG2uM9d/S8gzjFt9Vzgp4DQzLvRB5q2OFKpn1ICAbkuMI1F0xlFEB+wpc1fRp25pF18AVGpnhPo6C2PAV4y2r0D0CXe/7KgGbcocd+I04dH/3pAf+RS85NhiULYByUJKfETKnELWRE2Z+nrOtPZPrk5fehDOlS5Fldi5Za91ko9448UsEOSc4OJ26uaBYVXFFIMhHrCXdRxdTZUs3vr160RvfGksevodCzNSe5RvGK9TZoUQ5sdtHPCJg1JuN6T4VnkigHYnsGJpDesHuooW7KLw7cp5O7Ct/0uVY5F/NfdS3mYfAhlYXAcJUhuFAqFoK6IHoruYnXN8BhjyxsNNE+XahktSMwqneShJj1C+2nQc1ktWi00RruhXFMQJgofmxhBU7h6pXms5F4QR1Qu/D/p9AdJ5N3s5Dg5ogkNEZychT6BnZvTdB6aqT5mYNOYehplj+GptKFZZfphpHYzVw6SMNjwbcZ1qzszXHpuix223egmbPN5F2zaVb+OYCTj7jKKvS7vRee8L/WSHoh+EMYolmGolQRANo6xTPdpvEE+OYj9YXAXs9OgjNA3OKa8KU1koMmz3e76ukxK0zosaL16/D1H9y4/2Fn0KwkupaUi4E5FgtNwKQl85r/ThcVfMPK3cP/9uEE/FcuKH5cO3UOzbU8PLaGQiJjFnrubdH2g97W+OgsXLchta8OZIXXlRT/mX31gJ/D/apNmgDdwzPjQLMyuoZm+E3Jtcu2Xe7rdsqUXiBONBuYvenZZGVxpxwh0WYRGve5n+jXkIY0atedjVdCd0R2tDXL3ZkVl5MOvH2GQ897dQOwoJ0EmfMMiycVYRzNq0Wmgev66UIbMtpbXh+dtoXu80arkDgF5/6axOudWo5K6P+UX84fo+7eFG4+jSvXZfQpgTPBjmI1TptGmb8PF7V+P1xWyFpNNgWZHir02pppH28RkiBkv7dq+q8LsXKoEgI88+9fqb+bFrI93P2bl2c+M/jvtD7tRHHtu+tDeCUoIJ6mejUHZmyus2rfO9JnXgCSCqeKFv3HYKijXcDMtMQtysvf0hcdyzLzLOKuT0XXupZDh4+iGdOxDmlo9KR7NGY0+P4E0+l+UFEJpH57uK9WG1FLQ/rMhEzMn5kH+eAkQdxpbItrn5IHf//ba9r9I0F87Ud+6o/zUkk9dMIpREriJ753CvwCHQ3tgY+EYLNZ737yWpwWz9RmThUYHpKj9fGqo75BLhxcf8rgBcwkhKPJXoEH0zg841xdlHU8NcbovZqm3RKLdPO1CyDyR1nFlAUCtwchh5WG7D8/6323LZX+w8BFeQFKzEzw+X3bXvb7Ekom18EYJPHzuOxYyP2YgdJrGNuywcspZEp02jxdWm2t2/5847nUSkAsMdoSMR9JtDfAqGa2JQxCKSxCy6ZdU4zQUbExL3jH/fPvLuw3a4n55hPUReXk5CEtlDX1tFvtcx2SORYSPbGe5C4SUipaGS7kzanlG3THdCilFoq9IUG0Tr+9O2S3zNkKQbUzyTyKnODXKTuD5CQd1QbzW+B/QWIA5OhI3r9+UIxYAvgCatXBEDuHD0FDVAM8fweU5nfoa3/U1Gz07JM6Bebo27axntUUxNufx/j4iisAG3O9u8x70+ETDJJLUGlUtIr27G+k2/ZKaNpnpZnYEGoogFpegjz0xiddJZrkPkfWbzg+GaIqjyyQJbK99vQJEm8Flq57uSsjmPTfHkoMf3v7hQ88SBQxnujUWwvv0x89teJMJkyNNBZ2TkSnFod44O0nuXrbmGaZDfANplBccfkqp7wWany1vh+X6siPBSXprb/TCjx0VD0DLRnuMUmOMKD9gb84kPh4SPB42eUT9exgz1WhCUhmASviC5UK2LPRfFZh9lBv2hs8wmNLwo3Q3VoQN2e1PElsOAiKnpsCEXrsV3V06jCmw35jtJOKtKRXVcMxLqrykTa/1ZBcF5FDc1v5RQTGlmjAWJF50xK7dLpZA7efLGO561KQJolXfKkxaI55nHIJ5Ntad7oY+hsOHd6iG00Fms2s3KNN4qIQ5WKtV0DvCw0hUyvv5Ta2VTzE37nKC9DS4/Wbo8xD4IOb/rIS0gqBXjz9iaS6ncy+YcRCV92i24csRWDMZzcyRHExgCdrw/UsgFRzwnfYtqV7vdxJzM8IwV40v3KLwLH1MmTc29F6jIuyH4UbRNveYOX11vcozv2R+JKcoR0jA/vuYj5CyoWE6nXHhzb55Qc/4j+Zezjn3F5OuuLiu9n3rxv9scg1MGVj5WJjvM0eAXgdSkekI+aS9pblZhOavzKRLgTPuX9ywq4flEy35kDuZ7GeaolclHipk0Gl1cVqnFtzjSLPf9kJV0B6pgN0LnDaM7cxHXskGGAtJ9oRmorEsmQldoa83mhN5N4arUohiInCaWkwwqA78obbVXb8qxh/KOTNqHMw6rhKic7kKN9I/mj0S+bDC1yzscQQqwOSUn/HRxSMWQlKsmZttZ3cImxTPIgVFZ4bTJzKPBo71a27cAkiOCzyjlv1cvvxipGYIByGAQg0NojLJ3GpXCj7WB8DmTz0V5S9+4DAXH72DIFk6VuALElA7sYmLj1pzdtAD/2M228ghrodHEGOs8R8FgHRw0F64e0zi40vmZDrS3uHlhU+T4+7ZhOmpknhAfsB9LU07GwnRDmSeLbvoEaZT9pd43c7KmBCDK4xy0B5H01fV6yRkkLqPdINrMrU4RCVTQhqasRoGIaCTd6LPyC085ioU8UpWNKT8UkXLAUMYZLb8bOsy1BKWjKqEbCBCZqups42G06OLlMX080Lt72jpmdnjR0KAI4y42d8Rqzs4kFN/I8cajpW/M+Yg8y0GVy57pdozfQuP7zGyAn4eQ87XF68RgypZID83U/KUegy4zTwwx62Lqe6kgkgDBaksYxCwxauEnHvMjbDG92WAJAxdeCgXE+5zUUmhS3lOsCUBKLVVlE0gZyEoZQ/1mQG0SQR1BFVRQQDrYKq//b+5QzjCzAA1bFRlqRxvgNpkZgjzKCvByvwGmc+9ceZ8BqsKRFwTQeWIY1FPwxAngcsUUoXr7xozhbcgAylrOhWLvUODUz+WsIc0GOd+5Lr2ThftRGgfniO+r353262e/skex192Gpcvx0bpPH/rCTPqHJF2EziDL7fA6c7Dwl8shgP1MeiZSkvYzJqflObV0N54Y0frWkxQ2ktEWjCs8DscaP6rDmPKSikFpP8aji9Rg7T4rhCg1SVPeXCCYxxDEJ76xnlEkZztJsyjZwVVjURNSwKP9PIHdGomewSFWjss7H8HjC179NwFJ2H9S8Krvm2rlz6s7ubpBBykQIzVoozcMSd77tSS9vDbcptUq3x7Mu4FasvUvINudmyvwWj+VA9eVhm19CY/rGAl1wiYui4bvRV7a+8rg8e8INuM+AqAOu4U3jxFvPSjgSp03xSlIEpYwwpLAzqmE8CUHJnguZb8ai74qvo0EQE5g0gRMw9MoZan+BTwux7ThD5Cn1yHOrobakGnkNxKm1Y36uAC33QoxxuaEcgF
"homepage_credentials": "ENC[AES256_GCM,data:MD2SN7qBy9MY5UE9pU1CeM1ctI3hxRT20Tt0EHgn/cMwrY0U7U7zczeNl/NoCpP+iBI2KrZcq7ksWX3GCDxIIxIbQY1x917Wm+r8UTmY0+FRDUy5x8E04kncbQjDFmQQ9NPdvp5jO/HN17m0JnzSzT6hOckjx0YqPiaktMKEpv2SSF8FzLX8RSzelDh4D9oqT5TL/UjTlL9LGLUFUX4ulmdUvF+VHt7vSitzzUccdN/m8oAp/dbAyHXZWYTeTE3oAPTaCLaVgWv1DLNfaNXYt02nMx6GerFLPPVOfuMo9s6RX3HX2tidNV5czyvf8fGWU1Glovm2xf9e6oK18jtUkLzO8/MSGloSh/cVTqdCVBPk6MKHB404XctsGmZsrTabpLQfI6LE29atjNUJorzNCaI4aG/VGNmgJCqsay6iD5RdxOYlcC/S4mF9fpA7YfggYFi/JoZK2D05eyt+cEpEc1p26p8GYQ0+GyIsPop3IGMDo0w8+LktelGNKa66kAOZC9VtN33puoGViiUxeIksxMMIqJdbhQCzQjkPmfNkA4deMP1dbBOnJxXRKsx/ho/vWSEQ8M8nT2phB21KWkr3NjLnAT+Cg6amYAXguRj3N4yZGmXR8vAeO6AduJ6vFzM3Cfl2hrPu34b0iFDLcc6YVwTzjPcpv0gpFfDBW2PMU/HQ3QGUMsU6+Nv0yY3FJjHKh2k1Czlg+6FyOQryLcW5DkwvLae6bF0siddQHA6xiX9SjUUxlVuuM9MD73ONuYBLXUlG3FGSAAzTuLyRtWx8WjfLWpjD6ib5fqXzY4kjbrEy+ZwuxfXFfEv95mWKIXUc2vQcsmHJhdSPMXgPFcd5Rmg+TGCRslCypvhdjrx4VcXbgNSOSxL5fciypII20+xJKsQcSJby95I24HwofZEP8JTbXj5b6Upxs2ohTeXOemdFnids7Q1MxDsVReNpAKTX4FVJ+7O7trhXV9jWxRRUQUKmTj0owbA812MhWw1rd4GzX350iP9fOpQXOu1uqQyfzD+vBvuBcOF0XVYX/Pwwi+qzd5048+tPa2SjK3/qI0F/9t9fiKb2o+UdTPt1AFiqFO5LNWCHe7wfliwA+nFQIwGMR47yvBLvKV8pCAkkPfLJM2nVBXS5RB+AGArJUdg1eblMDZdXsAq1xrRUzQBcy+tHa0YSrvE+3Gy9WO/jNoU860djrjcB6wc0KnXhiNDE0oNCznM6qAnrfli3u47ULa/cpYbdbMji0yxSfmplU9RA9/0JTr7B2Y9KJTXPFBDJJuQfzIYEJLQadFSQH6Ca5H76kaYp3jULdeZ8jvxMfT2I8RFgYyfTN1TvYNiBa8he8r2CSwAD8jP8TpzHpf+CfaoXb74xXR1BLjRSD21gkbhyUBy+eq9iM9ILKPyMRe6VA47BQFF3P2F4FXdn+/trkI1WPLtt2r0WXQKar8buDXJ3ifQ8ECRiV/VHH8MFyK/TopJpP1gjKq7Fb/6a7siTMbhznigOSkB/tC/klJkb0wTVvNDNf1qCQp10X8cil+VExnL9GHi3378DpskweyIn7zduRd42K6VFcz2D7qCmsZhaHqpHhIqaqzI2/e/bNfRtP6txdGXWB6R2D43qR26x4/dy7UFr5K+Nh8jdQ3t55S4LIRDdTReFrI2XzM9fwg/BL7ysNjGbYPun8vFPcO0/pO7h7c88Spf3gFSLrFAfdNB1x/tw2+kpEIQ2EKzRsJ3Z2jhUKqPl62D7oqt5y4AEzcEFW8rrgARwP8h/MUbMt3bckTI+EsWSVbxaOrqihIi2Ww88l6zAn/ecYOOIFwu4eDfOkfxSmbGj1Xye72Q8AILCHPrlGnEzk5ny5d3EBbqcms0vOGuHLVh8EmrEnNWy/9OqkOXhjFcc8hAQJQbgpWh1uz1cO9jxYmvyhmNGQBZj0gQwZEcHbVPdA4HTex+vEOSgxcYW5V47e0sXulicPBkBORYAwRR2pD9MzO8djy9XT/Ggyo2qvtsaw4tbeiAjAiBb3DaF1O2YciOA2DssveL+pc18BXV10fybnrHOd+2NXaX5zQFkSAU1W67rP/piSB+PnGJRVbg66+fZpL0RuotPGJEJ1cco/jprhk4JO68vTh9HhfJ8LjetD5/vUpSkNM0wKumHY0VcpIFWiaN22TJ5K6qHCN70tjEHdMA13ctKT+tDJY2ZCYXN4QeVpD2ZKQvveM2k7BoVks0UnXQmppc/R9KOcfLeOZHM/qsE2qsfZPmYKilv4ulFkTTUaL1FjsUNVqx0fdptFVwPZS1p65pIcd/vJ7WX9WFhnDPRFOtfq+av/wRm3jfG9yopjtmOgAAOQxkQLs+PsIvABJQ6KduoQg5Nmmv4QNDEZQKQsptrynFKUWs+ecmU/HdiOh/zqvDqeeh93+fWdivuf2TRjemxW1VMqGidIC4AskZO4zten4Nchr/mM8xla0sP94dl/LpZ7+1OkqExLMBrZkGUVF6P5Swbz8tZiR5NtL5VV4XEnKCHTAVvdVrQvrJHkJnBRr6/eMk+Nxyp/R2IT7lnJET6YzToSwyIk6HDkuQ92/vxBbPhoW5TBCTmXE+zb07w9+o827UVV02cuFgOQ3xTbC9CNRFUlRSSZIobAXFSuNZmSfJnq5JgwcYOphRAzTuwE2+QWwz0LhE0FmPm9TW0mCNWJ+/NAk67RnZJ1NGmF7LwKhd80YAcPAgDoxjJ7pOuOLfJ2ewR0a4s3eGK7HemeZCiyxhO96orq+7LihoLhNBOAtf7AA==,iv:0TGZcyTQzCRcaqUlQ3u2VfJT3JyfRB79qHWeKpzeRdY=,tag:QUB9I99zm/p7eg5r0oEYAg==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:lfLwFNhzIX8II0+xtVZFOC3srzc7e64eT+WAMwk5GoZGlaWyBytnzDOSmA==,iv:qmX9ge7rh1SN7F+0+lYBtR3WII2P2e5mLBqjUZZBYx0=,tag:jchLFdS+TTnWLGTYvcphYg==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:xr/aqAygIBXF2U7M9xcd3++qJ1HSu/tES+tya9yMuHz3Tdz77Zhentuz8qfTGdyQnkdHmHJEnN/rgHmvuX8byxnvQuu4wY3LODySFz8SpH7dpXUMnd/93KDF7XnlJ44OTnCyxmXwQ8ytpBZibGyBDEp02LIyzdY0qX2Hl8CXIc7UfgM860cUQgbdu48SpnnNcvkTBBX+I60pShG4kx9ncwiv3sJF+QqGzVjtiYo=,iv:7uywLXuw+sLjASMxfN+LxX09QKfnyrR0X/NLg2fCMwM=,tag:56eikORHjslO+ril5puyVA==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:SgJX6Xb149FuGydpc3Gx2qU5lasIXua7GnEFJmMHaW10UHUJxY2VPQ2mkvfgXlA1H6l06fpIg+lEqFFqTHS0eHM07vOZvLoDGHcIPSZC5/fvEKFm5aleFXLmrgdEAOtpF1wwa5NlvVq4a+mA4qXQhm9vWn8xKSCF1R0jEI34TAxBbf8UAFNLBQM8uhIXCtW7J5ckQZXSNabyGU06bKJO/6dk6Vlg70AC2+fpZ5WZ4A9zCEY7yogAZyi/pAVTFtc/stPsPTW26oZPxivWthRDsvL/UEXFB95tmi5J5WWfNBduDBmJ8NkolD0iKDBLCC1EX4Jtg0OBi/qYHeeEjFxQCNCJhi8VY+o2SInWY1EBO+JTMHWKFaYLvag6jIKEOocj1taOi8exvBL79R8xhw/7drkeWnqxxN8PxEx4lpl5VTYJMexUp5erFDGgezDNYPVDaNBJzGqMhKTyUe3EST0yXACL5pIZxMaQU23AOHvfXQXyPM7kiyoVZtVJJBjfXfdK3smrsPoVz9l9GpLWo8erF8uKFpHae1xOQgUK4ZNw+38Nx9AqLCr2wb6nKpsN4RllxNU2Ub46LCz9C/ZTzLbWgRzElZnuD17AxUR1qUO3/zGZ5HHlGva6wgq2qevi5q9nFr8PCWd8XmBQ6WDQbHDhqJjvFUiuZkPCzUG2qd4ueD5PkrRG+w/D6dY5nN32woTNk4elK4ISQTFxUuAbtTpRQZhlZb5u5IqwJZ4A7bQP1+M9xzk0iND+KJxGDE9gEbat2FMpjEfBNdmG2CGdbCo/tTic1Vz0upTGc/EiiLC+MeWUK1wKdzmshHAGRwXmIBZfOQuyLaYPpTP6jDw/aDblqAY/s3jTGlBOnG//zjaPKweq1LPxki2TY9baRQyXZCdtwDeIF7uuz2UyadcAbVnY,iv:XFGQooSO5icx52Rly3FmEpjFxrEEx3I31ZlLCYk6ER0=,tag:WTa5IviYf+XWpDls2lijoQ==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:iG2kkAg/VrXccCdUGifPA662q4xkLtAEMpg08jT1IBWfk9iPkU92X53ScucXNP3pJ30/Ueo6nGUI2dN3gjafaXXuvbMpfKtLLtZ9rfe7dQTQ7NC7Bu2PZjaDQDWtl0FQSqykXf4qhzzuJlqFZUrSvStzlbFC2EXoihNdyMIecVeurHE/sE9jG436wz+Veqd/y0M2kEaSJ1dEaja/asm/PLRn8ZPl8ERrSTjxXIDv5HrJ7xTNr336mMr/pJRiNB96RwLqkPU7P+eRmlHjMw7EVR/kECRIbY1CjcfeGxE09YznHtx7OyebSbuRd9rNEp/gbc6nCXdgvR/Pr4KaBQTdjYz6Rw+8rqkj9cHq4h25/QHFpe/yGnNK/+O3cIvk+u8NKNRyqUuwXWqPzsZ0ukqQptqqB/uN6YvKb10/RnDe1I6uKBR3EgLUbyGoQeOt7aDSYgUWbfSXQjo8u39XA/3Qt4yQQ5nFupkzUZY11AZOdoGlpbOY1mJx10qXr2nshDuc30S1YWYKQFS9k8lrE0teSExNpQlw0lC8CVEfIqms4GB3sVSPmF/LFo9MgZ7dcHzeWS2EOgxzK6utfGfCg1YAPgtkcu+s,iv:Y2n6hjM8z71okGeIl6TVqcQdyV2hBRdpQTJ9dTNOx7g=,tag:pVB6JUMwQVNcZ6qJ6p5TEA==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:vVHia7BPJiWI8ecYt7yeVC7o8USn04N6/0Aa2EBb2cOzFTvm89Ain795bt9k9rAQ8Wz+0mh1iZaXRztCathLOcbx5rR8VCZZ8hxHesn3HF+Aybb647I/2NPgv58NmYoQlHoVhYJNm2HQVGYhWwo536BN8x2J39W8TBAFZ+C6cjOMZAtwMFehs1DK6LEikq99B6VUA07byTY0JkiFInpTtiEdwtgIFKE0qOyCdB60cfVnfvkUYxno412QE/unhCvVqepLzDwwSuBEvHPV13J7N+sZ1j84DvWRVpi5mdeMYjRZh03Kh+vrLtzOpvMlnnMXlc0ejlkrOSA+68bFUn5MRl9SMOOY1J2LmcG4lMRRKxyHglx8DGlTg1UhUlUxuB5Ugslw6gCM6A+E4lJeVjJ7zC5goCmxMb+/r5VtALDs9rSe6Ywq+QOsNweTc10MiWKs5R5+iWEzIMQ2Wn1t/CJHyu+xfgAfgYgrcAu8/okTZgTk23leAkdNoWwhZZ8tgIGpdwKBnOKOcbYMjWgnEWKu3m2DIGNOhdVasgZ6iiBs9dKVS2bp2Mbq2Bi2Wc2Sh6/r1VsTOQSzDPJUgAbUUbxRMKYdrDM4NdtIN+j3e/0XIEqVQr1V3EsORwy8JvNfr6Mhtfq++iFSW8fF1Tk+TujAf2RyIjoihXtfA6xe3+hKhNc5fPcgv4Xr9+FxQqdAYJAeSYY55R4NR3OLERboNVPDutp41OPEHlv5HJ+4VcLN9KtQGSU50+t1zuXssD3Gr+OAlGnvP+QUC2gRciYKNV0BwI1Y4ocIqQ4RGRbcSw2Ev5lTW1FGK0dcQQvhB/2cvJTpb3rCl8ms2oRPw5Gi4D5Sa6VGIUJxEmXxUrBo19ZkT/lntlFyexbyyZR1pwOnibrbN8xl8gZ+iSAm96OSJAseV+GAZMV8k3NQKRXBvVnSJ7IwM6lpJa+PXQStwdmZizWljQz3U8szPsskIoYn/cVOlURrRBIGtSa1jUxz5+MTuxHaoI7GfSqJFOfd+OeEhgrIbcfEOTx6CCvhJyomvSP8p3GImM5AvCtzhvjcsd8O63ikqX0nnCIhWtDgm0SOzDgIEci2i9oGpOOXnlUPJgMmgPjyWU38+IhJbV43FfhE4DEaKoIV9NulDQ9NrcFwyMYWbe/9ER53WrqImSrgq3rI3Qrhh76omPAf0l8z+8/k7Q92P2d0+6DxH9XjZCVI30698xAuQ3g2iUdhlLny7eGi0OPAnMfpqnmHiITy0dKvwENjLBzCPgbJMcdL2U5G8gYkQmwniouVEC/01VbjE5Uckx/th18vDAnM0ZjXsOfew+yymCnesCOl7AomnZtgac2zUmX01BnDdnBtEcbFhhkXSWOdf6DFcp/+R/LtSKeuCvX/8pFAdkcyBN1Z5owBVfhWjEJfknZwZOQ/7nReFGVH9icdxNmNEyPM6RZl208t5yETTgE+/F1QkSYeb62A54ol6pZ3NN124tfQOyOGiakxw1uCTtk+UFyYGJycD6Zu1WpGRkXCACRAMFFMPZz1obOUTMLqRO4kq2qGUhKaGXLRv2xQrDLPPZk4C3UcKAR975gw9QBTp58hlluAKaw7DAMK28yy4sf6B8jhg3M2I4ilgLMvw8NWyyrju2bn5aSLdJFwotrb9/olrA0UUxEG1kDUj6z5H0ogn2RynUbqW7TAUAqCShUqJcEKgbKq7ohe3LHae85H//wIn/RlVypoMO3yEEj7gNgvNDjkSPcN/78NrbMfHzEK8cbR13qzRClQLz2oUYkd0RnVlspHhxg/CStzpebpu1Tk0eWYF14d4q5uLrwV9Svxhk3Y+3LLgA6p9jue0avmPnFFQijafmwkGF5XKqPNKsARsbg+vIMElQAdQUOXmTo+A7DBqqX7quxYI4ITNvZqqfB0bvtMIeSULoWJyAi3P9n4TYYmwUIK0OpkoAGnBSaixxfaskWz7ldhy7mGSxf1wGu+YcG9E9NONdBFKAUaAQ/IBg/Ph9aUZC0Bdc5p2Y84et0+umZWSdQJOn1wWgLWWFCAbNw57o/6FVV16RonHCtwLmEdC+ONlE6LZoJe0Y9crNoJRH4Yp+q/EsTvkh+ECwsRaSzii91ptsBVxG0d4qKpHejSa6K4EuuuAybeAeQ8zSgOV1Aw7qgB1t/uPq4bd/74BbFdIroWbkDO76V00iDkGkw2OaZAa3286FfCv+kyrxBnUKMNs1ulIRuipEp13crDxa4YMK3CZP45uJntcMT8YPtuDu/rgAf71O0Mkz2SPHfCBD2W6A==,iv:leXW2nNa0h5jLqtmUOEEgVeaeBumbnSUYrUaYLdYQe8=,tag:FmEv9KI6MqPjJkXaX8SslQ==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:4NaEN5t40oBvJdYbQcw=,iv:ub44NsZaxhVJzOIGOvMO4ogEBgFlZUpfxn3Rjsn2tRQ=,tag:33PeyLhq9l4KDRZNAAl77Q==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:Ixdblk11c0s4eDxEejYXHJ5QC6wKC0ilvcgLCTkGLlqPDNluI3J68rsWSTC/fDueaPVrbM9bNiX1r6z7j2k0yyAE2c3WEshnpFjIBidGkrqbVxWnxpcOQ6+ugBMeCf6O7aH0,iv:wUmGAzwZjjpvNgAkgdOCPZbXJ9NSXlklJOwF6Zg/mrg=,tag:xPlaWmQtvXQCTgcqXbUEyg==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:MMBb6e7c,iv:3IuYMkbZH9BNzS5HhnuWqgM6wzF43PXIVlCEsuejfnU=,tag:k/a4QXcPEC05ql126J3UhA==,type:str]",
"pve_password": "ENC[AES256_GCM,data:VHPmR8bdm86Z/g68RC9C85G0Gv8GhQ4lvve27w==,iv:L1ClJ1A4xeZfYEongSdpBXey3YG393Zrz8MwvQJHJNo=,tag:zbkJRuc/LuTh/AdhOSmwbw==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:mlggNax7wLdhnkSPLb0=,iv:G9YIMVp4YlfbVay1CGXPtxI8hA/D5/3tH4DfHfv460A=,tag:L1wykQEYPVK8sfRlfR2McQ==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:nXzd/+bqZDHzR9QLTHdDH0aD73c/mMI=,iv:X9IsQI14RwdOCHDcuT5JBtJUVatDIKeNZnvZdjHLrjU=,tag:d8ZcMpZBSAC5al7pNovd+A==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:hrO8qP0=,iv:ZJzT/kqlC/oR/pTiAS7BCi3N1PNqHjxLyDxURpJD7Pw=,tag:ABenn0Go4wb0hV3MkaA7JA==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:qdIbvSsNYBsbBCg+zLXbJWXK691MTA==,iv:53fvAlbR1LjumVcjHQDgFcqBg1GO9ZfFxmCoBPD4BTo=,tag:uiTUqzlh57vuh8DBFLOflw==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:6DDvNTkgFWgANCn1mLHctj8P25oEPZPVsORIUMClGU2aD1a1tYqYe+PSO3mSOm3tjLCILy624wC8JAVImjxM62qU,iv:Y5n+QIpafD0skVmOt2s02B/MbgUq1IQf+6yI7oIbngk=,tag:qMgl+9OR6e33WIDXbt+hlg==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:8Cyl0vJUvpM2iPMMPWIpnUc9INA5atpoL3Ws/SrXqzfeLcWNf0KAhiGPTT03wxY+jhIG/X0yLwClEjKgNfcOGftf4wWv2Xk4TqcafTi9IBGsrw/Fz+e2hpca3Z1qJkC42FdoD4CpFbgqyIWmzqXvQRCeQmA3dHeVa0RJcmxiFXdZ6NXXS/JHSqzGxUh/cSlmP5TZZTv441pJbqmseYBh5jUz1t79Xwt17udhHjQkrzRZCXW3qZARks0NKJzUgusT1HSzCQ2pGStZaxM3KiFnLBPLpGXrC4/oP08FXMDDfeqWer8XDa89fjMgwM1RS3d+Mv5lisezakAYrNph7Su0Bdi34EPAAwsDwqwIi3ClJ5IsWBMlf31avuTgfoNeDy9d+wbq/wws5LdDSqUBBYZLpmwkuFmvyq6P0K0RHbsWiUiMuXBh1k8mz6IpyJAV2G9HovkGGv4blCL7W1Mg4UzgCtx2DCU5OkUOE/imCaYzDoq18n8+qxxkjrF0ECmnsm9H9OX6eCLLElWkJNJP0qhTmKP99yeVLQROd24M,iv:p3esAVMAbE4MYYQOhhkfDANyRLeHKkscUgeqhVVYCUQ=,tag:14htvSeV/b02Wo8QdkND3Q==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:ZReSeyapyo+XHgbnPle3w91H9f8=,iv:zjzSeJCOVKAa2ZADh+E+rdY25+c40U20qsir4vQW0tQ=,tag:+sVutyEVEISmxyGjWltCJg==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:MMP4AMdNjBwj8R1HaOoQNLEPUKwTrr6RYm4Dz8+hpo48KsQdH+RvZA==,iv:xyR83uX5EOANrqp22njLm6aI0KalB8wt/uFyzg0+13E=,tag:M3BvezL+9ZyrgdITSi7KLg==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:n4R+PRxxp02LqGs8,iv:nCICJzUn3fShva5Y0c4jgqqAFr9eTp+IfVlnVKcN40E=,tag:NR1x9XqynIOoS79x52AYMQ==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:PKJ7CDCTXwaWJuSs3CUVfAT3YKJ7fAzesRcKNKgMcsEp6ily7CbkhfTpcUnU1sC2jH1L6HxA33BuXnhC3rSn0IvNdQh5bKjeYTpL3d6xhVkn7GcwMS6YL4QUo0vvxM6R/2c0lNXn6/F5CDcBJZEfAT21m4wJLjQdLNVVIp7FRYE/IActiorQy/jyMoJxb0cWx17I8yUWsa/dJuUXdw8ttW7K7FRtcwoSGABLUboUdY9pl2qRoIQHY0kC6GSexFsS6nmBASCJ31jjvufD60WQLIBkbLUbpaGSDFlya74O8145PI24f6HVEubPb/sjT/dTDpCKImlg0MhIEAnbsSFvCO4BAu68jwOak/7uggU3TcgxDrioIE3u+0CX+nkAiJh3BobGxR6m6DCDRYT+tA5U1opgKhTvKH9dFOaVRiQ1W+eAkU/ezNzBQpbKpeP3/LIIIe6Nuq3IcLEDFxNKWhHST55+DJ5t/+05mNwyJy8qQXVCLCdYMgydr3NfFyaq/8K654XCSBnKZaCV3ySSrcK5DStJd9asuYOKg5+rgg==,iv:PQQGQgySnZhL7+FG5Dv6KbIXWENyxAmnNkYF2QbYX+U=,tag:tE8hA051E9NO6zIpDSBZjA==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:v3wmbYUxtH5pqd7K7cVp8AVnmXejZpsNE2qGFLA2C/FzK2+210HC937pS7O2pH3Z7zd1LqIx3bb/tcxt4P5QxR+fhGeym4wc409cvChEyI74aWyg5NvMSpDOyk25VMGPquOmu9rUHp+HgzfR06VRMliUcyrxEsFb1ab4oxjbYCB6UMWrcPzGrQp0VUEhCF0Vh1Jj3J5dYnJWJf+AHNTYJEUZtsdhLz6ty0S3pWDXFUfkG3+dxBsbVcwP+hBCT/uKhkuKvhzd00Wg2PjSq8ly2SKDcL5kHXNvKTjxO10hLCqBrP5FyY5SiYeLGmZL/QptYkOBBgmP18HQaCmv2oVMLekBhFo1A2RrdUUBYES6rcoblGr3Ss1wrEOFbhRTJQ1ZJyQcSY8ejZ14CAFObXnu3RkVyPYpdFGjh7cUfcO68UfF/8YsRPUsaKDqsvBk64UMRnv4cbC6OGN2Yc1tFr/TYv+IC9gEhqU/eq8M9b/lRAkkpUwtA3PQb1Rnp2ibfYXx8eNjGZCtsu742XNXyDfHODG13vjApMM0JG4rihVBK5Gr/hk6QhaO9GbrHBQwJLdg3nYG1xnsCH7AtzN7pxPWTHOYD4TLyBTkWk5HCIanuy+sBA2K0rVrpMYeR5PDbJ27yhN5ptTQ4xAJOXtxIyEwy3RGUCa+OmFbZ2QUzzwZkn7FQIdCm2NJOXr0QGjQa2lHKYgP2R53u9VnF9kTRA4KO4khByKyI/HfXIzcgwTekTAydwwYUgb2G3UQIOquEWLFyWCpfTwpFOC8B8ZK4+N74mpBfm8sgVD9MhjFDe5ZEtdYsuf+VoICeIrs2Icqu0PZrJ+trcjjmybxRiHz3xiXouj5xaKBuyE1B9RxyjNHJW/9qKNLoR//9RV4dQ4dK+x/X1awhJehsN37Lelojd9x79vbyQDCkxV/AGliU4JacLxI7xsO+xpdIj3D+bvTEMjGPv7W+z7QkuCXoUJVU1jB6OpXJXUSPo5VxchBUy5q1t+b6XA/goU3jaOx22Qf00Rxtl8kO2tuxenq4nWIPPlW+VFKTNRKHSTSUZ5poWOjIPMByp8Xj6Q3h4orOCgx1TJdCEo7Wh/EFRl+QvgF2bxE+81AL9muOViEaPkmTPevgB/7UwRtgofNiNma2rqvYAUBMPmQcUvb0Ll7cN78FV2AIWtRDgRz0s10fMpdd0QzXn534+44Tc4ZDOeAfWmet5SYeLwwOAXhS+OEsV1BHTvJwoQ9m0lQU1IrT4lURSVmBlqFg8Mt/pd4BF1amcogKlbnRFObYTbIYxCYTIMIS7pb3ENK1NJmbTFo2D4xBMvDCRgCjW7wFQdZ5tKRJlg12AVnVZ+FL5KPyhNcvgTl2ykUmP4oIraFeN/e/WZLsqWIOUCSr6vzAvY2evmtx/wqNJSvwG1FYNZ85/qYWFb/wdlXE06AQ9YJMbW/B3GcqJPKtlonPCwrAkI2q8SNQamE/qvThNHBo8AeV7p3ArGi/DVtNeYdyV27oA4czvhOAX//jKtYMBJbAFvPiiQ4NxI1oyEg7KxBYYsUWxCXdX0PpsvQsVIiJdpT0dKzYAbPsiRs9hkb0u5vWkPONOaGsYTBa8NYg7u/xbiMhZ4A7PK6hW0+g1pOUBg5wxkkgGyF1D7wkg1t7p3nyuWqzfrgdkdJ051kLOTJX0yy8Jk7ra3U7Ru6j8HECADfgPlm1tuoqH3cSpJtZA+UyqkhC/cruytva+fOr8Ziq9PEOAikKStdVZCzeH0ty8YxsyiAc5HXYuJvr/6SmBCP6bBgzifbgkwLCui+92IhkmxEL4eQ2dLfDOm9rOARgXmaRgZhFkWrwY49RQ3pg0hGC216KM58h2JhmoL6sJ710YxvGEDXhZ3X2kexJmUfLoDSu21PgWFZcu/AK64LcjcNhhSLCgDPIz+FZKTgcgkXqhRy8CODTUH2pYRRX1GRWZBoIkMXduESwAOAk285UqpBRSDYqTTlDaNLfIB5VLDTwrMKfqHBK3oLbYNlC3gsiNx+ki4djxcfwscaOUaz3RsZO42bDZ0VQzMoKmc+kkY6kUVtyZVdKz+DO2+FxVfqTsMYH7RFRyWzV9CtkuOaTdIBo1uED3pJJW4LzNp+wZUNa/43TlcdPw7jzucGwk7O6F24XqNSkFY4MCPfwH0pHAantABVYHez9CGeTTQhCKF9M7q2YgK9YcohPfRFprEqGeqjzM/7jbB7YMoeC6iiA6ASkO5sffSPWmjKEqH8V0nxeRMc1bXdaKP+jgSoewhqoCMP4pvFp3sjxZHldtYmB4E3U6kB0FL77na9vexiLCYDGpoOa2TpEVd/nDkre/cKcziqXludlkVHX1qIuxjTAEovEfwt0m9KOlzrrcQCJLa9kO13jyOXg0SpSAfqvtM/h3i66UEQ6BRp6geHMxJ9+Hv7tMg3KEu7xGnnwNkxdUZxBW5qRRLC3Aw49daxwwBChoF/NWzSf9WRXFt5KgmCYuHWT62z6xpS8xc/s1sN7a6lV2nLvGGA/lJtIKj+bEZT35ihJjceKLYsBpJDPBwvRYPNeLji4hnguxBODJJIaDZ3dl1hJRb1PQ+p4D8hY02Hs5wyRrx1V0i/YMleD8f57kbH8jaIO+nVURr6DbynRME7MqMizTzApfUWVOa6IqNwMarQy3ebj7/mH77Fiax+b0kQDn0t4Gu7AjtgVMyYybAiBkSOnBn8m5oa642cUScZsI+bskUgKFEnGf9DVyxEDFrQVtXxIgM5vKcCDWqdVW/lS2f09a57opFPNLPXNLjDo+YKs/+SH/fQ5wAmdq0m3B3RmfsMymKyOK4kqk61nYRE0BPVvw4mIUOA5lIYkvYUm4l236cYZkhwUxCdypvSktZ5BO/R4PQ+2PfgO0A/pgrpTmD5Dy0hZ4jZMJ3TroIRKTzK46WtBRwTL0OFLR038l6K/Wug7+7v2YNa+EcIKWUK6apMGbTp1+ZAoSIbEG1L1GaJ1apS95og4YNsjGDimZilPEhgQsFu+oUvV8x1mj5zM949ZXFRh1xVle1gJwd+8RXE3GUPBzujcVn2x97rIJzQMxuZOXt4NTz6y619PoBzpGBQNRlMbwoMqPeha9FYJDMhx5tow0aAQpjg5H9NYX4AihFH4EdxpcROz8y+RRaUStDnJcQNSiYHTOe4pJW81HEHHyhmKb/fwUaZ1jZcLArYnIgBfymzhrOFfPFM01c4OhLBQGi2tGBkMZRollJToAPFdivtw6n9vQmXZBWe244K59XtnBrFYjzmAybHUeFLbARkGOaFCERfT/0aGgfI2VqWbA4FLT9fhShLcZu14tQgcz6eW/p1tOxgg/ZC2bdPO8CA2UDKvmZ6bLtR9jlCY8659fz5Dcd8QQxfnT0gSQr0aVPRl7tRqgbaY1n4uHGxrtflOt9zf4gWEZtEHvkvSvdSeipGuhm7y81wVW/J8yuGdkXX9bLDVdZgUpQr06NmGDb7kqHfoA==,iv:2gL5GRr3XPiGMTl7i38h9DF0QVZrO6qB0atJPU7tlYs=,tag:ARLSGewJkPY+oBDtfcH0Rg==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:aGiK8YOmnoMxgdzxlCb2NKP+SCy+TjaVgcwzguQuY0H3BTGnKKnT5XakZxc=,iv:VI+METRatkWaFmGQPa3vj6DlJ/64lu2ocREVheMI91E=,tag:PpviUKUuqcDhz1Hzz+w3xg==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:C99gp0hLBpHD2OOYWqBKTn0Z5Rb2xyHwAayX07AzAoIlOWiP48uNN64MHyKGrfU=,iv:sTLdTVueNhCO36Hoiy75fYnjC2+DsF0bgEE8F4zherg=,tag:PKmLZF1cfXX2IqAwIzoXfQ==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:AA5KzA0sV9rZfTvQl8EqgAEr27bdmnH2NHMrihf2L051s5sJ4qKAmFuGLw==,iv:zWp7jbBk50caSiblF3Ym9j4TySd4SI7/5tXgXRpp8bI=,tag:wlRilfYAw+BR/oTCHImkQw==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:wxn9NcKwJA6cNVwaMtC6ekOSUY8IJZ8HGjzVYVGFZ3LNFziLWm3in01ZUjTx9C74Aud4J4VH5UPQDNAIBeYhTBg=,iv:qh6WQh9zplh0nMjkhuqomxhRK+PWvZDA23UIP4A/+Hg=,tag:gep7ogRL/z3vHKYwH95xVA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"data_json": "ENC[AES256_GCM,data:Bd6lVHwP3bxa6EuFOo0hwxMVw7bpiKbprmGx4UsOE5AIUzz+Je1a/fd2q5FHW8Cdu41dXDetguArmEowVvKbhenADCojCRj01c461VL9cLJcIlx+/Lqfqe2Y7WBrlJiAlkIg2LK99mbgQklJ+ixxiAfdhpqA3WNRSR4exH8EOGF1upZcDB4J2FuyPK18T0TLQmlPK+aWKWeDNtl5kSOWVsby4Gs8esCNDIvNsdHh2XysJgJuJuw68EinkTR9vl2VFeQmlIceGXAcqtiKlGqcUoFKt0x2do0lAaaxmaUVe0tKFIicftbr+Vo/9I/l7v2WYd4lRuWqromTogOHSWs3z3s/2cK0FHHQHrKM54RJrIOpugRKseX1c9A2Bh+XIDbdInG0VvtQxQEsXo2D9Nca5pNFGKRgq94uz/3+jZptgJHWAR4TPbuglBn2I2tMH0JffIt+cSSweN+f+BhYYTZhNBnKNGKEj9UiRyffyRm1l1oGbvoIPfLHQkd7KOo5FhBxDFRa9UeM484Dh/Oz2leU/mwS7L057df14dWaEXVrGn57LlOJiCJxxolADgP6vWJNm65SxgOUsUupAcVwCV7nWD+U9ccyxIGGnDh1eC05EFORABHtEEf65oYRuRDe4ThkQ0fch1VMID3uzWqnGxKr3YUpWlrBxMZ89WMmNGmwu7XeThjPXsjnLKsrZnQdMtbjS+sNNFTLz2DVuHkIGOpKtG/nC20DQfh6WABRGpLp3ofAMtT0hjhgZgqZOnR322u5R0gjzkLIVuabB6217050I6hVQeqWKWT1b2LIKzV7cXQEwZn7V9IZGPLsRwdxNTVUkW4joEYM/ttCqcp1fQ+m+vrl2ViyOBUzUqTWLkFjLVgEX6lZ+f2/xeYsue9NyqCDQwKXK14PhHKewcOGHgkqeezLpHcnZdKLcjVr9vcqvRjLRnlY03aiHEcDaYOsm435GW0gof9DbBuaopV19oAWvB0Dd5WJuuAPginD1NLQdoBL5I2jTEyTPUAmdrEmYS962DX9NULkq9ikp3SMT1Gb1eEncc+n2IWwvSwsbPCTuROFXtfCPp8p2SfvpGgln+Fdzv+HfY5JZQgBS5EnAyJehRh0B8PvATUhLAh+FQ4QR9eS782hhbPZhzm18/aBsiP4vvMn4JkxOWZPhuHhHc2V56/2vnISCk7b/5VF7xSxR5HBRB+EdQTl0v1bwP6CBSka+ldgOLGXiBG/qPTzOJUUVY2yRvkOlZXwUl4krZ/6IWxGsg5oqkT1oWcfXW2k5u7dnxeLb5CbUUePIxaPgwSVwbE2KzqipNkzMvpWlOInHkdbk/ruKxXDrSwSG81+Dx85nLQInpifD2To3LjrN+2lCuCD4rNZe8mHhCYwCNpKA/IKsaEmxM+xSRgC6ou2qgn/c9DzZ4Lsdl8pximOdRN/TY5nmUojeWfwBFBcCAgOyir9Uz5+HIF9t7nhO6C3eiNDlPB1UBxXrk/Rn3zqXJ3TTxco1xbs4BP7QXGgKp8AMJ8iLWRIzbsU9gfNEvrr40ah/A0F7Z5AaAy+Pynkg6wmxk3YB9jWpyrt8bTeyOfSTRiizEnadsaRMdPemG7f2MYp9a1jY6sEAX6BhQnc44vpch0r16pM2h9DFydI6vREMBR2InC05D3hm0AsPg4caihT129u4CKrQNrOM2VALwuUZLBZfC4BX/j9GxackF0CTcsirBvb1hMxQ2mnx32lC4NVyDVQuItJ8HBZzppVVO8NLJmNlNhh4HE856zQmElvO9PsyMvRLH0XzRoRJ7fQ7ZKAZyjbiZwZ6EPUg13rrSem97gQyrOjueoqR7t6s7NGSc2w5u1lW1TT/5mVxDR5APl9pB7I8AzOLxpN41W6fNgomuMQUDePmMkzFlIWW5AIR+Z6yhViILfZDqrA8JI2kgAWQB0PZ+qFLPcpzMFc7pkPKT7VRkvwhQ2uc+gJc8KapjD621ugGMexOui0Dh1ViIyvL3YChxKbGfgHILusQUP6NgpVKRVHCpcPZ0CNcEH4Vk3GHAq0vXtlhsraV92hSGVmUblnf5wi7CRslTQ4cgHUvdzNozfb4N2mSV0nT2XqxKMAyA+JA4CcyoiJpCoJTitXW9vmnFKIcyG2RXzcmXUaOpCiCTjd7xPcahHdz+dlLGq2FVXvV0aGGmtR70WfzLWCYOgjZFe5HHE3CIxhz27s2s+nixHNFaQUouyF+457GzxtGwC4LDKyW8ve/kiFw/cZRpogwPbBNl3BRsS9RYaeqsoUSwq4S5KBMfu95TEbqw16zzcloxKEaafR6iGJWMY3ED61l75j6TDneelQbguImpRsxGXLr63rOjLkhWF4ty8icYpD0vQsPVHcs243rtc6TXTREP0lXFBadn8y2jPqVh5PxaeKxbWz1S4tLJmvMZI/dpLg7yxNOX6ksO90He3w4LrfwTxsu2kQu+dsOFjatyr2L1v2yG62z8X4QSrGrd2qwyW3lJ0OEr0AZ4zKGKJM2AGqeQ1IBPhUKAdHszFng7tyYQVIBz/JVt0K00sB6HlZAbKZzsiZkbjsyI9A15RQbMDewnBP+jI6l1jjCZyYpTV7TMUDP3wkI+sd+WLJyAaXm8njCfmRMxSNWNI9V7hs+08Y0JRZ/w1sSc7XMZ9E+QUzjLrSmhXo3i0zAY0GdjOqDVUPimrPxaOpcbyh0uCnD82qRdBGTM4qSU9YtXFlAUpZr5HCtWjFlB1dwtMTZ/b4+5O8SDUoWop4MNP8rKmO/rmJZxdrHfT4ksh+CFy5MMfdktqYSMwmR+qw9lPw8rrxGge3UPp4xO6mc20LDau1y894rBgvs4aPsiij+5qapDgWaSrXJo8jpnSFhBwl5pn/PHT8/8fcPn6ovZyEKtk+Tq8qioU6OkQyTxK3ngOIRazUtGRo/W0VrCjrnjCR/KpUHvM/TKYGbI68Gw6LhQcDQy28E9A2Xspzme5cUu/OkunuYTboVmVCc0MGULVQPQky1zaVajJuU9yY4zxyl0keER6kBhV0oRtQGJJqlwu9IameKWI55zPRStFzOnB5Ipr2NyQARdJV2TT2352xzWFbwk5xorisO7JFk4WkYPh34fwMXGchxQcpQXFEUY20jsZJVOaNXU3oLy1DaA11Ecp7M6gtfNQGLdMSf7c9rT3Eg3YbstsKnz8o+6sKOE8k5zsvWHlIx3bz+79kr8VvnOhiyR3eV8KndTxYYs3QLc0RkAAk0CjxnFT6FEXx6fAhGAeiKnW6JOs6XHfRHg9dkWyfrtqN/K/yUMQe6Thoa7YEpFDzZJaHo15R7blOWVgcMrVAO9ujWKEV+VcAngvP0y3uXVCPkpD1aDxM/jC0OBBUrDpf7u+vjngqIZPI7ONutMld5V34CHNWM33krkzKSBdGW63S+0v+LswquZ1gxpj5LoiI16SnWHwsY2cuh5JOzo2q34/kLIi4hL9+Xvo4uad4BQeVP3A37vWWbreqrPAC7eoYb9yucwM3vTBhuyFdMPEG/sU2DBio4GaiJ9zgMFvtQ8uqcu7uQT/cyDubh9jyaqN992YwKCxGaRdB9izCI1VD8Kd6LRKWexpqHs4AEGKTuHK4DvKgGi8oE0DJuAU7UPuetT8CoUGYPxIm78M4CX31gVNUp4y2w02YZ+Dx3hdq+rY0+bUGxFRqGbw7SbFIOkEdry6875RbBZEz4E2NAvdaeRYQ5NKN7wiaRxJSjtnvWIwZBTMDut6zzOT0vK2dUkFkIODmG5G8T1DUW8L9wiy3Qwdz8y2MWhg7x9KtDyeFWTXGz/nCMw5f11PAodTh3zrNQqDBRj80Srljv8Dn29DLX62ICVvfb4xa6/VWpJQ/5zbARS7tvxYdtxGERSfNPtrIcL2xwN8hwVznl/zQddGMBsgH2AlIEi6d/4GMpFYvp1MG3HWEHQL2Z1JUXDTcuj6O8QbxFpx9Z+msMlcI1fwmqHfdqWVK+9mZFO4aSHf5WYDUmlUi+IboVGX90JELdo+Oawe4QuY0JUoOISy2WDppoqBh2fn++8wjfuc+7QOfF1iqJ9RnANg/hmPpsA0o1Cs
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"destroyed": "ENC[AES256_GCM,data:87jX/EA=,iv:oryjcOZ2ZEqZ+5QDwWBh6YSPaqG/K/vTsdSP9z/1HFc=,tag:tlfr0r8idG9YNFb6EDOTzw==,type:bool]",
"id": "ENC[AES256_GCM,data:zWRLf2UdV2ifOAkjUNS31bDI1DI=,iv:lc22n19nnuZJEbOZ92CNQgV/p6RnAEfczGKdcDnbPdM=,tag:rAOFzjfrC0+okAd/0635Nw==,type:str]",
"mount": "ENC[AES256_GCM,data:UkbRIm/9,iv:pncxCPoP+U/3744cKW+ahiKiHuqFaT9ZUFsAjguwaoA=,tag:aBBMqIUkC6ZXnuvE1FQ1rg==,type:str]",
"name": "ENC[AES256_GCM,data:8Bb5DJFtMa8=,iv:nNrat8qGHoDklavvUCLxEkWIpkVTxtAMuiI8RFnl53c=,tag:PCYUUNgh1hi1L1R3fvlHCw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:AF4GIOZcPmRvD77DQqYsJGEW6xE=,iv:ywLIUdSNk7Z5GH3s4HX8YHKadtNOsQ/B1g2jibuw2CE=,tag:rcgWWPhfEiMRAapiJyDPCg==,type:str]",
"version": "ENC[AES256_GCM,data:tg==,iv:K0jlGQTBlPVlmFPzD1bGsNf7qOGlEO0gCO05/tBn5z8=,tag:TBVyvMYapeykF5BV1GqAjQ==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:nmIf+teLrIo1Ob6N3Sj1Uw==,iv:tK0QEDtZ+v2EOVmRXlP2gPfyZzkt0Nx1gofKq6s2gCk=,tag:7sP2XvDdnk4Uo77c60TcWw==,type:str]",
"mode": "ENC[AES256_GCM,data:iIKF89WdaA==,iv:JznyIE3BsyfdQzVxNuIf4C+1kie9KcVikoPUj0X4xew=,tag:zptFUiQh50hjX99J4faYzQ==,type:str]",
"type": "ENC[AES256_GCM,data:FyKN2q4OJVcMvxQe,iv:42ma1MSn2Vtpf6XuEzTl36SorQVIEdtDqMGSnsOZmFk=,tag:ckuwnIBrixnxnT4OVElqNQ==,type:str]",
"name": "ENC[AES256_GCM,data:cxBminG4OzlQ,iv:TwFdkZEfwh8XtZmUPAlOcsWvPtiyFp1kZaKMvHtweAo=,tag:dFKaNpEkkOi9mljIeZmhtA==,type:str]",
"provider": "ENC[AES256_GCM,data:nRB1ImXVbomVadHMjwJqazCF5Xr3aEJoUYk+1G+KGC9PNbAiO9p3M98Ri1WuSSuG,iv:gPwIkayEbWHuTwxK0BTha06KnEj0hDl3Ux3hSPJq074=,tag:rj/TtKGniMMicrxg+izZgQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Xw==,iv:6j81YQQVCUSBFPJl4q43K/u2vWVVDM1CcDwcRxYlsOI=,tag:jVWhm6hdfvpfdaq9Rr3p+w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"atomic": "ENC[AES256_GCM,data:3elrsw==,iv:qL7k6kU7jjhUckFH+PFO7GuZEcmV0j3Ol/CIYJUsPZM=,tag:u8z9ZkNaioHn2emewtoqkw==,type:bool]",
"chart": "ENC[AES256_GCM,data:d5TwavyA9J8v,iv:YiVzkanef+sQIdi8n7CH6Xmfjzrw6tw8ifHJY2DSt1s=,tag:KkZsXSl/zakoUubJL4qjGA==,type:str]",
"cleanup_on_fail": "ENC[AES256_GCM,data:AefbNbM=,iv:EyVqLBKlkWSZJsDtuhrpe3KeQGUrJhoqJMXJgD6T0QM=,tag:hswseiPgio8vP0FtZADHoA==,type:bool]",
"create_namespace": "ENC[AES256_GCM,data:pyXMKA==,iv:7uz14hfVRrroFWB8XuR8PKBjSJ8QPhQ14f7sRXVbkPw=,tag:rbj625TTotm2fI7LyX31zQ==,type:bool]",
"dependency_update": "ENC[AES256_GCM,data:OufL3uc=,iv:8eS7E+xpfNzdTu57ZWEVILQHRLiU+wG5dT27VlfCojI=,tag:BJZhF3tawY1prp6/bAkdvg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"description": null,
"devel": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"disable_crd_hooks": "ENC[AES256_GCM,data:OPERfhw=,iv:Z0deICB5jmivPQmCAmZokYuwwZAhndpMTmiq+EM9uak=,tag:dG3fBrda1+Y+F8HVhmKN6g==,type:bool]",
"disable_openapi_validation": "ENC[AES256_GCM,data:ZfmHNRo=,iv:n9265OLGm8p/ZPcke9m6bj+zmZ3IzD3Nt1rcdTdNRTw=,tag:UUGYJ7eCObyK+G23LsLdCg==,type:bool]",
"disable_webhooks": "ENC[AES256_GCM,data:et1nZds=,iv:NnZpusb/4SUFMijWtCRWDXWNS8Se5G5PFWlb+OYR00Q=,tag:g1AI9c+ekNeNNcPCbIwszg==,type:bool]",
"force_update": "ENC[AES256_GCM,data:1EPlmJc=,iv:3cxTURuZ/fqHmBvYtBYVTl31B3AjPVOLrNUjtfL9mAI=,tag:/WaLKkCE9EdYCgIHD604VA==,type:bool]",
"id": "ENC[AES256_GCM,data:MnMGY+Q/GoU1HLk=,iv:bd7JMveetYnnRM1rLi7dK59keKgOcmcBgjS3/lAEAk8=,tag:9oI12/H5B0FSPTB08MeWXA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"keyring": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lint": "ENC[AES256_GCM,data:nG2cAMM=,iv:GRDrNZkPmPk/Oq0QEy/0w2Zvs1VEbGd9vex/Gsa1ki8=,tag:zJ9LteI8sn7WnC3DWRnuLw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"manifest": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"max_history": "ENC[AES256_GCM,data:cA==,iv:5MZlqppPKH0rqhuIIRtU+gTsMbVNyJfQ65/5mppUCx0=,tag:QXiRvOjh98eb3aV519XSuQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app_version": "ENC[AES256_GCM,data:OK3tlSFuMvvY,iv:acYk5HT94FVyqg3tanfmRn5AmGiLcz8rM5zMlU0Wgvo=,tag:Fvkqc8OnMybm0VFFIU+FZQ==,type:str]",
"chart": "ENC[AES256_GCM,data:JHSW7ljj47A2,iv:WDwTBokcXH5FmIMV4mpVs4GFFJEJnq4GkM3g95fOAAA=,tag:H89m6iQ7CR3UG2gKbYsrnA==,type:str]",
"first_deployed": "ENC[AES256_GCM,data:Qss5byGnsdZs/A==,iv:Ggancjtiv/lLgqmxxw+FjHSDSCS/RanQ0qYIWXsv+bg=,tag:QY2F/d3zWTArvBjeNI9HwQ==,type:float]",
"last_deployed": "ENC[AES256_GCM,data:NoZIIOWzyyVlvg==,iv:4dDEhSd/OSn/wqpX+ttKdvdOvywPiXHzvuSPudNfrD0=,tag:Uk3DPKvmVpLbIQMPV6UO7g==,type:float]",
"name": "ENC[AES256_GCM,data:XOYDz1z3CQ4Loas=,iv:Tec+ksmRPnKQuBRSoFKNGpcuY491eVkm6R/8w8KVbO4=,tag:za0JiygT7S8UWmu/j/AFMw==,type:str]",
"namespace": "ENC[AES256_GCM,data:YmJjCiVIWGZ7,iv:xZ5Gyu7jnYqkLZkog1hZaF3SxhCUoB6D6Vp7n44mpS8=,tag:Af3Ou+sVAml9CHUYuRO+YQ==,type:str]",
"notes": "ENC[AES256_GCM,data:VXoyRMynsb6EFNYI7pj6XspAg94w816LQsgB8LeVsgVK5VSIR86FslOwWU8Jrw7V7TrGOEwhwL3fiiLKqJpRUeS+/ZwP9HiEQ5hUAXe6Fnx6PZFuhS1lGtxDceHfx6amiykgEu25/wtbKVv9FNJEVf2kZWdc3kgG5zBr4S8DvehXm+wk+fu8geZWFwAvd3Yn9uqy9Q97P1T/B7P8M4b9GTeRg+LNUsEF19FPKz80R80m1oi0Jgo4/fjXv6ulW7dS0RM0GN/6R+ViDhX3mEigzjkmHVYOzjvE6WYxZB8HO3KSuVpyMdpC084NkbArcjbFVcLhu9YsP+1OOFMFhv+aoTeYA96hZ/iCXb3Bzp0V32D50W5NxxJL71EV3HGYj+4OM5UlqpEM38A2CameAaG/jl2kuFtosJF6tZNvlyan1zoZwLoa+GU5pSYr+bsamsUwk7vfEmYAYP37c/VBY9L72s4F5w2uoSlttlxGhKiPk22Iu02QaP1gm/eot/Ci3mnWHgtiZ6HvDLrFnzUevWlZ4Dshj2o57cLI+4Y9Y26qIRJ2/bWP73M/N27jAuyuOuGCV62JshAIeYZe0IaGnWWVIx9JO5SVY6cNnqQ3H7CiG+oJl6MWa+uFioJkwv6ixEX94vixHxqaSophNQgm4ysmN0mmDYZTYoaoB8QSB4Pf8vkkA21vQLOND1BvphO6Kao+U+L99ZiRW/Eyw7UB/1hw2pKV3AnKy8NkHNxHvuJGAXcaj/zNBoR9ZVj8VW7u6xBgmn0B0bPK0OBjkR+x7BPSTP6WuWTwOosru8XgGQsBwxG574JWXxdCKawVsOOx55+W2RnfMsdaUIYrPdiMbwYeZg1Nne0xE8jFaKDw9HZifLLylY9clCrhWWZAd9Qc/9a75VVPAfuAcdM3CIHnFcdq9g2+Aop/KiHRBvdXV/68Ahyq+Jvu1XSb9ELeJuE5RqmDpQJZJwwzIfMRnoS9qpDeQEESqeJYyWy0UplNUwxOv6Bx3/RTSWQoJGu6s01VlfXuIWBhJL/1m+wHcGsER5FQybol9GFGR1T3fm1PC6tld/PHAi23mZ3T5vLfWlS4OlOQmsSr35nC2DhPLKIzKU14JBQWEYfqb7r/tm5D1xGAcc4mJcyYk4GSmek=,iv:Z7vJmrD73x40m30VcT9GXqYbD0+YtkkWfcxGK+2qrqI=,tag:aA9f2ad110I+w4J5U8XFNA==,type:str]",
"revision": "ENC[AES256_GCM,data:cFE=,iv:HfarLOGZuXANErQEFi8XLTOhYhOvH4iqu0/zAWbXxRg=,tag:M5vxjLfLBL0FNNn1CGhJpA==,type:float]",
"values": "ENC[AES256_GCM,data:+yMM+P1thd2ntiE1P36oFgF53Ow7MyPoDRg2t17RBPiIz1zbxmI9LttZ9ZcVaVggX6B6k6MUAMTdaH+Fre9b6C4w29XcPehkgODgi4jAIVVYfqJu4soEPL1FTZTLd6VdE7Iiy05yXRHQ+eEs42VKbs/Q+FjOnNzfRxQBy3VrOc+OtjjxXD4CvwZQIxYHN+6hD0gvbr2K9b38AuuTsgS2ySiyW7dkrR829uEHhTXexPLcPA4uwl7wbY96jSAvdaSNCK3CG59cgJSUWQgqCXoUQ4hjMwmrr6hl3UI+MzmLOKO9DuRd2HgtZI55KnfOSNYN/nruzWsGu3yBCytoNKcpQSuyNxRzRBJ4r9ACnm/2foxAcpvv7+0EuU4aTsFJZW0viSIq75bh8q5N5GoxHoGYg9HSdkoQ/EiSGiBQeg4BP/I+ar2nOdmFfJbF5xb7FoF3foauLoIj3/GbYD5zhXM5pHPilaMmnxVWIlSX3n95GyGJGXZNxyAt03ZYLHw+naNJtCMYkaQYvmNTwM2iSJezhgFZJB7HH4hq/g7jJ/JmmItO24+xI8Z5I19k9kVZR5pFt45TV0RgKzuosd+69NNb8ozYL4RA59JgKFBZidlhD9c1ETFZ2UT4x0bak45ZwrmKxz9JnKiBjpQ9ysGlUZc6fQeNPJI7aJv7yzIOhOcDQ/C+U/rp+YpqX47nfk1KAp/j0P4vpsycvy25L2k/3xEMK7TXUMsaGHqi+pCQd0e6fDQux2II7JUjpakeLC3/8TgKrRVu20pP3l5tfA+NxxyvRL8VS7NhrY5lCmvwMSNtR/TJFFSDRElVLXHGNP3Hf5ENsFRETrkZ1s2a3BpjOXL3b8J9EWbJinOf5b/BMJ1NJsYO49H9qxFzVIZL3r2dfJ0ab+esdON8BZR2Z6Hpn9sOMdEoy0YsiW6oVBubxJoEIx1iB3Otf/WPmzNPvuXikpqE5ik8cgub8kHOfVJOGLSr8bHuPkn6oPrEkl951L1wzGAPWEGedTyAPa0oUSLaMg3pYS2RYg3ayqwl+qWRIRqtoTHmLPiuYVAy+mq390QeA68jaOoLXjcOWVeWVnvKtGqT5xxfXHd0gVGYRJYPLK/2/7VLyoiKqYFc5wBef9vjQmvKzk6zN/rKbUmRng4I3rhsUdNZcwCowtZnh/YIB4r83Nrw1MwA17fSsbW7hfmHF7AGWVvChCEsGzniCG/T85AsjcDYLFUGW2Si+CsgdETuohbapzFUkj/YnrjI3OYK8k/zEsN/MMKrNraOZbmEHSY9K0zfzXKhQDstjooYdGc0hDgWddXQ/hnWHCe8MBVix3Jd27lnT9HRXdvl7RBOdX0VVTI0it+BamderAjWg/Hyt47ft2y3+V9jca6cKGcGUVTYmnOwY5c8eXMIToqotP8iSZXVqfHyKcLeTyzy5dcjvkASfdH4Z2FJaskvDAHGc1C/54VWArC43xwomyAQlmd18aaEupmWpnh69U70Ce4T4YoFTlARGNJ5essTqLL7lDx53Jb9VZ7Bkkpwwxe1RKM9I4qlGixVvnSbL66iWlrWUHBSDVRB0RRAjSiC/oFeI+8R9Kys38G9sjIuc1oWzbMbxow1RGSIlKEAd8VpxnPRu7TkYj6Djt1VH7kqJg/tCUeUCEFGrrZ0dOqVwsq+63o6s59/TfuYiEOWBpLbGGCH3dNMB4OgdXw7T7Jz4UL1DoVYba7RL2ggW+CQNAm5BYf9h90=,iv:UpZLQkXTW4gCAbAETtskvp0/3RTvNtMPaQcU1nuWzmM=,tag:L5QfwURLaDZ8ZH12moVcvA==,type:str]",
"version": "ENC[AES256_GCM,data:lmHoqm9FNjX2,iv:6MiIq9SQyMU/PwL+xqAmvLuzJOPSOTbr6ehdbwm+rNs=,tag:hvDpfSL+pxP7mgiEGabH/Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:+U56c06dcydZRqQ=,iv:uFBRs3MFCkS0kZmEgn9XhGY65OnMC/xYghuTYqCeR3s=,tag:cUfsJ5ByyR5zFUQVJ9uhCw==,type:str]",
"namespace": "ENC[AES256_GCM,data:GzCQmzKtnWtK,iv:YvGbPFsKYWunMBvzQT/34nh50ZrEXA9K2k7SIFyfhi4=,tag:0cYtIY0k9+0AlbuE8ZSfSA==,type:str]",
"pass_credentials": "ENC[AES256_GCM,data:SFOYljw=,iv:uQSFLEsFSbxLNALn84vA511nMvkNwsS3pTMAxNFm34o=,tag:v8uxkpFj9Eirrq9omZIoDg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"postrender": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"recreate_pods": "ENC[AES256_GCM,data:JrJ4vkg=,iv:dss76JrWuUa8RTWQZCKbg9uc6LsM8/V0qtM6+VvWTFk=,tag:txuBS/6th7AsQ2qiN7C54g==,type:bool]",
"render_subchart_notes": "ENC[AES256_GCM,data:AaQHjg==,iv:xNkLHW96A/hmBT5nP345+s41UzSScVsbQoF4C/0GL+8=,tag:U2upNcjuZAFIMrKGB2tS3Q==,type:bool]",
"replace": "ENC[AES256_GCM,data:Ajq7Gfc=,iv:WKjqUdcamRHMK+6ukuF22X2Hi5SiwnlRbzYGIJ9hT74=,tag:O7fQ4Cq7iYwzNxfiQ0kdQQ==,type:bool]",
"repository": "ENC[AES256_GCM,data:V9N2WpbrybBLu1YSVASdZc7cdKHpPYUFHWTRgA9R,iv:aKLupSuFjVnlF1DCH/GEtwdvWaQBe/yKC0E/LnIJqqI=,tag:bwo9qSxC9Q1UDp5plLbI+A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"repository_ca_file": null,
"repository_cert_file": null,
"repository_key_file": null,
"repository_password": null,
"repository_username": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reset_values": "ENC[AES256_GCM,data:kU3aO1E=,iv:okeu2i1hujyAZ1a6Vhbj6vxkMYf+o1yqUjGoKfFjJqM=,tag:mRmteDHvhtMDyGVjrqjCRA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"resources": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reuse_values": "ENC[AES256_GCM,data:tS/3cag=,iv:CL//tdX0xYyfk6cHgiQIb6mny37CQT2bVxvqHy7AdWc=,tag:Je8cnMYGlDE+5eO/f6Jpyw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"set": null,
"set_list": null,
"set_sensitive": null,
"set_wo": null,
"set_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"skip_crds": "ENC[AES256_GCM,data:mO8N/A8=,iv:y2PGj30JsCcjDugQ7yLePzjKw5W0L409rSpVr75U1kY=,tag:gK3fby2RJy5tctMd9mQRZg==,type:bool]",
"status": "ENC[AES256_GCM,data:v+JayXtePE8=,iv:VX/62uUitpIV7L1XsUJ+3Ye3OPUgWnzLVlGHcLOXkzg=,tag:2/1OdLgg6KgWI/zzEx3OYA==,type:str]",
"take_ownership": "ENC[AES256_GCM,data:y3X68EQ=,iv:udzn1P6yWUGzQelr/iGscT8Cc9QL8nx9kOVyvM973C4=,tag:mWwYLNwPsDGTH4lJV15Lhg==,type:bool]",
"timeout": "ENC[AES256_GCM,data:Kx/p2A==,iv:ngTUgHiO8nNhPRkMm6aqJkFrA2pFqvwf5uKdSxTsRng=,tag:GiR7zR7Nt8AtrpGoNSV9RA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"upgrade_install": "ENC[AES256_GCM,data:nCVf5jQ=,iv:HwrUn+8/GB6aNBhMkjPKsQ3vu6zHyfYe1H7daTaO6+M=,tag:L/6q8iWuYRqjRCvyNQpyrw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"values": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Qa2Twe36kW4sNz7OHy4RF4jvP+xEtXhWIMAFGLUkTIeYZei2Qs4BRoP/cujUT1HhtkP2wqqo2th9seu2jCaDtZDm16IC0BMJyiy7CRDi5c9XE2FBmwrIpI7hMGno3wJhh8YQVwHr7k+iSIY5g759mP/HBArAcGkbYzdpZy+jYTKQx8K3SkgRsiM3PYgDCcSD26n/rY2DvWPPwbDbnUCxMCL0YqzcZFSC3K03euy0EjOEzxW1pRv628azykeuTTT9afycmx6sNsiB3Fs3/+s4TJWui7nATKmOiGrUtoYFWG6uQXpIrjNS8aKpmER9ke5o/OQiH+z/xFm2BFG96h55HYDjdMr32KeFcuPOQ4e1NQmKapD5d3J7oezAhYvR+qe/wipp3vfI/fWZ0rsVrDBvWlJ+d7CkODqFio63U89j9RutyBN4VWKr6kPbOxBw/FjsCvayam/W7+xNuX7L13CrPgnAMUV7lxb9IueJZr+NalHePh3tGI57JomdFnsoUleHYkqefA5a3YI8T5v7isVHyL2ke1dtMOSBuZcrOyDJLb2fsa1/hINo4QZWKEqGP63pA6bkpzWgkWxGKA7ZZhVnY5hnr5ivSFXzNi9Vgj8LOCYXMYy2xsdH89f5hYfwAOhShxqhh0hRTcZbn+nfT9T6oQp3DpwlYMn8PsAbKXCvr/5upNFlgowvhUQ8gnEVgHZOY+I05PAv9J+KWFJ6Fw23asQfblX05eftje0MXOZ8LpVvpm2eJatrZviNCZCHfqNMPPxC9f5etEn5QzoyvHC5GDkb1XF/WpDm1I64FyNbz6elNPMkeL1rBXJtOzXKIk7b0QR2XRknU/8nR8Gaa69rEJYWGGYpVEi6yNj6EjDsJ304URII7vE2+TiIVNynFKqeKtW3/IQMpc4YvcTtBTnB7rAv97UP6z0ub4rcob3TeEGxFuEMpQEE0G6we9uqdoLwKuBZAd0Bh+mV3vyrRfEmo0TD+NAoyaA7UkjVO8HMe65oulz83H3wvRj5G0o5Kk+0vEiq4uqhd42TVUMYjDFrGPWO7cfd0VxCTKGlm8rWTtuniGT2dSpV9oUdjVWIxKbIPnnZCN7nKRFy8o5esa/1TJZklD+1xQxJHTQcwXhFqW0dkcmV17WHBCuvFjGVvwS/5rn46i7vEO7IUrCEqR0fT3IERYisl/NNm2h/hDbWpQxT/UnvN84g/KBbplnlF3daiEH5FJy2kOwHCEpo0HZaomEZjN+HLQemRavaNUpw4+VvD+cWw9t8221Y5Ay9ppI+imMm3fyDpvWE+alGyI8D45ibjjJEeAPjKX68EzEcJefpAmxwp5FmpC6an/hOX1niNfJPCZ4S9EU4R2G8RF7roXDDAaLHbWCDDaRnxut77rkG1XzAd8/XhahwZUyYKm26p54TBLHB9/2OCFSKnyEah3cPcaan3hMLOi5hibIbnIKch9+1j7f28Adq8KcxfzI3+H6wvpBI4XpNWuX2tzPvJ4KQ/zxQIXawPMcOIJYEZYI0QFOWyA+hvRLYLjiYHtZXV38Baqnsuw0eYPq9rAOR6w3IWoZ7amwud30tFfE1FD9qNU2oStDLosJNa/aIc+CBrAcpXKLDhlLcyeOx91hNixj7E76OD1iqUSozX4xzp5TTz6wfWzu1+agYjDj4yIjWYAy3w9o4Ea2rOQJnaR+USYI7y4LgQely/o4DQPx6kSOnxM8ls3h8DV+h99JlcWmtOgCna7a1xO5cjUY8uSuOlT/x2h6vjCpV8qL/xLB1l00IlGgKPJCzqvpdO5aX+In1IW3AJGgHhoA1Kce22iayam3oKWFU4Y4wPTVz7+tzdcHoocPaJ8rG/r7scn8/MB+vsGB5krGIL8t9QNsDPpnkwxsaR+Vztq83z4InfKfrlsN2O52YajwGJqnR78mKkvVd+A0+9hSleDWs4sxDxpyallqY2Y/r29Wixfs4KxuamIA/FnTEnnttLw8NoWahkk8MyyMNPBeW2aLAIIDgg2KBJtTb/2oAwxPSVPbYYShHV/Fwa+o8RuHqx3Q49nfUEGTS/42/az+puSuAAzymH71WfwVxSPv13Vodk9SbvcxE34GL9KyndKGsbaElzr+RE1CS9SGO/chq7u5DCFdD8DH/uQ3038v2RGAaMIUEAHYIbxYeB3ZT/YC4ogENMJ/D2fp7xIKtT3uM7c/2rM3aH7JovEB/884wGtD1S1AK9r5jOZEW93jRaFfZQTgQBc70bwInNn6/Zu4wOviJJ1oSqPs4gIdJobYBaA==,iv:6X0htaavALcp6PhAzYHk2alzoo4r7MFqxijmNa2Z4xA=,tag:z5QJ/O1YlNOPCW2QbfZhaw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"verify": "ENC[AES256_GCM,data:KMEEgxI=,iv:onkuNcOsydIkpjRHbKZHP7S4MUT5tLu8aeRK4ptotnU=,tag:N/TBLK4UfiMTWQvLfjxXLg==,type:bool]",
"version": "ENC[AES256_GCM,data:g91c/2csPzFx,iv:IiDrIA+006yf17LffcU6xQhrGBW6JDz7Wijm7gTA1Qc=,tag:B2W4F/8yk9Dd8X3uVOOiNA==,type:str]",
"wait": "ENC[AES256_GCM,data:9+HHUw==,iv:VgWH2yQQjQFDIhd0TPRaQxOHUk8y4FzQpZTz2juNj4Y=,tag:wYPSBlOyVNMgoUJR8YrBjw==,type:bool]",
"wait_for_jobs": "ENC[AES256_GCM,data:yxY1Hpk=,iv:twzmB423ruvR8LIIPnKO+EZlksj3ak7fQmmXoJtV8PM=,tag:SNB+SU+UkYOuNVk5Kv2XGA==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:ApPqEivXtlI=,iv:ZFiY/B6kIpD5+TJJyeKBSkJgDEGnxf+BHmlvoylHtbI=,tag:SOuDVFZ4TWX+y/zUGNWvqw==,type:str]",
"value": "ENC[AES256_GCM,data:mJRty8ET,iv:LoGoPmB1szB2VSYPTuV/DpVNJlZnZ/odudXQZ3AJCEo=,tag:AqbEzzMTXOxS7zNvNsIZOA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:UP3cj/A=,iv:LE87EV7fsYZwne67rnuCVjia5nmB3dj1BsfPcGGTo0Q=,tag:yN1MxwO4WIgNLpcT4pWSmw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:sw==,iv:heNPsm0KMBl83MhJv9KRz1nh052BE45js+b7+Cuxx7Q=,tag:C0seDRKGNBYgCFwFAFM6qQ==,type:float]",
"type": "ENC[AES256_GCM,data:RECaV8tR,iv:vDDohoX07bAYmswuyG8smlC3dibF4cSB+sibyjpGnss=,tag:I0Lm3Z5gnERGlzMpaJD23A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:QxEz0WIY5617P0gLE+uYC5IZ+zZitc0TsZJT5QCP9A==,iv:aAjJ2BxbLWDxnHEfIvHNiqlWnxN6REnwrWJiUIuUZWw=,tag:8IZlhpfFpKHzrN5iWTO7Fg==,type:str]",
"ENC[AES256_GCM,data:UAusuTSo7BfCeRcxMffO69a6f62McZD8pIEswqG8hSy9BptFVvLGC22okGSS68Y=,iv:bDvp3tGjEO8FBWp6ERxsBrOeU9SC61v2JdbvvEK4tMc=,tag:cSkmby1BIRzdXe/gtBmI+w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:OC99hrhu43WOLN+WxtIuoA==,iv:sg8Pd/wJ6Qu2TvLcUTSJIk4zX12OAzvEMWcvnGwD3Ic=,tag:d256rSlVvpLhqgi5d30lRg==,type:str]",
"mode": "ENC[AES256_GCM,data:h7cIMygH4Q==,iv:8q/4HjBw6bH02SZO05U/iUwrCvep9KsNcSE+eL8MgKY=,tag:wdPkfoGcBmoiCyJB/oLQwA==,type:str]",
"type": "ENC[AES256_GCM,data:kGGE733SjAMsbBgjS5t7pErpMOWR,iv:98ev4qJ7mXOcMsfXEl6SzrwCnN179YK4VL2KDheFNIU=,tag:b2ji/l9uZqHpXpb99xZgPw==,type:str]",
"name": "ENC[AES256_GCM,data:pIeJxGel69Z4kVtUwt/fBw==,iv:tCUlgsR0gWH5z7e5IKMADPI8LfRrmdZ9bNH67qqKumY=,tag:as/nMTe4v/MRNg26dOP4dQ==,type:str]",
"provider": "ENC[AES256_GCM,data:rx6EYml5+DQ9yiETyGZK9pbogMAnxbEdhop4SlCFz8iJ/dOiweAtUhx+Gh0X7r1VvKerBJkx,iv:DhZfrTA4JidygcZapgA9thkeG6mvoOYVFfNhIKhbxs8=,tag:RVsGfNHC8MPZ7MjtNlSyOA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Ww==,iv:tAwWKhPcmw4lYwoRg3dN15l9jeB+6o5B2HJfZItuIFo=,tag:9LIApaxFDY4PmSL2Do5yag==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": {},
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"pgbouncer.ini": "ENC[AES256_GCM,data:GiBzx/asXkUL2XJR2ZPm5A2gPkkshaplw3+51w7MAD/6kc9PvUJzQFhvJbhOBNchbmgYYm0Xy8UgmEYED+ZxcYh2s7nxfIQyDUMCypbCTDuZs84n2Mjp66hjiB2SCr7OQiBwsy4/8sa4luQQh5eRpw+R3vQs1kD10yhoBfKmVx8SBiD/gQczNawgauFgdRv2KzGBJHc/lFG2yPGby3eqyW9DF563NZngySCLXVyvu/zKTQVKHg9DwwsQ/Tcx7FHQ4GmdAMnNM2A6mNzV+kraCtK8PPMNXnEIdUdQmMdtcPMePOjV1bf47B52tInBdIml5Tent8erqdA2EYCKYtvDqfPx0bekatnEq7Q5r6A8n/pzbGJ4v+zQCLGi8BmG7QAxjr2dvYYldYenBqQx07v/qeM+9AaWPXYJpXaHp/r2gscc+ruZ3rE+9wYhJzLgL10tQ4hD46OfGzt+8BRYflwUaMLSwEDwi2Ua2cZ9Y3VTQl3UGasjeUgw4cT/GvJa/aHgmLGp,iv:79CZpKyixJn6heaA5Vq7R0a2s7C1MpllbETs4nDUmbM=,tag:DF7ygrbKW+3DkE/VJKffnA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:1zHUumjRHzTsLO0YiIaDTA4Ye45A3Qntvlw=,iv:A4mU/RUrSxX1dKDiN/ulLrF5yYUI5U6xW0m8GG+QB8w=,tag:3pFXNN4Al/XAXrwss5U7Pw==,type:str]",
"immutable": "ENC[AES256_GCM,data:JnylH44=,iv:3EtdZaJBb7GgH8CmwDX78UBh4bvjzfocptBSI17z0yU=,tag:FfcGsghHlgEZR8sDbxLK2g==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:IA==,iv:zl/YzW2kj6zgvvjyhsnrv6e4mKttM6SEX25PyJJA8Lk=,tag:Qt6Hz1dKI0FGXnPrNXi6xw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:9ANOX2wXs2ZqluJmMgLP1g==,iv:/IBZ/kvSRLCNfv/amx/1qJJdd2Sh/Ulk6nNHFEwyOho=,tag:U79BQ0lt2rJ8YgQ25hAZPg==,type:str]",
"namespace": "ENC[AES256_GCM,data:qlzWiwtAQ52o,iv:RCGg9uutVVYfDztCO8irdMNi82D7Uto7Q4LWsY4EhDA=,tag:PBuSbA+oBTMw15NMMAf4/w==,type:str]",
"resource_version": "ENC[AES256_GCM,data:YCiOKDnXov70,iv:aPP/oVD2cfq0Vi1a0ZerbH5JFKgsCpuFCkzHzFVCkR4=,tag:uffF/vaZyqbSKTHjgTBqxQ==,type:str]",
"uid": "ENC[AES256_GCM,data:2yOO3b27+H0tAEQngPbzD6Bai3BdMmG7BeHeizESceHY/e/C,iv:16sAnvqJNzw6SS7F/24EPehzuTSqiDav5cH1fPhIIHI=,tag:Ru+AmS6ovOlNGeH9oCXmLQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:cs79garM0AU=,iv:65Gr3w42hPTE2H+gAOBLsn2LY11lymAPhcHlPOdFhe0=,tag:TvXT/9+X5seCfbZ3zavHqw==,type:str]",
"value": "ENC[AES256_GCM,data:DFXSAQ==,iv:3xzWDir6kOaqdmLJn8WXRVWwKPDDVXnM1Q3aLOuYLU8=,tag:8OG4isYY9Uxhx85/DE9T6w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:HDuqtR4=,iv:vGZYee5pQxglTuakbg6jtr4VpkOgqT3C2iABOHC2+EA=,tag:2wYsPwQxjDLTfgG6OaKPDQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:XfTkUCwMG0qnVGHmtQ==,iv:UNO+KvLgCvNd4FhBH0bm2r3XdRe+MD1RmA3XIsO5VQo=,tag:3lYkXM9vw63SeOymXmXEPg==,type:str]",
"type": "ENC[AES256_GCM,data:KrA8iAjv,iv:RHVIYsMcO+8L5XuiBi29dF/lSIzTeEUJBasagcNmf30=,tag:igyDOt85MEA88IJMMlEQOA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:2jB0S0CubPo=,iv:30j0SlgTfJRo8Es7Ok1BuQi4VxghYWIAv87UMCQx5YU=,tag:2s90yGg66iUDCQ8bWUCY6g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:WTGEfnmqKCaIDzPx1aDsH4WWfJ4dWCndebVRLu1N9g==,iv:AIW/1ckJHQfBBwGAS3sK/a9Tvvk3r9RxGn6ijXBDNwQ=,tag:O8VsMnhHivRSQG8I7OGUUQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:ok3O1pIPZfxTLhPj8xmySA==,iv:swIPdsSOSW2IPEwoNBnFTSW+QHH/tlN0Vl+w7QZGuzM=,tag:ns6uM1oD5Ge5O9LMatGZjg==,type:str]",
"mode": "ENC[AES256_GCM,data:yfAoNc+AuQ==,iv:XYPtKaoKaUKtgC2LpgZtDogUOUUoZvjamcmuOZ/s0ks=,tag:hiBETNK7tF/v7ADO3vwfvw==,type:str]",
"type": "ENC[AES256_GCM,data:jsS7lai1FMiN/JLDNPs9HDFX8kHV,iv:S5thXadebHLiSNCBDmnBun3tuVtiEUxOKJpwP0ZFdPg=,tag:QETLiZYyWqauy+N73Ik6/Q==,type:str]",
"name": "ENC[AES256_GCM,data:qYinYRd87ez8,iv:kNyOlxDUjKw/9tmKhqdN6WIrCy/iTTtshkzn410ZWxs=,tag:yN2JCCyb198mqay331Td8A==,type:str]",
"provider": "ENC[AES256_GCM,data:51qyyBstlxu2Hpn5tR0IfSzqEgseFtaaBtpeg1XRoB2MFZN+DvtUGqtdwz0Gibkz09cOuqHL,iv:tefKLFdFueasGDc4jSLHsiZz68Qq8hi/FSPFRKgN7IU=,tag:T8HvSU1ZiyXg+1x2vubb9A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:DQ==,iv:qOeUbvnW0AB1RuHSdYFpe3SZQLhVZeQBKHsLOzwQP8M=,tag:mPHsvPJ1kfbncMi6HMkXMA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:95xlR0YdDEBevSoF4bopAlDc1Q==,iv:apIdGNsmRLTAjnm9RKfwGF56Xj9aWgphwI2YlcubNnI=,tag:cTzVS2VvDxGDwm8DkGmWaQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:MIg=,iv:McXrF0Sy2TjJdxu5TeO4jQNgddPdLe1fGFZFX5MqWF0=,tag:ZDSMEPCQChLjDfWCPDyW7A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:ou/2fX51Pedx,iv:jOVP/iyq/NCKracYVu1OKfSorJll+F2ps+wHACxRkSA=,tag:tSQ7oSoYQ6AarEQQjDiabA==,type:str]",
"tier": "ENC[AES256_GCM,data:Eh5zJFf77xTd,iv:x16E+RO4iMFi3vLUvEhR4XNOicKFZYGqqbCrjuN6VvA=,tag:d6q3A0kUGpOXjnk3WhITyQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:E4e8StbcIaBT,iv:2HZ7boI/03tY14MXdW5SHpWC8PVzkRh5y+vnvbdygyM=,tag:EINHhSxT7r9eDYDQ55VgMw==,type:str]",
"namespace": "ENC[AES256_GCM,data:wR2g/tmMKvqD,iv:c/oNLcmbAVMDxTQHyMEl8I6cl6Pc5PC+MsYPu/HbErI=,tag:WfnVpcmOukfBucf/eebaHQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:I6gbx4qiGPR5,iv:OhEMYOZ0VhZFaqGRwDc4c3hfuN3198Olc2MQtW7AdVQ=,tag:B7zI14bHktjO2PKyG2gAGg==,type:str]",
"uid": "ENC[AES256_GCM,data:3N/Xb6syD0QJJqMUr8zTo5rld1h7AYeZu9u04IuftD1ecQ47,iv:R8QeufJXS4WQNIfRiyFGGyVeSndMubMl1Im0UcvN9QY=,tag:R4pyAsTuWSUhMsNzIUM35w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"min_ready_seconds": "ENC[AES256_GCM,data:NA==,iv:ZoeBLTvPt0BSMuL059Q6qd7aMI5Wbjr5L6nxEKOPjE4=,tag:KDp1KUGEhRzpzHYuEEMmaw==,type:float]",
"paused": "ENC[AES256_GCM,data:LXttAxg=,iv:748B08OnuMLG+hqYtxUeDFfhfW/3dKcoriaqLZDvgpg=,tag:s00N3dArAGfw5d6LKcGB0g==,type:bool]",
"progress_deadline_seconds": "ENC[AES256_GCM,data:FFmr,iv:uFuOfNsQE7mNCNmmHgEbmAlZozGLQChBflV7Pdq6VKs=,tag:oCdhL4eVpPPkY+yJTIgZOA==,type:float]",
"replicas": "ENC[AES256_GCM,data:SQ==,iv:9cA8ZlXxOitRzV5lZ+H32Ufap7vmROG9DpEPc2+Ocoo=,tag:SPuy1MvO0669o8AKNGORbA==,type:str]",
"revision_history_limit": "ENC[AES256_GCM,data:upc=,iv:7LnBIb+02QG08kyJa1L4mJ+S8X074g295ph5rQMFeAE=,tag:6ZMS9T4hRaBRMkqTtbmO6A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": [
{
"match_expressions": [],
"match_labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:oRCkEyCGDv3J,iv:gfPGJEWHYps3sYoShtntw6ZTQdLflDf+jYctPpiF0ng=,tag:nKh8BA8uvVs12r984EgSHg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"strategy": [
{
"rolling_update": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"max_surge": "ENC[AES256_GCM,data:7337,iv:/EdjqKm2k/0DWmrVDHvC0t8M6+UsUgaRaQFAGynteTQ=,tag:0jc3LPGPrHSAGVy62GYBjg==,type:str]",
"max_unavailable": "ENC[AES256_GCM,data:pwIT,iv:SfYTbXTuxroD/RZoLGrq4PnGDboafcc6vw9Kz1qv4h0=,tag:yU53j6uOe1gnJxWQ7HUdQw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:RlLahsSkA8DuJ+MxeQ==,iv:jVIQ0kFlhFlJ2j+o+wBjHs6WoV54ShgWFuj1JT95h1A=,tag:8pkKJzY+HX43gXkmCBSSRA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"template": [
{
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Mw==,iv:30kEWIwOeMYNOv4/ORlDIRlnjzGhH4fu89NZB2BjesA=,tag:AFigxpdj3Eo48uDN/bE7cg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:8GIKIeENpgph,iv:+KcMo0yXzU5ltejU9BKfs0EonjQWIndoSNyxIGv7ntM=,tag:7MnWf38BoDbhLYD7SU4oWA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"name": "",
"namespace": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:qg==,iv:aZKLsdmtWr5467uaIkn25YmnDHy5EOM16sHXVG/0amw=,tag:jO9cR+2kCRGC2jancMelxw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"affinity": [
{
"node_affinity": [],
"pod_affinity": [],
"pod_anti_affinity": [
{
"preferred_during_scheduling_ignored_during_execution": [],
"required_during_scheduling_ignored_during_execution": [
{
"label_selector": [
{
"match_expressions": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:FZxwuMIPNSQP,iv:VhZg7C7dWrJUTTEAIDCIwSXODxFHm0Tf+8IwzcA7+s0=,tag:1wCI+t9SqnqnHfh5DAZDgg==,type:str]",
"operator": "ENC[AES256_GCM,data:Q3c=,iv:2UM/3iTvo4VYSe+1ANqk0gxWdbpp9khJi5E+yVDFT0w=,tag:qMwfnQVaXZAgXy8gXvQPTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"values": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:qvDJvzyG,iv:77kdNpCgS+IiXOQtENsxBVb409Jn5omdAeRJdxJF4T0=,tag:5QULHq4k4azDEArpeyrKFQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"match_labels": {}
}
],
"namespace_selector": [],
"namespaces": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"topology_key": "ENC[AES256_GCM,data:pZruN3+7+PnpJp6I4+vwStFpHpkEUQ==,iv:St4i2tzZEhtVikbqtmzvl4wPYOGR+Xv5UYlMSWROd0Y=,tag:Z8cfEg+EW4pz8RWz0EQVfg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:yFEdBg==,iv:eqxFaxQci4Q5tR5wNfyOs1NqXBesQ5pZ9/Uw+F2BqPs=,tag:eVEi7ds/e9GDIvpQxFQ1yQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"container": [
{
"args": [],
"command": [],
"env": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:33p/ytoyhtmzszjiHZD3guEGbA==,iv:OsJcrlR5LiIyo1intG4HlKkvoTFk8bPMa/dqMIHo4S4=,tag:22rykRMZS7fHp/1ptGV4cQ==,type:str]",
"value": "ENC[AES256_GCM,data:HZ+shhLoHOV18Y566CpNObDjvdU1XVIcHlRUGYq5GbiHLVAN9xTRI/pyALSDeTCxsUJiTOsEegQz1Q10PUw067UZAjEY46zJM85hhajqwUwD,iv:bWJAw1KE3nGCKGThcjhmlrNDMxHN8k5YQEqc3XrweSM=,tag:TzRhJFanpV0oXR0+zR51AA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
}
],
"env_from": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"image": "ENC[AES256_GCM,data:taija+avUHIs2iQEdgND+gZlUZHFRs/g,iv:bztAbh0ZLClrKiN3Hv9axD47KViiVx7fM3uuhnooS9w=,tag:NqnegOHZMt2/Np/HRHc7og==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:us8AodoCGFbWC2mg,iv:tmelmmbC/q1FGhoZvF8D2nvfDJDUOOwDnCisZiDBfYs=,tag:hiE7213Ga4x/WeejGvhojA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"lifecycle": [],
"liveness_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:20pEBHiPcaQ0,iv:cb9I13mLpsWSFzQtjsEv0hifjGBye7fbQcSqPa8P7tw=,tag:z2ty9hfx5YfYtCvba+bpsA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:4H4AgA==,iv:rN14qW/LBz7MTgsh1rA0Zhs99/KvIVweDo3ULKdm4Uo=,tag:8w2NXVIHCu3JVgJa4phqQg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:wQ==,iv:2fStVBBJfoh1KI+BOdFOVbijb6x4ih7pdV2UtJaKhOU=,tag:TnRnOzmUMekxOt44+wqApw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:pGte,iv:zWzEBrR6P6CYSCgNUDu8eL2VTmCbb9Rr7EsJ6GPVq6E=,tag:DS/o3DE/ADgK1IN+jM4Vpw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"readiness_probe": [],
"resources": [
{
"limits": {},
"requests": {}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"stdin": "ENC[AES256_GCM,data:iEkTNFw=,iv:dhXuCuykdLCG1wy0FXIXJ5Oa6J4CjWI+mYUYQwbBx5Q=,tag:ltTHPp00/9kdPgm1xE4ThA==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:3cgvvlg=,iv:YB5QFZ0GOd10+K0mpI9hg9KXh76Ai+VQU7W238QkVnY=,tag:N0PDkt1Vs6UzTUQ4E1GOdQ==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:Mfco9e+6kd/HjXoZcaBnmJfvmQ4=,iv:0MDh536qIps80mB3eOAnunjhjVAkZfRDk8UR12TORP8=,tag:cHHV4NpOL9MuBI8WQ0FDQQ==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:jlDnSg==,iv:VNRrfa1xbhaFnktb160hqn6HrmB/dQ49hAlOn9MEMB4=,tag:s+9UPMWsYNkJtYaZ2hEkoQ==,type:str]",
"tty": "ENC[AES256_GCM,data:+wA4jAg=,iv:5rEtKL3auSBphkSwnRZDGU4ygzTWHx7rORmHOuhBgM8=,tag:aG9sxqgyENWm3pdN38m9Ig==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:DY4jr8wUYeUkjYnVfR9Gh+G9g7gDwrPq8pPa5Q==,iv:iI/Sz6PMJkzP6rxvRt2/ZSl2MNkz/r18VCchABfbmYg=,tag:8HAWx+vc995T1dKCk5WC1Q==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:stBP2A==,iv:2gyfIPv5kUsJmmVARycwCbaFjqbO7UULbtmKU9+qbDk=,tag:kGq6GqgkyDigPAf27dwrpA==,type:str]",
"name": "ENC[AES256_GCM,data:EU8JnZGy,iv:BtToH6nqxrCNlfBgBhirBOJc+cTgltohXHsS1vda8no=,tag:fbcrxWFE5eORiE5G75q0ZQ==,type:str]",
"read_only": "ENC[AES256_GCM,data:EwQxCn8=,iv:13ZcDvwL1VWarBmgYQpZJREFv9DY4OeFWd0dxNoufis=,tag:Qb6akr3zNYIuej4XcXVDeg==,type:bool]",
"sub_path": "ENC[AES256_GCM,data:Ap7PPdf/laGsgJA9rQ==,iv:gZnQcfxfc8b/boN2Rcri7VxfDCw+FBtF+AmnkKS9TrA=,tag:8XG2XUgT0XilWpo2tjMvyw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path_expr": ""
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:L/Zerxx8UJKfKYfu/lOxrPikJxDaxlXkVxee,iv:mUQ9dER0o9KeM3Y+89jZGDjr2VOMnJhkpY9FYdQZOvw=,tag:kfeLqLuq0dwiKbpPjzBkQw==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:uSwf5w==,iv:Vjq5x6Fw6abToQTPQmkyJggto5k1JcUCbrfAHFXN2r0=,tag:ZvL6qfAX9s77q9WYoiJs4w==,type:str]",
"name": "ENC[AES256_GCM,data:NQB2nw==,iv:TRg3mZq2P707wusf34+A/LQDVS4JRI0Flze1cbqgxbs=,tag:s2NCN32qM62I8zZdoYgBsA==,type:str]",
"read_only": "ENC[AES256_GCM,data:1deE2Cc=,iv:c/8Ome/1cwg+keOYKmt9Ck85PCrqxDrmTBtosxHljrA=,tag:RWJPw2zJJ6QZDI4bk9EgOg==,type:bool]",
"sub_path": "ENC[AES256_GCM,data:2MntHBgtg+dYRkjP,iv:vGYO0EpUBsvc78JQgC/wX9HypZtDmg9N1VZ7Vd/a59U=,tag:K4bgqtVV5RuznuEjnGZ5jg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path_expr": ""
}
],
"working_dir": ""
}
],
"dns_config": [
{
"nameservers": [],
"option": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:WP7bmi4=,iv:7nJjkWLWxvG7PRSHWilqqBDKgb1GrR0dqBY8mTdZt3E=,tag:EvID/kN4g8K8C4GSg13r+A==,type:str]",
"value": "ENC[AES256_GCM,data:rQ==,iv:yuJYhAZJZm5ti5de4FxfI9KrKDsGj8wKjg8IYtYMVFY=,tag:D1luzN6c75w7mMe2ZrAyhg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"searches": []
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"dns_policy": "ENC[AES256_GCM,data:X1UBpx3fmiK4hrdd,iv:L9UdMmmdOA3A3BCu2RxgZnzBMrX5hpDwVok+cnpz250=,tag:4pTOwa3MC3+ZQX7ZqH4STQ==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:ALtUgA==,iv:1C3zH1Wr2z/mFiCsK4mDY+/7g9s88yJ0aMa7Dx/rAX4=,tag:DFMnSXTirJOZdXayy4qldQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_aliases": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_ipc": "ENC[AES256_GCM,data:nRC7XTY=,iv:OMhVew9TbvlPmY8biGpcEZqIdHXVnfzdfAvRjKL0bE8=,tag:VmUcCoc5/JAfknka+DAcuQ==,type:bool]",
"host_network": "ENC[AES256_GCM,data:YD8/qIM=,iv:Iz7z3LwUq5GnTRlnlwpAi9j53I+9lDi6iirvgU33ack=,tag:22pRxP1gqbF3PHGABEqIWQ==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:ko2MlKg=,iv:hjdRVnYtAj11OV83JfIWdreXpvm4+abL/lB3t2OpaN4=,tag:TnTCcsIjABfuPKOrB4knKA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": {},
"os": [],
"priority_class_name": "",
"readiness_gate": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"restart_policy": "ENC[AES256_GCM,data:jL/9fkYO,iv:x6bHoSvLLE5ZcC5O7xdBdo+9w3NmfqEBRs+jBeOJuO8=,tag:v62UoGMNQAyQEDh/cRHB9Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"runtime_class_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"scheduler_name": "ENC[AES256_GCM,data:3Ko1Fk96Bh+A6PQnhzGS4kA=,iv:FREXM3S2vdYP74tZOUfdJVKhkPbx4kLpfmkykrkuQbo=,tag:uKPkpCYjz6ZLKK1sMhCE8Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"security_context": [],
"service_account_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:IyDv1Wo=,iv:BC8SLO1kteEhCk//MCkjt/9ZPlp9Yb5+VUOatNv7o9A=,tag:8+M/GNexO78DDIoafeD5rQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subdomain": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:2Fk=,iv:izCLt/6S7TKAvKsSpGXt7IbVauSQ5CjZkmyymyvdCpY=,tag:4vtGRp/AWl/coUq4leDKWw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"default_mode": "ENC[AES256_GCM,data:BEvZKA==,iv:E43TISdfTWXcI/hJuImUU4G4QeecbxDPaRKtpkHf/1g=,tag:OzWzUbHum/SvDxZpi6nNmw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"items": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:WSkYdzn53JqkZpa3eWGELw==,iv:dReh4OpTDRY37XABpds10GqRqJ5IGAksG97r+qO0PaE=,tag:maMOJVtCaaukzIwkPfPzbQ==,type:str]",
"optional": "ENC[AES256_GCM,data:cfA3ZSU=,iv:DlECo5Y86nqU/F3pQqb20eCFWo3vHYJWsDfm2cYd6zo=,tag:O4NMhM0oCeIV4VUxCUFHuQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:pydVvac6,iv:QWSrO3Ai1cZPtYT49MGvQcs+k9HJJWweSIBqAzFK6qU=,tag:FWamYaSpuOgaqcfsx8e3Lw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
},
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:3h6cDQ==,iv:/r+sEWo+Kv2qQroDn6zInlE+oxCHCuXia1IFJSgfCxA=,tag:QlBlKtJuTRquzQwP/msivg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"default_mode": "ENC[AES256_GCM,data:YXqbdw==,iv:CzOjkZ5dvFdpB9xm9lYmDiLcS7Szpta6JlIEDUpBlmg=,tag:u0wZQ+Q9U9h/A+shyFRBAQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"items": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"optional": "ENC[AES256_GCM,data:0e7lxlw=,iv:aIdHhx55uEfRooTVtdstYZGTXS1+wgNN0AKabDSjp+k=,tag:MQItZOtW4OP+0K4+c96AFQ==,type:bool]",
"secret_name": "ENC[AES256_GCM,data:j0wU6U7qu3m4WLwP+Mw=,iv:bPEw0kT1e8MxfUytPT3nplMpMiW/K6gOoNraATrXltI=,tag:88NajeMCBFid1q4qqY2jhQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"vsphere_volume": []
}
]
}
]
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_rollout": "ENC[AES256_GCM,data:/o+0Kw==,iv:YhXjw5F4RHFSl8NYTdGGEj+74kG15HpzkRfRTtmmLsk=,tag:lD2D8xhIt12vRLdciznjOQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:BSGmD834aD8=,iv:L5rI0Hza/9vQzSDZMzW7pXqKTIYgMA3Vn0sfOF4G6zE=,tag:8UKiF8BHtw68cfC7ApP4Dg==,type:str]",
"value": "ENC[AES256_GCM,data:02y9WA==,iv:6cRagdZnl+aniYhfPDA24Pg8BEkn+ACOwdGBa8QwvXE=,tag:xP7+4xnrWKgVQjxtSmy7Ww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:GfWrJOE=,iv:e7cdL6SFqFrih06VMJNqJ/KEUf5+O69nvfKUC6/5OiU=,tag:sMeVa7xpHkPxh/MeXs3HYQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:Sg==,iv:wjX0sa4B98GOSrmrg6QErRBV6gNBt28HeGhAp0/7bWM=,tag:TH6ehfzJHLULdHn54+D0Rg==,type:float]",
"type": "ENC[AES256_GCM,data:e1XpZ7XM,iv:WaV7sORVyu0eaCXO+Kj0Nu+PJ+quWu+MqygiuxuodkU=,tag:7D0vmK4YWUznpMF74Vh1vQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:+TphufH9Tpw=,iv:KxytKsdCF/NYW8XIqKSvDDIyRyVCZtnq4fFRNYjTTo4=,tag:a/BSiXcpsr9rFp1DBJQ8dw==,type:str]",
"value": "ENC[AES256_GCM,data:46n3PLV4sgM=,iv:mawNMmsdqRWrZr5KliDx+1sSAKs93gr7pjKdLHtmw0E=,tag:SuyzG354v0x2UkH5apeR4w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:jJYtpyc=,iv:grQ49S0cMj3oFmRFBD9tZp1d6ewm3tV9mFcvV33usw0=,tag:NsXHuSyURF8BLElDK7vzNQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:VQ==,iv:W0TWw7uGpYRiL1TIGUFWBOHiGDBju7tqlDWYm2Mlylg=,tag:5CYGoL4AKgFhhZ3a4y//Rg==,type:float]",
"type": "ENC[AES256_GCM,data:mVYTM7Vn,iv:mb2ZFj2BZIJAu8OSpDpL4DmevwFT+6fIbzMTJgB7DlI=,tag:+RuhVtFM3liO4H2GAnda+g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:ZGJisJkF99o=,iv:j39qj9IcdxnU6D4HCE6+8Z9g6Zau2Ja/P5hZfZR/8eU=,tag:C8OxERQ9cYXxwABJSW4pWg==,type:str]",
"value": "ENC[AES256_GCM,data:A70CyQ==,iv:DVw3sDML+MrfUbQqQu8rPXt9/W4wVadbsE+51qkx6Hg=,tag:/4ItLYSTcIXPW9keN72yEg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:O/BMdDA=,iv:K5fB42l9l3k+ofHaa+jGIF0qGtpE5bUt6OcQQXDQHp0=,tag:wCWc6nQt33IORmvt+IXq8Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:Uw==,iv:IuZ0Put6eORMbiXAa5ZsLQMDOqFPMXbu0HVWWI+UEh0=,tag:6KfDAaIrKH/vkVOBNKSUIQ==,type:float]",
"type": "ENC[AES256_GCM,data:UWh+Wj3x,iv:yuoBOfvFmd7+dpV5jKWaf3ADoC6XgkjVHqpZqpWztOI=,tag:/jQtC9cljz+/M+J4JE+deA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:9D3Yle7+uH8=,iv:HEppXXZVJkJj4gZCoqP4zl3MVqmj3m/f2Qyp8vmo3JI=,tag:DOZLD8MNvr1Tj1Viy3zzrQ==,type:str]",
"value": "ENC[AES256_GCM,data:op9xESK2YOS3,iv:WD4c9LDUS4TaUws4hUmYGvwoqfn0eLTVjSBYVjuUtsw=,tag:xn/jbCFJU5HOxFQY4KDIEA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:5s8fro4=,iv:ZwZqnGnkDCOiWJ9S2qRJJlqTiMto3JDI9NjqDCj/pg0=,tag:q9w6E8/1DQrA9mWi468IHg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:Pg==,iv:fnLP3y/1kE+iPrH6r0vFUw+XFl8tLQmwDH8hHwfhx4w=,tag:z2iYzOIapflsoeL3yZ5MPQ==,type:float]",
"type": "ENC[AES256_GCM,data:uV0tgtZG,iv:RpB+V4yBkjMe2GrFpopudXxI+ytxKtDX/dqeidYCV8w=,tag:BmMwRKsoaLdy1cAWisSppA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:4ny/cL7wqfk=,iv:yjahwFnbu4duAxAKgjFSePGMcoZMBpXmJb/Cg0PdFcY=,tag:r5MO3c9MmbgC+cJn8rnYRg==,type:str]",
"value": "ENC[AES256_GCM,data:Kz8N,iv:Fp6xaU4OY4uUHRV4fqH2SdRVeJzMyrIXN5kLqccKIpY=,tag:QTEGD/oSmyyfWejxmSHLmw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:69X8TMM=,iv:27KFLrcy7ihweExsVWejxX3Y7Sv7f8tdRU2fRybL8uk=,tag:hDTv/wKU+GcXmFp/X7I6vw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:KQ==,iv:0DZzc5jQxBlW1Gq6POfZZAwzGYEdnfN89p0Pddbv62s=,tag:GgOW71jUw7+CZH6myyTAtg==,type:float]",
"type": "ENC[AES256_GCM,data:vsJoP+Cg,iv:S/LlxXYC0zzC8UHEi3Jei2LlToHtOeWLqqbt81rq46s=,tag:QbjWfSvcHqYq9faefJrSmQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:L70GpSFHW2Y=,iv:j/d/I/YjOsz2t6R3sNumwrq2cLFq8OyIXcR3f4Ss+xc=,tag:WykXjQapDPV9FQ3gW+4sGw==,type:str]",
"value": "ENC[AES256_GCM,data:A8QytIw=,iv:G0XP4FBWDVgio6GRfKDT7UBTsJbuj5tazPt3eaRn7sE=,tag:RTG6R+wIayqFWJvLBI38ug==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:nZoY5m32uEDYlmJhzCOU9ySmDpDvV6AhMmBU/YtuMLrVCiLs10cOuIOy2DYaG4u3/9/5rt/fgEzYSnxqPYDxDiin4fSoqMERtKVH0if5GRxCg2BUEBZdggwgGhBC7BYbnLVwd1DgEISAqQXpRTa+1/6zdV/KxH1uKMWZffKv+b+M+w9R8HMvJEbm4fTNoebwROYbHfAxdHUgv9zb2TFMvfmd1wZNQyQARXNxew==,iv:VM9QTrdbqmY7s8d5/bea+cKBdQulne9JToURK9iJzhU=,tag:92e4o9UKbgbUGn5AANcNrg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:TS4CmlyU1/XOMCtnSpt7RT2Kn24sKcXSiSWmR0KWjA==,iv:XHxbWxjoauDqVQa9o8W0+EyBGJcS2sbceoiYwXoBUlk=,tag:/o1ujNIvJ1Ogaz2iTOZwNA==,type:str]",
"ENC[AES256_GCM,data:cu/Knaqb4n74vJ9JsmE6cAPGn5bA8DsV4su7gbIhLA5UP7JsoeTczZh9cgXMoxUr8Wvkh6vrWQ==,iv:M4FtYQmYH+rIr86MrA6aBf5zzSBKBh0yyqP7SvT0hFg=,tag:Oybpe80cK933YqO1tun5kg==,type:str]",
"ENC[AES256_GCM,data:RaNiaT2Wp9DukL8Ce0lIC/6TOlmesuh8Aza16xQMp++eWuvsCnWte6KaKbDvxmWzCA==,iv:7CdQp5lcaZeZgcg0dRuMtzADBM6wMEjD4wIVBkadcLo=,tag:CmucDv0Q0epWknSFS7PCVw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:jXFv7NUdIN4PDAkknpMd5g==,iv:4JHge3K6WlBYeqooX3HwAGjjJDREc9c1lWkG9fhs7kQ=,tag:aESzeFMQ353ar9cRQJygIA==,type:str]",
"mode": "ENC[AES256_GCM,data:kQ7Q2JmOrQ==,iv:095im0srvnQz7AgFCW9giu/m+D//5BlKT2qRU3z2vpA=,tag:di3HD28aMJX23q/JLmssWg==,type:str]",
"type": "ENC[AES256_GCM,data:E3efHFKObrn7NdjHvaHq0fR7C4c=,iv:+Jl7t3EbtR2+J9d0N85+GkdnvEJZ5zaJcdoZEmLik7Y=,tag:2+OVBZz1wRluPPywKTVtUg==,type:str]",
"name": "ENC[AES256_GCM,data:m5xhnoO2S4Xw,iv:xFkxHS/7oT7rxJq21AWPCX5fXniFlwxiTxeXz5HmpwA=,tag:dZiFDylbBmgw+a8KHdaRUg==,type:str]",
"provider": "ENC[AES256_GCM,data:R4GGstoWEDKB7bDc7Y1Rtgun+Nwq5UBtF3Lv4BsiuNaueaAPODVYWaOpDu9XB/2FQjJjGrzE,iv:xgI1CfgDoh8YfXVND4R9H/mBRD/WhwnSrQ08GTZw2M4=,tag:/5F496flFxc7KifVAkyHyw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:OA==,iv:77dqH2DVDXCa6bqj4+GW94iJXBpYK2LSAFLYbqtq/Ys=,tag:fjzQCqND4VF3wOTyN2m1yw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:bPxUY/1wJH6k,iv:CT6U9CZq06wBT/8etRVK640iiEKgqKXxvpGM5zSjo5g=,tag:Xs7/7d7vGMWHnwQFe2gtRA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:7g==,iv:dRZuOvo3WwmiHBB+lb+yaRlpICfJU2xPnB5ydzw/fsU=,tag:fp4TQH7CvxllACU8nUbNYQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"resource-governance/custom-quota": "ENC[AES256_GCM,data:LYWbyw==,iv:ikhugg5RqjMJAUKSHM+pY8XEq/+yRTC9fzxKpbxpVNE=,tag:+yFjzv4zcG6m0OIfKspsrQ==,type:str]",
"tier": "ENC[AES256_GCM,data:hCn9+/QMRq7g,iv:/sYOM7BfCtB7HLRsBX57cWxl2tO0U5J0O15+S6nxCsI=,tag:xXosbXZEqtlhGYiELs24yA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:3g6iC7B7ekOX,iv:fMmLBLKtWZlWgjdaY29CnwvCmKQ/KU6G33M1EEsfukU=,tag:DMg0kR6WEr92l5YyAFHbDA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:i0x734jPAeOT,iv:r4CECTb6jsAx+1geclEeNJqjzdMkwzoAEfzdvCuOapE=,tag:8o8uEEfeSGonHxs4OHzVaA==,type:str]",
"uid": "ENC[AES256_GCM,data:Ba7tazTa1kTZelbEhlIPNvAE+cD1qRc2cOYeNOjWFL8v2mIT,iv:29aZ4lw0sqql3tm6voXDFQ6bdxcRZiMMZwss+g720WE=,tag:sVHMNyMGZSHFXB77wTir3A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:f0rsbww=,iv:EsU6sXPMhc9lP6ER6Zz/4Ot567ay0QLqsRk3VD3B634=,tag:gcxyzbSfXJOosa57rDsiAg==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:UgjH87hGXJ6IuZQneOpEdOYzREUyXFiksNyP95kMOZAmfwQNgbsoTqivGeYDmoYAYjyhvJ4dJRXa+34de32GYFT9JAvtQmiDhnKLoWn+o3yV4W+DIUgGkg==,iv:O30mOZeHlEQQhHoiGY2K7Gp4jItyxVTZsqh25zOVbPM=,tag:0RfgNAPEAb3hBDFJReOWsA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:Vj2CArKBsMB9OygDzIq6uw==,iv:qeNz6qDKnX3JgGmTi5J0gNZQKicvx6X+Q/BsEEJlywE=,tag:DDfiiOrqJCxCMOBCnKuzDA==,type:str]",
"mode": "ENC[AES256_GCM,data:vGDHY3zcwQ==,iv:G/6XbRG6as6BhA02G1VGIbHejtRmMDG7XqNSDqnoYuY=,tag:xRnI2819/TxcnQFBO6OSKQ==,type:str]",
"type": "ENC[AES256_GCM,data:Ozvn+KMFVmixQ1QekjY3YKNh0IMaRhv5xg==,iv:H2atESn2KvD0NQfWxcUicTR/MYm3uUgIxP+LxZwZcTg=,tag:reZPIfa15EMMV0yXgLo8Ww==,type:str]",
"name": "ENC[AES256_GCM,data:2KXbsspDylqn,iv:9nGQYKqAvUNIJocu9VIcuva4z4jh3kBCrGNdPzOiBz0=,tag:z3lNgEst9PyMBMuqY8txlw==,type:str]",
"provider": "ENC[AES256_GCM,data:dXft6fFwGST30Vv3G0DdOgqdU5tqud6cNYYPRoGJaV9TEg40aB6h+Jvj+Ilh4u0l9INSvJM8,iv:b0/1FUUFlbSEPIB5KvbT9j4ppgSON69lI99kGzL8/Wo=,tag:yiM6TVZq4QmC0wBRIn/wZQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:wg==,iv:2yWwEePY8E3PiHBHImcdySkbH+KYmOIXwjfaEunfDkc=,tag:idvIa8/FT9wuPbmy3qHsRA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:q8Q3OdgomTQlM7LF6REWQwNt290pRFklQA==,iv:7lWz4DbgHFm0r6UoqH18Z4/PfKlKcOBp6jy2zD/TeeY=,tag:b0v5hC5Tb0d5KdGPxF5c7w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:/Q==,iv:9cA0eF5BSDrTqSrCQx21x3ncIXZQJf5RkOLFpWGZbGA=,tag:H6bL10F1RvYTXdtpl27pIQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:xPzQ4AFn8+ILvUREwwxV,iv:rKbfXyFItyrHFa4gvVGKzyG+CC+E/OT5K6jQFU/wtyo=,tag:ZZlb+edOR4vG6QkCrTYjPw==,type:str]",
"namespace": "ENC[AES256_GCM,data:ZkfbLdbiuBGD,iv:W/KHImiH/pQyIUgYM1EVGsPzsfRVVLJLSHNTHFJUfoc=,tag:Hbq10ELzO669VTvNvxsmfQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:wK+e4hAzSOZ+,iv:f3qMzxFPl4EqsxPSsKpZeYXX/Da0WyNfZY4Om6fqYy8=,tag:utt/eylFvIY2voFydT0OXw==,type:str]",
"uid": "ENC[AES256_GCM,data:iy1PJCMjuwwInXFYRr7PfRrsnb3rLo+EHO5hPJ7KEH/bI5er,iv:Ly23VRjP2HjiN5RIlGeQ60gzLi/TR76jFRmU11zeTmc=,tag:ASkFAsIK3EjSlE1D5plpwA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"hard": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"limits.memory": "ENC[AES256_GCM,data:b9MDhg==,iv:cQ4XiZfgrxnLj6jC7c2d8S9aUTaCyRb6kwuKoI5vwNo=,tag:q721IF6xrA3szmWyhb9Z5w==,type:str]",
"pods": "ENC[AES256_GCM,data:2go=,iv:6d0VX/OVYV/1VZEZEndGsmYf4J0FQvcuQybNBIZOXXo=,tag:81C6dBAygBTFLMwvxXkFKA==,type:str]",
"requests.cpu": "ENC[AES256_GCM,data:O40=,iv:z7DkYSZsMx9BQoQrWZnPHUENj2GKbmVu0GokwO8ee88=,tag:7h55T+NbklcxXFlbYGBQIQ==,type:str]",
"requests.memory": "ENC[AES256_GCM,data:s0/wJw==,iv:C5xXGqO8+4uHgclgmcqc1qQVGXNwrEj3za81FUbIBqQ=,tag:/Dzf9jQqdX+pcS2qn8FtsA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"scope_selector": [],
"scopes": []
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:DNN+PN8F/A8W6kXY//ixjxsbQVwasX4Fg1TZHLjK/kQ688GGlO9XLx/zp2swlbRjNKpzzH9gjv9JprIPh2H3hOgy9wv499S7NGh7jhV+VB7lI+E63K4TwxAQK1NzljqMqBA619TxSYc2OESOQPjaYQ==,iv:jQiAixSrptt98UbE1sUfbaW/eL6Q+wmtdJFfyidql80=,tag:TQu+2QJzHzUROVSANwzUvw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:4BwnwY2U5p0cP3JSoTGQbXhxmqC3kVK1kZl5F4yvpsa747U1XynfrLpSsU91MNQ=,iv:hS6Fg+NSOOAO2bXw5xZyLCdftpLBtEAcCdvxn0GDne8=,tag:gHTZObvHTvBE4JVIS2t8sw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:t2D/U4QdPys1gUvBMrf4gA==,iv:5v5guVMTMI5XysRzFY+akF4BuFmoW5VF470WwGg8xMk=,tag:pmeyYHatS3rFV05Oyjs0Kg==,type:str]",
"mode": "ENC[AES256_GCM,data:meM2Gd6evQ==,iv:hwA/s+oSOoMnGjqQoRayEvifhr5kh7dsBzG2Hqg5KjI=,tag:LdK6QCaUsZBOcVeb95IW6g==,type:str]",
"type": "ENC[AES256_GCM,data:NlduiIvayMWlOn0WnVKBKUI=,iv:opJ9TagA5BRwSFA/ijXcD4/1MyCKOnov77/26nfAFsg=,tag:kPylS4ILyrzxkSWVcBTPEg==,type:str]",
"name": "ENC[AES256_GCM,data:gIsWsrnZ4S1ZHTNNRi8=,iv:cPUnPsn7lyzum1Kg1BaJ2AAcdWH+D7d1zxjmZPTvRDQ=,tag:jmiQ3ppkSRf/nD5LtCyRDA==,type:str]",
"provider": "ENC[AES256_GCM,data:CQpt5Lc0WE0149j2WpYy4f0al8QTKPhWEm0ecScZ77e006rzA+6KFV/JT2SIa/bFNGxG1rK3,iv:cvh+CVLJem84FelpgOBUSqwEV2wBtbGfBhMn8SPFWV4=,tag:rdGBhRSdGIKt/MQJ7usCGA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:6g==,iv:OOjOqihZL2SJ+eftyeGPy+uNjN8/KpYJCB7sUlEvGF0=,tag:N0bSIWhw9PdNEB5D8oHnHQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"userlist.txt": "ENC[AES256_GCM,data:A98zlzilCwDnjBEfK9uUYp4RspLsK8Yo839dSjtsiw==,iv:XLwydxiwXf/SX9mEOf/sNTmOHb7DaZ6/5QkzIVlXWiw=,tag:cHy6/+k94NTd1qAyGoYL+w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:Nb5OY2B8kSh30pHToChgY0z7l1LyzUl8,iv:E08ZraY7u56qELavxasA2ThtEyNh8BPidZkaZagajJk=,tag:m42jm4kgGzKp6LRQW9fGfg==,type:str]",
"immutable": "ENC[AES256_GCM,data:uS33948=,iv:diGwROhoFs5s5zX5gT6kHGJ1L062+moHu2Z3GRNnAPU=,tag:6FZuY67L4V8qY8GdU/iQnA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:qQ==,iv:vV/K1J99J71thBlEjhx92vWhzBaJ/W8rZKlDwCERib4=,tag:fa5aUI8Db6r8hgzmio8V7A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:W43//7ndrWbrX0hzb1w=,iv:9UDrExuVyuCiA+rd5PMsszZkVGEecaiEjdjs2lwxoV4=,tag:nXZouUcSfOqUqWbUUzYHxA==,type:str]",
"namespace": "ENC[AES256_GCM,data:2y6dx1GpI00y,iv:dCIxhVA9CBU2Boh+lfRdQNhnhHhSdO6MQjPmrj/N9Og=,tag:JALaraH4XXBfR0LVrBXWbw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:aofT/UK9Tkh9,iv:juxu5BdlJqZYLAWXhK4NjpzA2ZAeTkGTdGYaNWr/HXk=,tag:RZv7yTHZfo3+K7eXANKO5A==,type:str]",
"uid": "ENC[AES256_GCM,data:f2wxf6lpReeiJyt1MY60szhX8UGNT7BWi2v3UW4Srz1MsISV,iv:wH6jgQD/y4CNpvWI9IcaYrNk/Ue4nvTCgR8lVhDB4uY=,tag:OLCP4CGa2xnrWw9j3l25DQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:Ssm3o5Y5,iv:pU8Fj4nVrZIbRDT9RQXtxZCBJ6izLqoGcuAAB/MCHIE=,tag:40+qQwgqR/3o6g9oeTa8ag==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:jBnaiw==,iv:EPtmFWas1Wwazb60U0S0cMx1egOqaIqSbPdjLaacrH4=,tag:loUHFgMHhBswzkTQ+lpl9w==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:c9heUReUbVs=,iv:sz/07Rt+nttprqffjKn65WNcJNs4DvVkpzWL6BGDVZI=,tag:v1oHhkHDYDCk0p6WY1z+Jw==,type:str]",
"value": "ENC[AES256_GCM,data:Xm0/QQ==,iv:HtKGuaEHdRcaYK/WaxB9Dx17leZqPHU77kkbQ4uu4tU=,tag:6ENMPiwNyyKVYfF9kerniA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:X0KKIx0=,iv:9VjUb9aRce6R5gXjijhACzue5Xtwi9f1ZJ7i4B9Utog=,tag:Yp6Pl1ggTWphBWuKxXbOqQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:TI8gMmCUEdIapzec,iv:7scRDTsnXlIajhrpQAydiPk7BD9pbKcNbZ1Kgo7tZIg=,tag:DdQGa4MsPlHCXq2djWYNkA==,type:str]",
"type": "ENC[AES256_GCM,data:kRGgvxYc,iv:W6Yrx4U8obcXDhQo/OA0ozs4bYO2xBx34ZW9ijARcWA=,tag:vnwf4D1hkJlZO10FArKLJg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:3Vh8LVgFm7Zn/uP6WB2fD/YeA7O5tlNmlgmXDJMKPGOcF92rStt1Uayz7cvWVpSisVzPlVa70DF8NlZ9Ry+kL3oyLZBe5fHdwj3zSAlScAIhulj8,iv:BswGsSWsNRmCWrMhKNPlRxqvo898rWRo5g+2oMA/Iag=,tag:Q2cghOHIzWYr7t1ZMtLSeg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:OofDjKquEEaIMkjzDoHZhOp4GuPth6leOBw8wB86gQ==,iv:5fDRCTZXPy2HRdgV+RtHQj3Az1H4npkBThNNk383OmQ=,tag:tbYMQbe1MEJ58ThnifxotA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:5NJAx9u7+YtooWNvNMrhWA==,iv:+it//gBmDz5h3N/7jMyN6yMH0QRZJAqtpbfNyWQPJmU=,tag:spfsAD0W0yIb4AewN+xYug==,type:str]",
"mode": "ENC[AES256_GCM,data:6OOxP/Du/Q==,iv:17AphZIe/g4QoNWnMo30q8OOQEaQnePiCuvNMlAr1F8=,tag:4BSksFVXzKKDGcFlZESssg==,type:str]",
"type": "ENC[AES256_GCM,data:gZ4Tl0suN8tWUQRCcqc868q4,iv:MOruYiY3zKzuhYnNN6+CduOob6ngwO12XLLQbR+89Co=,tag:bdgO0/NwAmNBOjtIPxT2kg==,type:str]",
"name": "ENC[AES256_GCM,data:S2Nl+qd7OyYK,iv:d6f8jE1TlOdhXH5b7VkgYTd7LhFfbLEC8IHZNcTQY5I=,tag:vfcRUq7VWO9TiQcWrPlGIg==,type:str]",
"provider": "ENC[AES256_GCM,data:r0FLfbY2Ky5AtI9xty6X0qBBi87UG8CRSfBRLZijhPvWLye+0otzZ+VJaloEIIvDUFjcbOJB,iv:Xockk524QUd90RuP92JCBqLbLng/nSjyef4Mi6Wd6JY=,tag:I+VXQVlh3sZEGcIs/4xfWQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:CA==,iv:ZC0JwU/I9ADRA+/6oc1D/ZEvxcVIT5UsLfT1GtmV0wc=,tag:9K3wSdVxC3Y23jQsZsYwzw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:R4qKOZ42pP7rR3GL7o8YXLxwKw==,iv:ESWxS/VhDf8nEry4khH7+xQAjZEfeCNobCRlJyQAh9g=,tag:bHsnrBQRh7HqxMQLWLbY5w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:fg==,iv:/02haSA16MRe6XCaKPq2bDcx28/eMsbqUcIbFuCZ1L8=,tag:V7LeqaQDB1cCTNNFHg34ug==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:4WlCmcpoPoaF,iv:vgxLFiRrVM+Cc90GVUBpfHuTQ+jqZNCBJ1xmYVfxEVA=,tag:JgscEBu7mRtzOCseO0Ftng==,type:str]",
"namespace": "ENC[AES256_GCM,data:3bY7rOyEqpjI,iv:aLBwj2ej3s+6v9l41Zn9/vUxIPlebMiiqeJolC4yAEM=,tag:ziCKcBGhhdmnT60IDP17bQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:QUbhsf9Su37k,iv:fmnLMi8603LCXZxNXr+H87L3UJ9HPwOfkciImlDj7Do=,tag:XvmOaimoS3GXPq10XXQSfQ==,type:str]",
"uid": "ENC[AES256_GCM,data:OCSq+bhIarhC85KX7lX3vl9ZUTiLdKtPwXsxCMkx6cJxXbQD,iv:ANnksNIWGpTjxK3sICHyqJba3IjDkA8y23o7nVlSsrw=,tag:QmG1+iaXOPi7WAhpfCRsaw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"allocate_load_balancer_node_ports": "ENC[AES256_GCM,data:fcCrLQ==,iv:i6PAIp4J49IBJ33+ZPZSIbsfvifc5fAgiTgbf9qAPZQ=,tag:+PLzQIhSOb8BhxkE96nT6w==,type:bool]",
"cluster_ip": "ENC[AES256_GCM,data:tQCG+EHh9QHJMkDO/A==,iv:g1XXtpjer/E95tgx0LBkfYj+ShMjnv/V2fihlwpvTyU=,tag:5hCnHi3ZRFcvDoERryFI1A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"cluster_ips": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Sp9nZ6jaS1WlIyw+jg==,iv:0Tczipe9nROf4nmdQBl3+HLzNEOrk0OgwUdDwGc0scY=,tag:MY8kOIfuKzaNoTI5wSXLiQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"external_ips": [],
"external_name": "",
"external_traffic_policy": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"health_check_node_port": "ENC[AES256_GCM,data:NA==,iv:iHYy4M1O5EP7jl3briRjAcNpFBS9FN3MNh+V5vNAsHk=,tag:HnBRAYg/xbq9ojykhZVYyQ==,type:float]",
"internal_traffic_policy": "ENC[AES256_GCM,data:/3jQr5aNDA==,iv:wnULbWrs67sBe+DO1o7IiG02o/ZysVirEWOlNDAj4Lc=,tag:d0R5sKbnumOkOWIK4gWA3A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ip_families": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:BZDNyw==,iv:LHJqStkSoCJk+EilHwF88QWFbZe3Sp0rE1jY+2R9Yek=,tag:DjyFHkSU3MhpaQJFB1YfdQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip_family_policy": "ENC[AES256_GCM,data:9rj3wDUKB8Gw0Ds=,iv:HmuyAnTVJ83PRoeswYFCSb9dfqWwRCoiiB6TenptA2I=,tag:BmYpXxIfmZWsbAfexUDm9g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"load_balancer_class": "",
"load_balancer_ip": "",
"load_balancer_source_ranges": [],
"port": [
{
"app_protocol": "",
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"node_port": "ENC[AES256_GCM,data:Tg==,iv:J2+xj1sjzvwLOOuYVCNNqCoZ58Xkj2Qj1PjgG2aAA1g=,tag:3QxTMOvnF47yriv2qwhEjA==,type:float]",
"port": "ENC[AES256_GCM,data:q3acNw==,iv:XELJ3tfEHhB4ly1IIK4jwl1HBVVuNKn13es9NLkPAo4=,tag:44FV1KDTcEPaXYGU+DmC0A==,type:float]",
"protocol": "ENC[AES256_GCM,data:+gF1,iv:XKuqA8U7dwl36RZqm/Qz/6xk5xQVVmFzNh/cl4g0BY0=,tag:ZyqhUOIcl+Upyfo4Tc32cA==,type:str]",
"target_port": "ENC[AES256_GCM,data:fyXFfA==,iv:K0LeFLK5SQivgOFns5XofmSNlIiLLe4cj9PjE9e/N14=,tag:mrS5TpVWQKvcetOj6p1gyA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"publish_not_ready_addresses": "ENC[AES256_GCM,data:j8/XQ6M=,iv:ZXgqXrVm1oE/2pSoClYt4lpKwzNgHfB5jSgaZrWyg6M=,tag:NBhy9bTlc0jtjlftoRDlQQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:tjDHIOdOxUgB,iv:kMpmvch23gNEOTBx+ZTxIp0Mqo93DlUTX8KACD0KyZM=,tag:74j+oMf8CVogOqvQlBbJxA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"session_affinity": "ENC[AES256_GCM,data:cC2xMA==,iv:wCmDYq5DQNwHA1jHX1j8i2yExj2UNkCHgdunDGlJivw=,tag:wpjYtz5R0OGxQYjiBmuxWQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"session_affinity_config": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:RNfm1H80aOoz,iv:w0ncijLDN3+eTbb1Lhbw429DkSDXZCM91jw/0vEOyGs=,tag:kaiTcr4g7VJQhKSca9HQMA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
{
"load_balancer": [
{
"ingress": []
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_load_balancer": "ENC[AES256_GCM,data:x4kSLw==,iv:bcj8jbdYIzVAID0WJjoQnXWMJ9wKFzq/n3sc50GWpqo=,tag:rjsDd6dbl/Ool4XaOAUITw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:AFg2c65r5YLLbNJA7mA29yOvMew+7IRZgOfuNkVxqWgHVVeRQGr4n27el3Ndqm/ysoX8uw2JhefiC8IQspVTGlN27eJWXGLhvLmDawnql5DEu8MKywQZCcuorKt3SasaOBLwg5MQbVgTU8Z9kFzZEfbc9Z4=,iv:6GyPFiJTBmOkjaPWXEoZJHLS/6LbM4Oh5CCLp9csYYE=,tag:nhvqxeya92f3HvceFwmkTw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:7GFYAd8Qicj85jhqHctUPMsv+qSqwzy7IzuEMRHziA==,iv:Opd2ICo96dzSbYW9pIAvT2k4cS5q07E3X48+MJAbmaw=,tag:8E4fWs5oZ7cEh9z4M3JXhQ==,type:str]",
"mode": "ENC[AES256_GCM,data:AHEyA74lFw==,iv:oUrX9bQpZYO+4tQhmEZeKRZ0S7QGRpYXziWiV3+JSmE=,tag:mLfYv7ZXeGhWHLGTbaeClw==,type:str]",
"type": "ENC[AES256_GCM,data:Py4ttx66zHg9MpR/bCPb73XK2ZBD,iv:Kdv65njYT9EwEfBhnICAGVZlkkviiQNOm1jQ6T1SnR0=,tag:fPXIlNpAHdlF/O94ozug0w==,type:str]",
"name": "ENC[AES256_GCM,data:EVrrM+minePKiJDcIa5x,iv:GdaJneuweAXZ0s9HZvGzayZFfMIbFxRf07K/vhqaTHY=,tag:9JgYgKfTzrQZiQag6j9UQQ==,type:str]",
"provider": "ENC[AES256_GCM,data:guCHFnqMOCzkRJSTMWmGMF2+6UCCGxU7xQf1iGEM400o7SH2TrRLFjA8+bLLS4T+DbR1Mbiu,iv:aQ+Hgg3b+UHctxc2RInKzg6NqaEzzMzfJjJPaJRKpMk=,tag:DLQYp4zVZvcK9wbWdxDoAg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:JQ==,iv:Z5WUR7e8mlR+qze2rpXFMDHQKnEBxnePSScxd03xXJs=,tag:92oqrkbBD4h4c+KX1xcBZQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:FQimSQc+MBsnBC/zr0AbekDJ/w==,iv:kmB/Kqp81gZdw2168QpFDAr+HtSBr/UXCZ7Qp+zqw/E=,tag:XGzYTgsV3G3CZwtr4i7epw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"gethomepage.dev/description": "ENC[AES256_GCM,data:Hu2MA7bbGa5gk6NLDAz060M=,iv:nv4rcN7Ea7Vj2uGc1M53huH3lRzLgI6F8job7QMzJrs=,tag:mp9fgXhHhinRLu4GpuZ3yA==,type:str]",
"gethomepage.dev/enabled": "ENC[AES256_GCM,data:q36Zfw==,iv:WezAvH9xRL2w/JreiOc0swlruAHd9ctM3bBI0fRm9TM=,tag:VbmnvEelXAS8HR0coD43JA==,type:str]",
"gethomepage.dev/group": "ENC[AES256_GCM,data:ngB54AOv1KgYuXMPMnaRpTVdIg==,iv:oCR4AxKioSbhZ9MgJd0+Idhe617dulDzaxaaJcdwxZc=,tag:NZt0iuwvpgvql+w2fxMP0w==,type:str]",
"gethomepage.dev/icon": "ENC[AES256_GCM,data:0PNvUrUVMOVhjK3GFg==,iv:QrfaL4YLXwoFhDfcEsANkHKCD7XZcqyR5lkLxx9rO6Y=,tag:nOL/lJL3klmAZ2vKC5VtRQ==,type:str]",
"gethomepage.dev/name": "ENC[AES256_GCM,data:bLUKGaRm0or7,iv:nRFViOywVEFQYzdOGGCpWkFlt8cYA03W9ElI7sSIF3U=,tag:wM8nNq3RXNQAIls9jl8l3Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"gethomepage.dev/pod-selector": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"gethomepage.dev/widget.key": "ENC[AES256_GCM,data:EDCJH3V7lf8HMKsrML34AZMRn6boolwTdPIQVV2lbaJxFkQGW9C+EcPSe7z6pKxK2FClKV9QzheCLsMX,iv:bi76EdZ7pLacFinH21RzpEunpKDR7MynMo51+irvuHA=,tag:bGwfyzzwr++MJalBdmUjsw==,type:str]",
"gethomepage.dev/widget.type": "ENC[AES256_GCM,data:d50Iq3FJY2uk,iv:m4+Z840FscyrbNRHyDBxpbudOgMxS0B6aG/GQxkrdho=,tag:ELSQ+WHh2ajVS3ETBdZfFg==,type:str]",
"gethomepage.dev/widget.url": "ENC[AES256_GCM,data:m7jhgRdYSJe+yg6nuHefOua0gHrhujemrvmfUZsX+MZViixHw93n/6snXIC9sSbqVQHGSvc=,iv:dWr+tq2SY9AwMlgS6VmPwiKeA95xXNTtP3kQuFqSnRY=,tag:tSVKTHsYBFRGF8eAb6Sr5A==,type:str]",
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:uPCUoOZ8uTeE,iv:3uVGVK1ugbcLsZpVUcKxDST75z3lfltdNculhJrJLSU=,tag:CZHJItopxmgGaCLrcf8hOA==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:4flYS11vDMbB36c4y0wUVgoOfSqbzph34cyYUJOdjp6Qbgvv4zcncVWCATflh/w5IGwKblb+5KUMTq0JwzDaV/q1mOCndb28kLDIiUoaO0r6rtKgujwA558k2SZVVRg2m6vKmdfxwda2OCLbKu8WyPzOzhAZfnBvwTIMN33zq+vIMOM5t18JXdge47EkUnPOjAoRJ49+3pcslMShS8UV4CQZo3YJkr95LfEk161PJjMzIb8T5AvY5FvBNQ9MQFBMhPg8jh3oSfGs0UZUIc4DPEFDCjfB3LEpjPwYHd6hgKox9wbW+u2dufsEghyhQ7pyi0o4ofCNTyHUXiPd+N+LFvadfQd0ZoEqH1f3sO9dJSYR4qdX697uMEQLyA==,iv:DdWaVMolpFsryXo907Clmd3KkxRgprDL88e1pjixEiw=,tag:JQPQbQQy8S5NxxcCod/zTA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:dQ==,iv:iGvsLF+0Bizj4uIGlz9MGmZiJBxR6RVewZ1nW0aamg0=,tag:FxXGxUkwH00PmKtn7vKOYw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:tAWbC5azO6AU,iv:3yW97yyK+mYv6FTYegdhB6DiMSz2DafgfyzoSziptac=,tag:XSdWsuGpXWq1wgxcA2ttDQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:fcvjnstGsOPT,iv:DApi2oVyOk8CJmrrjQn7ssptZSo1URnM0MbGK93UOiU=,tag:jSMyAYojZdLc93HgqIVF7A==,type:str]",
"resource_version": "ENC[AES256_GCM,data:B08NcURkkLKj,iv:cbFAQdTiWEx1ZtRtM84ATI2ENR1CEFKDU2LcHwOY2TA=,tag:cUsowIQA41FOh2WQMAyZhA==,type:str]",
"uid": "ENC[AES256_GCM,data:u4jWwnxcyfxJImSyTqjSKblgF0A8qNI5UTRgnx2X+CwT2KOP,iv:A4s/fp/Dc7qQItuPuU++3ExBMGegwda8AfgG0Ux3mMQ=,tag:NWzCZc49DbhOoZYYfZBV/A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:bYkTrecWqA==,iv:BrFDgXbs/0VyjqrW7YXTcet/2eLXWu0QYjz8RC0uc/c=,tag:sBsSz+8nZNb93309WlS+SQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:lMqsIdyyTH0Q9GkU7qV57maP/uJAqzF/PQ==,iv:px0NyYv6Jj1nGgjTzOBlWukch4+YTqhdTmtbtKzb2FM=,tag:poe/DcW/+K944VB/2Fy85w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:LGjwEn03rcCHsR5QvIo/xMcS,iv:vEyFAtxAxrNxi8PIkgC95SQv7WO5V1DaSOqP1GIlyik=,tag:ZjSX2peUD00e6m+579bREg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:Tds=,iv:rJfMypxMk1ev7Bma0hXDMu/NRHcM37EKktazqFR1DvQ=,tag:bejVBxyhpvC0VDfMzD+zWg==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:wg==,iv:IdIX3ECXBesbykYnBP4Ku8vRPnpgMFJHJAJTDisqqH4=,tag:5FLaXmgZl9UjnnSLVPB0pQ==,type:str]",
"path_type": "ENC[AES256_GCM,data:j8lo5B4Fx2V8Bsls13WhktpOKHw4tQ==,iv:t+RWEJnoNCYjF2bizfdzpjsddf+Ch3v15unrQmVttuk=,tag:ERaw2Wa6PrIS4qHw7VLgZA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:z7Lw3r5jwhk//q7VCLVtyJh28Zrq7lq5xg==,iv:otJiRxdX/k2L+WIo+60pEBHXA+OCBGQQx3hV4Iy5WLA=,tag:AvNCmDqiUWfaM5pvDFMAww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:PQFrdr9E+ZWAYw==,iv:IgYIWdYgllF/WbeNg5hqcCtOOJdT1uRhKp5hZpBnRiw=,tag:lHG//CMNc4VhD1qMaLgGSQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:i4WFzZhktmvdhr4=,iv:LrWwHmy981pxhrqnJtssdINsvQWoBpAAhJVupg+hUdU=,tag:ReDelvFvOHZRjqWOH5FwSA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:aRSp8/I/650=,iv:O1ocYzzch47k9KGNKSU//E8J9gqJKe53EXO+LPxeG2E=,tag:0TCkRKrjDcspsDUnI0K8yQ==,type:str]",
"value": "ENC[AES256_GCM,data:Y332wF6Zk5Q=,iv:uzU/J3qXG/sBwb1qrbS5sSex0Mg86wYU9pQYbDlNKSI=,tag:jERm3phWT1S3OXyHmIMOqQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:4pYktQ8=,iv:ales6TTQ7GPOvA+8MSF16vM8sAkMQzft2s2f90dJ2n4=,tag:cyW445bBbEMDaOpXBpgEuQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:eg==,iv:e28Sruro79kOtk/5yyOTHTmrapBB5/WI+IcVyDBiMVs=,tag:rfDI+/ON4AEjc2oaCjGKuQ==,type:float]",
"type": "ENC[AES256_GCM,data:61buPzcR,iv:PkD1CzdetgAfEAtIHm+leQ1nORcpnaaRsC2ROrzF6Nc=,tag:1V6c02ylY0Mero2+hVS1aA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:wS3f/UX8CN4=,iv:iuV4K0Jo5yjPjGFcTz2sRXUbO9ujCAtGxSDmqM7zZ94=,tag:Lb0b7XDi0sulpX9So4Egtw==,type:str]",
"value": "ENC[AES256_GCM,data:oHejMpZwisjOiCc=,iv:K2cj8fh9eBakWF6eNCyRaG9dRhkSek0dDm2NT/UYvQI=,tag:WZP6SLTHmxdB/tUQ+1YRgQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:NEOJBBg=,iv:n4XL98364X4c4hZf0QitzLlWd73gJa1oiLxoUKV6Kkg=,tag:FCKVGr1FKcErB/92k6rWuQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:XRaJ1GMoDsggIlJw6lwmMLV0RdA+gSW+2UI=,iv:zTr7ndrTQ6QsizoTOPVV9kdNqqaIoxSmmdRKfrNPhuU=,tag:+1PzWAKW0CME/w3K7YpCYQ==,type:str]",
"type": "ENC[AES256_GCM,data:tWE5+RzN,iv:/qTQcMNwVIl6eYXTWNpdr8T+s7mKsY17cYa/oXXIIok=,tag:SfUeKMRFVVJnBWIhWhH1pA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:b4X/+PT7qluBuSnvUJfdDLaUVxIQk7zcb4bOpam3BFGzf/upOPDUpSxW0odslM7tTQWm8ItA0hg/Q40oqlODfO1IV0/J5VZ/NrfKrE+fGCBUEmX1QnTIz14cfdzhaTKZnVQ/9nnWTfm4nSthbKutQAVwCl/2+dhb,iv:ex4hEJmCDKoxYhqwNTfbwJ37I8QeMHam08b302zGfro=,tag:/vGruzdLlqVaYucj/08SMA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:178sArBVo5i+G//TGqU43wMjjMBb7Yy74wvL7nkp5w==,iv:4hyOsZfxJVkUJ+RwVOfoV7Lw04VGDkXe+6TAN5E9gpc=,tag:FlLsyvcSiHqPfjtLCjXWSg==,type:str]",
"ENC[AES256_GCM,data:eZW1o5vSazHRhQS9fXOfLYb7Lt2fD+6HR0kX9SigiBGPAPjlaEib99I/ZJlKlOY=,iv:arxUH6DE4G8tcc7Bo90GoKp2q1SBKPUS+ZhFwBPjI60=,tag:rrgyjpnRk1QNghYbET2/og==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:TPOtujV6OdR95BoroFFbUe7eHpQ3NLpSFx/oOCqiURMxDZ62T3eG,iv:3Ej5m8V1TWe8T1s3GXgds0V9UA1Vju2wmOFtmHepPAM=,tag:+HmPa/QLi3wneXDbC6iaiA==,type:str]",
"mode": "ENC[AES256_GCM,data:Iu93bKsxDg==,iv:pNcdTVRP4/dAgbrCKnX8zDtLzQnPacx/DmhHEPGNi/g=,tag:1cIgh1n++R95pHV3ugClXg==,type:str]",
"type": "ENC[AES256_GCM,data:NRXxS9xuwrr0j9OWN6Sc4lh0CrjL,iv:fTZe0bpra1De/A6mmOl67GQn/Z+hSYQtKRsNAPH/CJc=,tag:1We88ehVYzh1yYJFLgX70g==,type:str]",
"name": "ENC[AES256_GCM,data:xXQhTdPhYRsimcYg+HWQ,iv:tSP/QejNr20q1wPVr/8DkOMXVprdrREHJ8FCxHxoVt8=,tag:YTqr8xgECtxhSonBqrkClQ==,type:str]",
"provider": "ENC[AES256_GCM,data:KCbuAqDgr3Av3ph5BOdVJ6IayrRI5vtNykJZ5N3Gsmk5qVkN1nYYdFLu01Q67KtC0tv7clgO,iv:a2nvC9aSXfGyPXwbxE5WRbAWdbYV0iKArjD5zoBlNHs=,tag:TdrSRap+MhWkmEN668nNXw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:qQ==,iv:DLdp9zy7/MiqkwCLYyi+begQb7yhWfFwxvQRd8RoIa8=,tag:MvGtYEKDuJb6y+QQRF6DKw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:EiFpgjEyJeLk4KB1S9sp40X+qDXDmaaa4Ou7,iv:zmC39/BiZ5kHMUkIOGdx7TxZ0vMOquIL8i1LJa6HjW4=,tag:Crsuzxhbkyl+s9VdY7rnwg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:jK5ryBl9RumS,iv:6YwXivt/xDoDgcxvJKrd8ZdGdP2qC2S82n/N8cfBY34=,tag:OuQBsuLtyqufbevh14PNIA==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:7LPqoQXGLE3KkiGVIcgl+zI6Ej5Gdfu1uyX6yTmcP/KhkGFbmMZ+pHjE+1Slzdd22t2vSUZn/KdVYRcNz+rb4n7m/R8qkVwELoQw0ccaZ/kwQiP0mSKijN9+VEnYuJCfnzbBkmOZ3NoIevBehly/XVN+U3btNzH5uTZbhVMDK2VlcVOJow5sMHczAnF441F+idiizffoEDMg9tzSie3bpNCOgD5KJTEJEhekQ9XBQmlhIYtKOl6wKWGsdAJtFWf9NeKHeUW98u3MnER8qlZACY0DHeJJ5w/93q08z1WQuSQSfE7u1AoLpyaVhxbkHzCrw77nvqs4PrXvIvPdQUu154IhjFo5kzFVVDUWWz0uSCQCV2MhVlFhYnycHQ==,iv:ji6gBL/ShLsRtbfSg0AThA0ADmB5BG2qRgjtIfgrYcQ=,tag:35FrH11ezt0v9ecUYqZ8ZA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Fw==,iv:N1z9A79kGiz1tWPkPQHYGAET86w3Smx0v27Ut8CDPLc=,tag:qF9Bnmp6eyaP8m5NU6gBLA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:1iVArelz1tKhUt0KMFerJqM=,iv:yTP+kiZEk4PBgEnPwEuLafmTDYAXX+StttzU15eD1dI=,tag:sxJ3Qw3OG8uVh3DsSdW0dQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:ogqKW5OnhalF,iv:RMOaNPhoWBdthA57dT7Duo/H3Rh4IflJPaKtpJ9EqSM=,tag:50GLK9PaaQTzt05OkHcvlw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:d91zAcLArk+h,iv:JLvHWJzjV7uBsHpQ55WPnZjbuTuDVMuRk35QxMmSRM4=,tag:YgQFed9d/DE1IX8RWMew9g==,type:str]",
"uid": "ENC[AES256_GCM,data:Vri8Wa0BXhlzIbWjKqgYJCJg70DzXldrH2lx4gO3NtTMwaBs,iv:ENLTsqbPn7HEaqfliMjPe3SmRH0zMmx1/ygCWscMhKE=,tag:TnPks2s25pKNNf4mtXb4tw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:kaKJdsnm3A==,iv:g35NERo8jLTGoi71bGQ9NltconWb7Mk0ZNQ6tv52CfQ=,tag:bU+KU0l/AQy+4ePIQLudQg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:aPRivIkIm+wOHLle/hvbM6DlcQWxRuih9Q==,iv:/QQ8tR7s9YCNNtPso8De1KPdxoSkFYQUuLAL59pSX34=,tag:63TbJZZ5ESQgl9qaEnG4+g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:snaugzgwXJ28gbsFAKeBgFyWZUKuueIyqCIuka9DjY+I7CcSNg==,iv:J64iWUlJmOzU2APdVca0CHvHMsKJn8kFBlIUOu2RgHs=,tag:3ho7jiIWEMTGFehCROCviQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:y9cfTg==,iv:g0Cw1y4gFPkbrA3Psr2AFvSjAEEcKgsYkKbGJpqaOlM=,tag:/EMJDsLlOaf+O5rdZfWrkA==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:pZaXDJ6ASLXYmpBQbPEddWHoQqvsuys=,iv:ISWisZz6+ClAZduhA2iMe8AfF5Kplo0p+3bVa3+v9Fg=,tag:p2aPFdiCork3JAKsWPeIzQ==,type:str]",
"path_type": "ENC[AES256_GCM,data:qgoFUjYyrlNsnWlpfyGkZPdjvY8bAQ==,iv:Pc04BQrEStlTEpd3uIzMAwoyxj+FS+fI+ehbXOQolLs=,tag:OkmUHBRSEIZtQ4+sXLlpgw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:GiSJyoz2AY5BpB/NnvsoP3DLVOXfv8+fZA==,iv:aCcXN+AFLdYhQEbHeFviWWJKY0Nt7IKGHmnysCq6Wn8=,tag:sRgdUvjlLaVbZdlRNES1Ow==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:FgOxGPdZhZe7lA==,iv:4b6wlaJxpL+bDrpfuu2ckR5mFcJgefXlSbUXs15G6aI=,tag:Is+ywjx1CQa1ScJCIFZFQw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:nTSO1Qet6rXLQRs=,iv:90cPUll1oa80g1NiQFX3tlu8a9OHCK/nc0puhE92BKI=,tag://G7LW4Ylf483HQJ+Emo0Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:NLMb9EdG3TmSqFHcd5KKSIg2+3S4MiUUpWK2TA1MOi255NCKvXQU8JTYZjrFrMgFiMc4OgEFtfuTDqoSHHpwrBblBKFMKs01V/+lbnPZC+GQ+1wATgTjCfUhDmXlkr882wwYeZtTHX/wsmkkPaQ7CpOC52+nu0Fs,iv:dOhZwkHhrLuA2x0bqLmtnblzHoarQCcResW/0UyW7MU=,tag:Py9GT8z1qx2z/sPP92LJlA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:x9emcM06rJmm1jhvHcIz2/Vlh7TZ97ZQSOA7NlKuMdzLuyA+IwmHF+pEOO5ghog=,iv:J5ySsmTiSOOyh80tXKqtM6tHF5OdIaI/W21+zmqTy3c=,tag:HzJhlGvgoZ21yNp8p1uQNA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:tG0QCzZNTPtFagPSZMIABL8uvXtxbwrJPZwySw/LngDlbw==,iv:zoBP8X8fFoupUCJUqqa9w5QBo/1G8IxCV/FXGD/3S/c=,tag:h34p40uObhUmrNwVTuLeIg==,type:str]",
"mode": "ENC[AES256_GCM,data:D8Nb+pSZIg==,iv:tx5CAY0wJ24lXnVGgGx5+MWIIkONHUmEdxIZRmZGfl0=,tag:vKGanSg2oibRmoaJXPAxkQ==,type:str]",
"type": "ENC[AES256_GCM,data:gWOicdRzZi6NfAehIFn+wes=,iv:qly6We/YdvP4UXIq3I8dxA7l+BJyv/1SJK0r/2xAyLg=,tag:TrLoUCx2fekKXlWfhuxrWg==,type:str]",
"name": "ENC[AES256_GCM,data:zB7SiT7BGcv0sQ==,iv:/cOQFaHWgl/NdM3ADSrwWeQJgyafVA0hucplZdBq3tc=,tag:nH4tzQHRQ7GR0/iZpO6c6Q==,type:str]",
"provider": "ENC[AES256_GCM,data:yTN0QxAU+m6+O25MVkxMxu/O8TxUd1IXlgfqpkDwa8JxYMTXrPk+BVersMnga4BboOJpLbat,iv:TAmnV6tsHJBDyRiqSQQ840sm4EmZQn7qeZwQ5nfuvIw=,tag:C8wuGum4RB8lVYCZ16tAJw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:VQ==,iv:T/lL9eC3WYiz2R16nn/9RhtjKsROfMgpfdIGP72jjQ0=,tag:zz5SfGYFSPWI68+H8iAStw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tls.crt": "ENC[AES256_GCM,data:HabQ/UbK5C6fGgtPeSwGZXqKmRu2llaLzDXedkAoHo1JwrWqE7REI2AXHU83FCi9YT/b3aknF3+kbNPgdErKPa6utmYI2Wq1lQhOvmNE/JcvtPepzUKyP7nHQu6h4jnJQR4N1nGP0KMGzDBRbxj3MNtQZrjLOJlgbLa/O5IFM+6i7aAlW1ZiD4Hp8BCzq31MkWrqWqrv/KtFYuvqDPEmegARAF342IKop12+y4i1KUnKcgUh3dp2lcbUd84mLHud120d5dCQGEY1uFz7CbW5/5BdM1C+/e6uwXma4PIhDTHhx8ldhaQ9hZrL2Nvy7V+wNToAnNwZpWvF8QtbKK/p2v3K8hC5bq8dTgSaDW7QsHQGAFrNr4ObhnORr/80Oyh9f6H8KaSnEm7tWB0jxja0PgtrtYzVxX3wB5wztizIn0k636Q6JoV7u6yvJUyvnjvRvdf1aMITszjORi3LRiSYlH7m9pknRpr6Ff04HbQ5TDZU0ckpKF/Z4HP9c0L6on2kgH6YYqHgqnbvou+ww2kaDM8YuNZgcEx2HcsGHM2173ediVN6m2e0gAQqAyucGiTJi4BFHksOE9AwaCc6uU99PzM6zjr1jrxGZvYE16rUeZ/jbFHvJS+TD8nMzMazhjZ/4S303gh6rzSTk1vryfaYdo+o/r5fw/CbNHUThsWtMwGUMHsxQXpHZIdz0bTxpHMCZvWrCvsCahy2SWTG5OoJ5441kkYvSATuHz7sg2TvC4ic3kJS2s+VEUg8+7tdm/Y5JEjF3azEdfFDCdR342JTyw5C4iKYcPiX6kInbHkAY5CiiLwb/hiT8nQVkDtViVNe8r+HypVTsOsupwKkO9GQMShN2A+uN71V2wzg+dLFo6lDqcWFSG8vfxCEQsrv7QYb8fX27ao1Y3HTH+zLMdzR976o1zqNaFM7WyrrC5r0oxS559F9zvnPYFGO0RcntdW375lwjT75u/WW2f47ozPxXkQbIJZjtW2wsl6yS3WWN9LF0/vxwsqVRsc23O0N/E4PCVYC7WkcgNjPvEK17J1XZL33g9n8v43gpLRaZoquRjdF8UuAsgUWeu24DDj+cHOdSZHso5nqusXZWjj8cI7ESipc72gdUNnPCa+VreA5oBQv9cwcY22gxRnp1qP9du5S8CQb5URSaFjiis778YRl0Y3zXAnnN6yq7ww19HN3Pc6OS5GkBtIASFkCBPwpmYP2YepASTTXsgn43RB9fokygH1qGiQxp5nJV2Xwjd42yjtE04IMkP7k1yRiRYDZPIaBk7+F7AJFEzSiQvah3RsbJs9SnGt3VhaaX+cCVHmbh/qhoEMnOLJkNap7c7IrFfL07rBYcFATP8ryA360irYaO29gNhQtwCw1zdIfQb0nrPz0OtdXAPF1okZVsnXLOVMxSR3CsWJJ2pI7DJJYn9gdEZqz/WMsSncmveVLBrtyVf06tzZDdnZSbskxvYna1+h0SxoE6goO6rZMRBImYx618rPWpvysCSzWnJpRgb4WjBDEEP1b6/GgW1oXUAxw4SDFjF/wyOUtDdrZUk7wwGgGl1VUY+TrTc9IuoGTEoEuiS/7STBdtEKEpPHtFBFQ0uNxnsz5re42IzHQrHMqGKS5161khQyv3vyKJFdl28K4CTO+QnyfcIdUc8Q5duPPoRRDtKgLuuBonxqAAaq6CLIZM40kt2SYkLC2DO7zfhnkGUbzA6keYhwF2rLuQcnOnWIdeJWpGzqwtS8mwb81xueXWgcOb3HnZ2KIFPynQn5UFO7Vn+Bw3plMzILSYkE85SPPwJRUoiNsoMzqTxUNhYG+i8BPADD0o3ucq3b/srjn6GZ/yM/fcRFkb7afCphcR1xr/CVm2nGmzSLvtz34ZFL9HD/PuQEg/JYzfG5olC2+Lx2tr8oefWReAKYJm1oVSkqusuTok7+TKSGBTwF6Puq7e4GcZyU9oyMRGmvpmvMb9R3TDjxA9MhOqF8p+qlY4tc88wcUH8DkOzJo/0rAjyJSONSKUJl4HrhvZ36ICuwSFAlTNt2er6IDYoy918BNN/7Ps3w5vWom5D//8YjwvKNnjsOeATGLO3FxHax7LM/nEiUMUDGK5coQVMPQNgndhQdsS4rXtOY3IKpGAj+eF0w7K2z5obDqTxubwnkI5ownDS/GY/756Be9eeviZb0e5KMUwou766lQ5iLpbXnDtDaPNB319GNFpeR6QF/D1dsFNg11KjJ2Pkp9zW5H+29ZVdWCiv0Ae4uxnGooy0kgScCrSkAG4J7O22GcUYNnSERuX7ZgBOiELWpo5ZTI/gEkk2f1DW9Difvc64Y50UY0nITNx31PMN5qxMqY4KBMQNvsKqOXAJ37hMbtOps/bRSRlSj7N+U3f7CzP6QvF2Mly4l6afln1U+m/+1KtzlffC8+cdGyJqEUjer3h6RR+/YtOzJ2EJyhCByHe5lO3XuCy2M3ALHEMH0e7lpPiL9CWumFbM2248FdtwQgF5wkZtQQWFXe0odSzNnSm+SAQdfsr112Y9sZ4o7niyjLBw+pOHU0sw3gD8ZnzDJUbtnvFIoUTYjG62ZewtOA9oYZFlBVyZn6KTgIkGyJynQ9sXFeXMihOHUv5iO0JfUAfz84cPZO9ipg3sp7IyYkku5bKCY3rj8p6duQl5W9sT4CeR882vSfLD56Ns9jblgohmp29OdWsZvUE3pnRboH0vRiXtPBO6eQ2t1fZRdsRGk7YKJKYxgjz8M2WoYFhMPvcVBWo8yQkirdAp7/iJiJHE0m985imifkWkY0+C0whjav6ul9Hjf1M78uyD0pvofJlkNriW51T7EyqyKNXBGiIiEiaUAIHaW27nmd/DydsJyWCZ+dwvptbX5Q3bmvP9MzHrbX338dwk+Bs9Lgsx5yOPWfAYkAS+PsWErwwrrRTiVbsDbVKCb20pN6t8EF7ITuHgwFdB2kmW+Irjs3hzg4YTOnZYe5AlodG/pTkMOaiJW1/NmZKOArsozxJcv/cmGJP8SGnt+VDpdTGpZDveUgeAW8TusPaXUXXOS8/TW+6Y2in6p8j8bBwHs22pBui2lgA42+YTR5iNLQXOPYt+a+AiBLCDl8saltMKQJ6urkYUn0Nkw6foWjvJZ9WohDGPvN0BH+nnVjSJDoOEvEqpLMWqGCF/Zel79rhuI4HIFx/oWGnMNQRndu1bNLsutmcu6NCBKggNiMOtcmhgWmj2nyzyeoK4Fq6i1lXvhWP/y+4wVRjT4J3dA+YI6CHGkb959rm7H8PU0YCuNtSE4F0SJTTIvvs1gDMwd/rXtrTPzC+ktsPvpRsG5ttbo9lyIoIywF1MjTna9ZkxU/Hwko4lYrc7kBMx03sh+q/1JSI85i/VH1+11298Veo9OmiUyr/Nu7M+Lvx/e6FRaMwzJES/pGMvs/8ebcqstY6GNfH0kZF1w3rmAvO/jOE55PXPJH4AWgknUOD5Yyx8lGWTU7wjLMMM1kpk/ItDNxXswrVj4paGdJLrszdYZcV7/y6V3xtKL71mIW5h9QzfRHY0E2UIDjWvtJFATU0sRHooP7L5qGnI10VJhXAj8oqvABrpdmoNxAaTNeUTPjyxSF9jVtGS2Ckh8FJDscuyBdkLWeIcHoasQr/33asnY45OZmjf+6SYU0WnYfjmBhRBVSvgmIG9xoqD/O4wH+JqSv5GVwbExlCk3lr/8vSBwg5ZFqASBoHnsajIdf2YIEj8EMweKvu93DzRupUM6xxKqIZTHE6jAJaibiXa+0n1HouqVE70I1oJPxeCzwbQRr1wPwK44PiMwfsZ+XB5vQvhSFs1P5yhmlSYb2aPHGaKhCRBYK0KGl,iv:QGUFLTr2Bz9Ku3fjfg00TQEFJWI8mNvPfrw5UqF8p/M=,tag:na3vZ5wAWr/7a0ecOliBTQ==,type:str]",
"tls.key": "ENC[AES256_GCM,data:6zK+klzkRIoAqwUiMd9vZS7YFBGDctPok0g8IPef2SigMqc6z29l9ICJL5gptOaeGGs3FVOXfXhefMFA1zAKekBlQ4FNxiqH23px96HiX8sntxEgmx990tpruVb1by/kJUjtEmOa3SfM04EHmUOtjCO7ZXedMOhvh7agbjUkgmcoCWalyBTaDFpIW0TCZgCeefyPTZu8rdk877jsAwXaqvLOfgrUKt39kJHfZYnzEkdZNkBsm9b6eV373gu9m2m5riiuK6yCNC3baOh0XO968MV86i098Q0m+nldH0d2TqatoB5G1ppwbA6LB/1Zt4p5Gw==,iv:VwXnfC4H0Yutz0F0iye0cvUZwfOibZTFKXTa0NDvfw0=,tag:YGlnCFjRRtMTMNIz3NlT6g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:PfsobDSkzg8OnkEXwZltoRqns/M=,iv:HRGzDDZyDBRB/kBArm4UQOEskVW7PuRih+393Rvz8ds=,tag:PfvOjWOXdT/Qi0++SB8BXw==,type:str]",
"immutable": "ENC[AES256_GCM,data:koJfHVc=,iv:DZK4fAeWRdbB05ByG5yP0d115fs0Y7AkQhCXuZ+TQKY=,tag:6gGwcjsgP8ED3cMo5Sdc3A==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:tg==,iv:1VHupPqMmeVtlWwtLGmayoGtjEDhtxU6LNd1zKEpsRc=,tag:di8UjNJT4fXvum1gjGR07g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:I9JQqYvJpM2MTA==,iv:CbfD2X+bKSUHgIENqTT3gRUJWiRd5tNm5EQkCQM0Y5c=,tag:O/CAFcvlaD2kr69zZBK+hA==,type:str]",
"namespace": "ENC[AES256_GCM,data:10U1PhO91R2j,iv:FreUKP9yL/wQPAm0W0EtZ6H1j/PKRQNMCx4MkHVDa7s=,tag:dHrzh3BYfsxJiPaEYDOLVQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:fKZ12mLhLcwp,iv:zulg2VaHJimQIIjFGGLjYDGlz8tqENjvzlaaZcrOmjk=,tag:hlyIct9QYG/lotFhHwp7Tw==,type:str]",
"uid": "ENC[AES256_GCM,data:uKJhJ3Sgae3tTYM0TJTwR3iqdNKaXT+zSQS1l+jHVIclcmOA,iv:r3xcxfMUNn+UZcS3kIK1fLvOJyhxz1WhbYyr4ZsuOks=,tag:dhxbi2IbtSig/UdFnwCYmQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:uFVmxrBbaHe62ga9x8PWgf4=,iv:tt+G3QqdRls0OJopXHfczzUR73BtSfZtw9nKF8S6Vu4=,tag:B6Zl0Tlsyz2vuOlwCaneTw==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:1dJ14Q==,iv:2XJpwknluI7kuZHxfFEI+x1JqUCrezREYBk3GAE7ud8=,tag:1XuwGonvaX/wDQoJIPilBw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:DW1vIwSuwt9QyYlRMTaZqgFr76QfxybbiL7dG8QoIyTuDpLOVWUmTHhVmZ1gR7vUzShPx76vQ0uTf8sw+UgT8d7xGVYcxYGVzmCdXlOZwMkXMo/u,iv:zB0Dq1vkR+4D7YOh0GNmACViS9vdP1K7ygHfA4liaJA=,tag:WKnbE9p6IWuAsfyrYXKWxA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:SMoEOvlUwLQCFXhWou6W1cKA1oVliWx/94EqFZbG4hDTKFGCO6VWIlgrl5Z1qoE=,iv:aEaztb18RYFXmw1l/LkuvSOMjacu+Nq4FfE7loWxR/c=,tag:QQLLH9VcOmBoes0CT7n2Ig==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key_name": "sops-state-authentik",
"created_at": "2026-03-17T23:05:43Z",
"enc": "vault:v1:t40SPqopRts9JWVIzbfuSahiUXg3qXHUzJwgIYwZbRJuQr0R+J+d5uQPFYYFJPrgHdr8USmBrdJ4kBnT"
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoUk4wTmpuMXNwMkthWDV2\nUFNNNis3cEtBckxkcU40ckozRjVuV0FTalE4CjVxb29RcU9YSmhTOFVPS3BwK3Nr\nR3k2dE9QeldrY0R5dGxHSjFGZzJyQ0kKLS0tIG5PcEhFMkIrNTdWV2xvbXRsZmQ2\nNjZGUTNXdVYzWUdIVzZ0ZzVVUTlabmsKu7rACec+nlOH3BeqHfGIkxWlLUAOhEIq\n9rJ0/FEpqBFPgw0VY1zvHP33WwcwQXvJQo0on6ZTrLCl0ewk2itU7w==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1enc2b3EyMEYrYWYvVC9L\nOXM2QUIzb2R1cXFXcGQ2SkF4dzVlcFNQakc4CmZSamFacGt3NWZKVFNwNHdZMWNi\nQmxuL1UzWjg4cWFoaW9LREo5VS9McncKLS0tIHVhVmlJMDBScnRFRGFQeUg0ZU9m\nTXE2TUdpckRvSy8rdE43ZWtXWDZhRzQKgKoo7DPEvxyyqYq0PZFdxiTDn096JU+M\nKEtQow3hfMC6Kdq6vr417PQJch2sVAbdMa7kRrViHhRnqqjwSvkscg==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lastmodified": "2026-03-17T23:05:44Z",
"mac": "ENC[AES256_GCM,data:uY7UGczfrwtM6cVJ8Ss5xlphMAwaPh8bNwtZ/k81zGopUhPOLbuVhuMon5yKMYoGupr9jTZObioR2qwdQ5lo86H639huJPUz02sN6YpIFA1afQZY+VHeBvevQT2Z5SKAjdGxsAzW3UIhglcishFYUD5qO8926XunB4sDLugrAYg=,iv:tXzssYKUrDwR+WEdaLVELNbW3J+EPUwb+2UvwUMWGNQ=,tag:eL9AscbmMX0AcVppjuFiEw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink