viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/state/stacks/headscale/terraform.tfstate.enc

1189 lines
183 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"version": "ENC[AES256_GCM,data:WQ==,iv:sJ6vXN3HPoao1bFSaAyhoLSbZzXSeA1V0GIFSPy2zMQ=,tag:wDX5rRVfBHk+SdrL5ZUCuQ==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:utpDbQg=,iv:Qar0YZvUndaLQqNFe11GP0Eatmt49eYb7NupTsfx7O8=,tag:PX9wUOt9nQc0ccMlex4mGg==,type:str]",
"serial": "ENC[AES256_GCM,data:TA==,iv:bGUosBq/CG0tVJX26ln5+ZBYNjXzMC2SI2wOs1f2vzI=,tag:zAzRPw7eyiMwBRvMlBvRFA==,type:float]",
"lineage": "ENC[AES256_GCM,data:/5dfnntWeEm2QVXeYaWHOgDtNha6umKauQXmeZhXLPexs89w,iv:qBtNmSglA3ol6++MuDnAbE1Tr1K7h/wsoqGWpPa6+zA=,tag:CP9Mj38VTXw9kuTPeKEQDg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:ppDOSQ==,iv:r27TgFeAt4/0dYxDPRBgg3NTr04cH0ySsJLXSccjJkU=,tag:DPDFbpKPxO945B6oSJrCHQ==,type:str]",
"type": "ENC[AES256_GCM,data:gKytwKlCVL3gLrSjMw2ScyvR,iv:qd5YQX55HkIo0xNQt2G8liypxELLGwaev45gX77y+c0=,tag:S9KnOvOQYHcEaKVOJFOC3w==,type:str]",
"name": "ENC[AES256_GCM,data:m9QAqBSFaA==,iv:9AgXGp2xNqKV+vjhjXWXp/7YxMRyLyaipgGUV+HEdW8=,tag:4SM+3PvIo0zyjNgZEfWbhQ==,type:str]",
"provider": "ENC[AES256_GCM,data:+zNOK1VS7MxzIWasoHG/9p90MzYid/ny4n1X7OB7g4lPPiV5/qdIil2DcNlkzN4mFg==,iv:3x+Xh7tnamBRjbVG4sUR+BffGe48Vpo12JLnzycxWy8=,tag:Rd3kxsc95Q+qg/Yd0ym9uA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:2g==,iv:EKTLnl8R4C58O424/3GiqwQdDph0qvc9XuSNvHIvpkA=,tag:BvC+IoE0MTZ8TGP64DNULA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"created_time": "ENC[AES256_GCM,data:bQ0bhWo0QSqvhALM1A6/NhufPqT0gt86/5vKVcBd,iv:JJ794X9I01dbrIoTcx9Xxu9Kk3etfkDGJmOSq9wOFWA=,tag:SfZhLu7P5CMgP1amfqAqjQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:lcbym8t6680cEDsM0KWk1S1fM8M=,iv:grgS4emQ45OqHgcrdMuv1ra5fRpbL/+C7c+39DsTe+Q=,tag:YvCtit/ons2iFht2R1ooOg==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:y32NNSr68Dd4SHFBQGPZuMroNAHCMPw6e9xhhD2GlvSQmcjbBA6+H7R+e5QUB6iiOC+mJq3lT+FI3JxUnjh8cOjSWr4j2RWK2f9Rpw7U3T49,iv:24comCxuGmGIN7oxFV+0GHpAiA36QVUbUqn7b2iwEyw=,tag:wFoI85JWOHoO3AO8U6PSjA==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:bFZWaDGiIiZQbU9B5lpxI+OMbqro3qrsvZJ0fD/Ult90j3smDsOn3lp3ABJ/W9JUjnV/bm0Dupkc9a50pMTgIALv,iv:BEfxC+KZx8XXLj9/oMTtX46xu/vTAZoe0uqd4ikTZCE=,tag:hezX+M7LpNM5bIMMkwt42Q==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:lEpFc7yXW3o2p8XiLgIRow==,iv:3ytFnKdEgZHiqCevDg1vDZdGOszpz7sHwlTDCG9EW08=,tag:urFFRnaf4Ow/J6RTahd8Cg==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:ppLXazRCbkre/8/84TyTnDkLcuZIKk5QkwXk61hb2VTALUqeiiQWjD+7q8eUtpZCjCSi,iv:uZ+3m4/AgwJe3s/uRNVm2m0D5ev7e9/FScI69dsLULQ=,tag:7Fi32gfi6Yzs6OHNNJCT4Q==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:kuPqPwVBNFnQ/jiqsJ+ez4Fh0XGzh4ZAipPruSGsYaWbxxPTsw==,iv:BjPnktiRaxCcmRvx3dUomIVPHV5thkEOY59rbSWmj6I=,tag:MseS8NDKBy5d5mqwLA67YA==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:3rxYXFh8FJeezxD/a8XjslxEnPgfBmLMITFho6r+Ze48crCvG9AkqftutcqijoUGy7Fakzeue8fozo4V4pU7EOkXdsh4D37xEhWL90b1qVkufdPUyXol/crN84xIeVeqhFbKQ2Uwb6UO31c99IrDMUbKvLzkLYd56NO6hMafFejgT4ga8prEKBTgePaWJJZTX+5qbcAY/gkR9ROU4cQLbFTnQfUKdaqg+s2+LQOVUEeOCBF3DrajXQ==,iv:JWV1+yj27dfXEXkWztqmuPz4MHxKwmf07cauikgMwNo=,tag:1oFh5+DiJvnltilKNmIu8A==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:x8O/Lxy5KuGf4wKrrL1DE3Q2adcEqndHq/FRbnm0ZEb4DN4Xjv8LdLeUyg==,iv:upFVvTa0Fso06B14MNCTyLV8lvMIEFqoVIrqJPtYAn0=,tag:bN/KUdmFor0tmG5ASh7L9g==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:d5aBsp7fW+Kc76PgqTw6V0A88vHvzce8m+yw1V4=,iv:yjOappTKFpL50H+U3t9NxIYIAd1O9vDDptm3rVa2qqU=,tag:cyzpskkNipfhokXMi2N7Jg==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:gOltkyuOtyW+Nl3fYFvBLUpgRnQM3McWIdIZAkFQL+idiGki4plj0Nve5g/BMPOr8+wqd7IOIXX5Vlt2zZ2h7A==,iv:Xnt442vkPqfQRbTU/CPjSuCHjclRrRxvt3SmpXDGC58=,tag:d3M6T4wJwTW3Vp5znlop4w==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:dhTDTnih2XkFDqa2mmE=,iv:BuiuoDyB0BHvAZhzb+JljRI4PGmKjIZhR8GJ1MBk/Sg=,tag:mL5Ys4sK4ZP8BeSI6M6FXA==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:f/OBom8j/PyjGbB8DKLiMOJn+OT0j9FMAw==,iv:t3k734IYMnrRifZ+2paFguXgeAS9gT3gnFt/U61DX9M=,tag:+P0r/HcpzVqVQWAufW5yMw==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:jHE0qLUdHTsLBq5O7l16FZLsGD9etuZj8xZB0atXH/k=,iv:nSTevDSUoN7q3kuddppQCSaGtgNxl4FDNctVv8A0tm0=,tag:/j5czBR1x/c1D3vD42Leeg==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:anc9wUUfuC6c5rKl1c0L8PX/DTopvWMKo8Y=,iv:SwmmNTWEtgjeNjgicC3LbJ3VXdrX8ioSFAfGd2M7TLA=,tag:gdPg5k56mmRhQUGgg4lVvQ==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:krXYSsYaKt61qfskIo9X4Rus9eixanAF/h59DQ==,iv:JzoiFloNGynRhhbywLw1MLNOc/w3VzXbwrFRvUFl82E=,tag:8CXPyi7aHVMkx5U3jOYOmA==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:/3WVL0QWCtFm3paQD21hAkENO4g=,iv:cZYN0HIQlqHf4uv9BlCcpUDn6vBmnDs+DIng62B3zCc=,tag:wQ4n/xVl+rtpDAp1RpvSow==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:4kkx7uYxMBQfyMwD381hnntVjZGj,iv:AyT5cU+2fA9OZPfvPC4dtpT9nLHLCYSNP7DrQUdkB9A=,tag:W38hdEQ+GhSe6FA837TNLw==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:vaYeReMcVO9YDf9xVUNGrdvwlpVQ6Pr8X9f58LUlCuVqOcz2g/+YDIHVkmwyDY+CgonPKt4zpissHWQTDX4w3VfTMR45HJ4hMcW9bl6wH5B8eZB71d/J+kQAgiHO7liAdsrPkdQ8/rsdqgbQ5fK+B/uWLdVObT1V2iMymz1tcgfGcjcmtnWPsFgBYtxPgGfTaUxsNb6i7cucvsD/oyxTHniad+kF7YZHgwvQUTYJtaMHvHhmz6YL,iv:Wk6CBBbYKet7oW3Gm84SUIQKhMDwRPQljghhOC7myaw=,tag:iXCxSWtWF5s0DnPKkEDc5g==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:kBglyQi7Dm4BBC/yxG+piM3bXP7mOod0sykmhiGjwyiMRzBP5h2PSLxpCPsF7iR/bDmSwGLUk5O7w61DoQgWceTkCAqXL12V4NmaXERGEFtHoYgHBiSMR0tBrvLCuuX6kjqURluoGnBfu5KO6EDss8Hx1316RuiJLPAjUA8X/MhcSTlMYDqfUBSTy01+q9Y8i0eYbVPUNJ56V6eORw6zFhfU99IGJZ3FY0SDCtg3//Zzi5FkEa5h52vl0DSS7Pxu0daNDbqHEAPOlG8RYDbN5e8NBX3pquH/1MVpR82hxjBz+E/SQm98g2NzMUxaV1HtES8cjkqQesqFHAfo1JNgtwtdgZIhv1GvPR3XPMilyMXc1Gh98VnKnRhiRLQRRlH6XViuhFl5TBW8G6V73noGBKraTCkJNvetPQkuTGI9TeUHwo2qQ614qj/aGbH2jehKqVkeHgRHjBCYlzYFhQ0caCAIh/Q5FPHQoMcGZyJDiwCKZQ/PVTUTxbbqQgoo9VWAoylV5/QrCzQ3dSC7FG4F5EYO+HMyTK/pbkadSsLRY1ARxkfTNWrfgeSLfg3o4Ba+wDAzSvW90qySQao3/3CAs6M/e2qi9QuEsF6ua7ZweauAcUW3061gEGi5qf1lnf+BMrhcV2ra4UlXfgERr3mEvRapcGLoUDAUoQAyT1zFNDfYuVpWwQosI8kSuw+dWUC6HAv19wab2ALqWii94fRNf3fS4r7J9D17cw+yBB5ervFOHNmrPjJDO663as7FQUtojUafzgfp5lIGsHUjDbxs5VIV5JmMG4WZzSygtGP6XSkZa9x3UCcMvyvYGU5T+AMpXmL54xKI6oiILPm+ryasmh0uuNyzYCjYDma8t6ubGeVmRDlSYi15/TdTipqihch1Ksaj1CGas9E3uDAdwy98VYsw6g5xh3wY6vhppmtpO4ui1h6YseGsEDZbm69S2WH8qhUgPDsD0W1wFxd9jg2slcn9putviPHjhcX6O1pe8BGLkWDTROfp39Eeb5brjVc1vKuV6e5qPq+e4A3sG/TXoemo8IJHJBE9qEcfLYgoptxJ/auXt4HcdROF2bSLhmprSdSJBGHDSHlgifBxKaz54NgJk5hzSQvp8/gM1EBNNHMJJ52N+1+mlBEZ1Vp7JW/ygA8qrF7+/B4MZGEITCKeDmjWrHgboRYQAcKbL8r8YokfRLJsk9x9wDWudkulrq4MBAp8fz1K/UTgyVa4aLD2qNJCIIpjNvnfwdqWaSo2sW/iIO/2F8m4qrM1t99LuFk8YcaGTFyGfXJjysKQWbVPGYjt3bBkhxjVKAnVythtNWmLXS4cRH0FJgeudFGWivlwwSkysN35Z6JEu2suS3PciDgweo1/MHr1Ba+/woFM1hFvo9EFkcAiKqWcrGUtMLPpI2ICvc3qz3eAV7wyjBhBzCURgDYkOitIvLhcL34SpvwWJMI2iqvrpGdfXFRH6F0sa+bFFv7xswtj0T3JQL99HiOaqrMrQ2G1aTGSOO7S/PBrBSjyd4smt3X6c+N5IzuyLtrDngmP8SKqFfz58Ec1dijYKECi5JUT3APK6pCuA7OapgLpqpSGJ58/45MYUhwMqrHDcinC/ANNnsQ8t201lD+Von4ABJnzov524v0098WdXvchdRHCgm6kibT/E+lXFiUzMD4nNcLCgUSYvs/3yN35gup9xkmupemi4G1FmCto//fXcyaF4MQMMlJS0Nkc926pDpQSOMRhPrCRtbiKzwgT9p67UFoXcjDvF8EM4D3hPYpMydyyC23Iw1B+xd4FgQvtieoxk+pmnuYAGmIrEcSuJi/RjiDILbiH/iFnHfLL2k5eajImodU9zO38xC2LqXB+k7gEkhFS5UYQnJ8O+NWgkXt9CfaHoJhmxZ+ONTnsAfY0/cl8z7UaLyP48B4lgRT9aOQ+PfBwfsoElpY8NfhHpZkmq2KCUoy2U7+2RkDE3okrva3AOHHjUS9Mu/jJVFHkKXifMkex50jfRR5vxDJ9l5/cTzBzFHk3SksfpSiEfs8nl8vVV5uTmoMb74wuv49sdFy/PiFz987Ys9uPCcyDpNoSr/GHVuMp94mI/0X7qh/28Yw7yDCySYcObSivaxURyisGpQ6PSxE9q0a8VGuxPpt8kpbNJJDVJJ6VugeLhB6ZNQnh60xy3TpJg7XXbUzPyUijvRvjXAkSp3euARnimMhxQtr7KsCCGwvwcv0Vu9KlCJA02j0Q3bK3bm4dADNO2KbH3+stS54kblf9h51zIppP6ONmp94lR8MJPLpYY04Y+8nDL8jmItHsVDth78mLlz3j/RRxgy05rEjbOV79RQ7ATWe6Y1to8LqnbqVCFHIBwfS1fkubigMJ7xiZPDQbhktDwdI23OMj1fSRD9fcSdzTJSqQJtgqkHQLrQuFO/XDYHngohQ1PHxPYIdAHa31bY9JzWnQnjKEsLhNrXID+UJIN/hAv9oTJXYzlY8AlpsaepPMz4MJ5+g/s2uSdL3v81LAox2KbdGaVgB2yl+oeJWknFVFpQ4CZPR+lFtftqQH90E/yP2BVwdeStsjrXhwm9zN5uhn6mtlvWr/jH4SJXFlVvwsxd8X0Yh7N58YDuSbi5CpdxvPUCm96awYDt3K13Tpa/1OiKrZ4R0qo/qNjbJPMNpQTNWApcqWxDsJRpCj4cWE+2zEHBPW6eTtPX3LTd7Mpp/0YHLGjSYEGuSU5buODx2C+/TWUk2g9ZExWZdNmeR+eysv7VRQgilMJfoUzez4qCWEQmJBmDgFC9A43bMOx7Gxy6N23nfX8Fns4yJpnn77ZkzrbCX+vMX7b/1gxulaNqwKyCU4CorfU3QGeWgDAvzK13ovUxbYHeItmsb3HraN+foNrL7dQ3jW9ZHx6lHyWtcxXwOUJ/214JTAPam65UEoNedq3w69Yb2X1hfIwuGur9KfifZBA5gGK7Q5c6MpO5OEJtR2wMjbAEdExzMoHZf4kataV0P/84N6cV731Il13a7Zs+eYa2iXpWb8cDfrqMqYbwL3Xi6/XfFzYiESDOkKdNNnEoFHDckkjAd1DkFXRwg6b81vz781UpvIrluLjjwL2YRd1rE2Oog7xUR0giHwKz7EUZ3aFFYYMcBjT9yxoIJEY4Q0Yx/A5NDdc/aJsFKSitcdTZjlaxDVeA9n67qBII7e3ldtX8Wo3/wdq5+PGEWrFae6Hdfv5Vwe/vnImBWJQQG4mq/glbZjON4kXZrtlu/feSdYfTS6snljLcSvdNw8INKrJcjABan530VOX5+7G3kuuo832OIfxFiY54sUW4nAv8V1rMLD9VDLkU16DKMvV15jQMTzEruCdKDhciTX0LMUc0QvycMkvLXIBHOXCNBal1HKg+n+sxF3SxKWZg2eh6Mwj09a4nGJFBJc2EDZBLnyU2ieOow5G6x9hxSXBlSrBFH7i8U2vbq27cW5MTas50Rx40NLAwnT5qSVBYl4SjGhU1ymdFLpoN7xlJgZrhXgTlwDwclJkFxgslGwHIrLGibITvaVIWokKVjFjzA5BG0iu+NA8go/WyBRQhRFRcAYsxBzqNb3IECNsGHkGP9iz30WOxgDxkKDnb5fI+dZus+oIOiknpLrFEdIjF9iPqT4PUbO3fZXiw91Rfj5rAoPXj0D4kqKNPjhz1lcaraFx0bBrat1i0mCce1jGSZQMC9jfhAzwp8IzpuWaBKJPicE2YAjV9MCoKPEMs8UgaeXdcteCp08jBu2ejqB4KnoTgTegHa59X0OruTqcS8kE/yHmKjvRdpU+0CVbgAm9PC7XXewJPI54If/kolaQPnFaVk0PZ3O9ajVUqBxfc7GrYRs38ay6dBqHFaTu/p+5KIqBC2cvnx+iA13+9feZkIuK+T3LkEsFu8TF6/uClKFzTH7KPKCdU1G6JHA2ZMIuX1s7EsAK+SPW49BBzkLCo6DVwgQBrL4iCu6CQHVC7TZyY2+lKVmh3fWiBEbO7PJ6/LdkwyuP9AUOiL/AEF/CJdq6aM0pm6oXWJ1LQonzFs5o/I7GoNbNKwC5xv9i/xj78ke2YZCUH
"headscale_config": "ENC[AES256_GCM,data:tI9kpO7BcXjRPKV8uDJ6ldTHZXWIaoQ1RW3UOPdQQLxjTXwekcyhbTFWtEcuHvs94mJFFTMX2EWNXE6TNf4WfK9bzu+FtS3WhTGbV3Z14CgMcMl0JVAATyVn5RWv9zjEjaQN3U60ccOuSoqJUtFwzRR+OInkDQInGfPhxaIhtZu5p7zv+0hSGUf+Tbx1qyTGCO5mnCH30FIuDXXQXCWzPIX7yTCGgUVFj6W1lYV1QHW5sz9DQ2+lFA3rmMTrr0gDE68t3wmgydJQZoZiXyZSuwlcnqtcK5ce9ko5p0l19VOX92IwMS8Qm0ti3QVhqGrHrcyQTBLno0bOi0M1SyjAOidx43aYvdiNl2524RMPGXI7ld3Ne530M/EZf1Z8leOQXcIbCP5RjjkdTqgINVS60ouLn0xdBXolwOMfu9Ajo+AdPfuNS2XJhCUJ/kjxzEnNIQjE4vUiKCdaRktUUgXYvWQH8jsymddCA4Mxz0mca6XLcD3YbUVfB/fwOKA9NfwE9gq7H7oDMdFQI7qRk4xCjKawKWK4kGTBRX4TWNKmHC5llSMUCFZgruzBeC/9kvPQ3YjbVWCcgjUvp1DzAIBKZxEa8YpOosBPBxrAX3UaNFf/sF+vegA1KAmHVcTJrKWRXRmcctZrbHJX9iq/w/OrZhi3YKuvV3Lwofhadc4kDZLMFLOt6qVI6lIaLkqCrcsyFHwVG1RTXsjc15f+jFaKDi+5OYGCF4046d6LqpYzKzKDmtA4moAc+eS9EP8Sk8RGhYkH7DTLgkIJC96Dpo6+NI2F9wwo694eiyca94H3+dsXeEKv6pALJwKubu9W8xERouhCyy/EeRjcAa+iTLlhJ6kkR8NpyJ1D5DjvckpEpSM239EF4glXLlrLt9BdNV6wSV5WMXcgE/pMupzt8tj5b+B99JsBV5pR0AJlMLtOio3L8wrJggehQTCeI/m+CmR79pQB4EBJ5CZu+N8HfWk1E43Zm++DfQ2f/mi09tO6Tp2f9V3o/FdopLKV+n4kHv9XKZkQaL8/k6Q0/uSDLvBVfmb633WWJsluvI73UT4ByBcj9gi5mpM1rIu4bjwIrP3Npvk5ZZFCyp+o5UPvAx+gFER6qvXprDiY4cT9Y6VqattP7AbeGU2Hzve0cGpQ6eLTFuaVs8qANwaRXdfUmTXo6OuCnHcLLOtSVjd7TATgQi7dn8pOCMhNVkOvf5nTOPTyoGD9GOE3GShclnYFYH5Y9SioAQN4AcO9TwmronF+njAlTwbnR0LW62Gq+ADzlc7YrizT42baFSjkrj+xVPXzSdP18OYon4My407Q+hgOYBHA2Mz/4drwspvDcEu4ISx7GRJZ1A3zzxrJXurLNmpo7f2ZpdjrZCCONo12clg0WuJy5FahUV7+vd4HWMUPz8U6FBvxeRe+RUi/7+hkTh36/DxScwkse1qbhgVfNae8Dga2rq0fjC0fyYapIgdFoTrb4gqsFPO3QjL4CMY5LoHQzC3giWRB/h0LuNpwNr3I51NBoLf9VwfD6TIPawnI6Q5K6zXRNMZKR8qwNl7E7G+WAd+cmv/ty9fVCsHWTbxwVyyHZSCorR1MTA/hU3NcZauCGjxZ6QTXpjghtu6hIaUMIdvWiLMHsQcHVeDDdIJp1m3+wAF1sAxUxmoV9FCcoGr0h7NvPaNEp6blzVeeJFodi4O87i3ni1d8db5CFpi5VO3/yTd4HiOvEHWk16iDf9xgRZbXUlX7jHBwyHdXI8QUIs2bdcNh4O2jm6zLdEGwUd9tG6g+pSBhyPNs6wW9NGbePXQbjy736UTWgpOq2+E77Spznz5O11J/rfhvtthAZzeweafZSbr8XiOSzv83B0xySowJBPK+RXXUomcolirtKHRvuOyUc/kPK5l3pKEUiwc7I1IvnADzhOrh+EkqJ3+k9clOB/vFbdZN1InoZehXsluvFKRC3IHAYxfDtNJE0M+GOqQ54Z+O7CStP1aWIZ9IBGTsH7QLBqG39nnq764JaPYOBpHjsE1M9qm4YyAiqUz3ESAikr9BqHD1O31Uo5i5Kyp0SfccbQIbTDJjaCMeEfUC2V58HdANgPTiIl95XQVg/zBdcvzSoTGnCCBIDhwPT7lES9LhnC1FGJpkMpZyGWqpOeWs/ewaqXLrdDT9X6OjJ1kH6Hpi9mCVdJTDRpzfRdgORT6UsKu9cf4tdVkjMjkb8HrFF+VPYEUz4qGKd1GXsskalB/akCmV2NWMKSwainPIecfLHtJ/h6WOOhuD2lAD3I8VVC21cwm9j46gjzb/MR58mzwOVLsQnu9oHdAY7KH8ZZ5TKqyA92YBVAqjNyHjL+5z1BmamWsZ4kplrYAx2KURWK8Nl/yqVsYHnpMQdzm1k5RnNx0OeMlQlnM1wMHDpv/oR8q9Zfgc6+34ahHxtzlaQEd8Y3hlXUizDpVpS2A1MebMf6G3unWk2kC2w6F8Henb9YQdgI6fPbY+OZM6NbCAhKDDF2sUstxx/3iE+WYQsse1M32dFufl9dNg+rNapg0sWa28wSEgRRTP2yb5hXMnWu8VyklB5CMUxm2dWthx60sNPTNK9sXNCDEqWnkiV0TOI+G1LhDPSpTyfXOVBGnIpPHKDhNKVnpIMLE8oOsT4/18PL/sfY4iZNDYzHpHjb9m0q4iaa5UTT6L+S8qHYEXL1wDbh7yz9iH54REK4KwMMEWEIDb+TelnfLL82fSbcrmUcTe3KmbqYlOMThIn4YykR74HB4AGuAXTlZbD9L9P0u/zV7YkYFMj6/9n78PrVVloc5M7hjfEfWh7RtmMMOSgm5NM9zpr7B6QxWGYJ1NLkWoICxFuK9s6LpvlqtxQlhzA5Xv8r88CqD3cBQxku5HQ/w+OlCPRAfLlzZsL/m6MQW72E9KZ6Uw39aNAH/5+kLWzt27Hg877UNm2i+NZK1FnizCxvpN9v5louBTdqiER82MbjjzZS+/p6FXft3NtNe9EYgiR7y9bd1bzpdE7VkJujACYnxSiwhELJeo/BtjPlY2JFd2Jm9mahtIm3bDhBG3edvwYg6E/zqBxIq9SOHijPU5VYfrpKD3QYJfzd2BbgLXNRIr8GA3HOVbxbJyB7SESBWnyXBXo3ja+WJgFaPKIrL340CMFY4xICLO+5yNa5igZTWNc5vETZ+CPzpYif2iMN0OcNQB10yCCMJq8ydZpb4hhd/FOdWqvWr1lTHz8VeL77B7fTklFgns5JRKJwWbtSqpOsFNWGLJtYgpZ9tKMJS6Y39vfPb4AZOWZ/hygR/K49F2aPalq+1pfHEZl3Mi8vZkr+irrpeDcbrRVtpQ9vH1dTWv/Qq1MPJ3Jk0SfrgpATKm5JiLjVi8r+CPrbTKWK3nFMqti5ORd0kgKilPvtRcBxF3DegWBwdsWkZL6ocoZOirOGgXijFcOH6Frnldvf689DF/oDmI1cVVo5l/tk/W5I9POUvkBN09qlAZ91Os41TJycCJ2Q80WUqYpAjdpqMZTn5oIR1Z1T7JWNF8Y6hYtwCy3YcMqEdtw6/zbTQr6v/AXgkc1alYG4sGXhXIUHO7JOIVzKR0R2iA0Aen45+9T6lP5uycUXL7upygkcKaKGEjWFvYVi5bYiEh3suPc4AXPmPUOx7eP/kIleW0SfNjexg/m8sjZ9mrEUFgx7N/f6Fx0OqAgoZbQqXgELUGHbf97wvMf9MFGYT+7tj4uUCVUcTieLOklfU1VILaDjIkJmeoW21OVVhhrScIqBV67yISP/p9WaVcKVSiPNRVMzCPXkzaKj98xpYEhyTzOuo5azJxRXyi/S+Oq5O7X5I1WDM4tWZCdWgwL/47CWY0D9lk8LEgOlxN4Xfl0B+GWz8Uz4gtEt23AjqhZdq9SPgcs0pyJpf39e6GTy5jfxpcXP2okOR+wxrD+rgcntdAETaYm0RuW6vOfPD1w6qIFry//6Xx0X9rImiJR7ZF1u9yxIz7uE9UpAAHpGFUx9ty3NiRD26vEiZJLrrHIfmo4Dpq7/M57xjP/BiCoyLfX4AwBSUeIyWmcewSZv+U4DG9X9e1VNR0Mpg
"homepage_credentials": "ENC[AES256_GCM,data:qsp8MdaGpqqutMk+KGfHoooorQX/AMgNP8vvVfpz3quu9lO+ghmZFt40YWvEI1Nbtc4RCEVqs6E+M9rcca/rNk16yIsWLZD5pZ88g1sdz/ay9tlZbAETBK4vdvGV+LmhsvoYZp+iFRJN4grXqlCZxeWzGpo3pj5wHWtPAY9C1PXbR2nBAkHW/lq7FXeUEvIc0ZqZXOlLTrclI2Drkg2CXRGK96MtBZto60DIYAnNKUf4RyyyGUMaZXaHbQMEGq1OG0cia2oYD/+biy0HR1jImCt1dtzhmh03Cm0CAvkwfAN9uxMkVrPfLwh26jfi2qKJRpMmsJW0M4rER262UMum6XdvdqYArAUW4WyOjwC4iDmYV/D2QM7A2PtQvZLGE3ONiD9cU8Muf5O19OLGNdAGu5xLKKutDVXfg1K330b0Y6tNO9PdG0xGXBKy8NlTBwRPJb4Hp+kAxyaiS9fenr0iaQA6s/ekSay+TWHETXAT9tsDMStjMdDC4WuNFpaAeIHGCeyqpeXLp3B7UQnDD28ooUH8NHi/yrz7ckzyy2MCo99Z3MidlZbousFWK93B6LWbhNqEVSH1bpLsRxw07HqJhyUU5UvJg03eQ3yGMLQv/APzch3LAJUC9KPgnLQVgLHce8JbrdRo1oeCvTToXOjo8kL8kQVxLuiOmVAHLnNjQVtf8gZ5sRS9jw8AsBV8e9SDPH1f7UYPzOrPhUn9aDmCr3HIms1zAd3MdgssFOv2XI6IGK3TcJWsI5zyj1ds/Q3xb7N5WxWyZNvLvqQq4Abi8Xdh3ap4sMHMkt5PGfSGynRTVPe4znvCwPx1wRd4dUhb/3Q/iHi4jqrUSCKkQzctS1Sdd1O5ot3mwluzGLMIdJHEsA/Adv+RnmebLoIgyZtrACOI2JZ76IDv/jedqxTmjjUDGnzXOsSIXLrGvLNlkYVQkJ4V2x+vn4uDxoKduiBBKOfM7gk0BFjg85QvebxX9H0iejbK98rZnnKLGm2TOaufKjPIqh8Tqrm3tWuLYQMbPcUTYc5hQb4RGP8Dv+DRFc6RwmFiZo83yuNPB3PBvvk7vEkLEqd8IEpQbutuaNHzZBYPgYAoJxUIdnWlAb6DNDVAzbsA3Apko+wz+Ir4+i3WM8Up3BTUllAWtKOeJOS0uS9T+OWX3p0XZpJXeVJEelzG5T3+7pm3iRS05Y+gN3I8HNDx0SaUhW1D+aW4siS/tBNEKbQV+EBceSjlQ7VR4IjO1PqCRV3u14mRML1IByxYadHX4KRfag67VzpmxuHvrfB2nlg9QX0w+eg8bsAb+3d3M6L+GlGRD3/LWIqcGIZzIIQyhm9VxjWcmTFOWzxlJGKsoj2t8nyVcnWRNfPacMjI1R8eqIHCgOEqs96dpYYX2HVhus4XaGTtjygByUDjGwpLKsMCq/zb7iQS8sPNIa/2H4vS/qJJmqdsHIGNHpyNOhqlA3gbbP9tRbjxgqJ5Ib/m9/yCgirqAR7PYmEhaRpxvPBd3ynDrzjqxZYqbkKTimwQgSAFxAJpetlNkkccCJ/XrLlqcAxaxdwgQmnkPrnT4B2ncySudf1nqfAR37Z7TMrXh+kFanwVq61QxyaoFJktU9k+PbMwR8VgPMXH7wJb1rR4APDa1f8ZhTu33BmASOvTopj6sPpDd4oTovCc//Ij2oVq7684AYPFtCDnjARYc7wxEXLfb5bRuoqyuVoxu7yzM3ZQVBKGv4P7jNeeZ6fbg/inZCa/lbfWYMhsI7+XDn4kZehjYOQJ+SrFHS9yLj07JGB30zZvkPo0JdMCjtS7eGaZhWemrvXLH8b03h3PTsHuyswh7k5lswSEEel2JqdVU+M8iDsz4aitPYGkPA2zQ75yyQwkDS/wmXEwpA1KxqoHr4fL4A5M+7Q/940dcq6A1ZlPF50xB9W4z9ULBqfptDYek7f0Z6QV62AzHD2eQq4X7wFV/dbm8KOfiqK7lcu7RrSTheszw0mrJfqFThbfI9sOWr9enUv3OXefatlXqZSiWZ/MU1PUpfme/DNZ1ZX7nppYaA17yHXv0ISZk0wfk1/1OqrASZrffmNTjf+6JxQ2csbJi6/UzAb7pyw/exsqYJhcgSMFZ4rwwUU7VrTaV8yGYXcriMSRMH4ZF/13bIY7VommmUiox4hnl1U0OlFrw3uVtFv4OztDaeLTE/rmq6F5RRh+KxEEHGC1ATleI4JVwOHEGOFU452Rk1NmM+uEx3goNwlC7ZvQza2wgdmBB/qNCk1o10qGSf+DXFw6/Qx/w4q6uEOsj4WGPGMQpPh7yCspZIjV3aY+oAWawTEKVfaCmGSe9QHpZbKtg0vAs8osiuvGiMNqnSGmsVoa/aME7O5PFt0KsblkA2apqkLtMCSObQiRzsjGakIvncSd3BhCfDXQBd6I5YQB+9HPyW8FwneiDib7htpDSqC47BFKpoH3egpSibzQzjaYbmaobzEyl2vwVxrS+VWySbCusahWbopih2WU5p2uboO5BzgsEQaiy3SXy80Yav7D/XsqmYkZUvXV7fMnaRQmy4h7kwjzySo+RYiQqbaq4cyN2BMSDjzekluodNdkEp1jq/tMpQagshv9amzdHygkHNRZY9vSDK5S9yaDxPp807ypd4ZGYh9ieNg24H/vhwpnmS8AB9mKE8eaPjq10Ky2KKk5yJBp17JqdTUhvWBtOZ/Wcqs1p/ZePGgV7icICtPWDx2rCpv6S4SJENTWnTy0AWNl3Xl7eT7xbCxOaSQuOpXybaPRtA==,iv:4rygr8IhkTJD2ne793n6E0wyG5O9sLCF8OidCEnyzWQ=,tag:f6X+vU3u+6vgjFHQN/eDxQ==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:g+gN5ZyoIPrFJqq7ZVQleipjGQFreJJKiRRShtwHQyhgN6n48ENVUC7Vcw==,iv:24LYSLZS0MdoSBsVJcUEcBgvNXCnBU1yTRSUgbENqh8=,tag:pGxlx3jcumyye/bnxL0rsw==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:b4fXD3vEsQvScngZoKrIjCoFCccaH2OqlqXJb4K1pZWqO5jlB1BQ3kwHldB2YxkeZkfKTqbrDYYHNs61LgnLGaVT6XcvwGg10a/+TV1v5SHQti92F/N7BQtHj3vc2Yn+UfYPoh2YlWMHvnOVIKfqszCd2HUMIzBcaPzA1rt8LsbkuUNSXh7BcSHm0pzE0cyQ1oeH4UV/ydCgIlTHzFgkrrgxSdPvBmTjAAcDkHs=,iv:Kgjpd0uDeHtxNjDvoTqoHP/IQH7ZVaRSls+OUA7ewPw=,tag:G7051CF9ncZ6z1EoBKSjdA==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:/YlkwBsErygbuUfslo1SWYzdGMraz4nZLxnq5h4fQ2z5Kydb5nQ1ndM0NnPVDfqj+h/O0zQcmEzm7fw7eq++2CWMqSIyBCmhoK6I0/KWbQz196s7rWz7eTrMOfKTzy1Krj3Qb2Hh6aJiWpWkNXjgQpjgcHHTb5+Z6Tl/SZ3OndO8Uf0iSu4e624bifs4u94o7zdMrNzuAXfr2pIsvy05kkYrEHKiqDth4xjBCEQG/OcvytZ7rP6XkzyWzpt07cZk3jFMqOlyRO2Y0C+mXPBhLiQDshNZLM7wz/mFH0XXmYt06v7Cyhq1Z9jT/ArMjTGj2eQ1/I+XI1wY3b8fxBFcvswYCT0cUxwlJEWMguyajIhUgBgqbvkLFcKVUS3BgWO8lSPitctjOQMj1lIWWO2I3dGHs2op8GasLumOHoKLEMJgs3uUE24gapz9Lsjhr2eLxLwVcxu66UGbwqagTlBCcJ+rY9InL4jlxhKZCemEfSGg8u8jekBJDwVpsT+FS41GMkV7lRQ6I8xdsuzjPU/Ge7LBDPUpW/2AGZN4KDD3YBCohDVdY7aJgPJn4n4rdsVy1uawyCvv5LAgYUI4Gm9OrjFQamZPgCmOLcBLz8mECWdpbec5k+vaHvETXBKNN+slx8hO9ZQcAd8sxOgEosJCsQSDLohwivoUBLVaEW5LYHKjEARyxLAuUHfO3/gOevfCtHPG/eMH+UYlUWyFSjZrT2xzJGfnG78aC/b6khJOl/vJSNtgc3GjAsRXt3Uhd9L+y+mHLBaJk25CDOVHUcOhIqXhYQ5R8HQhKwXqO8dXkvqz4+CAd6yjIYdbZRNMuwLiv2NC8UHb2+mg7gxHXXI8k5GpnBVk2ihZB0VRxP8I6e0qBjvwoIlqHnl2O0xviYcCwt8rHsV+m43fXzp+Ogsn,iv:QuCH1ZElPW0dPC1ASgKmfZX2Sw7F/mmTWi8p5NiqmRk=,tag:fqQPjhqzeBRVK+g8btYW5g==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:+h59H8+ETaNOfuVxibzhBY6ZOpz0f4PCIIoSrmh6BLHRt6aQa8u1lgeX/gzCprK7xa1o/E7CV/St140fxDSwdiJjby88ZS5WMcFdJZKDxzDpmRIzYW03jdBD/BXZSvJqDy/atssuJLlbvvNgjYM1KJBCe185uzHfsBlRfbjAUrkhPIw45QCEcVzX/KfoHGo2Yvf/w9Nw7eKTupDqgNqtJtRlpCBU/on654NRGD47NVcd4KvLNtjzO8Qi70HwR/6iEsMFfjNJQt4ycFmJpqe6U4hEbYrIW/G/l3XDFcpviqkudyBg5O6fvD20/bFL1vPbOmI1Y1XgYlBaRQ2mnLQiUTPU/I4sakrWM3keCLVMUbGIt4c1TNOaxmJYIOjpGsw6AEj8UjbiIe1Brp71NVpDvTRTSf0gUKHhPVMMRpYrJpGuB1H8jxuhH92gDKGdpVu3S1grK8Kaf7ULvWYURBPyXHH+YptnSqUOwwtSXpuuTEv1zkBM7hkogMR7gC/GlsJxnMWiKzNllxykkgZ8iNwgowi3mW4uc4DnXozHCswXtHwpJW0ttyf9vZb56UUDhiGC/TZRXx+G7gfgL7vcvfvBZEccGf1R,iv:tgwxKn2u32X5S+YNHQlus5F10tnfkCZGQFlnX/OdeZc=,tag:97xLeYzLeZlYSrXIm3l5WQ==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:/JG/PhrsioSSIq3wpl3hI6y7/Z8V2xrXPN58ZfNO275zp0EqaBl/RXC6MYTiq/vGJB8/QwlvcKr30GezD1uzqWDIB7E7DKROwZdUJm51Q6BMUXiu9JLlZs0Veu2z2twWOPaogkowP8SKDcVd90BHhEb/3jAAIHfVJfmuzJw4fYIDh1cqbKLFqfFp74ZwwbhPP6ZzPlOrQprt4/bHNvN+Ei4qgM2hSBV+cGELw4cjEXywyQrj5Es7qdnR+/GZHJBlvebrGKgu0g1XHemdTgOADrl6l8gx94sWSdto0M5ocMGCa14pDm2EJBDBxvbDJEicbQbcyXmK2vPQCCK9nxbI6pRNZRCvYZixFbg5TAPeQzHTzpLAV89t3XXqtwijFoz+L9II/SqKa+vYExBVw+yrGVln+YXyF9TJIEPSbEIbvsmUXcJiN7M0AvMN9iZJdFry3Gal38SKmLaln8qq3srMg/ZdJNYnN0UguCPesmYLNXizslokYtri+kwEG3LbbiyWvu7IJbnOppIC210vNGinS55xFZKTiuxXRjdP5GRVDiUM8CookdtyU79ZySE8Rg5yDAsNpEh/48xUf3AtthOcHb/ThVM6Rel7SEYhOEqFyDHOL0MH81ydg1oY75vTP+XV+rnlIE27hK4dL8F4EMqPRLb61cRbWqz99fMPM4LwN7097w1LCFUwkG8fYQBboXQonxY5UPF3CYl1hUvGjLgYyqPZI5REzmoC96HuU2JPVFFGO9SFdlmWRrlhJt4l6qNjHzVzt/1fBc2uo6tKkqcAWkaHfHP9zd2J3+Dc/9RF6hfRVsROFRhl6GsgZIxREjAtGKgahZbLuyn4G9aqPoHTMUU9oyI5rBazWihC+3puudQA9Jt2ao1R+LqZdnP0CMkKEgZRqY/mqZvyckfLLoItuqJLqIUXOvs5TYgNVPV2+v9Pt2glJ4O4IRFVDAqE3E5X5DTfUd/6qNOEE0QcrMWo42W00Z6wXOEXnJWCGmFU/WLvTFPpKS0TsM+8m4z/llentNr+fohNjyVwIkbS9M6wMvLsHU6ipu1181oTDsfeMofsf6/5UnpcQXdoakMG2Er6/iqSVnGroag4R+cll0LSefqxy4GNziLrtlWtfYZVRj4TSmuLOVA7FhfYb/WFHa5AlU5xBmepPIuRP6yKOY0iaa67bvM+nJfPFKvutdzq+ynlZSDLyScHRwVkF/1lotnUGeq8RWNVUbtBZKViAH+T9bMffnelfFKGGEEG0Fbhuau7hkQ+PQKo75hUGqOtOyxySY/lR5G3RvVVkCAVbqN2i40P8SI1NonmAiCohgSfMMu3gQgB1OR6ohSeKRvdolGGsGYbRmLJxSfl1a+Lmpp0GARAdouW9an8lBI3IuuG8rLE69Fzd+GQg6lt0/DysotDez6ne73MACeU70w1eRbKnz1UqAABO/wbuCjc1cJJGZTNOfjpMnwib1xpgwwXPG3hVI+mHX1wzdzTkO6Jn2XZGLRmOxDK1o1KW9+NkRpsdBDzT75f81HLIJZ6VMwQZiq5Dp/c2R44+JhxMcGG/F6Gmh8kBIJpp1Oe1ru+ypplLTNcIGR5ZF+jRWRmZKsj/IST9QHURaePt4GP6YbWD0iBT1s0Wym8JbMIAbpRXokrNzEvodh0pqOGknZHnDJzkcm5YfxV08D4MJMT7V9IOCbUGNigjgcjMq2tvVRTAQSWNhV5IufVHiFU9zBcz4m0LuPE5LkZRcPiBT1xX+KIMaJZIwUat6fIsn1OKwu36YDjBVYr0APU857hSuz/gBujjEvfPW0ICEa4GzqX/54yR3zfQYpoQv3Yewze7EJ1k97+UHA6cWdNuJoYJzbGdKChX5rRDoVEdm3g+SxsXstchmUFw4jVquvzxvmqPn7fEAaZW4ZhM/yqUzLnU9FMajthpm1KM8R7Z20BEC7yWTUfPfb7vVZW/3fCnZy+vUgftAg7S0gV8Fz6r0HIF8nkwFE23pdC1FqZubSyrN+/jQXyNxkHWGYY6AikDYG4EY9QMTNf9Ak3FVat2Io4QOKHYAsE4E2AmSeemks8fhwZKVjWgAAbN9UuzkZMuJq10JVE0i7MzPXLIPDkpA83H/7EBb5C39aYDSoV5gFTm+2pyBtbUGQ6wEtpdrf0Srqds/Yc5g063/mtzd1L2xUJmO4q75nJk4yP46KQjnJQ1+zL6PLxpvycUHe0c17BPibCKAFgUkqSf66qeyMCY7XnIQmunsR85uE+pOejmdlE8mMQmMEnompFHZ0xtNqBxbKLuqEN0A==,iv:qa+8TjRd4Daxn8yLnoNa4YUvLSWR7t4jKJQgJVi/Gzg=,tag:QBkd7AaRJ2XuU/mwK0y0tA==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:MXMKeMve8yYk6f6v+ZE=,iv:SsylyN5CYa6U69SLJ7Fbwh/na/GuS89ecqgIcBdIzz4=,tag:Ry62tkjXEt58pCFPtmxb5w==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:etZpLsW8b8nMTY15XLbvxyX0yPlOPYC2mzQWc+V+oW5xjex2Qxe6ZhORTiVvtopm9AKQ2eZougBgnh/c7YX6QwOxRuJkAx+BKLDfI0QxhHMDfJL7KwaRe64+tDCYgsudkBF4,iv:QvcEM0kER4EoWoXz6pm8kdxpnvcrawOJODrdlaPrEAI=,tag:LzHJKoEGdDlU74JBm3AmWQ==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:bqcNhNs/,iv:Kvt6F/jLdAARdJWMMPKagDW8qbAo/eitHJpKp6oDvr8=,tag:RHex6HFcwyFNsi36BtXqhA==,type:str]",
"pve_password": "ENC[AES256_GCM,data:VEc2mWK0DQePl9lIcvGQhW3kWL7MCThp4EBcNg==,iv:0T9ILylupmok+tgaiY93udBBwIKi8Ob76M2n0A+JBI0=,tag:M1s5z5UAX+DcnEhzNVdYjQ==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:CSarF9A6Kiz7VcTWQo4=,iv:coUSoYgZLxB1vFhm1EjLXfJnuRjukZLMClJITiV7xXI=,tag:aTLsDpcAYk2IR61bcjn0NQ==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:zkUm4bPmDmIFeVKhQIGC06bMncm3f4Y=,iv:ht068LH4K3nV2oaD89JySQjbB6fVDq4eGMBk9a7c5n8=,tag:BCOGh9rNiZsc4k+LB5HIXw==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:cMIHRn0=,iv:Zy+PPJBSBIR95o3sBrnCAYrT2fL8iwo8lMpVP4hPs14=,tag:8tJGFGQAt8HYLN6M+A7GNA==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:IFJwtbLsFR4hpdf9gZMMr6M9UxDk2w==,iv:15UflfuObIH3V4cUj27d9U0/oPr2jwq9SzJswMyacYc=,tag:ODGkzZRulbP0cuGFDoJ3vg==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:HBqy+p9LWf0TsQV2y6c8Xpjs4YN2LD4C034p6eSb2QEmbenfumJHSgq2csoXjKNKC45pjdQtD2Bbqq6w0G0/yFcJ,iv:nFeQULi3uDPyaRr5LP9CWzJlbZzngkfYY0AEmzigtrM=,tag:oeqaGXaJg6BEK2yp0YnTRw==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:9yzFyAz+RL/G5PwXmS0l2G6tXAFItjAUmGdyp1apR2BTML1LmXumxxAbH47VO+uaHk+8jRKBM28mjLyn3kATaiPUswEF//wlBwuox2lLJk65WQEYb+u4J2L72iIslid7ykVjaywtbFnosKcs37vtJaul/7AABZx2ke37vUKimKeDLnEX9GdlHaNePRFhkxKiblBCUg/96AscZUabJ3rw//IEVB3On9jqgsjLVPvFFfYNDcWoOg5/O7FHDwc7WQAA9oELkDMS8DtxFtm+gGfJxtYl6Y945HYZRMzDs2qWuxO3tFdFLGCuH1wIfCnxVbG+kEdI8m+J17+XM0kMLF2bENCFWO4+otL9ez7pdIGB0R5KQUkxqKWUpfrf0wk6/9maqy4D41Vl0dpk2ZmgQU0qXseSJJuEJB4RwE1pCL4MN+TXBQeoXdhvNtCZR6mCtnihpQyWmE2wU4cX60JS9rlhmRGIXgILjuDUf//09y/6Bx14jus4Wh+RTQijKwdh77Ws/5+5sIYcjfgVIpL89ixvrxnkyqKriqqswHHE,iv:fJhDf8+Yr8Wr402U8iK+L6EwuU2S9PgWyfewpe9Js28=,tag:r7ErZTItCZwVtLpUlrF89w==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:B+5SKu103y9wp4MvF99RGaY2BVc=,iv:okstJ4OWDirCmislad1JLKR0FXJHKelFpeUoEGPmC4c=,tag:dq03CdNBuiiQvoNSukN5PA==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:OCeBPi32iHq1CHtqK+joiDDfvcumn+c3MF+mRUQvSh3MB2DHzu+AAQ==,iv:aRPWvHUR5akNojW92V78hukmPGXDtUO4CsX/7Osb3gw=,tag:YbWWCr7Fgtr73Gsqaf/k2w==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:IeCizGWnrUUDeNts,iv:5ZxnyiyvIOc9+0CJaa2d5mWHoWUHcs5AVOfkjwCx4Rk=,tag:ZuTbJ1BaP8WHZoPNHijntQ==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:EX7PTC6mv1O2867R2j6dWlEJuE6HNMyp6NY3JRKAmjglfJEc+41GERPPmnSgvUAFFdAxyoC1E2jzENK67L87Um4+J3F34KjAGhjrq03Yv4bGiGZVXix8yaJsxlDvBRWsjCNabW3LJKs0rl3QGQ3z8P9tiLVcV8FsH1FqXrruaxdeVU4uQsMy2B2bVjtICYef9CbIueSfaJ5YR0adMDdc1fB6g/9Ifbz1jncRkUtH28sS0KXkZkv+yJzQ6g3WyDg4hau2/8ZetfAZLDL0w2h784XAhWr93m+SbIw6NrXqzui4vkBAHnx1e2FFidkm0dAQHxu76uCmWRD9cqzl0bdkMg9tkbq2/8Kj8jJcbcNdEF/Xsgzt31nwVQFo28y9kQcBVN4OxYfQ7fz41KDVtiDbYt810ls6i6dF1/mw5J+kUyYczlh2Ix4mCmlUfUstXbighGiQrJGLFreBCJoIpKQf6zg1owYvUCXjW1Me2zsLwKX4h/bTq2oAuYnOJkvpd3UhYzTDkknLXIRlGgazt2/J4Jhqy16RicWWK9scLw==,iv:n2jt8mm4v8pMH8hKV5gL/jjdaeDKnSxMXiJdqIM2064=,tag:RBwhpNJFOSeUU2ox+EgI2g==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:3N4UktIEs0ejLru+hEJRXECi2+2BybG97+qbwSK3d/kfkoWHol3aJidt8AS5h91SWIrkZbyT13TPeODap0rhiN1KTYWF0VTHDM+O+/vjHA9C8Hkbm0z/N3hP8s4XYYFlypPtjZd2+YKusK1uqeulxtINzgGd9lPYX0RP85rA0tldAO0HZwZSCRMg1kmqFTyr746pxJFo+inmVG8x/3NXWX+7Kx938vJd7GUop9c7R38/XUXf+BiAm1pfy12YBRVq9JAfILA/YzSrpWBa2DR/s5FGwgyUsQfl3MBXFjE436zLstwRDu5cpIbxIqKSE/VCZrVHC28+YnRwiIu/pnG/ErrrrqTK91gbxkCbM0/83OCPcti4fPgCVXnH6OawnGnDPy05haD8U2Hy2GVl7sU5Xqv/3y6pV8i7i6NbKeiKgbheCIm23ye/uBjSQaOarEuqcNmxyC70mvi/Oeyc3aVuDacf+MMyu2DJkjYuXJa4O+A695LerTAe2bdO/PWjxyrbZwdjeldRqKLlX6EKiOk6AmB+WyCuwZ/R2+Q45GQvXHZQKXu2CyE3h1PvUMggPxEXbpdn/QQ+eNaSHRlbcS/ci/dxkXEt70KcqNmghuE+c2U48RXvThfsXxbvTgNLYbOqmIqjz+yfLHUd9AlnNwdPeFnhAGk3nDv15U1aoOzQn1gFypY05pIhWCtrh8ebodf2c7u0l8RwRNPK2lXJpsH0omj1Ih7UR4VS/ENwBe5LZeNBo7LGun+S85zt8dnVOnNiV098xdIyRME4fQjy3NUZ8pxNKhrs5WY81rPOO0P0BApYdKG9kQ3bzXR6fz9sTUvAfpi3DY8aN15tqT/wVpAqeNUmRhF00sFEXoVImPHLxhVDVjHv4JfCZfuXZ5av7U18ZfxGuUxoIzRWbhjdYzdY+3kG6ReMAAVwDgC30VI3Q4W92jT3mtisdMRjeBOt0WT4I6KdScQR7tbnBYh/0oWU1YtAFvRLxi0HMKjUQ+EC+cmqa8gQSezeCl0tV1+WPn94mQTpR/9fHa6buluyffajuy/5mbgrIBTzS6Ga4tjL5GlrpgYc4Tcr2D3CJFSW0pEbEeBXsPcS2bHUHkuBxUl3xewkhxDO6iQak8E/iF9BN5fSI0pLIfwNUELDSMcEZtlNh2x7KMlO66HX5KtOkMMI47qgs8A5WvwGksFEMls71LukSpwA6w1YbkJxuB75HfsrL7H4lUYaK5Yetzry+qlgtsd0+KFlR/ah3BdPbtBYa7cAWd+vSq0uz8EYe5O90SBnuhW2RbUHqaGRIodN2ToR0xwVKAQjCot5GyMXOpfqm9DTnwPfOABF1YTpdjbBN959jfnY0FFdERD2ZghRPzQ/Sm7Rosqud+ExIjym/tRUZuNUt53sBvMmyIWji5wQUvVehDo2KrWQehBX7KvIEZ2Kkzx45u85fUKu+GALsvr+8AH7Zc4bVTZrNsvhDOe9GW08HeaoTEkGGaxrQyXSkRLIQxloLmTMUq94CuJkx6qYFLVmu7+QM2AoI1RBfW3KOLBVw+5L2Le60X5lZaX9t8DHRjETvILi9o1Wxph8EtjlXo92t73a+oadNNm16W72VKv1WGAJ3QLE54HTByQNA8pN3UzmVi7oUmtyiZ7xLuFiMykYmMWOTsXWpL5TAWetWnY8BWSHEm+fJx+ZZ3t24RM16Yhcojpqo00XL1FEpkiVz/AnDIgriCvCGBRh0JKrZhe0HCf+TFMRrxcMlVWEzJ3HP3YoMYRpUXw96pdFWOAdNONFlzEGrjYsAYZMK28UZaZnu9Ktii+DWZ3ylPn9bAAh0mv11bky5zoxx/zdzZP6pxw68jXHGr93jyXdZaL9vNGFl+II6b7uitq+86nnmlqGJCoWNAQOwi/tOb9MgKvz34t2hZBWov7pXe8AtuvQRyDT+xfbaoPjDQH6KRLsELhOYlEKrjS+Hux0gPbTL9pN9JIg5VHio6HS/g7NOtgLoBZXs58e6ehLiWnGkTyNLD5ULNi4k8Ng6FdT8F7a9hl6udiwpPTrG0uHVlSmixi8zjCu/NY4W5lzk9Dd96qjkV73193fTuwik5NbuZZ90zlPwly0TtmDih3higBXQuZK73+JXwj7cT1vQBC2pDKvjCnUmKkokL+7dNjOwZd6lAyTmIKa0qO6CUov37eN1Vgp6CLtlma+Zzg3PY2cA3CwSVkD1TYJxY/j+m7/px8x/7u6Jz78e2zu2izRw7AzCupCXGWM2ftZNWPI0trpuvVliYgnt1vCLSS4QR0H6F4xLPCB7FFCzB5LgUvlpFk5XFujm/1smciQhO8gMKfvYBGXDoTP9mn+LVRh5rmlt9jkgbZRkLaD97wYOzqkoLswUETRsFLch2yMs1KYPIIigj1K+WFdZpxq6bO+RmiK+QkMvOSRlRz+z9YezwkMIX/hpJYQ+3PNNmR32FxF5slOQ50Xo6WZvST6IIxMDnPUcUYr3/9w5F5uZTAfyNMZiwiJn9I7ydm1YqsUGhiEwJwYP8VCbRg1lr/RmD1KytKGhzU7EgucyZmPCVPGHpfejCSBIk+k0JVDu2NXVeR1dumCbozcNHJu0N63csSFiHlciMIpIjFAhMAYWR1lD+sMGbEuzdWlVkbk24bm1sEqeKdcomi2QtUVtE2/fRzlS4oblRqE0XRH5akQuwaLBe8Z3YDRQNnlN8AhhxTG/A/lEAp3M8lDegYCaYJKXqW33kikLvz8w3/awaSjJkP3MXGTRWbUcUA/7cs0dDV4mL4COi7A+M+vpe/j/48S/jM/bQCYFl8/Nk61/c4lyYW4R3UJPghhaZlMXB9ZoPfuVxqyjoWMdPMGJHPbQa4zWhz3mGvxWw+mjhhB+HuTXIlfH5IcotboKQEGqc+Yo6rIwhGO82fZCTOC+YzEXGummVHFNivaxSU39/UQz/jowOCYJVE9JeNXnWTB2wiabAyu6D0PWUrRkxG4aKbr1xOc13YmxLrYJci24HSThtG7QzwNw0Qd8+L8lGrLGfNtISqa1YxFBcmMSVHJTedv+Jhn5OiFXTA23oVIdxKgkIgZupLAZAKK40Pfmvb3ptyOYSkFZNU7g9RkZlKy+jWk+BlMLY+Ywk4jCp67vx7Z+ytSoCndkOaqKdMEEStMzP1dLlGqs3MlKlmLn0XjD5xblulnfkx6KpLh731yFkBWgUd85gvEnxFhcM8js7BN701outqwYjkfCDr+o0xzJWUjRPr0+761maHJJnKNXDESBvGYaKsdgbx6EIevYeQ+8Bl5uO02BYIKq8DmoY9RNu9DdpIJIovpsKN6ZhDcZiXreiXTGQOIAw93kShJic9Gi/YpIjODM23fDXFqb5HD80qHyQKC36VvRxGPC+mRvL07ZcCUgF1yu5FSItn2Wm6Q+BkWOPpohqtUE07/8wTHDRiuD3rxt2J3sjUoXsoxj9CDWXRZmPgX6jC2bYz3SlDiFgOttjzYIoFocKa6Ag==,iv:63s7sBnneN+/yoayGbgVr/9jhRFgfJilA7bhkcJZYmQ=,tag:0Jegn7ubhPkcyCbrTEa1hw==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:BRe0N5nJsVrGscVE4VY9RHR6rcqcGzZGLdX4UvMdmp4DvdMM0T+ybOpRWm0=,iv:OFkOhTke/UiG0Ty05UMEikaCpta8BzXO8++HFk8tuqg=,tag:2C7IqPhUFppdtJqIY7sVlw==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:XAXBNhxJ7vbfqT83da0Db/BHFW3md+yhOk5mjG4G28tVOYUAm9NPY9vege9c34M=,iv:ZZ3pPQNOM01hgwRWGKXplxUu30c6VEHUKxN7xjZTnlk=,tag:ldy9aCcyQnbO/40+DAEGxw==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:TSRcH2HqScfFHUNyI9aAJDsJlYQlCSpcchIOd+mWsmCIrFRKIA30QRbcdQ==,iv:CufOKQ5oIJV/KLMNqhTbvU8niasD8tn6B9B4AoN5FJg=,tag:fOqiLsWdKO1AD4V1lmkOvg==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:wkNeFeXG7pXnEyKLjblbyMd9d9MaeheSZxfLjUZbVdFTgN2HwT2lBaMwoFOYbTjDL5qolfT04lnFsopEM3l5O3I=,iv:MfuPcwr4PvSb9Tvavm7e2WBmybDlpNsuKT5RYBtarqc=,tag:HsYlH7wHeiDFfGyInukVEA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"data_json": "ENC[AES256_GCM,data:D7o4DaAfJclMdSDhouqQQCbqA5SxUXffWsFdzNuqYRpLZiBjHznE3Ne9+v3VXmPu6YjQh2j7ipV0Qem4gR/dmCoDO1kUtJ89exK3w7eWrOE6pREbE2PB0nqLC2vDfq6znu91Gg5h1dvF9Fj+ajhUiEeHyg3dSZOiZZMjVyqqsCEHZ2zcVMNSyQcVOsauYF5rTjL8f1IysliRlk/XdOS+tIHmo4qIjvamDb5VsCX9TB7AaO56AY//VdN7NlRvHhVCU8cvDYkef1yPntaXLi4G1E+yUU1UN/trxxu1V+XxTGqrk7f8232WS/n8tRGK71TikldbZ64A9imMA6Ftyp6xW9MP1sGzH+LeixJlX7qumFececPRIWeLPCxX0HpD9L5yZ6+ddyqRi9GkdqZQeuCdkf8txtAhb4xGltMHD4YfXZdItt6ebLgffdDYq07n4qeeZ7mfL83aDC5Yph9XRocrRGn7wNpRXvdDJbPFr6wfylGNOC8OP/GD8n2PcVmP0su/wc6PmSs7l3Ktsduar7AQt/zCAX/Q9AVOnuNSWF6LnFtb7ElgkGNeW+7EeMraMJXcprCZCGVSW2KKEy7y51W+t/unWStin+/g/nLiM1HD5stkLIsozcJUjZe5GfmlA8WflzyIexaO5vvEWIkQx4Z8vyMY8wMmlDxvE+C3Qtw0h4FRe/3/NjM4ocUmCJPsyt+J/qRn0OmncFG/UlJeC4fGbrj6T//WQrsrXwcYOwBKjXJxOcPMp2M3/FkMxStxWGcxRqairV5BW8WnRN39jaMV9o+1EQRAISRFKYuFM5vlt1wGK4a4vOnKZFgyIoSnltgYvogPJf9bwL+/SNYD3n3vf0yxyHtz9iruFTSuGt4eM++8djQiw1R3lRKhA7mpqULRTP9ZGdfFCq19y9xqQD9Nk5ycYIQUh2TbiwtVijwTXh4LHTPhqzo5ANfaCqryKUFUnu9HBeEmATP1SLkTwlkjlO34/TgHiX+k+i2cau9Q8+W6kZbcQG6i0FJw5LkA1VyzBhjA1SYpzwVrMJb4ozgAK2dXmj2SskeChIpZtEw/rkvcohmJXVS8cvZ1q55vwfO1xa7VtqD7XtGOaHZDkUqret4pRajeZbFOHRh1yeE+stgpdbK+LA6/NBZvE5kCOwUd7gfI1739bF0rlE3qYuKcFuSykgb5wOrRqACRYikAu6qU+kZKhiI3fDlepSE86vcnFcyYiL3QEvrJx3BGMGfzXoCkrJ6DdjJCzZF+IoeYpSSIK8ZSY8iQrN0D/jQr3UoTUFaxTJsljvCR7oOIqILJ9zyJNvzq156MJcNPXZjFpbVoouNG0/BNjdJaRiiwQztKHd9zyZYf1DK2wS4Iwl/JR2LZaBmpR85I6PClz6woQtmTWfvDnI23pHaYRg+C/Zd0IUSeq4TveSBLgVZyI5jTXIwtxeB8ukd/AsPMT5rKGuUV0s8UiookGmaIXU0+9MmTIHJT7rXwE7w4leFZUQ0VITCPKbFp98sUj4Nq837XJIQIkwthHaQEbbLEoy7nyDXZTacd8HpJ7cDhSJ8BQxlEpBBYbsZjyfQsTzVtOc6Q4keYKJg/feikwucu/iFJLXqQ/pcJSrC4vYUdRwxZlUQti+pBXf4iUuSiy5QogpMLmx7d9BMzEjvxFtSWTcssyWOM1ucMk0JyZKNzGmGO0gI5xQBPcG8ZoRn5Mp2WGTxBsq7wcDh4Do+QYCVkDDpTFD+sCf/AL6nUkSWCiRWT/fIhyrqPItPY39WwzIDF+B9GxfxAcJfmMADYd5TXg4839x4KRLNGb1wgOnQNU1BbU9jM6b6BCbBhE+UZEVmemH2K25d5Ijn9l9XVNNarHfYKTjaoUkm3XvteJ8/7g/Dnos20UmF2sYUIN7Bdl2NAOYNd3AUlsQMT0mVeLDrTM6/u3OQWR8tUIW3WRaed8qzhQ9kStwalsPJRNZ9e4Xh0HERFnQcfyC0octgH6roqFbbIIbiqzNWJFpKG3WeBktH8CV0GTz/Gn/0pFFTSeVu8v6emC9mAnB26dZu9sK05NlPFn7jwjJTfrlMT4QsGcmKEURg1S9McxWDNqV0vJVb06ZP8wUMMLyYcjmSGrsWnUMtPW6FF3dJSO2YOZ0aIKS5K9LhozoTfOep0LtLuBlFYOGnUhsLBR3YyreKxbGV9SyK7ujnsHYOeNylVA1LhHZCGCRUoZ4ruIBUTCJ3uP5ZqiX1LzGKrrKWTtZs3oYjmvi0dGyIE0cRH0WjmNriPTxqJ3Gwqr1et2QOQywQXyhWCQ6fU21rljwUVasspRVHAT/4SMbVyykuT1Ev9dxrzl1K6u+8IANw4Ew4nmKVuKOyjKLdO1/xBl6l6o9KmHBJfz1xbiyzUJ7hlgCW/cuF3jJZDnXHKFAOXltyIYbxlHAlnToBPGQY0F8eyRuqtc17GT54Y3I8pYPEq0UQg/tOvNcGiL0dSAzhijvUqQXxLHeuKNxBkAQAzR2HOTbCiKwxbM8YL9EtN33pwGGbd1Yh2SVid1wfluVJWKyF+LnxaPMniN6vRMB9M55RWX/3Jat1b/sncIm2npm/Xu/NpLkcrBy0BWQSZt5JjiW8qp3VsFmZc+9vxoDF1WRQHMTKEr/gdL5sQQwzosBl7pFCk9NeUqmtgCyuhnQjhGjeQAUnxynf/l4Qc48TED4OC9/qeG+kTEeRl92RPEPJjYmWfOAq5x4SRlbUyH//3Ekw3w7lBT0qpFUIDhty/CQqZNwa/6MXpm7gIu/YdjDNX87n3+b3ZStIXtRkHrCOnPL+y1k40T0lRqSmhCDFINts/bQwjd7i7cjOcngp/JNmbUGVwYpTqpfVoYh5TKX/aLTNL6WVenu0hmGEqCgcEaz4h11lD5gJOfCQFsasmVphii8E8xcRZuhnPV4hoHym17orJA7DW/jMTkiNegBcxXUhNdPH0vuf010VaLhEiyn1PQb7qLJob7E8yHbsOeIJM5QpkEBpM68dAQ3dRUKC5jlcCv1ci7WOptEaErw3UGJe5Z2KsjXDVFDjNU/+GEGhWEuscQ5HJQu2HtfpmEMZxdLqY247YYW2YH3zv/eFYAq4uKdCvwG0ltWqxYwLcKkNkfZK0ftCaoHfG67ThknwbRkYwr+vqsen4VHW6nILF3qzqqHicD82c4aXjdowTe9Y2iRe1ZH2RuSYj8tjQtw//Iugxce8Brgiw8S2l5yUKNXktfoffjMclG5YcASHy59N2nsFEOP92DcvJPdAnnOpCuvJjLKb7XgVROpGoijHTAxPRcs7JfAukQ3i2B1tf319XUWtLi64OsE0EraItBI5GKJw87+ADisMDhgD5REDfWQ/RsiNKVmmnny45J8Wf+oNghA+WHsyT745GkDN4KLprZOyR85B8nlBT8SVV5+INT1+uYj6Z/HtYZaYykBY/HAFd8sc64WFUehXSy6ofjbAlHYB7ZIeQpxvUPLNvlTS/dP60mjn4XUN4Fe5BkYm52fIfXp+CEgSnd32DSfi4yQU/gQCxQP4gylWF3H7O2iASOPsmxJrJIurO3GoO9Cj0CNX1MRiIqFu/ScfTZE4anZV8JN7bjXB20hkyNjJesfOrL8BT/3zSyds4FxHJAexAJoAmUkUNgcPUBS6TozGcp33b1mn+DhHqgIbXK4E0pcm0ITDLIFxi/+S/FSehN4LgLN6f2CHlkdz6UExjGoOVTdxSHC8cMoRvoIJJXUrlAlzqn33tGy7doY2I77SypTMdr4gTLk5PgATNBtbSskrccA8NWpm835zEVWsGcgWQIxZcRrCRxlaxe3OUSeuJHu0bB69ILyVzOcZgGTZ9Tw5zQnZGbYDjz/9Larri7MjbiweimcjAIeCxNcyFT7P+CuiuGc/4yLipLu20+/ffK4IKG1XBLYLhEFcMBmTmJoSTFvDNe3520Q/RQwtI0nF62Yh7i+U3BdJh+lVV596Qqx2GvruY2/kljEA03fjLRvmgtauVZA+6QSOuH1wMIa9iL/tfoY5cMiFo13tdHAc+kZiPz+Gz6zyypUy33EX7Gop7mrvxpBa0ZTj3aK5xIKUuPKBGKLO
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"destroyed": "ENC[AES256_GCM,data:AyiLx+U=,iv:69LoYUlcZsbx0m1w22bDyZymhEk85ETBy66mIEyBTfc=,tag:enOodoe6fQhamQvMOF74rQ==,type:bool]",
"id": "ENC[AES256_GCM,data:KshQIvJTYG2MWkZ07Bq83e/Ohu4=,iv:rHL796Obz8KjWtHmB6cEoKYdv3Mj06PdP/bG08oj2yE=,tag:ugHV29WSJ4OGEXuhpWrkyg==,type:str]",
"mount": "ENC[AES256_GCM,data:0s5cxKm3,iv:TAUXRnmgIgW25AVlJXAqix1XYUIStY8k3LAU1i8AO9o=,tag:1kPY8EYYBSylmNyTSomXLA==,type:str]",
"name": "ENC[AES256_GCM,data:8HaquNgfGzI=,iv:Bk+SNuKJsGQ7q3GA2tasVqQQk5A5sOdxm3jfjaTa9Ng=,tag:OwQHoar9HnMgxFwNkqFg/Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:UE8oNhoo+misIiKXREK9DCZSYkU=,iv:STeBDdBH9eqERXj1ZfdLSZNJTlpZuaVD/DAGal/aGBA=,tag:28cKKzuadXreGiyOPwtZaA==,type:str]",
"version": "ENC[AES256_GCM,data:LA==,iv:WxKJKvdGsIjFHvS7kcB1hya5zb0rDz45aUbk3nMchK8=,tag:75/xwCV762fpxHNj8XZvsQ==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:t58fRIWOUR3WZ6F2eZH0+A==,iv:xCsIWqi2MCwphzCtTgfmBelbAuZ8hwKx8UiglZwdn7Y=,tag:2wb/CNf8iMgS7Th6VD0HDw==,type:str]",
"mode": "ENC[AES256_GCM,data:UnisFSli+A==,iv:yBRIqyx5bL/UuLR1ySbSogNC2hQ1sVh3FLPwN3215NY=,tag:xjG/ZMcYjdcEmyuu/QaU1A==,type:str]",
"type": "ENC[AES256_GCM,data:0FC2lwmolUlyRiPJTa2bUmz9PTcB,iv:6swYyZ+GJIaYncjcJ9FjpWwg9wg2PVYSnmI7T9FhxZQ=,tag:xTn7pgOjrT+ymXu7fIR1SA==,type:str]",
"name": "ENC[AES256_GCM,data:n0a0eU7r/d7i+LyTsBybbw==,iv:yopSAZOCI3i04WDVVOzzleVTNjgQYsADmzjmwMiTG+c=,tag:0XfNGRgicBUv6yEy9aPbmg==,type:str]",
"provider": "ENC[AES256_GCM,data:hPPzVq6g45Xrpzutbmd5GTuSYlL2HxGeM0LW3jCBdhrHdVgXtcGsWVaCo6pVaAjN+oUH/01c,iv:IkH2P2pPVq0a4a6U56dm9+WitSJWSpUefEWAPq+4nWE=,tag:P0dmKzX/YJzOTWnXjwBP+g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Sw==,iv:Tcg1FISKpdKNsCfBB4C3Zj7FHpSrf6fbgVrLM9UKmIE=,tag:fUzzBtwZsGl6ZG4GKbThaw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": {},
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"acl.yaml": "ENC[AES256_GCM,data:2ebiV/3GjItCI9xSgpXEonLC6gRWwsaw/fytv54BDaHiVm9Gyq7qSqB/9wPgUvJQ4SBKnGJ2vgmMaYkWvwtOm1kryRu/CpSJHqpqYWegVsyjf9LW0CqT7uugz1ZIgIjyJPD+WIFtSD70niOEmfuNBKboYOoSaTX6eBa00kPe2w9ywPUp/cimXFiw0clcuRTao/hZap8E3i/uzz/kIR8jyBLbFzcJaeECarKEAM/XEl9gu8ALWV2euy3gMIs+JvyolmTXVlY46F5ZLyzLLZPXSM/gR9MbMujPmt391+LM62Ag3WcqaCSFNb22MXIHeV0CRDAWPyrq48PKogFy4v8cKDjwSznu43BuvDnpOmS9QuoTcW1jyt7U21M6Udei2ybboNNOZ+Vj/3NI5zyltjNejiaE2AFSFPLVoLqNwquCIUgEgPW8I6iC4V3xSAG56jp0M1HqbFT76m3mbXv/kSvC4mVCBBxYg6GfNvCOZumW8oVTSoEea/QsMdnjjQwWMdGMoIrGZjDH01Wqj0MfXux5co7J57hvamxiPodagIqKsXX2NEQkmHqy5gL6Mm0RgwcfTF0VhQgzaZNi91Bs+ICqaX1Ke1fRW++6mat6HW/tIfIW4CfZmApxP7jdhlKwaANq5Uwr5vLMUhmGFNxN4iqWiolkofAU31m0HhBfb7TRJxbjOFVN1BmsWM9lBEQ8qEkQtgkFiDAlP790uQGzPbLQMt5diS3NrNK4p4Ks5qMsmBSuGRqcE3/ZR0FWNpyY3E9yIfzBUosZjUOYQEh/tidks7JIzkz/w7h/V4wN3F+8vM9Bx3iB+C4Pev3UYGl+xGdRxSHjE3dVtIVpnKrBYQqOKi52VwmBLexqAdOCSy2jhX08YDAZkUdnWZOocG9sYZMqd9KFIeIkejlhkI0e8r1onjkWT8h7pfS7ICG8JuABOgPhhJgYOQFlpk4QvvGXe+y7ol7FXWiRGbf13GKXNx9cBzjaKMNoh96K+ALIyDT36jrg+95MAJXEJJdaTGztWs9UOa4rdLuLn3X/RrO1LnJwk/JXHojUIWy7E6MhOJImVraVE2BUfxmDGHSXE3NOv0yZjMq1YzAEu73QDT/d+EnYdqubOenSZncJq0GmJh2swzTrzJcszcQ1bd4mWnp4JXqhtqW/kIMGu1f2TOmZSQjUnREgF1iQJsi68oUlAK2R8nGaGmEVsn22hw5+4of2FjAVVRIlGdiWJ9KSprG0zFIrAwSbH3RyegmmzD3/2yXT1LDeTnOyoMGeVtsNfTS8r7IfdRSc9jyhLWkek0a5BO76wvEl6OFZymyytCKLK0E++hI5lkCtfUS9/IwOpkBsMKrIhNv6S7GkNm3JqafriyWKaYx7QAyM9SSJD+JsfFFEhPkOUNLOV7s4cO05lZz4qGe1Z36hWFdZfMnR6PlDIathOJVNCK5DHDrNz/uCXoHQsRKVph9eXFkKmmw+ZaTk9RuJAOVQR+Fg6r0KBzEsCjIe21lqTNFRZ17XgsGhFT2UhxuLnXTOlMZMkOiN1Gxich9PguNW68yRfp6PvddpX6TjptlwIBq8gIAwxrQwno6+qKJc4DiwmEKEa+GiZ46tg+mJoJjJQuPDdPd94o+ikU844Qfxez5BKCutwdXt6r0Jf0CP9fsJKePGuaYGQ7cCG1DNh3hcLeQMEOomQ/WK1JgDDhFazfdPJWwVBw6awOdf5O+IwyQ2v4vG8IRHHDZ1oH9+27oPLUAk5Aea91KRCYrK7ym4+BTeS2KL5sQgeB3I1UpKWmCS9p4YbQ24KPgxiI/tIJ24WqcgfpFsjjupqQfzrOUwOkx2pMh2VzsOtPRLV7bFHj5dbc9SDPHsNsVmqc1tq2ZIiBF50wYjMRpNH05126UCJd/ovHk9ILodf2bMNN6LQszdyKLvuTVpptz4nBACQDSDBsUv1fdYmWDUzk2d1FVKaTAz5AxxiCIQL2SNsgAUE6GJvH8weu3qdvUoStARXNqSCAvtzuzhlODMEYDjZ0jS1Rknrhu/uxKi3VgYF4tB1BYl7FvVkL3prQTM6ZnfWRkmb3BQbsS0Iw76Zy0JZg5UTK6HR/k1Wv2LhG06kTFYR03KtYu0OTaqb1zwvGeK5xHj4/Os9s79z1JX8TviGYmxq8qlF37EBpSFq6Dqkky/vPeqKVzgG76fHAw3tpLD+yuG+Zn8or0cXhuZyNmc2N1NOBMbNSDvYacB5XbFWdQKsHQlkwAwiUZA6Hodky2dRIv7IZ7PMsAOEwlmw1LqINbqIBA7pTfDXQ1DP3j0+/pg40z9lYX09iF+TJvNUQYZTAVOHyvqnsjbvZPuQYq+wRC73MwNVk3eck5dSfIRUdx/QvkSdnjkevaXR4VJFKo0vDchh+fIF9Lmxvmlg2kYLXfLK1DuPi6syhGRkxhlLv4gnVxdw+64D3uLJKVtHsziwFfbCYy+o7Tg2s66NXm7woTKlsjXjMKl6n6R8xwLM3h7M+jguJR8t7c4R06nWWQWkg4mjjhiuAkoHwF+/YyjeJ73bLdNNuJbO4KM4nXCLwPFB715rWWEJFWjvz67iZwH6hkGMrV5be8oTXaqga+2U5H/J8iavVEptxVGSPsefZaaZFmWnkhiZuoXord9uhbcAzyTVSstG0PpxmoUZrTw2I/kEH/0/AvNd4BRQTf1Bz954ygUYqbEz/8xAl6JxT4KV+hNn2GaG78ySx54vNSULGrlNkxQeQ5muLc4toar01XyVVIxi5inMCVc1MGN5PNE7FW01NXrcAl0XOK5tviUT7Pk1T+yAmM/XXOu8/2cVARh+IL1PIInWiubqUmIQELlqEfhHgu3EUsFh7b1rQ3V0XTFSGNAJF6EIUlXiUeEWTmQWYXSCNUAkH53V2wgHQ6guyD8bPIIW9WWLVIzEAYq+s2MBbAnNYua2FkvZo4bNgecaKWA5vrIk42Pg6Zt6O75QN6kCMPFNpsVPoVJI5HcTbpf6tU2lu78C6o+mNwp78E2IdpyL/lY6JNf2MxOWEeQw4XHcOLdyRPO6Jcf/3ui2DvbE88meItpmiSNu51OrltTWyj54Ik7CpSE6adBt1cFaaYsjJINkWkBblmUdH70bjRBRAOULCCxKeduaAbB9Lh3Y58VqNj0xcmUp/7oBGnqQPUTSfTH9exQ5VcMe5xRPfDT+5X4JLxu3r/Lno4UaNNG8OImoJoZuT4tJd4ZU+wneUYZoT2VAvoqlbt30v7nVIjie5/YVgOGxLAfiVpEGUbF96dAS3PQDB5VIEiMUu+0IIjCNojIb5ZKgfzC8pROOuWiV8D/RVxQbXKY8Mh2Rz3x8eUKjoZ+7sc5Gn4dHMB6E3+KLDc7gIlp/Imc5cMeNufSOwxaQhHD11bgERVVtWoQPwzZ4f/oz7mpmbHybTobrFJRqKevNUhDYqgk8qOJ5m1jyglRBsRwsAuBgOVhwhfnjbdBL8X3ktSd16Ir/ag+ae/xfNmPI/ToV8vsdFqiw4DgHDFdHRI5o1CHY4c9Ygudy7AwL6HHnOZzbxxOpmFbG0qL+cKz1X0rbwdjiZBwH2SV36d77egwqrRgNACBVrmp6t+7nj2RSF4enBOeoq6cAl0mwksJ3phkcD/OuVyDjivPvscBpulGFKZfIrJYf0XNN06wdSoLEqUBqNeTnYOXP2AggD3ArSCI1fIeGffvSdXlVU4sJgp5f5nUsZHcpsFu23wYWHilvqgxGBiueysyDsHBdB5QrAd8vUxj5iXolTtjPQsGX+i1/QcV8WHOgK/HvZJd4ljtIZT5Dvzo5XxxVj5/78/A3B1TtukrZpdzlI4y72jjWNsGLJX+U0Tg0S5/WgOBupLGrezX0YyNQ+gVBqAcaodkPM54AK7TCO9HskqWmAk6kFGAx8mv/l/F6H+SR0+FuFU6TRwxlb3uEIN8YQs4gBc5u/eC8Zz0WcxsI5YbH/I3mahyEYw5HFM5+jQ42Us+bxlm+fP+mWNWL9GlcOOB+qhGWyltjFZKH3X1LTqsX7bvYj+XV4E80wl2flD9sGY895Kg1KbroTjZK0mhSHYAOzuGE+JoIu6Zx0nVy1U
"config.yaml": "ENC[AES256_GCM,data:oXofGtkrLzrued3SBho1Px2WaztsUnzBlnv5/fUPo6Oldma7XJWgJfF5v2CkWP5Ex0uLPOS1lvT9549I2DA5uJ5j95fPnV9xsi7PhZOuydFwN4ONnH+aFIOWKWi1LFwNO/Hik5jkcGKnQsAvaFnJY7cF6b/JVNGwMKe9oJujqjvsUeJKc2dvtKfxZIl5orhDsCsxTIa/fTEZcbAPM8dOkDur8x/I+UNRE2DRwwAjfv2kvCUJm4m21jRW1ns5IJAbdqUNutcsabWryzoR8kogqjUBri8M1YXl/3kQG81LqS8ygQuifrIUC71L3IwtUbCJPex2cvvco/hie/6jWYyF8X3ABdPzpNvv3ktbJdHstN/rJy6jnEPv9yv9300hvnuI58w/j2srunWrj2T5KH4uyS3abW+h1w9WOID6/lWCL8wZdIEoKkhOAr3uEn9GGmElyEeEgQUjSvesQRmzuXykSbk4jugE8ildRyKFfCipOFjHKz9Ys/joN1MLnnJpEJbM4xOb7gFQiZiwf+sICnggRl0TYNth8FAHWFGx1ECLOTN2WwfDfWs/eROIyc8RoCIVH/ZldUB4UGbzq8xS4U5QHaFx14dHbT5H98whjn0ilhjIHZV4MbvI/gj5nk6mmCPJQ65FXZERalvSSkpfeOaAie/wt8uvrIqrabhQZqGWOYQZ5VT6q3cSht8tUu/y8unkBXsMCGDPlYp0PnMal8A+kRDWvNw2Jae6S0tyyDXiai99dKshiOy9LsTS3rREJNW1OjFx75cEbiTjry2zAML2QjHGtlR6RP5spleTiyZKRuV0t0L1xLNei5J2Gys60/zrggbXUVvAlAug5g5qLst+ctkSraEtWDrsQsebVn0Apmf9K+JMXwdboyhBoMkG5a4w2dv9WA1RKdJXh3sMZDH3tsMY5OfuolVDTKLImOCJOcNfYnZv1UvGLURRz/KD6mBK6ihiMq9RXdx3V/lh97xwwijQkrEdHQBDfPCYORqS6GRcyb757tSquVciZ0na1WCCa1/ezxVSjs/4PiQq+UJN1/kqNTdzYNyED7LyzBZBsonzqVwHfRWLvNoUxAVSfghX9GjNuIE/xLtTx8qExyo6tCTOlCUSJvLBavBh8ZHjWQ09OCT/FWr8il5wCxF46C2ugMKXAjGYc7Dnkqnak9zPugQL2xDbYXxBb5k9aC2NnbM/cGRpzmI+Ayj8Wdv1s0JSUzTxJOEmZcHnTk0iX+VtmvqdXD0uPNIK9EBxvEk/JVALhCEopmHlGW/chwVzQHplWgt+KXL7+4f18o/Ye/nHqIDU2CUOGmvMl5f949KZLMOPvcft45Tk2VRkT3/pA30mJSmf7MRycTi4oJaGNSsYDby89egfSowrB+iDvNVkVNYfSix6KSHkY1gfZ4rQa8czrYMyfB6JnIuHUCNOurjh9kyaaPCJ4gMpW/AChRJ7DOiz6NuUCG4Ctq1EJ9jbhvBNeKGddCuum9tpus3Ix363nycHVZFXY/jnEuRtDfUaHSQ0ryLFYOihFyUdHF9S5G6t11rFCGsZOdGvhbuaO8/dMGxbiFK07l1+KE0a02gTulDyyPcWedlU5wsDNAd3JBDLpyjt3FxToArO5cpFJyYRa7kwGPvEU1rowzsO5upR7mCpo7J9XeHAsPoTCvIuruep2XyVMjj92CA9mYu46ou+ATKUqWs9sPCcXn2o+qzC0Wq0LPk6v8PULhzYjI9zt9g0cSArE2s7JeG6PK1+uyiUWztHxYzHkbyammIS48IxwrPx95F8x1dEWpJazzs2DCo/z7mZ7KV91jR2+ogpJ6HnR/Q4Do3H9gYpiLKa75m4CbhJsRI2HynqnN2eq12Ves3tOmv90KjylCd3JZZOZYlFcIyIEHK6ELnJE6QH8edif03I3Nrg6URW8RPiVP7w8uHAbKjdbqn3p7LnZLlSnmNzWzs7LKXFEQlXar++q84YEUtixrIwRO/wC5lEz+u4ACFXMr0GMhgIv+eXkfdzizPDNLZE9N3km8sVAPE/wiUk0x1o7nljw6GBruKRkIMOdVSZ2R72nsm3mJxXwp80GjSczOJobxXP5D/eHdvx1OuckfS4PpXCVGeIkgW7pY7BRJ5NkFC4c+ud/9IDnebVs+Ad3JRc1MU90nIjj5PqRp5od3gFEOZAfLoKc+Ay9WEEd7Vd1NnwwBKphI616FOw4l4ZxcaCtDEeXlIkd4F+ChzKPH5NzFOQs7WLEs1bC8aRs1g+wXYHNsuusna5StzgDYBDd29yvi8VfPjhSqDYOjLV3SmlFkPib5Dc3mLgwFyLpi0KTehOvfZwOPK9Ij/2/uo+xj7yL/hahFiJZdNZPsESIBwcWAM3Uhj5kshnSZUmwlWdIX0DA/dOMm7wiPRlpBIpk+LoACifmyiQisCMXri5b91028F6vV0MRBqUKoFIG1EfWG0kqtI4SX4ap4W5eRt8BP3F0Ho2obRx3nfeQmKBtNiw0NZzTYn5i8WqcPYVs2henzlpKd5yzYmtOcQdc4e5Bk/UG0wdo/xJfA6Hs+2Qk/nRnalxRLihIilERio1i6V0U99PdTQsIvlk8GGcnVkkvQsH7WKqZ6VNSImj7Q2p8wFGTfgLbwOHvRitwMjnF0ob+VaD6wdPOlk6S/rv2odIgzFeePyzV46QNK3s4VqRANsvSWv/+IBNEnlrnpZtCg47sdO0cb0d8Zn2gII8H56SBD+5YShUhNTgvme63+K7AFhLI7xa6ZEeNEfHg5f42uVrzpDdJl1YKD5bJ9L8RoPfReO4Nxg7xOSUvN/c+h02xE3veiRhIFmdoSOLvRPDKNoSzWKWDQ3vpaz5ErSOAPJ3P/wabNYF85lDqJU5WB4B380l8OgyJg6hk795THvx0/rVMT2WCUMcKaFTHltARwkAVdzO5PM8cwS51ova6lKEozGkt7duGUdGV7hZXm8Tiw2o/Ea02Qt43tlzPhyfAgqbg4ECQ/HmtFGkLoRE2G7LbmPl+1G8jZWrNcclW5surOzLCdDHERZcdSPewyrUgRh+NRFfASe4oYbQK3Crmg11fCrDp/DLSbrHNoy4SutzZTZkmtiH4QuarwbkQ4YnR6qEukoWeCBn7NBOvP3dgrcBVsa0nyyo+ELuf9S8WuBD+V6fpd+aRtNCGK3pQANpLDI3JvC0V236ZMtiluWF5GdCbvrSezrh17K+3pSHl+aVHhHchXAtgvROhaf3tD4VVpJH2czT2E3WmNDazi8AAvA/EKs+GBGET2uHw3EKWEy+MCLUSrVZhknUUQdKVO/Q3Zqi/l1wksEuM9dYwAADin+Ioqoj1+7vzsVVq6T7fdIUhvCnqf0GCrDctl9JCSLDsYaHrlHsoDNzahItrzNSAKbGUpb03kvEhK9O1ealV7uROQ0oJ45niW9Q7Y7M8dfbD9zy6Y2jnGx8hr1SEkprTWVmGCTW5KU8Q4frkRJVsUtbpz+n6mtCS+REH8SLF6w07JBTQ5KP/8YYdhdDMdXbrOP/wyIuURmtXLavh8D407J4UusDL01ubYcM/3y5U+ReBoYK47UxfGy/kCSwIOg+I66553cFhUXH2d+Eq1G/Hp3Mmz/lf92eBHKGYzlCGsxj9G2JMn8lie9xw85jM4j6MBwuhRDGNFxNc1xZ0RwD0ZjG5sDWacwucUyd0Q2zhy2Dg5bogY9bQY3y3CL+8F4toh+Pv6l6YemdFbjJV2g/FGL2crnLr67J+FixLSGV6BhxA2Sc0nQakR+zA8M462F9DcxEKFPbxLThFJZZK36vgu7HxZSdzwulPioYaZj8q8bc+rf5nIjAZkBJZJTCkNeCyRZHRZTfaHb15knyuDmjqYMu37i2kbs8n6u8jijG/SIbcMenX3iLPrCK6/5P2v7v45PYNL53BSCqOl6x6vlZvB3wkuD2KOucibM8PoXuMZ/HLwVuGexOc7kmFLhyAA1LeiQ8jmLtnKZCaqnUvMV79kBwqkvg7tIbX7+9jic7URXecdnEPBvJJcA2/W78E3JgLP/LJq9rrxD8CW/HlgbPEdEp0sL6JQ97JpVLFxoVHXEAVL1u
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:SdgzOOuJMJeCSgzC/xxpijQAlHVVelJJibc=,iv:ZdzBii3Guk7rgJG3ER/YY1MMyM4JTUyONYxP98w8zg4=,tag:btXFoaWoIDjf3R2eonkOJg==,type:str]",
"immutable": "ENC[AES256_GCM,data:1dbbIbA=,iv:eI9JSQwZKOAJTiUbLawrY9GJdP/5SqA4NqmUp4+QB5Y=,tag:cRC48PEjslNXeCH+ODZmGA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reloader.stakater.com/match": "ENC[AES256_GCM,data:rYnVGg==,iv:ee4A0adv4vG04156hE5T83TFy7H/qcyYs1Qpw2nv3fc=,tag:8YLOUVg3Fjcr59eCgUu5jg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Vg==,iv:n0cGnnDWOQ321Ss+J4F6yCPPCp1KCcvOyV+IXma5WdI=,tag:eF028MWMcySOxCrp8XTiuA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:KTs5w3Grw64Kq92PWJ3L8A==,iv:pLmB7SnR9GDWtf1fXyNLTRrxquqyqJKxyJBLUOzZnFs=,tag:DVGltneXZUDbd+iVmGqKEw==,type:str]",
"namespace": "ENC[AES256_GCM,data:gZ0FFnK0L2GD,iv:I3AINkhzG/N6FoDEomXcLHnXHJk86sXqThORCbiipaY=,tag:dIeuOeTFVeJxSala8aLixg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:m7sSYLSc8ysY,iv:wiPl9inz3fE7S5Y324fWokv4ZXbFdMN6t9RO8C5Oyu0=,tag:N77VzVZuD6LCGwG5xOrf5g==,type:str]",
"uid": "ENC[AES256_GCM,data:E3TWDw0749iwGrYVGxKdkOxFq4OSMNto9g4UnqJkzYwMX6Vm,iv:Qu0hWeAalJGtf3hxrFeF9FMyE0DcK0a/q+l5xczffs0=,tag:1sKjTQgJ1EJG9DqRnSjraA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:j/5l2r0UDi8=,iv:UCfmL5SMqbFyKDSGszN8mPifqYdgB62yM/4/GbtEEYQ=,tag:Pw8Q6XH1eb+Boecply1I+A==,type:str]",
"value": "ENC[AES256_GCM,data:X5rw8A==,iv:APlJr+PfQ/gwICUMd27KPWWeM1cxIYe4wWntyH6OBJ0=,tag:8bN4TgOFOSjaoueJagql+g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:ROzBxBw=,iv:WeO/QZTnrTZLIvGjV0kHk09gX3bWqBpRS8QvGEQrmYg=,tag:FLon/+o5gqHV8ELioyzqtA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:13HxHalHuAU=,iv:4Xq8l6rttD7UWHj0CfiHFigSAflfPnwJ6HjlY6xuKB4=,tag:9GkMf81pxCInSCF4x4jaTg==,type:str]",
"type": "ENC[AES256_GCM,data:Z6gsHuqF,iv:zkPOitD9vWp07nrBd/maduvVZe50OqpQF2ZCqmKeT58=,tag:jM10baunmmaxw5PZl0ZFEw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:SyXvEloifnE=,iv:0JXzWnXVLstntJR3Xa6y7oUXQqMW8GiMzVWVWf9lvEU=,tag:oPHGZHSCS0aCEGSW+txNBQ==,type:str]",
"value": "ENC[AES256_GCM,data:I+3hrg==,iv:hdxd6yCuf1GS+j1hiFKSg9x9wJogbTsI6THeIVZafH4=,tag:krfIjG9dBZOd2+oGAaEwFQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:URAvsH0=,iv:LPqU4nKMGIPsgk7pzEfphlVvuEVqFLyc27euJpn54jE=,tag:VIe358ngkATW9bA3PpXoKw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:x7KebESKan/j2bE=,iv:36O2opye0b+Z4Tp8awQyXN3WrwJLBugJIUmuOF8VIZo=,tag:BDhfpdHDHQwuoPW0aNOExQ==,type:str]",
"type": "ENC[AES256_GCM,data:K7QO1EeJ,iv:FWNY+IpZmXi2n+259lcy64+hiAxJruybkq8ppVhUFXM=,tag:YBYpUXp+yhdlxNQ9v0GU0w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:PDbcPqovfOI=,iv:SU1LVDkvQE4ZKg2TcZhlGhpGTfFQdA1TyoyXmigI1tQ=,tag:KnKcstKTs/2TXM3GurUKOg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:awWlmJEtdycnQSUEQYv5ILvEHsNBl4FDjNojw0BJOw==,iv:S1A8ygWcU+bjd4OaxlsBwKpM7mS4aDC92sQ+SIrGSQ8=,tag:Rffi22CAf13YUPKp7idnbA==,type:str]",
"ENC[AES256_GCM,data:drh8AHtXbzpmD5ttFjC8P6IU+CGNfQ6dmJsZKWCopyizEBRFz8piWE8c2zqmNa4=,iv:/kiZGL7Pku3n7e6Pn+ECUggzcckA3F5D7OJr31pn/MI=,tag:FUeoCJwHQIJKRZF/kWS3vA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:6cKLNqa4zkzG/s37jPtzuw==,iv:BIS0fTe+F/tjbrtsJC71Of7Hv0lAGqh8npWJOo8y6nk=,tag:d3STXmprClTOdq3Hpq+eIA==,type:str]",
"mode": "ENC[AES256_GCM,data:6u/ej50TQw==,iv:G+yj8F9TeLLrGfQEap1A8FKPlDzbcB+fdoliB4k4htE=,tag:j7tEfy3k9J35GpdJgm1XOA==,type:str]",
"type": "ENC[AES256_GCM,data:lLZVkTWjpo8hc+WixGlF9RoDWTBC,iv:NBQxiAoGEvH8JV/12VPJv+Qn6kuxxIltqElSIBfvM1w=,tag:mQlIRG7p7Lz4OhMA0cg8sw==,type:str]",
"name": "ENC[AES256_GCM,data:7GpstMrLVOXC,iv:rRNxIK9dlLD5lz6FKoyq1NR4e7Jleo/n9l4K8+EP7rQ=,tag:cDN03xs2aNo7gDOsVJP07A==,type:str]",
"provider": "ENC[AES256_GCM,data:zgfUC666QlN947fAwym5URHI9JGoA/wzgnBFBrimszeWlOc3IeHu1NirzrMD9oNpUERSywOy,iv:2rS7Kws7km7u3+zlYRIZh9ffmlUNM8DFx1ZgmIGImo4=,tag:d9mLb4Fk5TcDOznA4nNmng==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Dw==,iv:9rVxtxOamzwuLOIrW48D1FlUcW0S2bNc2CDFA8k6e+c=,tag:IK4TlvpqEXS2Z5yAMLG/Jw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:SQgGtsrbnsRe8BSd3P3EeNw8Yg==,iv:mDWBPBmhj5TZ+VUaM0/DleS/i/gciV0FQoR3FEKtqI0=,tag:ZMSZnxn+Ch7G1mZtn7pkRg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reloader.stakater.com/search": "ENC[AES256_GCM,data:OrBR3A==,iv:IQH8gIZv9sRH274imvp6Pq5W4ewmsM0KYj7p2Fpp8d0=,tag:bLdByjgiegabPEVSXcK1+w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:qJA=,iv:alZUDe88G82Q2Hpe/DrRsk727Vgb1qzmVWAnRJxyPEg=,tag:xoTSt2YAHS4n4pTyUbzpDA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:ahtAAhDTVnDd,iv:7du5vkM34jmbf38tXYtrE4glrPlDEpZKxdzyG7tzYHI=,tag:ClZEsupXBrS653zWuGTYsQ==,type:str]",
"tier": "ENC[AES256_GCM,data:Knm7wM7P,iv:8kSzz8NlU4kbHIVYk5dCHjXqOvGmf7yoPjY2jB5oJbs=,tag:mvhNKcx+Ta9Wbkct2+JCzw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:s05EN2pcUfXF,iv:qiNR6C+uB9uT7pcXVfRtsliGN1SNguJ9Es0OrktE840=,tag:8Oc9seEo35Kexwuj9r213Q==,type:str]",
"namespace": "ENC[AES256_GCM,data:eQISoDwANPgR,iv:5VY6TzHZPX8j442qZ/nwZf0AwJ6cEJGkqf1BLJxKqNc=,tag:tCaAny6ND/aI8ebujg5nkw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:pP4AB0E7rIUr,iv:4bqCj9FEZLLF7HDyGXT8aXC6hsT3bsH3J8sPaF6ZSds=,tag:YPA2I1XnGvTghl/B4tUMYw==,type:str]",
"uid": "ENC[AES256_GCM,data:t5shD8QbRlS6U8ehg6d0fcOQfgHQueq4Ek4RjldX073AXo0w,iv:LRdBWDKuwFbmXsND+iRMPVSTVQspLxNitdmOZMHdd/4=,tag:F9fKRpGbp7cAuVbrWQWSKw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"min_ready_seconds": "ENC[AES256_GCM,data:9Q==,iv:QOv4FTQm4C963xuyENWu5c9dS1qbuJBrt1cF6/PEHFQ=,tag:oYxS4RrzdmUWbuVZPS3V+g==,type:float]",
"paused": "ENC[AES256_GCM,data:TlG+Emk=,iv:IWZVkiYsoQ7IaZ1CN0xeAwYsECsEddx9WcRdAo5DJSs=,tag:TI3WgNupg4VX4u6HllrDAw==,type:bool]",
"progress_deadline_seconds": "ENC[AES256_GCM,data:Vf0W,iv:CC2x9omrL6MHyz9SmFiEArQ1X2KxAt/lVUecc2IU3iQ=,tag:MTTZGPvNvvQGgceDUvZBRQ==,type:float]",
"replicas": "ENC[AES256_GCM,data:Fw==,iv:z5hK9aOJD704/598bil+HhGi+8lNokpAmILrLPE9GCg=,tag:cq13RP9ZC/rxrIFjt+8B5g==,type:str]",
"revision_history_limit": "ENC[AES256_GCM,data:Svc=,iv:7elQT87fx/U50Ag92Uo/zPttNwCaK0wbQQQB28yBzIU=,tag:Ow7CjUXGLjbyi0ftRzREKQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": [
{
"match_expressions": [],
"match_labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:rJVWCeE+pSmG,iv:dVChGCPiXvd+fob/nNCSlm/ovGkQsboEa6EYC83Mxj8=,tag:Ff1508ymW5GSgfEqHCvKrA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"strategy": [
{
"rolling_update": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:RIiD+J7NPJo=,iv:KCwz3R/UJ4olUUrJ1GGaga8wjoqAK4VNhG/js1MDib4=,tag:Gg+9d32m+Izi6uE+p0KJiA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"template": [
{
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"diun.enable": "ENC[AES256_GCM,data:jJyx034=,iv:Ll8/mKVk2PQKtab3nI/lbbjRgLLeXFxv2awCVEhy880=,tag:925SQCm3LLjpqX9cj5qTjw==,type:str]",
"diun.include_tags": "ENC[AES256_GCM,data:h6wj3/UvuI3iVLJ8g0mD/N5fBzD7Aks8Pw==,iv:ofkQShjIlH3qBRUiQ0psSod7KY+VLOvW0IpQZECVB+k=,tag:pGcimEKZey8Me9J3QY/sIA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:ag==,iv:5o0RFWIVJPlcXi8HcMjab4nmVNwgbZKNvmm9/+GWd+o=,tag:H39Dref58Z6DNm/dIYLAeg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:mHSJt2SBUs3I,iv:JHrToxS5vzeXaTJA0E/FknwC8Je08+a5xicCHG6gK6I=,tag:utMtvuc0h//PSz4f+5eBMQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"name": "",
"namespace": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:/w==,iv:SumOgr6xEfWND3MzSLdbCWBYaBxf9yjiIJasxw/owso=,tag:lve0pq75xNslaHy0xDFjlQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"affinity": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:AlFk1w==,iv:3hNwdTg6OCutKIv8Jk1NslGXMx26VnT66DZ0utTA0ZY=,tag:ezGCWPJ7YcVZmNFWc5K4sQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"container": [
{
"args": [],
"command": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:8USK/A9Nhc98,iv:f1bxXl6p0qQa1OeT+RFdVnge14RvGeoN42MrFoQLDuQ=,tag:h/sx0fUnFa7g32gQoz+4ng==,type:str]",
"ENC[AES256_GCM,data:hTQc0mA=,iv:K3BT+n/XMGcWi3Yn3brPCcKdpR1npkV5854np/VkAMg=,tag:4YQbmmVwB7jh9tCJWqAxVg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"env": [],
"env_from": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"image": "ENC[AES256_GCM,data:9UxORnPXyfN+v5JsQua6LXdAOfhmtT7Wq1w=,iv:MxU4aDw2jHquBATa253/NTXFfCmRN0sJWlw24VXihqU=,tag:m3fMDsr0m/BNGGh8d7guHw==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:xnIFAR9Ah/m+DGwj,iv:QSZ54fWPkdOhk8jTMIFS+o+aRnahulpisTMDJ0ni7rc=,tag:DPpuJJ9taTr6M+pSaxg88Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"lifecycle": [],
"liveness_probe": [
{
"exec": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"failure_threshold": "ENC[AES256_GCM,data:MQ==,iv:FYFjR2Lwr323z0L81JpQykbofE381DIPhhRtsJafauA=,tag:A5Ru2Z/w9TFKgP+Jv3Yplg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"grpc": [],
"http_get": [
{
"host": "",
"http_header": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:Co2yVqGFKQ==,iv:n4LI1zc4MeC3FdqYKti5Jt9ubNWIvMRDl/4PWdGps4A=,tag:Ym5iu+RkGJGWH2Q+nU0bqA==,type:str]",
"port": "ENC[AES256_GCM,data:M3aWcQ==,iv:dxLlbg7Jv3s6HnDBc2nXhacMl3KWkNGvlgNK8md/qrQ=,tag:fNFCXCvsWhzQuTV9xMMo0w==,type:str]",
"scheme": "ENC[AES256_GCM,data:mZiXZg==,iv:HhX3uTJy6Q7JDsh3lvzY4+V9F5aqaSTcqPKAdNC0ayE=,tag:AlmudC57q4Z+s4zWDnKF4A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"initial_delay_seconds": "ENC[AES256_GCM,data:EYc=,iv:3IULPFXKSvHwaQrZBxBNOSYstXkxYc5lq/hLnMQQmJg=,tag:pfNUBJnlXr2YjnJjG1bUew==,type:float]",
"period_seconds": "ENC[AES256_GCM,data:hvo=,iv:U+WXVU8ftjYkeBjPdPpWIuptOVLrGW3UQp/KQlnNbBc=,tag:ADQNusXekyPG2rNgB3dnbw==,type:float]",
"success_threshold": "ENC[AES256_GCM,data:zA==,iv:p0euL+7MLcumqM+Zqc3Av2F+/e7d7OXb39LJVP9OHb0=,tag:H7nWuJfE0588R7ZGtsg6Qw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tcp_socket": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"timeout_seconds": "ENC[AES256_GCM,data:0w==,iv:ugXda9EYR1ny36M4tKsgvGBfLqukAul4BDo0fX7jbEk=,tag:8NAxdfItDZNUEDfkTd6wsg==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:sFrp6ih6KrJg,iv:pGpXLJkxViDDXePWY5Yu6lZOsSPskCsWhVcKWzduFGg=,tag:Xv5vzGhqXKhRx1zFK7PVkQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:Vm3ZEw==,iv:qsQnJyLnz1N+p9TMMRulQlJ7OcVkhnuTPr4PV0UgK4U=,tag:QPYCGoLr7GeMmA17IeSi7w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:kw==,iv:JCNXK7h4gO6IQEMGmKDZ6q+g8oB80A1GHyKiXAsO+vY=,tag:VvOVvs158lWWoMZZuWP79A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:SU6s,iv:5vEaVTYrGwhpnAWv9KEd1uciv0n5BdHfcdX8239OQYU=,tag:FnBnZVBS42OtVRKDtg/DIw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:GVzoKA==,iv:yeRTzHyLXnIWWTWQb+Hr09mmBQvb3B4aDoq/WbxmE84=,tag:rHSbqh0ay8poaoQHb8tSRw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:DA==,iv:E53s/L5Xbmtof3kci7QuKhCBnMJnCsz88QaHMQoYIw0=,tag:pRqDsnXP36q1LzTVNIzl+w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:RD7x,iv:VuPG/7xeXm4g5ak8T/yFrcfus0STofTikx/lo7aKVoo=,tag:cGwrZSijBKaRUpmM3qY/mg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:a46qCZU=,iv:59JvKck+d5YgfYoQ9Ms5vz8ZNeJfzbHkRDquTVmvSWs=,tag:wvrRxNMt85k7IFZ7fzFW7w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:iA==,iv:3uJ0r2nPrZXLMVUAFXVUa35HLy8Om2ApRVhJJxf4dG4=,tag:6Yl9u4iqbAZXeNFPWs5GqQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:Fdky,iv:K4p316zfiFI5NV4KSKQCLReFaCFhX3yVKwhJOUU8NVU=,tag:nXgbt3i4jOlvYGvPbaJRgw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"readiness_probe": [
{
"exec": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"failure_threshold": "ENC[AES256_GCM,data:hA==,iv:C2E9H2ePLW0EgJ/SUu7KNzQM1CnyWO6a57U6WAYvstA=,tag:3VqpjN3Aq81N4p+LsJ/Tmg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"grpc": [],
"http_get": [
{
"host": "",
"http_header": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:2kskJCiYCw==,iv:m6S37+Hd8h5sxmAVVTu8EqVc16LD92/HmAQjBvhOFoA=,tag:Vm6csSaTuQcgAQc924RhKw==,type:str]",
"port": "ENC[AES256_GCM,data:P1REoA==,iv:OlH7omXEmwXXyvFmtE3xf0Zn+Z4VhFW5zW0ae3Rw2I4=,tag:ouaKBUh5/uX422ooEDXxMg==,type:str]",
"scheme": "ENC[AES256_GCM,data:bpL7VQ==,iv:fSDPPK+vn0ZIlcCzVz2doKCNYHb12yeb7ZdqP7/rffE=,tag:dRjRqSFML9NhGJOsRz2oXg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"initial_delay_seconds": "ENC[AES256_GCM,data:6g==,iv:v1ppOn+31Nkh0PWOmJhvzO8rrGt2lflACLd51/fCOkI=,tag:s2bsmF/VD5B0PdkdY5tImA==,type:float]",
"period_seconds": "ENC[AES256_GCM,data:tnc=,iv:cwCRNWpyKENv1Sj5N4vDDlCwsxba4jEsFppf7odRtQ8=,tag:uhPVS5C/XaE4RQMH+k6Dww==,type:float]",
"success_threshold": "ENC[AES256_GCM,data:zA==,iv:iiYh0gW1zxeCZQaF5gYmKKlMvMHPfcvcqfGqBHya01c=,tag:BctINBi6AhWYiohFr//61Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tcp_socket": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"timeout_seconds": "ENC[AES256_GCM,data:og==,iv:Dg0SRZ9awRnfUb86ApmS4T4RFjefudKbIv8H+KkNWmQ=,tag:l8kB4z4uQY2bWrL4xugHEg==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"resources": [
{
"limits": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"memory": "ENC[AES256_GCM,data:es7Rm2c=,iv:EB6Z8Al0KjZZ7bm13nwGlAz7CEypRSiCRpGKCCH9Ad0=,tag:8xkFOzmuqfFJLxFRxY1HJw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"requests": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"cpu": "ENC[AES256_GCM,data:hs/3,iv:PRRJVMD7IrAM1Hh3BAr7w0RlOBk3figlnzLiGzKsYN4=,tag:D3BLr5diHuxOWQp5jaAB/Q==,type:str]",
"memory": "ENC[AES256_GCM,data:eY/mJ1A=,iv:I735w9rNw1jyn9S7HvVgTBLEWg63sX638PStEfODMVA=,tag:jymVz59Dr8I/+5Ue8JHQxA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"stdin": "ENC[AES256_GCM,data:KLyrHmA=,iv:D5/fAJ7pJK2FtXUhbpribJcDjTjY+gGQtxlcNPJjpSc=,tag:vJBl2YVs1cX01RmuGuXrXg==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:OecjT1I=,iv:Sc3YcVn6GH6lg/OLfBBtHJ79XwdNJfssVaR91AkqIus=,tag:k82eKHS7qS6p7VuJtG0KYw==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:TRAmiApwDszXvGQTBNgcHvKFgQk=,iv:DwYGhM1q6q8ymEND5ypsatx9Wjx40yT/+C4Ipoglrvk=,tag:pKmDbH2rkNh3tXu1b1rg4Q==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:WikGAA==,iv:o9kumilPaPM8yiLeCkL4xAKOzGSPRLEvPztpZyeVR60=,tag:eBAzdrVrHPbOYvSVe3mxiw==,type:str]",
"tty": "ENC[AES256_GCM,data:YnbIiag=,iv:ZCtyD2Hyv4W/S6LaCsEIt2/nhVFgS/evpUBoeLdLAws=,tag:82vB1wJYczuCjOnTgj3D9Q==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:YTBKP9odwTGESMXg+CQ=,iv:2kX+KLDRAsI4ZF0nXkLJurqWvTUh/st9MqwRxxVwri0=,tag:HMhrtx2C40yypet8h1jw4g==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:k+CwyA==,iv:Run/OWwQaUhXckXFQ97WvYg73OzRVhwf0BCJO8jvlbE=,tag:T10lsE2JqqwT7Wz1X9LA2g==,type:str]",
"name": "ENC[AES256_GCM,data:cheuTndgTy4XGlDdNQ==,iv:2Nky+YqrjHYLb7i54wtms3tfhVWI1lHebCWODDftpEI=,tag:JBocPi0ZjWNEMMg/ucCfPg==,type:str]",
"read_only": "ENC[AES256_GCM,data:7JyK4lU=,iv:jsgJGiedWDbJghKtEzicIW5g2Re1AKuN9IEVKAQ3vfs=,tag:9f8OBu+w0Ue+iskcKqOnsg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path": "",
"sub_path_expr": ""
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:TpYr4A==,iv:fejxno+HONTpgrVKdPEsf/cSlYpRBzWeLf5wq5/wjHc=,tag:Q4ugbjtcgI1VlzPYJ+cPfA==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:FM6qAg==,iv:D2EWWi28ZQGBmvW5QB3oAwGSLtrAc6JGABPEEz+VT44=,tag:pQjw/oR4Yd3/oX/KApy7fQ==,type:str]",
"name": "ENC[AES256_GCM,data:b2qsDmT7k+k7kA==,iv:AiY7UmQg2fzI9HhQsix96uBSEyBTQ3y40pGm7S1oPgA=,tag:j0IivQQ6/xQ2Sl6ayyOmJg==,type:str]",
"read_only": "ENC[AES256_GCM,data:9JYUQSc=,iv:ZFUJ604bMvnEda+j3+v979rVHLYqWM7xYd/HcZNevgk=,tag:XGhgp5R4HOs3aqG5cE/GYw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path": "",
"sub_path_expr": ""
}
],
"working_dir": ""
},
{
"args": [],
"command": [],
"env": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:rUgxjdpIKdEY,iv:ow+B2HRPCRh59zeYD2hIgMIyj6VvK1tY1uoeROp88Gw=,tag:za/Wf3zoVqGksA8yvz9iKw==,type:str]",
"value": "ENC[AES256_GCM,data:M1MoRQ==,iv:ebiYQYy8yi6qkURPQJvEVJlOCf9uFoE1WPbIizySb6E=,tag:ES7G6evZLWIQN9I0rgtEQg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:C3CjAc4cn5QKfZVbCA==,iv:xttsGHwDO+ytxfhHjrUnvLBZ79UQFeY92qhnmixP63c=,tag:fIF/9oVUl8vMFz671zuREQ==,type:str]",
"value": "ENC[AES256_GCM,data:zUyARfzm45pRWr6tZguyHmReAVIL,iv:4HZwbQPClwZkLCfiFmOxsLqT5EGDD+7Rv5M7feKZrUo=,tag:mo1/MwOGlgFQHcL1SUueZg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:2k+VUZQzMVA5C0xBeQ==,iv:2E+HGdjo3tXYdOQ/D5pdSESyPlgWh2/UDTEMI0qWgHo=,tag:5DWPebUuabORjdpyN4Bmrw==,type:str]",
"value": "ENC[AES256_GCM,data:sm02yJt3XojG,iv:8l9k32zFOaYKnM0khTGWy3x0yHYRcS59RfB/aZSKxN4=,tag:UACC5divdV94+8XlzqZ7oQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:m+Rc8Keo15hMAj6o,iv:He6djWS3CydnLNWbp69FCIfWeDdEHcM81nIj5R5HJXg=,tag:80EapqrsFNlIyhNNUi3K0g==,type:str]",
"value": "ENC[AES256_GCM,data:xuNWcksMAw83Vw==,iv:NotqKuV7KYVB54lg51iDbEYreMv4+P+yhIJwDkBGgBA=,tag:5nw/+nMzOr2TD1c6MnEtcw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value_from": []
}
],
"env_from": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"image": "ENC[AES256_GCM,data:MTKnvaHnAR7yaXTcf0i0+DjhAGG7764F7rwCXyK0HNVhw2P/6g0FA7I=,iv:JzpGcbNpepdhJsJO6wxyx1Quvo7cF7w6x9hqzaTzX4Y=,tag:K8Tygmw+utqHLOapG0RCSA==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:pFX30QaV,iv:8VnvKy0Z3GEJ1qCNldolx+Nh3cKGprvcVNUUT3MNGnY=,tag:Xow+pHDdQthq/4xedM8bUw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"lifecycle": [],
"liveness_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:3sHHb3mrS6gz9fB0,iv:KVRbOFsOkXyJsblJ7Bz3rnSU77+1SJ5iewbkskaddIc=,tag:MjdsPIBuoHMxZ33Le6jTMA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:TAGQYw==,iv:ciPbXukde9XM0t42h5yy23SVo5jOTwcRrwCBJhYzr+A=,tag:Q3pwYGvxwxuo8ndt5KMSQQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:/Q==,iv:RvKydLcozJdtYmxy4kQECdDH3+aigRzFiHGFUzqby2A=,tag:ZS8ey7XVKps94v3FmysRWg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:YNnm,iv:61nk9FZlbqEmEnCSTjtDEcWbk7TiarHAlS+ZxzjuJks=,tag:zKTdEasqcLFdmvyQRjKFZg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"readiness_probe": [],
"resources": [
{
"limits": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"memory": "ENC[AES256_GCM,data:uLp2osc=,iv:wNCycXRAi7p+5BbJbEJAm/8nWTka23FTL/M1sx1MPWc=,tag:LTWscziXLB85THUQurtjew==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"requests": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"cpu": "ENC[AES256_GCM,data:f/kO,iv:L0+/fuLDNX2LRr0IGIKGYmUmNRaVi/Wxs81ZP/OIwpQ=,tag:AB9X93LQEzdQQJhCb9TD7g==,type:str]",
"memory": "ENC[AES256_GCM,data:eO0Mpio=,iv:3AL5qH+LM/ozVt2oPJpvhqjwANqasES8oHovhiwngGA=,tag:JeUAadNnXJhOcYCLaQbn2w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"stdin": "ENC[AES256_GCM,data:OELW71Y=,iv:c204NEztGDuPNdq1G5R1lwWQ0aS4USe5tY4PRWVC8lY=,tag:XhbCDJoY0OTGKEqElMJ8Pw==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:dvQ0kUw=,iv:qRhpg5RKng5xNyhkUARtm44Dg5x5fum1+yZADmTLF60=,tag:rTkX4n69Uuf3DYJvmpQ/bQ==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:Iu5lHaIHU/YyGvCKhSwS9UBxrpk=,iv:NfkyrYAzC0tUysXTg8cDjjq1VjLD8EfmrWQ3XNj5XRQ=,tag:P2ZsP/etbQu0JGWggIq1Dg==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:IXFmlg==,iv:ECUW0tMp5yk3CAxmFUvgapE+H8qA5ojIrNNblPHgx0I=,tag:m1F1UkUMtGvr9XXouH16eA==,type:str]",
"tty": "ENC[AES256_GCM,data:ZwSlMtI=,iv:ucHxQ5QV4hv2NW7mmxsRO54UuJhsE55NtL7JzVaUx28=,tag:71kmkBRlNAuXd4XUxv+l6Q==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [],
"working_dir": ""
}
],
"dns_config": [
{
"nameservers": [],
"option": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:0L/T1gI=,iv:CQyUDFbEHnPzntgBaR0JmCLWfVsu3gkLH2sozSzQsnU=,tag:botQbhU6sTYf/mAQkDZw1A==,type:str]",
"value": "ENC[AES256_GCM,data:qw==,iv:GlxCE+pXMCCtGCFEe5J8XNwSTWcE0wloZSa38tMdla8=,tag:Hfbf6ieMC5bk9CBWjMF1ng==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"searches": []
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"dns_policy": "ENC[AES256_GCM,data:ZblrdSP5vG033ySF,iv:MzoXp+2TLaW63/9x38EQ+W2tBjYMLTIb8Jl8qZTAsEs=,tag:CTKTnYEIDgCv6z9Y2gkK5Q==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:bw85qw==,iv:suaG/IfXmCkCMMEQ9sGXUlyViVXb/1dN9DRUCcIt7rU=,tag:ijBqJG0FlJkXODqjuegEEQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_aliases": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_ipc": "ENC[AES256_GCM,data:9hiRJCc=,iv:1+uusFxtMu3RbXN5kwwu+mr0xNbqbW4YC2Kx+k+ATD0=,tag:wcyB3UR2MviGyU9NfN4iEA==,type:bool]",
"host_network": "ENC[AES256_GCM,data:oZoW0nw=,iv:GURhMMv7S5HUZawW0PvboeFnr/OjF1P8EZYkake3FJQ=,tag:EcztThHQpfSNTuXNdwjWXQ==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:LNMAWMg=,iv:1LtJcHVF0JugheEV82xLUiiAXrKCRxA7/k1dTfEBefo=,tag:EG+DTm0rJq2D9TfTWffZYg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": {},
"os": [],
"priority_class_name": "",
"readiness_gate": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"restart_policy": "ENC[AES256_GCM,data:m3g+FKOa,iv:JDLIZsq/Xb4qU9YNgJg4lFGPG3fFJpyHSp0+O89UmQQ=,tag:38sfy/LGMN3l8ZJNjM5FOA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"runtime_class_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"scheduler_name": "ENC[AES256_GCM,data:kDljSDcVhYcMiVZE2FxI0Tk=,iv:nA9icLJpyesazq+iOie4PkHf438HVqS3msMyIpORCj0=,tag:zhD9jjnnr92CHPbT1B0ZnA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"security_context": [],
"service_account_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:WFxW1j4=,iv:lx94ngKvbiBl/N+5rebQxXmnbI/muoasWI9FRwWCMvk=,tag:IJQQ8dYEfInDbVQ2mlPepw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subdomain": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:J7A=,iv:CdEe1TAi3rxZuwRg07QzakB4FDD26PtcWiI0rsl/6OQ=,tag:q4Mcby19E4VXkVhpX8kezA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"default_mode": "ENC[AES256_GCM,data:o/XRUw==,iv:HYCCys3NiIQw9qIW95VdCPCwDVYc+GelAo/ZESxgtW0=,tag:3rctbKl8QbuPl/VVSlwwDw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"items": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:QnbCyHSww9jwKMA=,iv:tsQcsyWbSibCkXL+xhMx6Dq9TIAmNG0WQTkCi3UeZ20=,tag:ofcPgZ+Ng08nyceJ+MLJzw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"mode": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:SPRCeo43477I/0s=,iv:w4WdrLTua2Kaeqqzzyr1TwcMRG8nVIz0kSVsHbRvPsU=,tag:3UdGc0sHh6CgIM/xWhdlDg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:m8HF0OhgL4w=,iv:pcq0pBw8k01pxEAcDvMQJVEwQjvEPEV3+60zEaUYdLA=,tag:JtAZiEgDnM0sFRgsduSVEw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"mode": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:/4CrLOM3ty0=,iv:2xOZQuQf8/s6Rk8aE73JekqVDJxfg3dU0Ka7lUR8+Xw=,tag:wV/PAq2mGLJNIJoLeGwrgQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:AnhUOm7uYbI7en0dI2M96g==,iv:dD/VIDRj+6rDn3Cw4HA+0pSlR4eKCpEgy2FGWKSuAUA=,tag:DhLS0x1ihSMs/vzp0g385Q==,type:str]",
"optional": "ENC[AES256_GCM,data:GLJXG44=,iv:V8tWZZhBX0lgxlZSQ3J81qf8hk3KoAQejJd5iS6Qj3E=,tag:fcG3UP7fPr5REpE5EOucQg==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Nf5TLMRGZVwwwEepgA==,iv:OngedWBDtV4gmIAZyC/iFK/VjbHhOwk2D5Fmpf2n898=,tag:fZXhg6vcHyLQvvfw9+93UA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
},
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:CkAnLCAJIlIFOQ==,iv:10pmlOwoYv6EXN+RCYSkoNiOV2D8iSAEzGhxQxLFJ1Y=,tag:HbF6JxcMuYjNxPBLigbw5g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"claim_name": "ENC[AES256_GCM,data:5LQD2rYFEBZGI/+aWW0=,iv:eYZs4VIrCiP82e6QnerbJDoAc+A6ccP616yqtJ5+8H0=,tag:my0nobDKeyVEiV+IIKIsSQ==,type:str]",
"read_only": "ENC[AES256_GCM,data:JV8F14s=,iv:LIUfp4sCEyt+z6a/Ke9ej5VvFVOsS191vHqYlegYxmE=,tag:Q3murMpVNsgGYxqGyh4g1w==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
}
]
}
]
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_rollout": "ENC[AES256_GCM,data:3RtYyA==,iv:mb7e6KQeWmPtLb+xrS8VDskAIcBe/Mnwz8PThuOjZyk=,tag:VxhvTY/VUfp/IDXgnBXglQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:hTV9eRUbxmSzm2B2CbtZ4LNQNf1E4qM18zOWbLWGdDOjmUR0nVYJlmgPceQ0uatbw3bOxyRK7gxtu1T7H13JRpSjrsA+6o9HtTSBmlWp3Xwnb8eH1P7sScsPCBHvyw0nPKxtW49T0rjWEQs6XbbKJMk53YZHS/hnjep3fvBkhFTzZMS/C1ZT+i63P4NqPnfu9RcQZ71PtlOF+bLvgYuQSlSo6q4JSmt/bEGPRA==,iv:4UuarWeQ37ww72AXyJgpjawpVNf1jEtFI5Vg5XTwEEw=,tag:eUoxsE86iqxsS8or5zH69w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:/gkRnY8QRCTfrmFF56xpNSkjRQtRAIi7/poYQ4CSYrmqtq1HSvRjBvBTU8p+Hu8=,iv:x/nmDf3CRHCwK8IPablCIN92LDLVrl9atLzbNdz3Rlk=,tag:0mxXS1WxcPsJBDPlxbinTg==,type:str]",
"ENC[AES256_GCM,data:ULRgPa1PeUjzx24VjlGEsLE7K5T86W9YpVNfykfLliWd+mLZsM+/hHC+XcfQgaDe4WEH498QTdd3eZV6rVpNyoo/,iv:LWfK+W8BdA19SzUYGH8z+aKJEFOmNcHN1ASK1dQzcn4=,tag:37TKTbw9Emkp2v6KUjWy1Q==,type:str]",
"ENC[AES256_GCM,data:LFiNegOSThF7aosmzk3m79pZprtokhJmsQs2xvf0MJzFmdLeKmMDw/QNVWPNAIiwcEvRG6re3QNj7MeXQJiZMOUrcWONwa77,iv:QKbvHaUF6NscUTZE+Qc4omIF0iYzP3z0E/iQouXUR9o=,tag:Sb69IJ5PTs4Iz7hhjTsVTw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:77MxC8uLNsnUaMn27FaG5g==,iv:c/x/Pwk3szsvUgyL8qzd34HJdwkDtCkViWDptSWJAy8=,tag:4dRGgYM5fHiHYXKVd0vacQ==,type:str]",
"mode": "ENC[AES256_GCM,data:oU3PwwF1PA==,iv:HUH+LvXNmjidDHKyTyjekajomVhzDSdw2P4gaT6wsW4=,tag:wmOjmt9rVQkWg99/Ptp9iQ==,type:str]",
"type": "ENC[AES256_GCM,data:V6qtC43FRS8CfvWKd5uoKmxabJ0=,iv:/dXDQxL2d6rD7V8n+FORZDXWSxgVuLY4Hm7mJRbgavU=,tag:cTKt90hAN0Bb4HCkscQTLg==,type:str]",
"name": "ENC[AES256_GCM,data:KV8aM+kfawpX,iv:fM79tw6slX8ns+/cWkqs7eizNekqh1R1E5rH4qGHyo0=,tag:MffM3afEG0BZqz5qbtN5pQ==,type:str]",
"provider": "ENC[AES256_GCM,data:OSFtj4mMPH9qKXy7TELivQClpj+TECK+cyGHUMlfpi0HWX4HmWoMicyaAAK4J31M/RhhaoqI,iv:z/pHYcv3lTKhKEZApZ47swlVDWkQn87UDAWXDdhaiKs=,tag:W3eLCZp5wqOviksC6VugOQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:OA==,iv:6ObjtIpD52QqaOy+uFhJF4emHuEmxFnsb5XJEQx2byA=,tag:1ogtA/OWZh9uQp/8PHpaXA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:ImEjvzVFXEgt,iv:H7SMHdRGFe3R2rMivf2r4lM/EyleFIKRreesoYr9xqE=,tag:YUatCULbUJnzAVKfrdRscQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:/A==,iv:nBRdb70pJ9VYj5rbJZbp9aW2wWrZ14pyffqTtQcNE4k=,tag:Oq+Qfrf8f6eUv5kT74Ix7Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tier": "ENC[AES256_GCM,data:KqMJbJQi,iv:0mFhox3gC/6ZaPm2ueLVunESCmhldHD9ra4XuhYdj+Q=,tag:taIouu8eBnjIRFgbm5fOzQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:4TpqCbUJB/vI,iv:b37sDhTN/R0tG+Q3AJupOcVjZeFzJyRQh1l/hNZ9Vnk=,tag:EcwmxV6rYGiVAaT4OvaJ+Q==,type:str]",
"resource_version": "ENC[AES256_GCM,data:p0i4t6z7lvTc,iv:KZPXOWbzuauAHglhXeqHCm5mnlHUmLWQ/i+GvKQrx6U=,tag:FiUaT/N4YXM/W42GhGSPig==,type:str]",
"uid": "ENC[AES256_GCM,data:exMdXo0pEa2f/QSUYIk40n07CqInFNNRjaA9nk9CySqxaXu0,iv:oEg9F+O/zcCckwmDYo89yTxesjlprzm+NLj6tbsloHY=,tag:7/sKDwnOHJIL2yxpBbUHWA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:mbQlY14=,iv:ItmjAqQHXL7SbGewClp/V2IIlgPNOgrn2k4/y5oU1nE=,tag:tMxnaGnDZDo5I8aNtgpgVw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:gDNhxjgiwiUIpwe6S1gnIY6bpr2jvsWJygp7DnQfT+5oXuMMqSe0npC56471SAdgC2wDsr+vSKhh/eD+WYwWHn1HWZurLE4BM7NLmTyTpFwtyuNrGvAEoQ==,iv:gEUGHNVMBRSiYCowPuN6t8x4jL6R/ZIqMG/L6PcTxFs=,tag:TPsPzRTX6u92DmLbmY55Wg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:J81plbBYc/pI49ApiK/HPQ==,iv:KuRyULdKpXU4w5Vj7m+TrMQa/TCmFjoTEgM7cCJtEFk=,tag:FvW5B5I0JMNGSmWRZoHI+w==,type:str]",
"mode": "ENC[AES256_GCM,data:xtR6ICuA/w==,iv:hrthbmSYJOr1kXoHdD9CDcOUNWhDViMiUHnZpTVIDc0=,tag:DngZxydCGqs9PxejIfiR1w==,type:str]",
"type": "ENC[AES256_GCM,data:8ll0Nh38GwG9Hr6yzvJyQRnk,iv:ZAnJu4qd65ocu2SsRRKTwQXYCYinsOt1oAoRSKJjAOg=,tag:v4GGtWnQMJG0MyVMQJUoKA==,type:str]",
"name": "ENC[AES256_GCM,data:SKunx5ONMMZl,iv:TSz05wbqlS0hfUkTovn/qlfnlqU3zewBWid/+EVLbE8=,tag:HD22Z8xSa9YNfY53JF9NTg==,type:str]",
"provider": "ENC[AES256_GCM,data:9AKm4vveQa2HdhvHMYFEYIk0oPcuQre+cm+QQ3a+z8Rbr70xluzeGGNSG3zPdA+GWIrIdPwg,iv:Sn8OXRYesklNE0t/IEunR8f3STyy53HsyX8YoR0jU2A=,tag:J9neCETFoMEsVrk1Mus+TA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Ug==,iv:dg+5EtXbC+V0kEoE1Xh2SxyNFwushGXJoXmyE9xx0NY=,tag:MMJielViAGzOGA03n0eOJw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:AwqaFsAiB83abRX7bbVu8jB6JA==,iv:EU7RRuowQN6lPZN2yy0hHM/TNUz0LKmwv4+VtoM1GhM=,tag:oY/DdTWqmCCRhYT5xHIeZA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"prometheus.io/port": "ENC[AES256_GCM,data:DLgO2g==,iv:C/jLp8ZJcI3yvmcHZTzh61bd/xkRrcrhBOisLTHAZYA=,tag:hEHyP7FjZo7NeFwVWvaxGA==,type:str]",
"prometheus.io/scrape": "ENC[AES256_GCM,data:+okeHQ==,iv:go+s4MVSettvO4DZZViIuIv4MGpqv5QdHiGdDFU1/JU=,tag:yB4V0AZrxk3ZBdDjMwoWYQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:YA==,iv:LfOWSVtQwxcljlvzOOyQC2NYelKtdJywzIFkPSQ8LbA=,tag:xuz9VrjcmKbopsD6rvDHHg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:0Wgb5/xhKMpp,iv:7Ow/S3BwM07LU+wPO3njr0YSGWbLDP3DZ6QkAjkJvwM=,tag:ixhwibBTUteSG3RVoViz1g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:l56c6xc2FZDV,iv:8G5Idvxeefs9X77XW7UNWLiHeUxyyHCIplX6qDnzbT0=,tag:aCeLxI1LRMW9osV5vsVAAg==,type:str]",
"namespace": "ENC[AES256_GCM,data:mFCpgTZJNLfl,iv:GIsJGcmOQhOC26xP0Lj5cj6x7wYXVeg1um/oMozpuW0=,tag:NtsAUOgABUfeZkJGYOQRHg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:S7+P55uBRYNv,iv:vKHO2pREC44xabSMa0f61NbTIE3BYCQ7F33VAwG31wk=,tag:E/a7RopzRv3AzeTpZ/lrSg==,type:str]",
"uid": "ENC[AES256_GCM,data:gNqInpFzDHOXJMV6i9i3t2q2hdVKlh+qVFyz3PyQlr3fPeU8,iv:kof25LqYLGfueiToklmjpbzXLThXYBTv4/E6Hya1K44=,tag:8xQXyEJP2o/eG8KPl6+GIw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"allocate_load_balancer_node_ports": "ENC[AES256_GCM,data:Z6STWw==,iv:F7MNT3ZXtW3Ke2pbgpmxEoTo27UCfeoB3UHdmcp6BQw=,tag:kSQXlD9l0rpJOy2Dsni3xQ==,type:bool]",
"cluster_ip": "ENC[AES256_GCM,data:NfUIRAvwYKTB76d7,iv:r7e2Y2yy81nL4YrhvAQsUYBDTOtVx8tAX4VrxkX49MA=,tag:byDi5Q0G58X53VGqQVE1Cw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"cluster_ips": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:HLndxbAJ/568kzqN,iv:LLjNczaja81/Sna7MDauGr7CjCkS+/6RhqPoUY7GD6g=,tag:JJNUYy/p/o/ywuA8hhFbhg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"external_ips": [],
"external_name": "",
"external_traffic_policy": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"health_check_node_port": "ENC[AES256_GCM,data:QA==,iv:U2Rmt7SO8onV7zTTDxLWDPD/DUyXe/OGzvdhhpCzEZg=,tag:GifzzI5clCU6sKXKrNnKNw==,type:float]",
"internal_traffic_policy": "ENC[AES256_GCM,data:R/m+xfipgQ==,iv:4kQi6r8SlTRWGr53L8n/OmFPk2ts0HKi0a0pgWCwds4=,tag:FkgCAJ8AP/+UiK8YVEOBbA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ip_families": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:vKtLLQ==,iv:b7FjAUzTH5JsunUEoxeR0VXhjOQvcd0GD0GTa5pfoPk=,tag:wh5kptFrARmv7nZMAAtZuQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip_family_policy": "ENC[AES256_GCM,data:k3GPzE3eYhymd6Y=,iv:qU/Fg47xJGw51M1j0dxCMmKkUENlCEGMGc2Rq1fEJGU=,tag:AakYd/PhENn9GgU6ACQiWg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"load_balancer_class": "",
"load_balancer_ip": "",
"load_balancer_source_ranges": [],
"port": [
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:M2GaO23yK+r0,iv:tl394/9IOVYUTBC7BJDwJSU28aD5SHb/VJssVaeMjZU=,tag:CKHtjhvBItwv1qCB/z4c8A==,type:str]",
"node_port": "ENC[AES256_GCM,data:NA==,iv:YocvWTth7OZtMi6tGwPB8s5sJxn66VcZ5o+yD6HU2CI=,tag:RlCcUuresBc9zA8pc3/g1w==,type:float]",
"port": "ENC[AES256_GCM,data:8dKz+Q==,iv:Xw6HsOQ1/TsPXVeHLRBPLumR36iH8b16PRhR7DtZJyU=,tag:SdnGb3l/vzgJUNRKkocbFA==,type:float]",
"protocol": "ENC[AES256_GCM,data:J7H6,iv:5CUvnRGs1Y6ZQBY+aca71XjlDvQ5om1BeaXgkPpYGSk=,tag:eWgtDeTokNDuggInfYvstw==,type:str]",
"target_port": "ENC[AES256_GCM,data:oUHkzQ==,iv:Kv54GA9VQ0XYn1NcaMutoZb+LYipu41sE0jOYcMFHao=,tag:3v+ZD+YIoeTqyUe5wPlh0g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:jmzzfMpjynBrHX4Y,iv:rTKfDzr4ggoFQ0Z8c0yQ+HCPpi4zDq3R1qx6Ohrtm/c=,tag:kczEBBF8hB1rtJBqTEnC8Q==,type:str]",
"node_port": "ENC[AES256_GCM,data:0Q==,iv:ZTiokCCIyTTtiqdXPtU9h+laKytFXELIubS8dhNHi0o=,tag:n9d1QShixzLZh1DWVnNQOg==,type:float]",
"port": "ENC[AES256_GCM,data:nDM=,iv:30zG5g/5SbtFydPWJ8oMw7jplg693siVlrEPLd5W6No=,tag:cV6wzL7NXJsVr4b21LKQxg==,type:float]",
"protocol": "ENC[AES256_GCM,data:KLO/,iv:y5oscvolF1CymdThSBOnt3/Fyw5NGOMQBparlXcgXwc=,tag:OI8/LUVg0Yyh+Xo4RStKug==,type:str]",
"target_port": "ENC[AES256_GCM,data:n5bD3A==,iv:6aNStMaatzvBhUI5GA7vi3hFGCkMP2QwG6Xwwhg9Ei4=,tag:JBHTxCOuxOvnVTzX4Rc5gg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:oba98f/k+Q==,iv:OJ68GgSe95gSj36k3BbnBcZYiFQwMdi4HTdRnPZVtxs=,tag:li6nRZH8vuLi+ztImQ3sCA==,type:str]",
"node_port": "ENC[AES256_GCM,data:hg==,iv:vzRp9lHIcs5t0bLL9I0dYtNmEF+sjniwsk8RD5MrC8Y=,tag:527MSSI/07cBF0t+6VTcDw==,type:float]",
"port": "ENC[AES256_GCM,data:aG5P4Q==,iv:PbjHMViNWOBIBVg2lbCo59nZDLkzAZNcG3vuFeTPOVc=,tag:KTDfGZRw/MdsjY4G7vUbaQ==,type:float]",
"protocol": "ENC[AES256_GCM,data:Zvun,iv:jSYaS4Fh5BianF6UfIMhTWVh/QNGOt0/I6aUCqJPiRg=,tag:hQjdW7sj6FCAgJbqSJaBnA==,type:str]",
"target_port": "ENC[AES256_GCM,data:bDc2mA==,iv:PRoVohbz8yuCFwgdnNMLVF/f4pTOj2vtGmwZPQlSKgw=,tag:zkXBJlXc71nNl53qIKhk6Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"publish_not_ready_addresses": "ENC[AES256_GCM,data:g1fX964=,iv:LMsU/7ExigolwC38+u4UcqObRVb8MX3aU+PFFPmt8fc=,tag:OWwVitwYZ1nd2aVTuxlYBg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:4GFLmHnHNJRr,iv:lH/ZKlWREjMy3m/dAYnKrH+IxgcbYSlfwMYx4RGZ+Y8=,tag:vEiRRqoS5IW/HfQSCLymEQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"session_affinity": "ENC[AES256_GCM,data:Ff6Mng==,iv:JPYcsK9HSIVreEVNESBUoezR2cu5+/VDZ3Qtwv4MWtk=,tag:T3kjmxHhuoaGdn0es/pa/w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"session_affinity_config": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:SWBcE4aOF8pl,iv:G/pK/8Fs7jnT3GxdJLFXkVw4KfWw4AhZ4nJsBKF7eFo=,tag:O4nkgW4lswvl0rPGSgdXZA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
{
"load_balancer": [
{
"ingress": []
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_load_balancer": "ENC[AES256_GCM,data:iVyLWA==,iv:CklRV+ywnipSwnDjBWnBPLEKWaGG9p4BSgrjHR4ZxJE=,tag:NV5gdM6UCdenYXphT+p7kQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:mZ3TFcm+Huw05MCCWAN64lKl0z3W3YH+LR/JwgSRGft9Q0lR/3I2+HY+3uR5bL0AxSgs6c2SaVnc1E+rMBHbUWF32o0Gi3Nwf1NtgoHyzMu5WuFe8PZWV5bQsnSN/VD5wJunhi1HAwJdP9+p6Kp0J2QQgD8=,iv:CZo8zYNi2ZvP+Cy2btLWIq/UTtupwf4POhBiw4OjBAs=,tag:FwUt9k+gEreoc5PW2iJ6BQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:fdfgg/KQIbJ8CxDk0iegY8zB5LeTQ6E57m5WKxVehF+fcs7hG6767PzOrNTuf4U=,iv:5Wvk9vYRbFLgDYDqxJFA/Mfgdou1OeEKrrhQwUFtQJA=,tag:ujNDcFEjEWz2oFnXB6s4uw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:aNyh7MfjXLsXJK31bk8ATg==,iv:nBQkKHetPIPj6fC4RExQkLSmkftfKPt3kpb1ODOuKoc=,tag:9idtXVdnlfvKPcaLO4G51w==,type:str]",
"mode": "ENC[AES256_GCM,data:bQFJ5T1OGA==,iv:KiJGqvZQMClRT+QfQd72WnpUp8a1HTGpst58TaTeink=,tag:to07GE5eiGXQvnW8KQhk5Q==,type:str]",
"type": "ENC[AES256_GCM,data:SYJkjxMU5cJ7CXW1MycFiCWM,iv:PYC2zcYNAjx2ZTk/pXi5IrXfItMGnjZI+yjMOxgaHKM=,tag:Fto5PFqMOphCBNlI6RDwFg==,type:str]",
"name": "ENC[AES256_GCM,data:cAP+Z1o1K1gJsYgdCc4Rsw==,iv:+xrZvhr7UYY3Eh7s528tKoixP2R3orAAfzOunNb0SLE=,tag:BNfBimmusQqc7nlqSfiNJQ==,type:str]",
"provider": "ENC[AES256_GCM,data:ZIENpC9BJ551sMVr/8UnFf9E6GmMA7LENx0APzYZiXlHxdTwroQy8lcKspyjs9Siza1Vf9zL,iv:VLq8PpcWlNMSjx8dJ2GMLCOzex9OJa/uf956cpiOdBw=,tag:cKjYAIC3Dk/TjAPCQFa2/g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Pg==,iv:TxfDPF3OPd/SQTqIz8gD70u6dBdZrQGOt9GwObPF9AA=,tag:AKMHdSbBli6aXjJtmuWLhg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:gIVYl/4N1+w9Q8cVFPdrDyZQvAQ7CD2aAsk=,iv:7TdnSEGR5pb039rGun/hiihctJLYb+eOdWi3sY7VOrc=,tag:g54lHIcSF43IxtPleXYZ6w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"metallb.universe.tf/allow-shared-ip": "ENC[AES256_GCM,data:2lnFHn2z,iv:AxpQI9G7yVSWkEstp9TsX8nEyq8CbWcYsvoepgXjfZo=,tag:DO/WA5mJsRzBLyu0GJMMqg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:iQ==,iv:ywB8dyHCqSjVYeSyAX4/Ol2Op6pJyosSnO1FvXp3ZzI=,tag:K/M80DOXdThZqyEycEp0RA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:qUvROW9aDSsZ,iv:3fDcfXSD6FmsX9JgI8HI2YHqJUlV9eywZScTWex+rGY=,tag:/I2wlSXRZa96rkCbNQ7tsw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:bdBWIZlYiUeex/jLa278zg==,iv:FBiUWsGjk0CH09qrSPbOH/90npTkJk+5CRkxwyK4zvI=,tag:7m/noIrVyjiwvEff7kFI/Q==,type:str]",
"namespace": "ENC[AES256_GCM,data:sMaFApgAfyc9,iv:VV//R1ugXazNsPLcqof3ggi/yI+kbZg0xM0QQZBNb2A=,tag:HoZVJOJrnFSBNeVH4NKy9A==,type:str]",
"resource_version": "ENC[AES256_GCM,data:X63SiYRZB0no,iv:NYUm5wlCvRNP3j/6zXcowtC2GKkBU5ooiFKtq56UQLs=,tag:ztzC5xEFimsi+IeTbE3uBg==,type:str]",
"uid": "ENC[AES256_GCM,data:EGGdC5OJ14RuBV+2NvGhxQf7E4a7UAU50+MMvWtzQYcR7Kdy,iv:YXeO8ri2w/h4FLGnfBGG5NPMFj7dEihRoub5JD3rymA=,tag:L1pCFrBYYxqqBv63KlI0qg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"allocate_load_balancer_node_ports": "ENC[AES256_GCM,data:XGupQA==,iv:ObbWjOO7MI73+MH43nZpmQUcF1VVsTA29dkcacVuTQk=,tag:urR4vlLwh0rsyk8l/Ky5jQ==,type:bool]",
"cluster_ip": "ENC[AES256_GCM,data:FNQhr46ncftvISsb/SM=,iv:zY3TDDGDZLW7jhXaGvSpkaRa3mvbrtQ9z17ytZQKvXc=,tag:SMNn786hSTf0uNDbdjyB6Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"cluster_ips": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:yfVFRuR3EU19Is1PYLA=,iv:4hdpOZUqkVfNWR8/yzU1Q/2CVec8eoNfE1LDhtgHdjo=,tag:ET3Io9Tc9mIunRMelyAy6Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"external_ips": [],
"external_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"external_traffic_policy": "ENC[AES256_GCM,data:AAh+tL/34g==,iv:6I0mFbhLX23FWJtwYXK9DOOS1PII0EzQtRvYt6rHYFw=,tag:5oUksRTDsEfeWZzvScB/UA==,type:str]",
"health_check_node_port": "ENC[AES256_GCM,data:AQ==,iv:QkYuWsYKvXIUkkG1Yno9/9hfEpd2leg+r2BoaI/Zcms=,tag:depjcJLw+uQ3UuxmK9ueIA==,type:float]",
"internal_traffic_policy": "ENC[AES256_GCM,data:oYzDqyNAuw==,iv:cLnjQO2KV7tYVLwLzxUu52+m3QvS4xXHqxMFzW6o8lM=,tag:cQ9KOdkDajMc+h1ckgZGxg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ip_families": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:iFM4TQ==,iv:skHkdvPH2BCDmozlyn5nYXNJx/nrrWb/VL9xw2n/ouk=,tag:t8q2zTijEkdHw6RVMSc9yg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip_family_policy": "ENC[AES256_GCM,data:nCun5vAdvVrlgyU=,iv:FqZ8akWsqWF3K16+UZGOeFfQ0FWu3oxdPZow0lh2c9k=,tag:PY6GtEOJndTcrpS1fQmFOA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"load_balancer_class": "",
"load_balancer_ip": "",
"load_balancer_source_ranges": [],
"port": [
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:fiTIXQXqY37C1dUDCg==,iv:mqn691ZZ1wBS0502UeatGnPQXH/kYg4SQy5ElF/5Ffs=,tag:4WNDEknUrGxtxXe8JwAUCA==,type:str]",
"node_port": "ENC[AES256_GCM,data:2BUonhg=,iv:seLOfjzDyZmpySb22CilIM3hsENVbALyfpHfw1YVqrE=,tag:FqzYNOaj7pFvX6BVqTIGpg==,type:float]",
"port": "ENC[AES256_GCM,data:LxZ8fNk=,iv:BfpUQcZDJ+FTVuLou2XDObxVuj3QdCGssUuvzdPvV3A=,tag:w34iDHiaugQmP2LD9YxRsQ==,type:float]",
"protocol": "ENC[AES256_GCM,data:TY07,iv:q27DS4zcIxKmB9RlV/knY5q/GU64vmcxV1jPFIVA4B4=,tag:pfMk4/ESeM9rkM80KbXyNg==,type:str]",
"target_port": "ENC[AES256_GCM,data:LfuEQtA=,iv:0P5NabiIb5nH7XYsRsoUwvBnsj7TrDTwStJsz6/HKPg=,tag:QfxvGxoQiFFjP0UgQlriRw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"publish_not_ready_addresses": "ENC[AES256_GCM,data:HhOEivM=,iv:XDjA12qKvL9OAATTyDzBkPYZUViw7zVB4t/eJjdH9Yk=,tag:QAwq+gsXAZgih7JsDz42+Q==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:02oYr9hfQqAi,iv:M6NNwvE7s3rYQIeeZxTKI0rVvbulZGFRrlN0rdBSsCE=,tag:5CsMykqZu3yXyMt8RtkKoA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"session_affinity": "ENC[AES256_GCM,data:qQUI7w==,iv:L44KqCktEqffkLXM/4QlGz5NmNiLPqTit1e9yn4CgVU=,tag:mLRQbt3EDdCIcuRq42KpkQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"session_affinity_config": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:xZllIsVb3Fu7I4tt,iv:5usFveagFmEIhMIMVzluh20nOIoS+WJfBrFMjjxKCSc=,tag:O4c3tvjhBxM9eJcjkOl2lg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:YW5M/gKQQ+VjCdM=,iv:Wmn/ba3uPx3/J2HdDixLrptdqhYgnv1kq/qZNVBsDLg=,tag:+7I+5AuthhiTfTLnwC2BRg==,type:str]",
"ip_mode": "ENC[AES256_GCM,data:3gfG,iv:uhTs+nrcwM1rgwZ8nkPHnzqZ1Lpg8XXbT2OURN9vXIc=,tag:uENzinRyX/oOSfaaKM21ZA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_load_balancer": "ENC[AES256_GCM,data:/RrgwA==,iv:e2zOtzDLcOELH4VXlHuJWUstKawyuAmwL3YiW0Xf/EE=,tag:V1C+W6N9ZzSaWRR8iewa4g==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:EXsPbdxVebgGaFuAMtawVCgCrqbpo523CK1jH26qaZ4cuwm/Wb+jxuDUTNyJ6kiJJJw4hA/QyVbDl2YG6zKVAv7i99h9RN2+WsGWwtufjJLmT+GHPbG8jj3FFI6CW+VytWD2mkMW3qs0mle7sk0LXfCIsG0=,iv:1A3bTNDBJwNSVFPivoBxSQOojD73o3ExTsXtHgXeejQ=,tag:jCv1b22+j44JAzpYbu9vaw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:5vxZVJM6kjwuMkVXojLA5ijVsLra0RHS19YoacoC47Wdn6eIaGppiwedACD5SJ4=,iv:PV3Ob+TLjjaaSShqtPOjNgE79RYn/jZcKMzfyHVJpOA=,tag:S8Fewby6DtyJzpCmvsJLmg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:09Xk5+73/HeMK6Q8kHSARVcdDCaMcSJsorykilb1bQ==,iv:/0uRZB95W4cpvldMD3wpWHaBo6/e/vm/e48IuMZOOMY=,tag:sNM2sWbs/fLrxzfac7ZEJg==,type:str]",
"mode": "ENC[AES256_GCM,data:ZwtNc69J4g==,iv:C8zcIj00uH2JDhYXZUcvFOcahC759GKJa7t7MAErDOo=,tag:CLpnQDvnoDcWbnUEAo349Q==,type:str]",
"type": "ENC[AES256_GCM,data:UUDVcTUmtByXxi+j5z60hypHNqyD,iv:4v3NffOoV1RB5hIkO/MxkyYvCqqT/TbhnOoYCpjZPmk=,tag:4nQ/I43xPO/EHU6lYbSsSA==,type:str]",
"name": "ENC[AES256_GCM,data:Xo5XJOzRUkKQ6unf3Lhg,iv:14QnAuUlimNhF3SNv0iTYxwMn4JE2d56I8SINc7Ozt0=,tag:wRuGwTQ7/WNP7QWqjM8Ysg==,type:str]",
"provider": "ENC[AES256_GCM,data:FhL4DJTSUatfapIYIcuq9NQ96JlWD32f+RgVdOSbJNtyIjADez2WuXar0Q4kAvZ06k90cnUk,iv:p1mD5HnUF/LHhDa2LsgQS2oAI5I50CUFumtBU41uf3U=,tag:sBx/wApmDd1VZ7UQMs8E1w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:zw==,iv:8a6E3gQtTWyqahTLcsFSxrgWBiEsgvX3Gpv0IRlkBW8=,tag:IxGoHoYi4MFtoMRnPUjmbA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:KHLNtBh9eL9sNFDGit0FFVRsAQ==,iv:Ths5Zh+C35b8WiGXIo06E/56ExbFKZRFnR/DG5rwJgc=,tag:O9CL42eHXolxN99cdZtfGQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"gethomepage.dev/description": "ENC[AES256_GCM,data:yDOaJU7ntMMv1yxgu4ojLw==,iv:AdYjUumVpgfvB0krF+czFaYrHHjI2XtKSqCx51a++mc=,tag:ltSqwAWnBA5wq0J2TG0SmA==,type:str]",
"gethomepage.dev/enabled": "ENC[AES256_GCM,data:f1YBBA==,iv:cI7tLeTe37dnqrLGOdber+Yf3rpn1DpSQytMvnJrwc0=,tag:+ZY/77ud7SpNKw8RjMzJlw==,type:str]",
"gethomepage.dev/group": "ENC[AES256_GCM,data:UTzyEw5XQmnh2ISe2dA+cPUb6Q==,iv:7CbREh6OrMHL9y2P127hMxjac9SpOiTH4CEmIBHIenY=,tag:sajl6CwMiCdLCZFZ+2/+Rg==,type:str]",
"gethomepage.dev/icon": "ENC[AES256_GCM,data:0QEeCLSwJxn56qpghQ==,iv:iGUSJ3WPQ6djyPE2GJ16J7uWBKMtn38drJJXotn8gbc=,tag:dlYZNShaeP3xkZu/y5QElw==,type:str]",
"gethomepage.dev/name": "ENC[AES256_GCM,data:29cJZ2dQ5jr1,iv:Jo0XwlsP06Kh7RF/gNcGYZ7wQoDL23JMXBlGLKmPvg8=,tag:4LdVDWA/eDLPrzCb2R8aTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"gethomepage.dev/pod-selector": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:UD+wSs1+BIIP,iv:GRcDmkrhboNVof3jwog6qqoL0obz90p34lJlAzDdYas=,tag:3MNJzxnoe/zl3NWHwYsPFg==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:v3fyPYu4EZmT3DiCXVweDZLyBx1DpX3/OarkKVFQ2EPmWqDPNbxME5WOX4Qz4/usJOX+B0SvqNaEUR6N2XnUmtjUr9+oJxOH7Wds0uziiMyiQNkIDJUT07GYfN6vby2O7heBFQj3fIRJraHNEOnfViHLN9OClz12P2Vb9hb7E/Lut3gkm5/0Gj53riwG0p/2no7zS9GOAaYB84TdS0pyUGkZuwL6BDQR7cAgQLAYiidDoufX06SK7Bdk719nSJLzSvYyAFWi8IBCXZ/eEssXjfnBqEDadpY4W27Ass+ZPxkwesGZO6fNYxfyw0agwHaVyQr3PcLvNQe7kwITmQRoYB7PzJqfeABcwpelYqllq7xsXDxDUe4PYzkgJQ==,iv:su+7NEAcfjxByosCyTTVezY5ZhGhw/+0f3CdqNd0Y4k=,tag:xbhzw9nV4rLQY/zxaaif5w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Ng==,iv:RoZyG2g/Ntsz7S/yNNhixh4Th4NZg9z/1LRCc3kIn64=,tag:+DW0DYjVNXPTJ7Zal+2FYw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:6G1RU28iQeq/,iv:A+eS1pYu4X8CZkGlv59saDTt0t4FNjK7FACnGmu3rQE=,tag:v2jCopgiKiBB6sjXP1LYRQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:Glh8OFvp+QqF,iv:qjpWRgED/z0IyIPE8XgeiV1qC2JlCVnoTiugS43PM0I=,tag:eP8n/aVdhF4KvzW6PM8EMQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:qBwOrydePnkf,iv:Mu44j8QXw2dL/f2osEY1nGVtJu2cd6tkTT0HjMRcZS4=,tag:DGAYAgbJPEW/11/yHsh8Dw==,type:str]",
"uid": "ENC[AES256_GCM,data:Am1uc3trbBYdACWuDI7Wj263NUN+F4dMKpi0nzM+BkmuDP3x,iv:iDt99t25VxS30B/kRKzFXF6Odku1AjROdf4cBGBYnKs=,tag:XH5ZVrqsgQWffdN95xNBaQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:vCcMAYDpbA==,iv:g61xc66oTJiEbqtN6BgTo1CEFEIp5z+NiBWCr1Ra3qU=,tag:GcVvw+fLYebnKKqAApW1Rw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:wvvA+8FaKqXzDkpeQNcZJwnSYrP0Ndc2mw==,iv:EfaxA6VjLFWwmefMqsa8a0CUwRQt8ty3Dqcp6NHemW4=,tag:LnVIm/0gCTEyt//Sed77Lg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:LtpwRj4/Rgt5,iv:V6aqIRpzxl8IOdQ9Vf5niFzy4fKvUbhugdd/BRgmP1A=,tag:pOGxFyZpyza6h2QguR9DtQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:VQK8Dg==,iv:ff+tWy2nUMN5bN3nuBchk52wdqSnv/DvCjpKudk4RXw=,tag:LriHJIww6oyz/Volyt47QQ==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:dA==,iv:ZNVDyS53rI34f1fNjeooq6YBLBu++cfwr0Nouf23L2I=,tag:rV1EskTQAFP+BKPB+JzcUA==,type:str]",
"path_type": "ENC[AES256_GCM,data:PNyoin4woHTaO2Jf8iN6GfzNxIPRCA==,iv:TBXwzstGxjYDl0xcJmMvID1lsY4GLzJb38EXKWqyZ9o=,tag:GUFsmxGhNOfrFcxpBMI+pg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:AuS0iJyxFou5O3qwoMoxUrToC92vNMpiIA==,iv:SnGmm+JLbDXrLmO7gJsglJOwzXuzmz9sZRdTDsJZ7oo=,tag:dNhEOT3Y7FUc1GAVHBsQ3g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:8dOistDjuh52rw==,iv:EsDCldLF5ze+hPJB3vuqSkWDsbCmq1efXtNdG3+Do4o=,tag:HN6I60yP4BgKB2inFFbLtg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:lP9lOQiYVlEea6s=,iv:FPdRkTeBRiMxvGeEOCWU5TcgdK2Q2+lhjjjuwuDLIzA=,tag:6a7V5TLjwrNciUI8NqCjUA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:wD7kGEpt2bP+QrJOkHUFRDYUejEuqhrW5EaAb7Kko6Q0Hu1tirXFDdcXZaGm7kkFczuq0taGwB0ymiLjtxDXNCojmQUKFiO537ow++FGhFxhErGUSgj0NY3I0C4pj4WBb2sSYhARHOpZE3NTBZGsFNP5Dtpn9dSJ,iv:JefNiTjgoKTtVCXCClkcLgda+cvQQEAw01dMJS6vAiU=,tag:od8LaoJHpFZAuUBhrnZHXg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:yKNSPT14Em43fnjmINhNvxPL4UsVbmSdZZWkQmoCfDmjo+o3AJknVDd5HNfQ6eo=,iv:v3xqNno+JkRxysYpI8Dt/+SchxUpSOd09EVOD/UKab4=,tag:g4eb/FbIcTpPTpfSRJBGxw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:kl8oBWfGjxmltJInKbG1wwQIpzrMp2P0TX0jykV1jAp/ag==,iv:po5R1b2Pwgb170EUR6vqPr6gQge5ujkmT4UizE/Hhsk=,tag:aqe/HUeZJ+HpWFp5B3x2Fg==,type:str]",
"mode": "ENC[AES256_GCM,data:2lzBaWLisw==,iv:dDs0gvm3rPbCDQM+eNo6vxJt/1mSnh7uduZuYdPmF58=,tag:suad8559ePLPbta4iIg3Zg==,type:str]",
"type": "ENC[AES256_GCM,data:yTErp3DASovqWTj2pbXBZ2jiYkkC,iv:fQK44pnye0SCoD2ZBPq8OEfXESR2SB0TVLMlV8u1GRw=,tag:CAtyAwO4HfUAl0gVc9l+8A==,type:str]",
"name": "ENC[AES256_GCM,data:4G2TbdKZLRXIOhhbBGsu,iv:tSNDVug+aEcf0N6YK3msfD89Vi8gOpxlXOt8TG36zq8=,tag:Q8nlfqSrW1It5m4fP5JNZw==,type:str]",
"provider": "ENC[AES256_GCM,data:u2a8CmdZTNAWcNVa04S0CSCb3ggoS6kG0CPrxf2F81sQu11HUw8Cf+pUp86ji58mLeJ5uoS8,iv:9rRkzpW7c51nquG91uz66D4yTrYRzxunhGK77cOh5x0=,tag:OlEru2D378YXvYBaFe9/Og==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:PA==,iv:wcXsVY7qmQArT/WGVNktuA1feOgbuwkSOL6wbL2ldhw=,tag:A0HfVRDhTKFVFtr4kRIWhA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:BX5PoLhJhShkU+NTA7Hvz50MFezmLw==,iv:NtcF5atN+2jNiujr0I+ch2POgd3I3Ml2xIbe0j6qb28=,tag:1rjffOYw9qxnzaA8YXt9OQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:aUMAtsZrlEos,iv:yElceIQ+spa/zTBcTz56eHzyWSQ+T+9KU6KXQ3mBk/c=,tag:Ui/vTIYoA8tLqS3MBhjMkg==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:fRVOc6bbAp5OVh5eaPqXqMgL3POimqJDFJt8JJipZGNDv4aNfah7eztWcnyGf+pNUaIUgs79l+RtAQppYQ1xcEPdfhuc1nFxD96KPC4Gqbn0Een4LYaC3RMbuO+Z+dwoQHcAb2Um5XRUUsA7sc6pqb0/Hbc4ePl2MAyQoohav4P9I6ViR4WsAzrWCmD51nAuiZnxz1SCUgk3X/LhjuDcgIW964RPyp4LxvRVmKJXOQLOuRDfHOeqkB+6sYJYC33Wiqf1VcLFGsn1TL/qHWl+cRLO2Fw5YWtx7XbtBqNw3URAeZlMsI8xxG8ph6S4hWJc1XlxaSsE6CdjoCnXLcs4Djn6sZre6f9LEzonlr+neVelMvf7YSpcJFAUxA==,iv:E9TgaaNuOT6v1Vxwuo97FsYLiBV3BW1ZF1HMAmL7ewE=,tag:xLulRQyIjodWdBwicfVRyg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:fw==,iv:lYeonb5XE9rtH5v2XsdiZvtPbNIbPoppPoN+ePv1dF4=,tag:cK++CHgqCeLpfgmkMYPitA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:TdVh1i5jXh0tDEdx,iv:BbSIVd1TIs63dlm/PwS6tnJ7ugGrg8El8P0sGFtn9+g=,tag:qnAOhZ9kvc/n/LOaB+eRbg==,type:str]",
"namespace": "ENC[AES256_GCM,data:oDjMqXZ3EfUP,iv:hmZOWhiDkGZKTvv/zsY7wIXieRylrYsIE1VO3mtPVjY=,tag:nTiYtNL8D+aCKqKLzN4+gQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:FUXp2LTpj52V,iv:1694GAdygG2q9DMpdyACW5W+a4muKUZzF9ULOZeL8D0=,tag:vGEYVfi5qRWam4J46CmYmw==,type:str]",
"uid": "ENC[AES256_GCM,data:XvYbPvadSPH31xIdaPyhiO+JKy7v4RMXxzc58SiiOkTTL555,iv:cT+clfcgdw/86QqRjLfuP1tL698TqxUjv/+Z/HZneMI=,tag:q0Eyao95mNBTrg0yXJiq+w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:0wAuJFOQ9Q==,iv:2sZfLpU4CDgGOhZokjWAYKWumt/X86WK13wsPXj9Ql4=,tag:I5NG4a2bPcZk+mF6cx55NQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:SVX/fLW65xl4kmJOeiHQevORfFY4mUjlAg==,iv:nSZw7TDN5K5pBuxnE+CCvW7EjaPCp9GNGZ5qlP7YjaI=,tag:+1wSbbuk6RwW03hzhPINrA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:4EKwnfyPbNNa,iv:DtLBMS04DWAmFja0XqS54GlwpWrHlXDIKbrwZGQjETw=,tag:FR+Qh+/YpJLcuR86j6b0/Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:fupz/g==,iv:MjioC/8pwFGtWa9JBFnYqJOP85DRitLSu/A4K1GxLTA=,tag:Iux/YXuXnmrUEjqLcuGOiA==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:wLQdiQ==,iv:0LkxAWCfBPV7Y5gmmRRoEM1wqcYQ1u9HofLeZ7cBds0=,tag:eCnVBY7IcgGqUWIWNbo5yg==,type:str]",
"path_type": "ENC[AES256_GCM,data:sg2bo0TCCA4KCpi0ZjLkUu/zozkJ3Q==,iv://RSnK8E6vI6ia+U+Ozuj04xMorJKXKGCFeeXz8e7Ys=,tag:wtyY9zdNzwzvSZaQWl/TNA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:QEBInqnjjYrs7Yq6Nwdl2jAeFe8lGmheiQ==,iv:zyP8qmitwe7tEkFex9yhXkjHHrAUEyXQW/lz01UnulM=,tag:AVErHfBnCdMZ4WfSIc8j1A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:Kl9vLfsJy/TYew==,iv:Od0edDqKvrlSxkgCymEBgD+yr/Bm5hDnQR1Q/ijMKyo=,tag:/V9VmEF+GJBTQjIwWCBKcg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:LDzW+7Y3KsPyejg=,iv:ujJnctLkJQ60xERGbzGZlv5vxaw0whE1HMn63nw7/c0=,tag:ZlCAmwuoSRp5iBv1ra76eQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:EMM7EEbiihyeJRT8TNV7iT23M5T1AAOJ3hB1mJJYGu/zJImrJ1P85ZXiVVfgwMPPTCxowdjQ51BvqL1YZJ9eApxWzIZnk4lKSsbQFfgow+mylQIMRg2VkkuVswt9tcUiXrAQ1UwZ6ji+KiJH0E8C6RN7QgsbBH6W,iv:GwkYxl6ghMURD4nuc/uSzSY7LqEgETa81WKlBywZcrA=,tag:mhc8dPIpr+UYOSh8auCoBA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:uz+oWIRsscsv04D16sgzOl+FOWO6Z6abJjcBNp+F8DJcI9dusKMOmpKayMm+dLk=,iv:HdoEMO/MZum6U+UV/PH5IX5COKFxMmBEsjBnO1oP/7A=,tag:eNTvxfkGaSmqNieSW9pjSw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:YilpnHwNCIE+p6GorBQ1+J3rOiQVOE1y4FbX8R4dDPk=,iv:hyw3Tzijnu5LlagvjZVvfvu9YhHmhSXRZ7u2T8y+I6w=,tag:54RAxk2mfan9c7YAxL/yWQ==,type:str]",
"mode": "ENC[AES256_GCM,data:YqQQyreOHw==,iv:pH68ZjeY6Qx3/QGUFgI+3QTa9KK54aM5fqtuc7FPrdY=,tag:Uy3uWv+em1nhiTDw1uZcBg==,type:str]",
"type": "ENC[AES256_GCM,data:SvJj89X8WjZIm7M4rBiZRRSYbCW0GvRwgSRUVw==,iv:9qHKEztKDFCYyBIIRR26gzPo4yYBiQWTxqMaQ1+rHgM=,tag:iVRCWocvAaZViG2QBvbTbg==,type:str]",
"name": "ENC[AES256_GCM,data:4twqmw==,iv:fc/ZbDUYDjHURNVWUI13fey0yeghHu9P7mR1OW69vbY=,tag:WhDMhUSQBgyfKjNZl9EyBA==,type:str]",
"provider": "ENC[AES256_GCM,data:EA/ezhXgvar4313F5Iv1IXPX70eGrciMa7Ozkduh4TFoYyyj0TcLFnKr+Zh2I+txSpe+QPhG,iv:VctXOMmPbScDKXumgL99q39JDBYZX6waqpjymdmIHwE=,tag:j8d3fEX+pgN7+P2iS9ZDtQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Aw==,iv:impK/DYzk3C4tTSn19eZUnClpjp4u8cjjajPK5lxP+c=,tag:20VmzItvBV8BE29b3Jf6dw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:NQIxjP6XaAoS8P1AstY=,iv:MP94bhkliTFGUmumLX+ltOLnPQRZyURtcj7RDMyVulo=,tag:Cd9CUq4zMoT80bBcCQ+yUg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Fg==,iv:KhZbNgoG1aKIvTN/DY7JKnQDesjPfjuOTPPgFT0VhIo=,tag:8+w7Qxs+YFZ9TVb9yGSqoA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:NvFnGqxzv2aekvBEZw8=,iv:nYXBg42VwWOYlOi/I68HRqrN0ao/ihG9ND7B6CpQ4To=,tag:E9sw2PG70emaoE+sRW9AJw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:Y7uRKiXfkTSK,iv:LGRmoAgFg5Exfo+zNQYpRFJg05PTAZdK199ATDFEHCc=,tag:g40tITTkmh4jme/f+sghcA==,type:str]",
"uid": "ENC[AES256_GCM,data:2DbA1g5u/n4IKInbCj04qqCZjI8y3Nt7CNhDbrlQ6NFeqY5P,iv:Cc37zxVznhr5Vm1I6hgBhdoJ6l4eeSbuc08kRQQ6v8M=,tag:N1wP/Re+n7wyfvXY5ho7Xg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"access_modes": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:KIHKKzlM7HAHhnc+bA==,iv:GuIuAN143pI+g/v/fdnOWmzSRvvciO2iAZo0AsH4AWk=,tag:Ei8+V+jagaheJmndqxAGow==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"capacity": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"storage": "ENC[AES256_GCM,data:Yrcj8A==,iv:bjP/oiv9J+8aQOPKc0IUVmdHXBQijhdlxITLTmrLRKs=,tag:afw/wlackf4A1w4lRQTxlQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"claim_ref": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:x+1FTGJGBTiqTGrDPk8=,iv:HWZxPHbLFH8UJVN0zSSzwgQsTw0IzheLruEIrww7ces=,tag:XjGWnW4BzVe20L0h+iGvpw==,type:str]",
"namespace": "ENC[AES256_GCM,data:bth5klzWc8Fg,iv:2DAKdN7XI+hZDleS3FtV29nMI87lTReWktDTa19tRxw=,tag:4DEl2e5/46DyFtNLhqj8XQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"mount_options": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:WqRm9YzBsEvK,iv:FbRZNWSI2wrKhXAGXCsayxSY9enPuGKn3xMfMmjqbe0=,tag:oyN39/OGjq5eOhe2+rkpWQ==,type:str]",
"ENC[AES256_GCM,data:nXYl0+8EFI6i,iv:aZBHpKrpId1XQx9WSygszoK5Pdy8mjh2Yw99H0CNXTg=,tag:ylofqH7pQSzSsiFda2eTQQ==,type:str]",
"ENC[AES256_GCM,data:sNXXUA==,iv:Ee+J+YEfILPl3FxhW0PTo1t/F4dcjMSh++u3K84Emvs=,tag:6jKgg/yTvNwMRTAgN8UCBQ==,type:str]",
"ENC[AES256_GCM,data:OJyH+49W+CM=,iv:pMuZ/sCvUlVWhxeCYh77jffegwRVVPmZ9uydKE22rZs=,tag:M1T8kK9W+P5eg1pRl8vh+g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"node_affinity": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"persistent_volume_reclaim_policy": "ENC[AES256_GCM,data:QUMjFVZP,iv:CRAUEWK65ggQtJ9QLBzz4rOyCO5ap69sPgih0xw5Sd4=,tag:vnRJFP3Y7ExqMcaU1R6Lig==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"persistent_volume_source": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"csi": [
{
"controller_expand_secret_ref": [],
"controller_publish_secret_ref": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"driver": "ENC[AES256_GCM,data:FhLRbaC8/7IgKhjMa1A=,iv:JmgFvX0K5ySZI/LGUFlXzvX3nIInes8p2SXdVYWqUU4=,tag:ddTJCInacZ2YgzUHw8DFtA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"fs_type": "",
"node_publish_secret_ref": [],
"node_stage_secret_ref": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"read_only": "ENC[AES256_GCM,data:Rxmi1ts=,iv:cZTYmCPFhTUsYqFllpIxDOlJMgL4tfVshwesUYMye44=,tag:hi7Z7ntmm4X/WvPegzh8gg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"server": "ENC[AES256_GCM,data:rV6yTatHOQqZTg==,iv:wmYf7OJAyUzpF54f/yrjfLF0DABRFGUzDi1SSbS44dc=,tag:hUgdl2ahCoIU6VsStSBBkA==,type:str]",
"share": "ENC[AES256_GCM,data:8FgQp90xQa94tZDjorQr5TKU6g==,iv:NlPJQOyZW1300oXBEocDkLYnBCKLaBsChIc2GCxAP4E=,tag:W8L/SxqxDzQ3FUxjSdDixQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"volume_handle": "ENC[AES256_GCM,data:mTtRGvz7Rwc11L48WMw=,iv:wTAJtbiCsKWpG/L58PW1D0j/KgCUFQtND3FlDi4HdMs=,tag:X7jyMYHH5WMqyHg/0DlIxw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
"nfs": [],
"photon_persistent_disk": [],
"quobyte": [],
"rbd": [],
"vsphere_volume": []
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"storage_class_name": "ENC[AES256_GCM,data:TKk5bq9MA+e9pYE=,iv:3FAtNagl5kjuwttg3IHuS3ehiSrm9yE0cDAh4sGxke8=,tag:Ad7G2pEotTm20rznIAILwQ==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:ajcKn8H6ROItKg==,iv:SDm68C5WrzeR/THsGXDG6nEBPKI1DwbZzWsymUSYC7c=,tag:HfIhr0sAJX+AJFegoc7wKg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:NTyUhsa0HvzudDxDxqjE+q5lfaoSlSySVvLrnH/VJ1YzSEGLbAuF1Z6jdJ06F1UJ4ZvP7ni2F5kKZyQ+NW2T+xk55hL37t2crSActOAFhoqnM1Wuw//BkA==,iv:T7dy8K9z4Gp6hDbRPTV+W8TYWC1yMlbMFQz2mdbAkuo=,tag:3v2d/pWAZLM8j6nde8C3Bg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:jtN0b1vWAhEFrYd57R98DXg9FplBD3NOqxzbyLnRSuo=,iv:R1RiAopqh9dpkL+6g0eB6rG960uW184Dignmsv5kgFQ=,tag:6OJgksETH8Ua46WXJgpNaQ==,type:str]",
"mode": "ENC[AES256_GCM,data:LUHfA3Hs6w==,iv:PNSVqXwW+otZN/JRnq1SOMMHGv67vmjjbauyb63X2do=,tag:wZP8trp6q65mXjJO8eq8Uw==,type:str]",
"type": "ENC[AES256_GCM,data:O/WibnX/ssdXB9WJtBBsunbM2AKYG9MfKuDm3TySXsUAuA==,iv:WoGVgVA/mJUi1iguBjhl8h1zTFHnz49VYNNrJOQ8rOQ=,tag:ZEX+k/e1l2ao8n3GlXFUJg==,type:str]",
"name": "ENC[AES256_GCM,data:6FT1vg==,iv:rJghanTrvUvZZuZ8IQSr1Nof2/cic+TgBnbG+kk0crE=,tag:XO+xR5Pn0IRRrEiA9OC+aw==,type:str]",
"provider": "ENC[AES256_GCM,data:M3Qq+srkPKaEu6x0e40UZn9DcEuX0Mx9KpuLCJ/1pkTmEj/afcFke+VHeYEIAnEwIuoHMvK7,iv:+GM5/rJzmFITmFX5qQmtmTCfNEPgotCuKPEJI4TnT40=,tag:f+4gbgRty2T3+myCZUMoRw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:oQ==,iv:rCDS4M4mlu1MGkoUf6cA2ieRdUs1puzASjHwTU7/IIQ=,tag:eyHzsmZS9PVNLDQ/RVKYvQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:Na3tOpX0G3Bzxhm3Tt34l3Iz7bMid899,iv:KjzpjCaM7BWFJ5deZ8ravK6Mj1FvILa3Jzm3NAwIXv0=,tag:wq1KcpCNTXdyypOmObSwUQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:kQ==,iv:oL27Xw7BfXmEqPbBtBuGxLoX4cUQ8E+3TS9WWwQDQCY=,tag:iLthP1489u1zLnwCACLEQQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:yNAXbXFj6bXUNYD1fOw=,iv:BQ3LFPCkxO5E+jU/jsHR7O//GbWH5V6GeYR0Z4unMOk=,tag:mJV2uTFiZJTmp7PHZNcBkw==,type:str]",
"namespace": "ENC[AES256_GCM,data:PiJmVnvOK4sE,iv:lHjoOci5zJWr56OnPe1znxX6ao8PRWjkogpjEdJNlH4=,tag:RKQ9zLycFMkXXTnF5XRwXg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:XxHuz8+z+w/c,iv:2K9+nUORFkHD/bt+vJ/+ebI5awrj5hnwqPXU6mXVcwc=,tag:e2YXyJa4mv/WjLFJ7tXB+A==,type:str]",
"uid": "ENC[AES256_GCM,data:l55FsH2VlXBrhuqiB7G0b85PytVuzO23Oq9xPxxD9fxM1PjQ,iv:zvEo4Db4U7cMF3/CN463Cu21I7ykfvu4E7Nc4sDDBxM=,tag:ZIiu3kvAGFsfAaO6xQNeag==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"access_modes": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Yz4TbqIyzc1QsPemWA==,iv:R5P6aJTiYbVmqpuFXDZNfpe+GULiSSa8+foWhrwTXPE=,tag:oIPcT8Pfu1WRe69fe3clRg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"resources": [
{
"limits": {},
"requests": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"storage": "ENC[AES256_GCM,data:/5sJ9A==,iv:8mVxkrRbjhsgFSQBvf55yItGU9kZZZ02XiVdNg+fRCQ=,tag:MSqiIummxFGpzlhWCuVWKA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"selector": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"storage_class_name": "ENC[AES256_GCM,data:ek4CxZMr9w6e4IA=,iv:zwhBtEIloveCPSZ9qYdABxvTzphRqpFoOpQqFqUV5fk=,tag:9yATmJz7wYVdE4vGwCg37Q==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:Hyp/kbVq3EsgKg==,iv:rxCQrIy9V0WnI1TET8uP/DoEyBZXdL1Uk++Uje3Yeqc=,tag:yB0eX9hMjobmZcwtltr+rw==,type:str]",
"volume_name": "ENC[AES256_GCM,data:u1CnNaFhNfcM5HB4kOE=,iv:auCtEembCcsUcNKyqMZe8mhRN2QBw66SryZ1D4/BcrM=,tag:aAYErhFgYmeiGLGYbIpMNA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_until_bound": "ENC[AES256_GCM,data:Ga/roA==,iv:NnVHorQr3beVcfBrv2XLfmxZzXC705p8/i4F2jd99Pk=,tag:tsB+ITandn+BEGzwNt3udg==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:Q0tItRPZlJZu/kUox4TXd67aIyxUrL5WQnjlQLmbx+z4igL5L8GBdrW9oQw7UdSoTPMMliLeRXsyFk5wNYQfebzGnEeNqLXdfsoCT+eEiwN40dv4BFp5aw==,iv:6L3WEYc7B6FUy3ZJdzCygwvwbKmvNmr61kqgF2KsHGA=,tag:/QMCdMldcEwul6o1+dQOpQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:MuBwcKSGSV5rAmtja5zYwRAbKARFjeE+0b3iinFhda29/qe85/RzIOwgHwWSolE=,iv:ZlWW1gnYYxAdbf6Wp0MOzxwuWVWUR5sYXWDnb/Z170A=,tag:2w2NPmVAv3f8KabPw0ZAFg==,type:str]",
"ENC[AES256_GCM,data:xTfP+tCjwBee6E67zRMaz7V7nfc/kWBy3usQ2I0NwNmMcM4SY5347dbrPBszDViAL2E/O3zWDMcsX6QWNgHd3NP6,iv:NxypARYrnsH5ym1sOBSLqoiTxMFTy5Pku+RCVhlatd0=,tag:4yfzJUjlvQKxcpU/QKkPAg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:2cOWobyaHwehdVx2VrM9ZYbMsVpkiax2oZsarX9Wu/4Nnw==,iv:PMCfct1sjfVpCCDQgQGkP5FzhP8s9Den7G6NqZfgg30=,tag:uwch8RpMzzcV3ZdaVt5YAQ==,type:str]",
"mode": "ENC[AES256_GCM,data:/inYYMGkZQ==,iv:DsmZdgoJ+VFHkXp8xJ24GZVMc2ooMl+1QXnN47TkJdk=,tag:xwUXoSGQmrlyj/+nRIgJMw==,type:str]",
"type": "ENC[AES256_GCM,data:Cra1rL+rN3meLfbCc6C4MZI=,iv:riA69QDuqG9yWLPyddvuu3AeZuqAyUuJAt8XGn9t/kA=,tag:Ci0Togw77tMz9bJQk7Q+YA==,type:str]",
"name": "ENC[AES256_GCM,data:kp2UT2PRLbanhg==,iv:76OcXt09a3HtJ29XEo/GBUeTOriUQ/OhUmPb8zhFSJU=,tag:XPANy5DXFGGJADzCz3r2JQ==,type:str]",
"provider": "ENC[AES256_GCM,data:6xKyKEEY6o0tK+FHvA49TJ2LolnpR1mmIcgEAiF35JO1Vua+8UpHflZkHPuPubjQTZQRJEI8,iv:M2XxZRFTnXPfaQvBS/LuiA6L4Et3sjpikyQNMMDHbWY=,tag:rSiVu/nxlLpOLUd+lOiA5g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:2A==,iv:fDYgHADfzdvH1ZzfCiOeBVlkI76FN6fAVN7gHduJZHg=,tag:hQLU5iD7I42S8s1vII8uUA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tls.crt": "ENC[AES256_GCM,data:sWqEYm0bXG1/yMUj11kUtLjTY2KofLQFcegBc46eSfxo0r1ezcDwca0vTBztYZQs/jJL7H8hCS45ZcHZLCwvCB44csx1c40lMteXCJFcP+5ZapjcdYnDELTykM6yffSyFWcmvYjJKas3oTH6960cy3sc4G6E4KYyQSiD08BilqWoEXqD1g4Z4WSHUCSn+o+E7NgnZTXUv2kC8uhTCPCUp5ngj0l6YM2v4o0g7+00psXuoyuQJZSfzEqeqQMSj15hUQh+Vibh8Z1Od5P3ZcpxbYkPC1wwH15PLmP7mBENUsU/kkGHHyW0YjVvysKHHUXOVJLXLbDbCTG6vAbj+m9a/G1RMok5lNTWpco5t3x5IBE9IvaTDA6zjHo3nLzvVlYsoTM7yzl0dosPM+/euo20Qv2bEQnUijM9CAxCl5FDg1eu2wAyUDtUN7qXoSzFq0bj31qJO+UXIqQFZaPY6oKkfMJJMye0yA8je8/VWIH5cnhbK/kSNL80uWuyhs8HFGTGE79r3cXPOciSjYJFwqZDHaa167kIPxLx7AgTAnLF734xXLoDpZERrY4uiRBBnyylZZdlb6HBXRW2ZqsTURXJkkoLxLgbdyR5UYaF/iwwGNtEWO6AB4D0NrSK9n4lSwW5gDeZJyKfBWJQt5Xi6GAlnty4kPPosbtn9EGLekIacH7FX50nAVFtoP0xn4qOOJ3OBJjIeBlcfcMikyentYs3p4v+NIlSZNER0/fH6viyeLZCzzP1UpqIkf1lseGkGJRfRBpLUUI1iHmxYj+YSGkHEBR3doZ4Yb56lQVtwej7m8Z9b8sAEUPSpKbQjzQwuLp0Kaa5bt2H+42hfHAzWDUTMLdkD4hVpozuiwetNlHj3n0j3s2dSBNysf/RqDpbLWn/XFxMiq6MWxA6Q0uh26GMS+GfPGrPLho2roHpb6TBHdrd57bXkFGujuoEcf8fJ7BO49DnG2NBbaXJRo5M6uLAcYPc1RD5hfBouRXmlnSkm3fs+2yAqHWqn6SvCEURRuxqr1wE8/hVgJN9HArgToYBcQahOJlJjBWLg/JWdrdKsVvGYifJzsx4NxG2LL3TBKiJTdYSmvIRafW4GZpcArqClYfeU893hbUoilcRwsGBIHAZSOYJb4jzpjp5plC5Ep940iWbk1CQWeovuPtjXid67AfTsQwRYNUQ4c+BncPQSPigvvPwZe2Cd6MLTq+rAOANvoBpzpzE38UgZvtGmiU2Eutg746Yw+JUX0BeAv9xmiJOjN4SRv25mrlnHTJnPApm1OkoGQO64MgZfkHdjg5gYBU/DYXvlXWV2NdujUCpyrdPSaFYsqSma/+6d0+z9LjS4aH68cS0RHAYDdXUzlcVXY4wXWmd8lJG5XQ2V1s3LClAECTYf7DYxeczi9vhfh3jPwhg2Oxi0YFpcCWpvWtK2xzdai2EhukbqWeV9j0nv3CDgHrJmcNfOTHoDTHj5hN8PwY3KsiV3KXvKL95XnG/oq1rkgkeyoFNv4tRFn2ZMo5CTnfdF1vcY+d4lPUnShdgmaCtNXplqcBHB+Achfm5BWfcsvd2UEx1Kwwwg9np2deFGMMQvx6DRS2l0Kd4tCuQUY6qtMCJOHBNOvqzeUcgKHbUq+nYcB+s7Jo1vQga3pJ9TBs13+LJ5jUqOILD/HZb6ktzzihUJ7t09tNaiBMl9RuWZv2WzgsBSMm9AUktAF5OoYOKBT8UYQz1301RNjzXkmnRChzERKMYgHhiIZXJxRXxnMLkFlHrfYTb0rs6YsgeGlCjd4TmaxNzPBQB8ufc/Extt7v0PUpS+PayeYhhOxH2KD3lPh6wFPKCvQOha/BjGJ6IamOGVBNckC/BHUJ//kSYUhthNJ0JX/PMjVP7KferRqBNDVlh5FbxQrqTEPorfvxfcmj41PiLOBmkTfkCymopxhQL5F78AuwNnWsy+LDA0k68OQGHCu7qSEKtsNQ3lgLvkGuQ8Y/bLloc+K7lDgqf4PByzbaSQsQRaYU5FfqvgH39rjiOctLm5Vs/64k3m4ztiga5aHZjpQceataurzI+hzp1Bg9mi8crW0eGgYvURBAnQORXFAgH0BTQZsX5wsOlTnzI4KqcVOHl0936mqA8gMKvLrgjYRFBVoDf8weW7h0O28inlGzTCOxxzWB2dm+q0bxJe8PqFu87VrtKYXn6BytbQhQ5/D7uKZaEIf734v0Vk1dkK7PQu484HIwxLVptzkVRZrhzAwTIzXSnMiSqw7dB8akcR3QNoOPTAQ2KAMCes2lgm2JwTdTcS9el6cCeGLWyYf9s/dHP/VEMld8Zy9NX7Uo3+CFPtRWIttGFB3G414Js29tKt+R2k9DJxl+QW8FrVWTTeb7L5xKh9DIdt5xc8g7A6/DPOX10/Z6N32V+tYNqsMgZ6Yrwa03+8db6aZtg/ZSbJ5fIGq0JlHLGNEIpwD4JaUIfU1e8hrPyMA4itgbndp7Aidnm+yGLkUcwjpR8GX9JEhauZuuwdc72gKUc1zYCp0LAmEg6H3VSFsisbm6t2jsq8PFLuZpnkoG5LUQ5gl526MUCchxEEe9+WPgnTeo6vEgRjt9zEKY9xy28dD+6ZzcOp4l9pbecP/M4jlEY3A1e3AVGZdh8wwtxdU7OIfUi1afDfek3NJcvUnQeLw8jNFKHB17NjEA/2yWJ+e1D83H63G+pnoGnsmmEcZuS7xzXAcROEjo4jaW9V3ycPLqTndskKgmqdVRAN5hOrv1cyeUimNlvaWJPXEHT2H1+yHLib1D14TsYz5xN2Ps7Inl8HgeR0ex1DJFONhVTGMPtqSw5czHXGMNwVzif1shuHfI8Ixb5jkgReCdNNlFQaYumJy+W2rsDKeo8MEfaF95aexR0nELLcYJsp2Hf4TY7RucprMCxhqqf6tpiOSK8kJhXdmPtVj5D5Xp86kPOSJ/zpvGyQuNmXbYS50PiLmDTmBbbLXJwxX6CkiJR7LWjkTyxR8sYm5VAeTgwsMvzfwsCFp2gVMHVm5r4EOK8V4H/U9dW6wPx60NSr55OAnChADbHK1TSRGBbJs3gGlZOpPnBTqfJgHWYJ4Boj9/FJAovPfWdOqzIGM9x9uxWvWCDqga7m40dopHs5hBevZwER2p1kkKt3E9SDXjy3+EycLQvmwophsobxC5mvBPifQqIUojLcZlG465fgLYV3cKvXRDtfw3DwgFdY6MK4ALpRLYzk/naNeVAVZqJhN+x2KroW7sXC1GpuThKOkj1pv3fl2l7F/4h9z81urT44DvGdTHiPHyehRVVRC8ocb38T+rQvwhIBWs6BwXNaZst3OdR8LiHDzgqrJx4wMLenR9twzz62lApPF9l32jE+qE3mprjfM4GPDPKd+CunRcnBwgZGtc4Wa3Bb90/PXzfjpmArnQWiptHhYalBwad1Er/1ECIXq9UOTfJYDpt0Qd8SAWHRcS0j4G/sVckq4pfLDoxcFRjGMko8NooGMzBk2gP/7lvPv7CQ45NaufSlWUfvqo+8xsCPR5IoiZtl7S1kYtR+Pn/WCX2I0yKu/Y2WsVofeXuj5EAp/ZMSj6IMrx3P/qAhVz+/JWH9i9LlxxlqyfF9j2DXthsULqZJ/Wo5ckVoVxkzElrUepbzU4sctvMUarjOc+7WbmW9ydz/cLAypY9ubkaxHh3+nORGJHVHKCp0Y3tifqeuTgcW0ktoA3kH+dEZLIaT30keE6Ucog8MFL7C6c7tQsJzCB6YMMLwbkAk/ruiH9s5OxgllI0HANEPKGj8dclnZUO4gz0dJracM5j+MDm61kguQoGnyvDO2hXvdNw50ESOaJHkdTsZ7Es8IF5,iv:SXEB+7QsRdmkUfmf69ziyrMI3YSK6R04MTHDydya7zA=,tag:Hk3w17ebEEi4cK9ezWPp7g==,type:str]",
"tls.key": "ENC[AES256_GCM,data:NKsMVpqo4NJDB4GfkzIlhjxx5kgSOLZ3R1Tj9DaKsygAfRqjYSjap8IQ6KRcgMQRDVCvztNruUUqk7kha4CDzScWiEmo1glEPIM/NYpyl9zHVEh1+Csav1rBTJKGpG5ezLvZ52f0u7otn3GBSjlJYz/d6kt2ZDyEUEeCI7ucCPoB/+KLaHofYmpcmeZ702S79R4DjgGoHIsSeFoynDmmIpR7s5zharr5jK+0Yx2vp7/xDgJIK+PnneukGin/KGpHZ8QE3vXOqCryLb0cYA546xeOqtVJqb6rNXm8FowGaYFvRqhZvnhtHwcJYTCn68CgCg==,iv:V7Au/UFwiufKpu/s4z5VnCzPQNiiO2cPZMYZBsEptPw=,tag:iB2gIbvQooVjwChrTczU7Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:++g9qoHPjDkWOroNOfV3oQ+BMyg=,iv:1CRU4lbiqo7StaXxolz0USZOR6U4BSjMqyKi1xKs+3o=,tag:NaJKDdGcULlhRbOenBLh8g==,type:str]",
"immutable": "ENC[AES256_GCM,data:UR5zV34=,iv:DekRs0wSHmzxNu+NP9aJ9/9HH6UuTeuFMkLCUstloqc=,tag:ebyiQLub5AvnEeCZnDTrTA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:PA==,iv:3KYBq8b6onbtKC038Kn9ADT4XPht7W/yacH4IqYBgvA=,tag:jLAFSbOnTuPSf9vYgkkJ9Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:xAc3QXc9jialzQ==,iv:9BCxuSiYKb3ZWizUuS0TqXNo5QRNw9ZlE1R1ptMjIAc=,tag:Hpw5OCVUM0+Aqm2N3llAhQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:3XrCGcZ7iE6A,iv:LV04lp2IhCsiJncFt5DECVwAn/BoIVoljI4JFxMVCek=,tag:sCodgwv4rmsz8DyjjA6JOw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:aOq6Y+QeZgDF,iv:4Wd64YPf1E8XyEmgtznOH9maWz5eBBEPxvtC4Vq+ZZw=,tag:2Dgggn/I/A7T3yrmxqWc+Q==,type:str]",
"uid": "ENC[AES256_GCM,data:wu7rTszehNd0K81M4guNVwnoAfchFUdJQMrUGqXMBq336ToR,iv:M/G8PtbTKRj54Scb9u/zQHRdeTffYF3NlE5jv9b/01Y=,tag:jRZJN06Ejb9eg5kJVEAHVA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:3wWhYq2xY36sIm/NlOkPvJM=,iv:VQGSr/ZTHalGpl4/nPuq+0nm5slU6+CsbfyUupENVN0=,tag:bI4gO9Sn5xuXjgDySmBXoQ==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:2A389g==,iv:a+gfsUhGaCQ9JJ1AqZo4slqV5lVQr5mQ71iXQJSZvTI=,tag:3qBtGnDaz8rLu7Z5SgJaBw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:Itwq6ABUQGopFvvCL0Sk6r80dE1CrR3PnmnA4ShQ3ZBRAiiIB490M+8TWWEHQlNmcJ45C1apJDvULcviY4oS8ANXcQ4KgvPbVEH3ntDIbXG8JjGf,iv:JE0oo5OzzkSvrZ6Bzva/T4mDouj/5GovQFJrQmZbsbA=,tag:YMZJjAbggcw1OcWA5kGKrA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:syKUc1VSukuT5C+j3iOkI/Mk6G5p5dTLQqZgq8syJNMMLSL/ZVLW9TF37wmziTs=,iv:hxJsS4Es5cp7fuT2LWqBUqyqpSMJgtl7xD3IJYVl++Y=,tag:VrgrYs0umUG4n/vVC2TFnQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key_name": "sops-state-headscale",
"created_at": "2026-03-17T23:05:48Z",
"enc": "vault:v1:LVriOdG6VgSeLZsSeMbj8CfSerPUtS4SHJH4PM6vyY9JmEwQHWOck5SsoANY1eeVeiY/TlaOdd2JTZVG"
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzdE9rRnp0L0pCaWpRUXhD\nQTRPY1NMbFBCSWtzUWxhUnBZRVdOb1ZMV1U0CmIyWEJ6QnVQZG0rQmVYcTA0cGlH\nVVNPd25YR0hTNzVIWXJwL2FBMVZQR00KLS0tIENUNVpBTW1GaTdteDBYbS9CWWpN\nRjZOZzE0cFkxcms5b3ZsTFM4azJiTWsKeIi+RTCXYMQ0wxlakGJZGy0yeUSmwWNL\nucapaqUtkI7DrNJ+MWH7mtJGUg0YH3D9z31wL4x5x7wVkLUaXbppsg==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2bzE4OFcvenNEaFZpb09X\nTmdtb1VZWWgrNjg5Qld1MjB3ckd5WjdYbng4CmJxT3N1NG05dDFxNHBFWUZkRHNL\nWHlvOFdzMDB4ZDMzWWRkTUxiUEtmUXcKLS0tIFBIMmV2cllMRS93emtoMUQzTThM\ncTNza0cxTTlDU252RlVXN1J5NEN4OUEKb4LZnyPEIhVzk6pxO0RF+H+b3VPsYTkS\nyb+f8xNq3RzRIP98Yf+LgQplzT9e+M086pLyZuhhTGUCUb7nhNeFtw==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lastmodified": "2026-03-17T23:05:48Z",
"mac": "ENC[AES256_GCM,data:271CcKAPtGc4BoOQhuC/u9ioRrPpu/teCbdI+/ql01GHXtJdWg5nzhCKZkOrtEQiaRubCfFcWyL8it2TAOUmYrv1S9RbtW7099ouFtGcJNyywVS+7GcJJqzZu27W5Ha1x+Lxz5s8CvxnSFJkq1DgC9S5l/9grOEo0RqAFQI9bbs=,iv:v0xHDlADa/L0V3Lsc4JmRjIS2rIPju6k7pCH6yRTKQQ=,tag:kZI9duz+bPXqkB0HRahDuA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink