viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/state/stacks/iscsi-csi/terraform.tfstate.enc

240 lines
104 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"version": "ENC[AES256_GCM,data:6Q==,iv:FkXRXDas4Wzw2QK5vwZzJoPNmpcU2n76Uub6FiTGBLo=,tag:DUtESBGtnfvYRNzuQyMxMQ==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:gENUbhQ=,iv:oooZeTXFXFKGP7sA6j5xDu66TNHCF6DPdfgaqK41cW0=,tag:ZXMDNzHtBI2FCUXT2Vfbmg==,type:str]",
"serial": "ENC[AES256_GCM,data:gA==,iv:NDOn2fpfyo66jn0dAbaAr6YGgnvlQx6xA6+Fen+T1KY=,tag:Y6Vz6/PTTieyl5LN+KvoyA==,type:float]",
"lineage": "ENC[AES256_GCM,data:/6/LcteXuhqdl+hGuuo87EVGUSRYdGBZ3VqGDxLqt1y0gSCK,iv:WpIT5iehvK40YZDgwBBHdxqGMTxL/AR7IToLE3Eh7cg=,tag:VNhU9eCqUUkw5BW6eSYYNw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:P00WLg==,iv:GFJY7vAAQ0PAgJ6pJ8Uwf61ini6e4r1SUUgrL4W00bo=,tag:jIGOhaaW/cR4862ihkekVA==,type:str]",
"type": "ENC[AES256_GCM,data:u2FE8sqNG2TMPMXy//VZjEJF,iv:KM2QR4wDNBoywJJbLYX7CraEPmZ2JwSqPEkxldqYx/E=,tag:KeAOaXBNMzFKR+Chmw3RqQ==,type:str]",
"name": "ENC[AES256_GCM,data:q7krsYk5Wg==,iv:WZYt90FT6xUKRMJU5juj/amnAdYCdvJgsLqqFiZaruo=,tag:VecvHJ8CUf1LY0kCGrHjUw==,type:str]",
"provider": "ENC[AES256_GCM,data:uXXgTMzAFf5Gmz+PDQkn7NHjgJwHDxWke31mGXq0EUNkFWh/PEsRfALQ8JbTmDIBtQ==,iv:xoPQgBddVsWHYiKh8DqYvaufraMFOxtVYK+5btL/QxI=,tag:QEuUSUp/EiBacYP1ZEfQZA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:XQ==,iv:y8FiHlZdQ/NfSTLOgCtOwh90X6S0o6HTf9O0OmSBr8c=,tag:UpaYXHUmwifWuUW+c9TjZw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"created_time": "ENC[AES256_GCM,data:w1Ta95HThleq4QNObuGOF3LBgszsiaxGzoSGIeqo,iv:w0k67xs/PcOIq37OUL5mXIqvJnokORjeVDgZxLob5cU=,tag:C13MwNM03NtXcgXCrPd8oA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:oeX1DLRlZ5T6O1UTKZZX6DS6zjY=,iv:h8QebHx8dQSwSoULZMSwatTzXyrtIX62Aqsh5phmkKU=,tag:vGQuntMl732tFuMmuii6wQ==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:vjLouaQNxiigXLFywdb98J9ia1lrguJCy6hSjrKGFiNkpvbh4nPYnmfOJEy5bOzUIG41v5iNJM+TjEkNL3b/KM15whkU/uuvGwRB9xr050Iu,iv:Rku0PReloWbpCkt15tsKHyUrcY8MbIhtPyivyA/Dvy0=,tag:QfuZwgB7uwd/rumBpVsnqA==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:eh71Z8bBtTWZYarEeZyAhQJ3PnuwO6Py36WPjL8hePVM93RE7Wa8+sApH6Ng2Jm1e0QVSwGwTWA1/9mZ30dkMDVB,iv:PfMqp2BqIoLKfJ10X7x3f7+AxfkIW41QEv2K8Wz3M+A=,tag:tCNb1JRBnDyG2oLwT/lzCA==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:0DoGcHhBkdQo56ZXGD47ZA==,iv:eGf4eqL6H9Dnn7uVCwiPe28gS10lSz7HnfwpTunj8Yc=,tag:foFG2jx55U5doRjGVghoXA==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:CjBjxWCphnfa5xe4fZppEPjHzdGUtZx0BH+1sCtsQyOOIRhUPuWUoF7QSc6URRcccmWr,iv:Wva3l8NvJ81kaRqU8hSuP0zcGcpODR0OLKkkKSsHtoA=,tag:EmESlw1nMgN0WzqpeQWTVw==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:F8YzDib1QhOuaQknJqVDMnTwl2vNzx5uieUL8OWk3ZgVl6gcaA==,iv:bFvatoB3GpdJkbTGz7MVz2p+d8utXnpmGKG9n4UCY8M=,tag:e5K4bH8lnTYNeNLO0wjBmg==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:aL6o9ACAw350P1ZBQRvEsG8d+BwKbpsMU0QUxEMO0THVInTL1yZ0MZ3CQe4J0yV2YLvG2Ie1+L1tj4VoBE0Iubu3J5gEVjFJP49whTgrpikp2vLEPDq+oX97c0emUmqPmMjod9SY/y2uZY/VLr6Mwgi+cYZ9neIvRx83mzXqhgKGoJVclcukItcBvGmWKsSQw/mm7/tqV0Vhh86JFMqUzEXj6Jwc7KfxEAgdWMDg53yWOmD8/niq1w==,iv:sEM1o5/1HEwF3vUuix2H6SlHDuAoq1DeH4xLtjdJ3Bw=,tag:0gBQ5MONCXx5SIrUoDrRxg==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:Z87GQpTgD+UkLAy6j80yM7NKNXo0muutTy1xcSXI8aWtQTfqW8FiR1Jdeg==,iv:MfbfPMI99SDNa6M9aI0l6I8QIrO/gcVyCIsJb+HRKxM=,tag:5WUzVsgcgTEJ/MKwihsD+g==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:iU2mo/8OJ6zGax5f9UD+rVOBTyx4BlBQyku1q5A=,iv:VYCsTJjBo0RZMSEDIipqAzql5Czw08eDYw+V15zazgw=,tag:ckK+VLCpuOQNuDvb+oPopQ==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:F8/YPWkBZErHURuJFMH+uT3KBzGIkA/K7idOoivB0DXKsFVBfMM1BHVVV/3f/VGqbsSR01LNxuXyqSi0lqP9nQ==,iv:ds+myg3Nw/XSsGFWMlfUvS4lqsqmhlj1GMV4gWLYGq0=,tag:OWiQeHTcUF+fMC0ZsvBXKw==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:ulHSM4SS6bb0Hc34W0M=,iv:3RBcRKB/IUQydcxgLH2SaEu228A69ZbsqkaVzzwLjdc=,tag:rwAu2PuEEU5XXxSugzUAuQ==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:CPyKsX3nbo9gVAhTUrnLgcP/u73m1AhCTw==,iv:JlT357sPbl1LWEQi8FwVXdxvdtpBMlytdQbwg19Wmjk=,tag:pavFPaxcVeDYOMfIIniIgA==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:sgO07vo5PrsnCMbPssEzzAGCzfZXZORy5uv/Sk5xDmU=,iv:UQn08pqiJWLQGIsxnSFVFQ2VssQjkGpZuray/jiFwPE=,tag:ZRq1j1pkubHDFSDZYHWExQ==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:UlWRsjqkhDZe5L8A0eTgW9+Qy7gyR8SgEkY=,iv:Yl+RUpOnEQ2LnyzU63/K2zkttFu3iYpnrVAoSg41mvI=,tag:0xWXjll4HeIYIl2WzFsaww==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:ghaibC7iwVQRCniC0unq0ItPJllIWTya4aRJ3w==,iv:9n2s9q0I+yIqEEWo83mGQAaV37FvHAVP/hM+4DjoTbM=,tag:GHOxeQZXBfh5C99z3PPKTA==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:hnfRQrNlxDO1z66sDdLQ2VgAe40=,iv:cJgk8poD8GnOPWosXHQ0Wr2VVXU/Mbl1qIDU3TQlNB4=,tag:btjUOX7y1+5BfnjiBTRS7w==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:gLgwIOHJ/y3KoyaLEoC29qKgyEkG,iv:GxQn4PVJi+Bb0bKXgV95Kuk/m7uHhXNWUuLn5OF83EU=,tag:y/RUCUs3NKvdLkF4SbnNaw==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:mhy0WsV+FOM9pU3E9Eh2xZpA9J2MSOYTCD/Q/iB+5lS4SFuxeoLbicLvtZXvS+D3R3We3l/Dx461i2BzG9tmVucmr7QyCmKrCCct3xrWZ1CmP1Rvuj3J6Yi3cIs7tY+LYu5RADQVYzvPEWYxcBAye2C2R+IElmKK9Yu4v3qoUpPSrYZ4BkKQ77jAWfuzmTfZyY3bAlbG0iISkMGX4l61t6x5/ZHVXtJb5zKdyykhYDV5KVG0/+rK,iv:to7ZYuQ0trLJSZTZtW7/6xqGATvqyQ+ez5riOsXK1I8=,tag:nd3DveBy00MhYH3fBn1+xg==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:D19H8p0LsNgMJv7L0AqQnqFbZOvmJ5Q8+ieSdoBIYN/1riLYtfsx5CfyeAsluINDeFDcFofLWmdEnmHsLVNthYY/+6B9PlKkqOFsTcz/O+3d9G7GFNYTzTmON/12JnHqoKo6AfK+iyS9brnpl9BOZyz8emH+kkeM3ajiT9F4QPcFZN941/ZCfg2DCVVjtJsPN0XYd8l5d1mzIMUPPStpb9E+hZNIpBE4zWqpgmWbNxx7MzbLADseGidzDaOSzNGBcr6uovGICvs9PhYd4YVoSzeE8yGSxH3ocutxAuwcRxWJvEOW2MOdEIIncFAvhEYAtiEi7dzUfezlYW+C0RkWfO84tuac+XjKVM038QiaYmR8TNju18DJsxK/9/OWrPGG6qCrnvE12l3RzbIZ5ffUX90CfLwUEWLULFBtCpz+paFKYWjXpyjNluXeL9McVu/my0uxaP8E3+8/6sZPUWcgc+XL7aDji9C/BifcUqXmQ5siJMHjUsCEIYMUOsMYoOn3n88uBQFpTG2pKCafXbySabyivlF0O2Pgg+GVuC6mTbpam+5rIqOHr61ILFnIriXhgipWjvTVE91V8jgzBEnTPJf2KO38/pHVd7xu1jIQ8RnoBYkdEZcvVAGmWRHDwdF7QY8i2Gnj3zCwLnzy/cO6v54Uo/UM5Aq6ISYiHYAB6VE/2fLvs6pBfRLnZ8lMFHw5Ua31FylnkPpz7dTryQ59XxEWKd1/B+xfl87S1x4vDOdhU8wJPNLssKQ0l9HxNvSp5BShMAwUikJWHDeYCZzmkVBFs8gpKw2rPTPXGNqytEOqCPAWx9YKdM4YBar07vqPvDgtv+RQDpMOsYWSzuecA0zeqKZElHP9FuJ1Z3+f+ykCegHFgNhyy0k+w+TCCBaqbAwlodUAAsKmMF8BYATtJ4C8qaWDLIZyKj+zmcNReOy2Zh/7IT79Md6dKA0AcB8AU3IwTEIExs79e3hbTlQDeY2qidNDsXYdAi5t2aCshg4WzHrCMWdsf/V2PXcB/pJacEwWt9nmbRf9jgC1qCWnOsygQNSxXsYUs+f0SD6DlL2RJi6gIxldlyEpLKWdLlded7O38SkJ3OZC4L7K+yHeG5lfKrpTDIo63msZJnSSpB7rLTi6xJGi+TLweddDHzemG8q3njOcJa+flZPOVM5wHVcVVPL5IVDFiB7f8dX6QcibBd2tzg+tdqaHwkuvtZA8JUXMSorpHBHpjq8Pxl3GLOJffZUarF1aMFKyI4x2hYFNHMG9Seja/ph1TbHuhuG6QuQOxYb+LJW0112kLv/isqEQsJzU+77Ds7S7Omep6kpJe/s/f3KhOuGJqXoIhk9WP91XqIXrMiXpHZFqzg/15EBC0nEk7/JXEC/ip8l5DFPtRg5OxS5bZa8iOVwcTD/f3Ciqd75CvQEyWhUF7epDDJPc64lgFM5MXzjhh0WSvm277ZxPlN16+bcMp86DytNBQ1vyCyx3wMoa21C7zWNkeMLqTaGyZ/FhxZLoadU4sMaWQr6m8jThyaGBtakDvC67oquPzYLMUsL4R/3CXzgF+/fx/8ssgX9gd+oJmsTUFa89VQ+gCTYscSEqVYV1lF1hib4bCO4l3p2NA+KQUiZmpW6oixxWlGDF26zbPLum4T71Py3fMQrekvSGWkxHl35el5mrTCMIrj6iGP2SSAvj0EExVvp2xPvaj2W4uoAwoF6WhsQsiFx+gBW0PjYLt6irYqiq3rrwpSGISaO08oxqELVuNHC2QMAnCYbi2Il3dG/yVO6XuOf+MdPxHgho/oo+CWL9eFstv+QylyAJ4lBI+WrT4CeoCOoMMbrhrfh4OgZS1spKlSpw02BY1Tw11kdFZPPldirEO/TbqKn7e7RR+GMebpgD6mYfs4uqQ3dohiJApJdXW414Tl4rSIPKsSBwwrhqH6+Wq2H4V5Vb6qDajZgYFx7S62y3SZJCGJQUdkvj9ZxCTgMUlUDbaYu/JVTSHOdSEwlzePP51WR69jLPDgsXxM/YcDpH+YFXD5JwMfIz2EGOE2eWtn1CeenjnAArn4TfJjJMJgFU7zV6np59Z0yk6MW1XbDWw40KbCWa69GbTJn9F89f0qeRF+lPit3aDoSTxqJXWaYX2OJvky/v/0zlCnV1AgfDzVbQ8il19G/PSyKaUWaR3N8cIVh3ITPFw6+u87k787+upL0HpmBU1YE1x21t3siX5K0QXWH0elb9CtHuyJ5LjgozJPITDRG5Qd39sTasj1oUT35heWshnelkivJxfolffZ0wyOX8sF/skihepULXT+YMejN5UjfEwCSKj10xcm80H2W0y8n4tuovx//su7Qn8Nb1WXNuhScmed0Xuv95hN+EJ735pcpeAhCtFhWYsMLnwgLY0DszDgUcNQkiLcQmU4HUi72jArQhDAvoUSbNMxsNgkHkbWofbEoXVOjAAUPygNbVLZUuorifTw4vljGlz2JS+mGG0cs5nh9IR4VvoNWShlHM5XOLhctv8PQjFRztRYnIAdgatjJIoPOCFaVxUlVFcl88bD1j58Uj931UQV3v4MbCrHu1lMn6Gxx0moXpiq+AkhhdkIB42MNp34/caJ6RKoPUVlYCgR15qk1FbQn8E3XjXCJ5PvnuJtfSNp09Q58XvZhju+LIjAQgN3/hFqelu0rh7R2xOI6/IpvBax8wngdkdBsaECPljwlpU4z7QR7vbP+QccvxSy263h4768UcCiKJEVuxSgJW9LjAC+ukKWZL/PqTh99v0JWGyoAyK4XUxKSygpDjNxouePH3yHucs6LAvxKB6kRTztRxdzLJNW7w69k/zFSM94JH5LtK91vZElqOgwm/uKaPq1iMHhkPWHD18NKZlje+0jCZiD2E4aE/DJRMJCpk5aJ2rtkgZxrAkVYYU4F06g5JyS8Yu71ULonPaiIWFoemr5HAxQWWqRIDGXO8q6Al9leAiQtfJMtkBRXlamuEMJRdOoAW5kupgMCaqr52EfFOAq2gWXOibo+wQMCNhNmGb31GH+PTAabJTusvc4LnqkRlSb1/oC0/Bg2HBEnzlU1R7MKl/pSzWGzdtKnfx15wXF6SqaayIOMdZmKdy/W84UcGpDOumTYkCOlveGLbCSQo17MmnEVXab1nRK8kLx7UD/4aGxWCaSk92XSDIQrySguS9jE+BEE9ejm8M9bKbsjGNTyYnTexlLU4asoZrAv1ZlIEzOAw3PSLQHv8MU6RA3A2Dubi4eTsLOTshKK6CDa3gUZuBEBBpEDc/O/puJtlyq9aEO47/AjBPYrce/pSIOAFTm/8yqYPnZ2Qhf6eD7sjQ7ZwLT8vluLMmW8TH2qbb9iwKox3GElW1rtV1M/rkuwXDPnMATDg1cGgJXNTVJyv+CYFamI6MbVqlGhchXc2UbD0XAR1PEprZgJpRDj+W8jVPNRTb9KV8+Pdwfax9ljOVWglxeqczUiKGhpnTWaWrhO3uH+x7ceCIHfV8petne9WBmY8dK+LbqhbztPXO0+4EKor/Bz6eM5RyluqZU+E1RVQxrR0uRJ1dTw18aFK/A3m3hIxvk205xMhsFt/6mnxdh8g91u+AmbFbdy0Pjj6DCsEgWsVRLEUaFYkozwunIJFBoTJa1cuDdXm5jLiAvcDAjsL+qatx51pSGesAUnKK9FfILEBYFv8nWnAoxXRxXQQe0e9/wU8esE7vTLRN3YOIy8+NUEdtMOH6R/R/e46SMc2CEejDkRMwdgb+s36xadAoFkOLI3LrbO2kAYHlLMWASZSkRX06mCRvLlfk52hb/1ZeWHQ8p/ynDu8vf/8EvesOZ1vN7BGBLgibXbqNEGvwQSNVNs7t+w8pY0tDR2nVK8H4n8Y/l3oq/ImbrRPiB1SU2Z7ogDul2MT73NeqfkPb5tnSv3BO6uCJGMfo9M7xFMPM6hNV82lbJ0SiVIOdNT+A05khsKcV33CxpU7D5j2xirG/eds9gqy+t7/TWxddsW3nk3rBz+BLGnqVuTbQGW+AqQ5NWMaaGGquuAzYLsTlxCiK8dEwryOymMegfsuYm1yeHcCParkIb
"headscale_config": "ENC[AES256_GCM,data:m1V+qh1mbiQN3uVFtYqoILUknUlXY4m3fEGIafYMRss5jYjXRFQs5/LnvL3Zb+lC/xa2M5lIMvX9yWsfgLyAPh6RvrDDsLxrZjUmN3iBHBpbnYwD7dVnf9Hf4qH7ctZ91DNGfiJWbRulgtQDLaCj3NkCXscBoag7MyMGaSKNzwSLExZHhPeIvrsvrOIOvCIr9rH6z0mO7lZZQWaXuoDoblB4++wMeL3m08G0OIKfsUDMOYwZKlXtHSFugg/eKD5rIva+m46EpdCMQjiIVyLVaWY8QmrymdKsJOBxj82lLVxgPvkiMocfdCslpsE2DTgFXLELnZuQOAAxTktyQbWAwDUrP90se3REBpzipTibbOdLLx8135lIjp3jkiAsPMosQfvKy3eytryFQyEYlngJxqrZuF7uu5Zmj/S6JhfRj5x2tP/ygnDsYAlF2spUjwEaCKP08FBsd+zzk/ooKki0TYz/6xcrQ2ISrHMlgvE0JXBLiz0ozWB+tBVAP4afe06fvGznLzPHaOEq9DSVIvrlpT7nhAj1hhSm/tCgxSdwQpXEATdTuRB3ck51ZLAudopJugOODBj3mBze4wiLAUM6sJG0VQaV1u3D2JHLTYErAbV6tJUJNqjNo/9P8w8A4rjZEEFwrhJaD26NPwlR2NsYpk7N24+9nlKA78UD6kqka+kbldLmrIQCzrRVAttQ6ykr6kXd43qHvWLgoAGk6yS7KmtO/xDWhfXxJz1FbfnoHCVNPbaqZ0XA2VZId77jc7tIC7JjYdb9g78X6OsMQhefrAua0PoDOoqbZTD15LT7k08p1myhUQMj8y+xBEM8KbN2dIeVcWN40Twg1ZfY142EOq5MvdW8/IjaxxPgvEVz+poJt4p/kjtyH8QVdB6F0Q/hL7RuebU1mWKumnK5cL5d0VunTaRBqbE/PeecOSGgZcF/eKyDcIRsAAJpJ91ShLTqgpwZ/1ipGS4oCBnQJYojUOGYO+fv7bV6JEI1qg+PWLAftLHGu/zkBUBy4CDZfGUNyl4XXROzRPz4zopaCaUeq2L1fCUGH5UNzoRPIPue3UOwXrXcOSYx19uDX/0I6Pj0StDbJW3TSt9W6QWRBsGFXhLxkBr2bnjexW0PI5ilmbuyIsMho63NRW6mfani3sRU1WJpQtn65A7YIdWB+E0M0PXxWKgiK4KHzcNSLNFn8SimEJnf3SqQpZXyOoVcv8Lr8q40mzFuPSwJZVHT+03orqABNZ4fBqGdQjK+QQd2/O+7HsHBy+gV8fp8vxqJOBUXFcVg6mM5F+zujl15AECH1E8ujsUJIn+9To5skddvzAPNzBn3DmoywZJguiTTCXAMnSO44jTbnVZTRqjMkccJEK7Nyh8kg/+mtv0Pc9dMmXlbk49u06L9gDCQSFpjic+y1f33e1Q30akb2w7lB2VWdCyHtTpFMCIR5pwWvpKfrI2viL/KDYHMrlgxNuTPPvd3iYbj1eGE6FBAdnNYepe9sV8GFULvD3JIJtKDY7kT5xuB24CQsEk1YIkHNAPUfNo/ghTW8QGrXozXbTKkotlPaxwVzDPwnL4Au4C2Ca6iyRQM0G6sEHhlQ1k0HyMgLJb95saQ1124OiRu1qLOn8/hGxe5n2HZ+I6Z2lQEavI/jHE0nRlCKKIR+CqFAxnmnIt4w2/WoPZQmXRPwLMCJvlrfxtmk4hV7Sjh2l/sSO+DHaODR00lL1A5QTbNekrLObjIEUFWqEDNSB4g16HzhvntBiy0SuV3UqPnxxWViQwVWSHcUxkvd6UoyGAE228k+OPU8JXct3KLJIRoWYPY+rcheYY9QwYoIbweNGksHMoG6ldjcl1jVfatbRYPqpta6zajQ1OtXkLb7NaA38Wq6/VjNGzNQauQ4krNmt6Qj3qUrBx95T0eWfibTbp8MNXOwFGPYNyk8VKp2bLq2JY4+MV/W1FQjbTQpkD9P+Pu/XSfOlrYp0lx05rMApY3kVDfdydL1FHQEIFjchOmW3YvyngOIYD7aPdGWA3yc19EAaVu4xXLPCKto7QQIkNH6LYTu8nhBQRaZR7hueoJkv2BYplZNdX+qEk3wVPlzAU7R3m9g4ID9vHRyITQFh8mglj2nzSHQv0Ya8H5ZE0C4bjUOuGOHsXG9kz5B38vmBdbHrD2NHJklQ66Re3jE2MHsNazoNseMZJcOqVQILbuV2d3SZrjFh7MuLM5wn4PbS9y3o094AJ5SPw6Np0ZoqgdMj+Alqr+Pyi1pfkJCqptPWoIIEkFQhs6zyK4Q/IooT+GvX0CJBhpT3eMMH3lbIdN4saozWTPLBsvTLB7jeQf87NFvxZBwsobC1MSiX/vPx7xAzl5RrgojAWRUtrMoxfLZ6iXrp9HkN0g0ha2Qrqv4Rn1WetXJ2rhwRKggDsBFik5+kh1KfB5H5hL7H/mGmLGrvhhnRf4iQkYJGsi+kclX6G4oD4svoNnyXGxBN0YlEp8SeKCxXhRA0YnAa7pzk+N9kqK4nsxUs3dLKMd/dBlGCTijI6AW+2mH3raSwnHzRvnBkXrwGXQ/0T/Un/jymrUPrx4nL3J57w5MVtta/DvT0Vucu1lFCelLBLGFM5zPmNG6yTDaCyLu+61qRp4tLIcpdSaRf0pRqN4EhwvuSjmtsip7VnRyR7xBd/GVRd25jP3gjFC24Y+Y8PtTsC+LCVsV8EhSZqc/6JdaKZHVnhYo8ZJs2daNXHOKoXFuVumL9WuyaYaGTrscTKjH5b//+FR0FS2YYeB8Wf1hGIK5O/d4yIh7TDMnVgtlIZqbhTuqjuaxUPytJ7QUKgJceDSoauHPrYUnnI1RMxkdqitfouMlj6yPFjnMZNFAkrfxStGdluGG3eDjBiDG9+381xXMjTIeTfNE6iUhnt6qpdoAI2BCG2uShA3ye1Uwpnk5wM88P0mx4WKLYhp8urjLs/mt2qwTb5ejEK06QUKmtUxuDK8CrlVDvaz8n0OUX0YBbXG0lJ18t1VYv8Z+JMNLitWELgM6LvTQCEQ5/hqL4WMoE+fzGxpRWZIGOHUaINyMrh+rbHvT7/xnvp/ulV0CuMaiBzeeA0n/NNLyr9mZpHkiI4oF+xqHKbXnq8v7wB9Yo+JEXpnSJ/QQ3E9QgzY4XHR2604Sdg40ZrZ8Ii79hO34UaFcDhBLS8xPPKIq6vvACh7ED69lNQIn9fYKSOrAYlgOsOl//Z1dDr1NzKnr3hVoL568OSV+Ex4CjyEPxWODWGM5/OrRbLIlnhW8ckFy/92jlscCk94c5pK8NXg1G2wtz7oVg88H7VYGGgO/V9pvjFkU7x89gymvWv8J75dDihZiMLlcDcaTCm5JPBsJCUURyBPoGvK1gGDDSXaRaQzWSvIh8piasnH8D9aR5TeFgxmMlLd63zrfOnnukCrvOTxCAU67nKVZV+oHgyruHGWNL+/P1d5X/nt/liEAnvS2BdXdljsCsF6RYJ85RFy8UbN8eZ329We3qPv2tMhLu+X1K+zYxlfUHKN6fjpSpCcpLhnbgnuIfsyRI2ScUOI0OYz5C+XDz5vi/+AKhkWmW2Xj01vcsbG6AVm1YpwIr63U/+opkNG+5O9DEqTqE6kOAHuUis0QoZ+vcRRJsbVbSqdVqfZyX63UOIGao+b2PQNTSy4Z8coqYwCOemG+RGhKVN53GeqD3nMBuOHtP4fwYyUTAvE0fcCwxStcWIUIEQ3QPDNJDoyAuJIji+yULr21yPNPfLyFitfwBryCvZz5sSU2jFE7q9t1IlkzNwLzxDYsxWuHyxhGJVjT1ccSY37o/3Ck5KMGT/DPcPYriIqPDVm94PuS7wVlGykZEz5u10EGmgeQV2iaBFi2js0XAsWjhFgFqIjYwdVpQEwetCkb/OJLHc17kmCDQGl+Fkj+q0EGNvD0cVQSBn4NlV2KzHJCF14+NLSZ8hyhwDmFgUjUGfeAEhQuuP/DXfnvmCE1FMRO1pEFi3+jrBITC14mSR0qK/IZBdAMp0j9Aa0NrBq+3Bx7h5FdL0RbJyKTt4TumB1Xu9Heixy8gmtKCdbhyUNqgmyB2TZKMD
"homepage_credentials": "ENC[AES256_GCM,data:6ZlSm7I/Sp7RqUdm3fGr1FucuzuGbadznm1Kv1sHpn7cjuQDtGy/1obv9RSzb1HZ1o5nFw/abfbYI88RF30oBILbR10UrtjpYeSqZvus/519OzqqOLSx8fTzcoTyBb7x65UrFxXq85tyKxhJurF/kSycsK5Zc3qP6cNiEJto7S2u+1KhMYmV6VNkL4H0HAsPMa7Xdy/mpgLuCCrmauhRydTUMljMxYeX3nWmL5JCRey6+SnIqPtubdFMn8QVRBJcMzCZh4aqfBn4/9ravwduWgpcKBWT145f9UG31pun/F0KJAjNXZi3Go8+BLXlhgJC7bgwGroyr0kCdRGpU+aHuh8ZRwue2G/EyS+eI/AD8DeO4CzkHGiCGCazKp326vfM0qfIue7OftIjS7HwIvdsyNKlEt+8I2Qz/M+dFVgnpQj6BnyEUG0ELFTM419LLf9ypsJX26bSfdM8UH2TLa6t09jC2JX+t6uGZmMW0QkpXz2G/zZ9ZXCtmWe03j9Fd3iPiudOHTdgW8l+OKNdqn46x3KqRqLGp+VoDu8K7DBz8kTZy+OBRnU73Cx2+ZNgPu6FLImo0/Hquyh+truMOqXB0eGMvF7o0t/xILMk/grQ23B0Epvmf/U56Qj2RXeFzg8wHoavJlchd5NYIBPAeg2rLBNegop+1iTSWMRlH9QTCuNoYRrHCmKn/Zrzllzav1mkwvKIGz30n0113U3lvI7u7AZSspce6uu3Z5xaOoJcsA/WK9yN9d/XUK7MMD1vlxAD0nOiLxiRPMYTKmJdcblEQLzq3h7ujnYfM2afZC1B0TmX9swFAJZ7nQowkV4MPEv6OXxZZREfp95bgqxHb+RAMvFp4X+vO6dOgZh6mQK65Blrq+14lZTadYK8Te3tNJG3562Ur3x0rc1vQhZP8U0yH0noiLK2tt7NNel8B1SfwukckjlVu7afA0a43KUzwYN6gjKjlK2CJoTvHE9c9YogFW2pkccHxXJKc8ESdpJfPS9MQ5e2zpVdMXVV0SQF9CK9Lg61aTJwdnmUeVuWnW8SVt1AlGRsPlJsxrTpm8/LQ/wBW/GMX32CbShkWSJzMmHr4gL0QZJ26syUUxFiHyv/ljDpEnI/dIBmZcpGIuATGS2HOI7TXBvGdLjxoeqqSAUEBMNwL2rMskJE9O4Wmf+DIDWhCwtnaB40/3TXbhbkz0l8ZY9Tg91W6cOLT23dtHdVaPdFzPoGFoHzHtqxpmgeLDJruZUncjSH7kbZWl0+jtjtW6TzCOAWtBj60exOLHRiICVF4ZMTXUMKqSZ7QQ142nAuBWRnqoKqb2kIgpOCjotRpWZ7VLYQ8/DGJg9UA+8VkXqoQ4h7Pw91e7gqiZcn68QWWzxr8fmAQdcQhoFi66Y0FjxfFWZqxbQhGiYh2kIGX7Jszivib6q73syzjKXvTMeRBi4YxkP4M3EVCABBLCPAYc19C+c4TAn0lQQpHCTDC22JGzWhLSxuHVNwAoG378JtiFuktyQvPvphqpFcSz5oHNzCd65WucE4QCGZYFApJbZo4WJ0WO/QG00+LGgSXh5l3O2VAOS7b3nqUlg/MFhD9QE+lRd1Wv62jUDth53/v97hjswajtz7h8XBRJlHyYOjgbNBrjuGZ5OSKwfsZIyukX7NSrpPB3RGVyomQvy3qdkn4GMqx/nm+VjndlWhMDmMhyEVXjkpXnXFk2WVqp0c5x5+1aa6vRY7S+UL31BsDN4dnuh63d8CRgzImMD4N9A6/w8HMJd8e/SiGqCaqphAQAzqn9LPod02eDfF8bbtJb9dZ9wHXBxgAZv1uBJMqEQ7AL1kvP72zZYBy0RKJsnCUqFWNfohYzmOoqdmbZUtj6D7+7dAXxREniSi3TCicMG7r18yHl3stY/P1g5I2mkXr/dT1kibk/5Cy9yvpzfkvw5qNHj1xq4mRUc4hq0vjbvO34cFpSEz11gPPpXoc69iXWX/mHdWb66u55cU4ifiK19hNXDHJGEpCmOEyK2rqPLIwawLbZEVmCAIFtBRWlnLrpglar7hJ5NG3jz0PSZrDHgCc1U5n92jHE9kW6L2fqqqEt5GWacL47+uLokxcMZY1r2mChmLlpuEXIgNKW5vDeYXkHPwKhs8DCy9LzGVBIIyBe6h0rInLpdpCmrTduAwGvKGy9vofSSA6txD1KxVSFm7XG0mIboQH4UcQTsfDCd6aLgfzlSEJAbrt6u//l6aEAx4OSQ+U0SHIhXtKuzKHtPT6fQC9f3Rbg82K9jimu7sDp7UC9V4BSrD2acnusGn+tnnK0kXpOBSRdDS0fqfmIfv2VNR+ew2B9U8PLOivMnz8OiJA04oaqzwZk+6yJFiBFp8I89LGcyemExSBuXoAxsZJ/XnEWm4J0E6GGN0CrqxEO1bwoBIhi2pSDanAhsorNb28g22s/daB/PvqGLEKqwbDy7uIRyW+Ji3EcbPDKXFLlu+6QOjAi/bksyW7N0XuiH+/TnS3CIbx/Az0Ucnsmqqox8hFXrrXRgPg+t2KYWYGdxsYUG5yeolbV9So68XcBVSJ4EmRGvZEbSyCRq4aLwEMWRtAf2ZflzsIxQAsjXv01gBb0/TGc6w6yf+PJ1Uw4BpFpt3l5s+HIg8OjEBgePBTyEpLlWy7TsiYpxgI5fKDRyOBM5/yxPhikJAcVqu+SQo00H0B7WyEICoW+rl0dOXx3I1rrGAsoOi++3AfK2iHEWMFqoIHaSIFL3AJi3pkPEk4QODYXYramDXQO5hsVJYsQ==,iv:W7ZUPM3gB//MSwuwmOB0velBlUzMWtBAouGByMfNFyc=,tag:T3AILeopml700yJGmTV7oQ==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:zM+B8VEhmflEmv0fdQuSUzZeLPh2mdnZVMj34ytI8OYISxQDquj4CLrRBw==,iv:d70M+MaWt3QAP4xs6auo/klZNRvVc7fU3b7w6tYBqLs=,tag:D0bkOASbPttKUalflc051Q==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:IF0JFPDofyjc7F5nEbRAtJqVJFbJxrvFHPjHDSesNiRlynd6TAjOstqOtjFb7mpa/tz24GgsHCjKqR4L01odGq8a44lzhpAiwhAEtdrAHxwWoT4N6UeGwsbIf07efZEbwjwyetvEeg0K3JfQNxI6I+EmC4GnOlDqezUQaJMPIgwOOITRqzH+XPiPqZOp7PGJO+Jgug/05a79sgpomGvG/zjYG+FHINWuqplsB7A=,iv:a5SRgt5whsNUK3PaeFhMuMzjcz9dQY05RvgJDY0VIP8=,tag:shbDtFiuAh175CP0a+68Aw==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:ogdv4PpSDcbTUizT2oe3KaK6G0F0Jkjdwg5/bF/uO80I8F+odiZ8/3rExNwZJGq5JdOJbROTCcQo/HlxXgSSrfspz0y4BmGFG8pzk5zB0CF5yJGeZa5wiSK1PW9ekJsJBDmGEry8a6p6jfAFGOSHwW+HCJzh8Cn2GHsH3aX9GSbVTq6wyeDhQh1tL6YTXeEsrP41yPw6rxtymASIThtGsMkT9/xaEDszFgp0jh6wfsQ1N6ZgULQpYrJSG1VLZZwxdGZPcFFiK+r7QCcG1ayzTUXGBErPAXHMyFqH3PUPwDWNmbBlS6CIxmUmEPfIGrpT5cJ3REX85d/eB2OLl9NK6bhu0F4meH9wq/UIXTlor/1vVFUfFas0BBRTY4K+eilXSZZ1+aQgLWlW2StjMn3d1P8MFGBI+pM33rM66pq7pmL5HVGtKNjbnuA5d/GndViL1LYTtZ/JHXJZ0Y/o4pnUk94m/7eAajyBOzkMzaqzg7E33IdlC43c7GjvZWnQsmAZjiI+hSRtMuzbZ9Pn+CoyzpVpdYtb/190PcVxWHLi1fragiesW8lihdTDtNJS+efDMwHtmoc2n+a0VBkmCmWGVlKHnbjmo7d+3M/p4w+8yBjr4dWvI+FUcCizllYypDEqL/4bCRU8bXF4A+dSEBr1joHrMlsbMqQOyjgzD2tNYzYoYDkQ9H34z3BYJ3bPED/4yK9VTVKkHlJAQFtE961jchAUGEj5udsMoXDFwLRCgLKde9nbby17oJHIdBFsZO2TtcmZ+i+XlN5tuOwwkSNBg3mglFCspADh5cxyBTHo0B7pValF1a/d66tKbQ4IR4OWWVcdu2TedyFPVvIC/Hou7jtVL2MWhSMjtXYbmI00p7S9m2MBeuD6VKqwqqgNFrcFQylAfipb7CVRNNsPo6Pp,iv:g703sBlrEtA2OM5RUb4XYJxaWZNJa6yGBxUEIrOyvSI=,tag:JUdzs0/w8rSL5gf9wrAC6w==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:nIcPjzwf7621YOfJpZ2X6t+N4R0ARkWpxUyoDHJH4d5KSC8dIqnY4jtZ3QtYXZv6xUKAwG7zAeUS7pxTqCOllIl7V2mOwlydN3OBstPB/l8QbEVQDsUfer3oE6Tr0DrAFzvtLmv3yfR23UJXd/HaanY5mKN/14PZjPQhklYAO+gWc0Slcat3LBHF5m2/35yP1shSg0u38mN1GUf2jv1eZHSPsIE4HxpP3KjH47+Oz2ul2dM+Xjf7G/ag87QeINpwLMJjbIYoATX2P7sxDvC57Ir99ptDDX1qXyIv5NKg5bUMOs4UwuLxizgiYLZe2O/HuDMsJazTvMO9O6B81f4XY89qWiDuvv02vCQ/zMtVwSkmsWEg7NyRCvf6WBWXEhG9EnoxWhfMg51wIgFetUQXkj4yINdz2aJtkM3Tjpbquv9h3NqeUP8sfcnByHw7BXmdZsHfrQyDKENU+/fvyvIHCgQ4iE7pQtBLz//Kb0cQT3h03ExAQ7jpbks2795cPJPzRtmw6GUp/Ll/Btm+wN1VsNdIcw9U8xK6uP9nwwiZyRXV6MegxEEZEhX/KqNoj8Av8TgTpRO5dafC1d6DCl1WxdX5pV6g,iv:TLVxtaxBGamgv3Hlo2XBtxExGot3de1V0IQdlrL/zeY=,tag:xxQEm+3fq7P74TNckjhMKQ==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:rNx7kGss7iHxBpGXQXXWtoRCnVzN9/fzIRmn5cNQ/yw8I6At4LCvx8Hv3nZMECyn4XhhRgbmJBwvgJp1KCh24DywcyEfjmCC0IiQdrtrKRg2C4yDw34WAxPEtIdd+vJFffxV+micwbJQiMSsdgR6srnl8pCAw5wiRoyrx+I+TM8AfY87HHRcK/QFNWIVO49f96/N+7rUcFreyxLcJKONG9RF/CEFNZ1+JluUp/1Mg0H6kEDE/X9gIYqN1b/YgvWFo9CwqK/kR3FONY1AVJz5ur9wflRpf6oi7l8QQENLKHyDOAAEk62TZDgbvvxzq110L9fFzvF6HWbWk5MDPEVfnNX6IxE226fTUG/GNvl5iHyCHiXXyFg8yLPzR7+/oRXANFu3PrV/Q/AXkV7R9pJm+wQlnPdvW10eBq24XqRnIFoiwCUugrdj0pqm8aZBvyGXED+D02Uqlj2R35qGWSv8XODeKb371rmp371Qdf05xdo4hDd4GL9zuFgs2VSxkC+LtrkebKrGAhRpJkMynIZwZQPEz6pnQyd3AbQI4I8sQAgpnWyV4Bp3ctX4FtiQlHhmDzFeQs0QiwXypNSK7ZdIrDk1UL2EjKOdnl3sBFoABSMbGdTUKuDrZfBL93bVi/pWP6l+4S/QrCabcJ7bX6rzaM0SEbvm2L8wctF7UyLNX0ri2Ik4Y1T5uk59sZFmQZmMNszIelPPemLB6JxfjJg6bmHGYq+aivcIrXaQAUSpZ7vdgSd5O8b3I1sisYVQWWOm/jjDf6lmnGgh3x33ao2czex86Ba6/NuX3bJT3NZtTW6L1EI63z4UzxmRYmUk/G/AJL1OLcQimp+zOq+TNT+vmUNdZYiCkEtES91mrk57tNsiGQ8jgkJF/IbIFrjJ3jLvA95Eswfv/5mg2BjGxLfv+rrgcHsKVns8YrbNOM+FPRZuPJYoia0rP1rtaGOigiYto5PYUY/TZ4ToOXxnDjoPTzx38GqnNTPgag2MPt3/xrQU07mfDhMWMZpRKsCXMpHQPc0ufAVxXxgMgNTlJ6TJ+aQxiR2NO3VmYbfvuiJ2tYFdzsVB1hEmWzNrddgW82nJ+3RateG4E2j9mkNWAKOxkyZrkev/VNq9i+fb1pDq/R/rTlxGksVoGUUfkq+qdGXoItR6PLMmMHEKb4YnpmSM0fe9YOPnBaeVsocUjeosSeTUujMSns3N19rrdEZwA0V7850fFVtKrYnr+dP2vhjtmEiisyY02jU+6ULEKrYD8QbvBj82vt19bef8wUPQNsJwcwnBE8qnuNomcsOr1ii+4zelCqPD8tob4kf3DBOeKl6GCyx5wCGISKCYmA3ndgxeyXEhd+HcnG27IEIny6FRkLb+qTI6VB6dvlli31OkCJyMuMqC3K2at6KJRtbUFUMQL8+W5WrDbDozfvZVhvIXBcEjGrrhq33SmsFWDQoJ/V53ARPj0/Cu+IU6YLwUXsB+RUHle4l2kibMeWcZkOSa9dnwIOdhkhMRKPM+EdelfTiar6yAoS65hMyCO91JUZ7WKdVh/2AY7DanQ20ipPJgqGR6ps6k68xN6fsmN1BZi1LR0te2NYVGVMZJJYiU7RllKX/SJI0EnA8G5WL1LxJrz0XofpYMrzUu3/tz/Rl5+vORro6+OMFea0ghAwIqKNXMhyyRYzGXjmBmGygtEdgLqKI0lDSNyPgZKs2WqyXFaWudtzP/laBPb80xAkQIPl7c61vx20E359wHGv+7EPACye9tmbxKy/G3j3e/VRUBNMq2iVXiIdWS5GcGzCvzLyNb07RQ8TyRdVNt+NAsW7p9u74hoo0jg71yLFows77gAZARcab7uqhzC3QaJn42qVl/RdaOvSkUvr5sKSxx9giISJ7VAtESj68zOjgtzYz3bj5uQJsNQxp9PnG8v97D1Yp7UFWnE0t9Jzhz3dQ7uR3tZTgsmsVJuJnq9z7zlSMgTbHcUuJ0EciFnUuuvQHSnk2YStzC1x09e40vt3nArx9RWNwqbFX7DL28v3pD36olRwwlpMh0r4F+tTQf6OlUUcUKxUYihS8hYPdjrGmqyFA6uioJmNEpEYvUH42gscxGwU5jnQer5AUwqDcLUxB7+0W6SgdxhcSKdxiSKD783Zzx6mO8upE3PCRStP9f3PMZk2tHrtEwGuYMnsl5yKsnnct+q/H30P0/EuAcnG0VMQbjsFgvi0HIyZ0boHwwmMLAjC098Q7TPTqT8iUA5kcp6pzDhTKUjx9+jwJT0FuJhiPpPeyhJZ708mu0Q975Ag==,iv:sYhs4BM3Q4X6wGHAIkROVae6Tf+kxXtE0uXWHWQJ1Q8=,tag:PeiQuFm6OYN5U5CYYofUFg==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:dmcF1/zOv19pNxiFCnA=,iv:9aE+O5/3CxarMpzMumJCfND+RgGiM15ByzVfAct7mbA=,tag:7IDV2AC7iiodSVOSEgl06Q==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:GHlkaPi69WiXzYlqZci69z77kuEV2i9rMzIBOfY1RdYqtQQ8SH+7gJwjBHR8FBNb+N1ikxjCJ6/1s4furV1zbBrFQRFm55RTKWwgbAGpQJz07yJoqypmqI8L1WiVyw53FJpU,iv:RHz+/STt423bAKNl/GFHiue7dknVMwPd/dsHqEzeICo=,tag:6xanIQSbaZh94tppRKQJVQ==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:6a/6vPum,iv:muz15yHpkUvqNL5lwFI3pFcrM7E4EVtgTTJfQEgJK2A=,tag:jpYQgaPEPaet3co7K+TmBg==,type:str]",
"pve_password": "ENC[AES256_GCM,data:NcOgPxgFghKMQiyeJb3rL0DSbiuTvuGDoUN0ug==,iv:Krez8aaBqTbLE04SCRbcQjH9Z/Zd9FNAzIe3sVc57wY=,tag:e+eYX1bs3JoGL35B4juAbQ==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:C5U7Jheu6BqcyW+OPKc=,iv:NtIWBLZy4O98L+5isFhDTpt1hsrWsph2n4kPPJUa5QM=,tag:0guGhzKxmwrsajrD9nfxOQ==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:9L9EHEkmUqGZZImhg4UzbjEtdVKcRvw=,iv:mBsG4vnzNmzA7CIms0efRV3rWUr9tEGgbuPRNLio09k=,tag:yk4q0MZnP/fm74JNw6VEqQ==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:9vXJlTM=,iv:gyRBqG8WzH/yAMcAoTPqaa1B+T6ubivddcc4QYBkILw=,tag:P6Wl3Asxtq+mLAs+3cnbQQ==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:4VZF5V1TYV5ykCgWiOFukZlXPAcFfQ==,iv:FJPWGb/wcBNroneTq5eFYfGQc3JrhJN77pmYtKBndJE=,tag:jCHMZF2Rg7P0YkSlO4fY4Q==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:BIrb6eHDg0I1m9ZP54Wgyplyft584PAjMFTs7StbgSMCQUrMY4JyR5onQjORP53HyDE+1cdXLt4otKdfPlpV0Ib7,iv:zQVdhTXNJiwbJvmdGM1hE1oD8S7qnxj75qA/7WGgs+A=,tag:KW3HsyAaIm78kWE8ULQcBw==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:VFqz7PtJ6AOXwx5JsObUSOLf0dhaSf2hngi6reoHFfIYZ3jx8KFl+Op9dUyYjMbP6lcuwuN7rtI60plFf+Hw3MZjvfVRo3klxGtffvNA+kea0BWaqJbxltBAEbKbVdGQSoMVvyzFmg+LMZGf2xjaSwu9r3EoScF6BurtPXcbmf79aJWgOnC1dse81wOkUmymRQvoLkV4nkcNCFlFP7Bx2RS59/ZmtQmbCAaZ8aUetI1gR/y9usxD+v9hoM8xLy7ckSeQRz+L1ytX3mLvhgiRJPeqa9ynE2ofc3WH9DM+1C8vb79rFpgx9mx526SHZzMJvDsS20wvW8bDmOromI6nGGqrAbrBmfmCF91raq8Yl1SQzGE7vN1q3VUdmsKv/uoA03OZ3i+QTmHlNqEM1bYSZUhfmf0Kw90pa02CI6PbjTyvjmZY6sn2ak7l3Y+M6eLXORBCBDojBQywwKsRGSvl7iiq1g68mjGrF+ucEhLh1YChDlZlkZk2GHijABFSWOkm3OZbAe2uvvI1zsZi8Z20Qg4oSbK6T2RxHbKw,iv:8qPuntsioC7Yp7Xb1JQDBqXz2wyMtgbOiBAz4QfAx64=,tag:K8WB7wqOgRNFDQ3kCcRs8w==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:+hocAtc5nJE/0jYmc5rJ0bxzeBA=,iv:vPXcfzWdvsp15EfU6xxs4F6LJEdK2R7jGx/083AAWlk=,tag:TOzWLEcyY8qQjHjvNqmA+w==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:bsavfr5eGsYz0pHUZwg8fhOACOc9Vphtf7HpZWcV1/pu+aDqmRFwSg==,iv:4lapGtl073vMXdVqQ9QnYFjqfStaROC2HWixUgd21M8=,tag:Z4cStF0IGaYp/OgZZ1g8pQ==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:vO5ghZ3FLvsI1K6A,iv:6WtKZtXctRiUhDTaqlw3zHqlkCqoElrY+4hMA6RbsHI=,tag:PbDGrZzzdK7VP+zImDQBVg==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:lI1gyGgd9E//8WWD58V4BJYJlxpzPlbEL7t3FxLaXpYrB4zkEQA+/YpXmskL7S5CAjU7FmLGWmqjIO3xtSuzRb/+L0JcnV6U7tGNqTwfMVByYbnbcXHJiyq3yqNqsBB1WaSThXSFhrUcAGF9ydP3G9ScM/sRBfjDgvQRdFSABjGacIZ2djzRDKfTdu3pA794Ucrg8xMYBh3ZPxnGFgZ77OsLGB5ZcIhamwg3scm0PwSW0ptbHVKfJ7qc7U5EnOZCEjlfnoLpZEhFqH0pSjxYFaHa7TkDLu4kp8gQkX3+mAq9gPMf2OX8vlTX8OKDOLNzDIxmyFTd9L5JTBbEZRIFKVSIBdiGuGTV5t9qFkm5w/CQSNP8bdCwH/9cU++cm/UPNahA0yGfBVyelyvdd/1ScFoBUIrEWz5zBOLrG0/vUxNDczSFEY3j6uHTE0/A0jk+UvNUcbqAlQZmc6OV87fuYnrJ8CJrKW0Np7/ERiQwUafTGiJX7f/DfV91eL8ggrtJ/ZjKoT4bF4Tij2wFUWe39M+ZPHUhDdA6YztLng==,iv:BMUVmWbWDoB/FQNm6GgnVJOPfhCBvtiXt/n74oQcLY0=,tag:NhmZOe8gUc+ayAa3ntQxNQ==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:i1lv7Ca2lbrsJqEF29JZE7k6c3/fdxzSbwJrvWWks9pSiX+dLtjJGLfCcqzarjMNPk3rL+BtO7c8yPvFc1ZpU4Fw1Nwlg9304tUp6hLtkEnMFZbLlYeSdbeVKirlh/k7WWP1waxofwz3+JEqZ+Vd8m7nqCZsVG4oD6TWGQLVYM6DKuD7nm5R06kke8u1Yv4mnlCnRRT0+vQIduusSk7hYyWsEypri4YaWMJXg1BzlSA+9ArAEyeOCmI4L2o51evsh4lSvbBbehKHrJFbJnOgCYeOoNdbBR5IK3L2JEfRaSUmZDsD9SGv7tlY3L9gA82DX8JbCBoCiGwFTgID48AQNPO6ZkNczcexbicdbff3m+8TI2LdWVZ2+t/1jB/FABeeVoFlaoWhATc6tSudjpydDUBlgevuDO5cdWEPK3ifScs5HDEnTNDppkKncfpL8sFUM2Mgka2mYZsNcRqbSlTHn9BSDpnwcGFi7xh8zj97+5xbctzisGbNbskI1FoV09OHWUtchn5zw2/q+CX3q7iW/HbdP91v38Wt5A4Pg8BOQjE1N6vezklF2ePBtGs6lpppg0os69jnYIHFBzhVVEwdinOpRJwyxQIrDm2u9xR8bKGnf8KS0UEMnhijC5FayyOyA8jQCfvzQ4i/nPH94bpfY/ODDKPj+uJ0gPXQKAl51CzQpXR608ro1eybP9JtnJ7G9Z/yb56vA7BHoqQIkrFSo5bJRetofk9sTz1KihEsZzkT2Kor1XDoYHRn5DE1lbzAYV1WRoDwIG0me0nHNJmnxOHnmpEBphS3ViW/zAPfEoDEDV4o53qo14Xa9lpAoiKtE7w0CAMAirGxhhnBHnTovpTZvR3XeX4ARo7NdtHxMR6ytl4tkSinul310yyL5HfYQdJyOwHVhYMG/fJ2gE6wBwskK/4R+FupbdWAbQy/uUdaq6wy4eJ41VaZR1cYISumm49RfHEUMwuKg6yeLjYNeXKD97tmbt3rX9dHQh0BiXxgPigiWnNxB5hwnrGdxx40pq974dZDA0xsCvo2M28SjDkUzBAysYbulatfB0wLA/LFM3A6JjDY0mR57TBMq3KmhsmmWMwG+PXZB0cwFD4PEZ7j28fAos+EMYUWmtDWEziRnIqqmXJL3GuqVJB53BP6KwyVsowcrgruLPt/dnvG4Ze3NaJCZO4eotfxP7oVc7vB2sHJLV14+TtYH93xVOL7X/MqVUcEdU/L7oWJadDfJ8PKtB1217kNLzWecAubsFbJuCRaYLxeIFq+pCHzK3aWRSgwi9NCJ3JOzxaAH2GCUkUkDzBdYqA+YF13TbfBl6lXWCj4re/m6n2FzRSculcYZdzCRf2125CSTtfHBO8+yohpSCu5DNtYH87tS4TbzD1AvsiLgJ/+YMOTuiHCSqrbKISo9li2D7CeCpm0Vw4xMxgHL4zwyzAs9JruEBFjBn3Hh4n+sEs85K8oOajsrq4XybvQlhGXxhKvsaeq4OEvIgX4h/NY9Xx6qkrDl5+CM1G0kGEV6yqPuvWpI5AB21gYSTc5lhQun+z1mRP9TeJwuXS5iHTZmcikFwrl9h0h6USeQ86Q41OFhR1nkLNRDUgGz/7U+WhRjUc8woyQJW7xa42iwFmOJuzlb9ioYMNRMXynK7S26iJax+/nMAi6WBOF9KtAoui0k/CC6NLoTgBVayLQDrdYfTDHzJb6kmefNIRD0MAHHjjREqqBie/8p6ujWYZJ7Q8e/0G4M3XRlHierYob2heFAz9MKSvVQ7LC/mLZHlFVFv2RoGl1m1KcAqUiY5TkvFaNkNMmd4YClmLiHzmB2ROyYgoI7TTiq0Z1tW3r5fyfDK2eBGJ/R4fNzEGeYAVjpfJMR/PBp5j9JmTSyU5I4zU8ZWAZCVE581kuk3PDWgGPXwJzLw8rdAPvGfAYTV2M+xmOmBEqrfL3ODREvwLuGvjLBv74yOGadWdetmD2vNIx9Gj2qpM5a9bVM2J8QGjRDsiPFjTaWhdvAxsUsSQmMnEcOG9l6wDQI6PLTjJR1AqQ5wnqVmomeVfT0iRXWvbhpqE1nzqcw/U2ajsqXgdVvSSn1oNADfRFqc6+BhlLTMUvku/tmEpC0II23LKQ7pIQalxkkWwZ/QEyN1H0cSZaGccBsCPjvHersv01i9BDBdViCd9a/kiNwkd7cbuGKUfDBKMGZZRjjm84Uivfb0mdZjfiY9WRkyw806yfSH7InsXCUDr7MmRfQeoBk877rmo+bhNUVbdqWZxKoAvPuE8YnG0seYcUOk9mAzvLdI/3R9oYriGDZEP1Y3QSFt/GuEhXtjnx8GtlUX0h+8Ip2YJbvrkYqi0AnS0eIKiN95zErl88AomWVHkuBPal4d6qEjk3ohUcGvKTGCHd9ZCz7v7mwfx4GA69UXlPVYIcPQVubjJrUY6pgLQd89WpsPFB8u7/IAITRj7bccZHYTf4vT4JKtrMzhP35eWCNKi9BfB7h1BQoJrAxvaBbkiGbbNSbY/94e8VOmED6JO0hXrqIxo1OYMRnvwsTx28IpcEUDiir9wnD+VCgwopl8DlvsfGfllnpGPTdM+Vo01LyvcqOz2sdyVzEHPuF9m1qOmiWu5VNePsFrqIuXBkCEbF6ytuTj7WhkxJhUR4J+9jpQTb4IcMnJio0kvy7n5ZUxZPztlK3ncDFi7YGa681UJTKyiENIfAqdaK44d/YVbWglmpBs8i7ceaFyR7K1II6crfecB3YrAXqtZ7TDxvoGu5NPW9d0FJfxN4/2+7sGolWgBHS9x78x57f+iILcf8NiXRwLuU+ylzaPwne/zb9LQS9Nsr3nxRj5vOfq7z0FLSVTDjoksrKIPhovRZlSqoui0ft7eUcV1fpZM4Q8Hx8LEjafjlXu0vd13FWxlO8gSafXdChWRW0JHaTU1VzbN+MTLFGnfD9WX0Bh1LzV+0Py59dtSGiBudMn+yIppjCWGAIpn05ir6BT3K1GaISkBPvzMWDwNea5+Cdhf3tJHSmuapvtnhktuTxmg6/9gnLsNEbS0ANA3p4Rsc3LE6wbwTc0WBH3EFKD19a/dhVpRwa33Byj3gM59IK1puMmNnsUKehuOhixj3cvOxKNOyBTYM6kHUeLEXQxSaKw5HqOrwPoBEk9sG7c/PX+nRhTblWxdz2iVY9XyZJjiXqO7jjSU8h51q32LQsc/ZwEys4RXICkLepo9cw57LET3Wl8G258PjYroSonAw/elqzE/Dac6rqHpx3aVD+yUC2RywpwsJ0Q4Qm5xuXrElQLhREaTSQyQmA4k0P6Mi6vm4WYq4sBY6hrrKlQue56jbbVpwWa1sIEQPQ40eA9jA1wq6Sg7eMfS9TxPb/SXKDeYBNGEbikWRDbiH3yEux4fo1FaT/HmJK//psRvzIWkHdh0Nk/ToUq2ZK98/42MZb1LCDHfLCdzrWrqjgFu2tE0JpCZkpF5uCLBzhJJaBhJblPwlhKLmIg==,iv:ehOCaVMCIwA+uXvEA0Fv1543XIkIHvIG0e/3G0y6i4w=,tag:X08i/12k+EPFpGXDXbg42Q==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:1YhlJmzQlcKhi/7OJYeZvNtM9cb20b+b+9ybwOzOPc7/cgin0p3yf3PsaSk=,iv:nEFU1J7dfjnPpQwZgPjOoj1U/6+bSHWawFHQL8do0eY=,tag:dxddPWUbG37no7oZnsdlVg==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:e0bbAnzvLF+kv3e5h8tTPfWZpMSork0bK0ztYlTZU0DJylvrD6p3bKTeKAAR2H8=,iv:Rt80IyexcVsYgjYE7JYpheCVnctJnvTDKDhDy8JssNM=,tag:015KHP2u5zjggVk3dCuVGQ==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:DmUuRGDKTRuubM4Ucz9HBoayMywM1A27dcyIpBgHm9xUzhalTauDuLCjwQ==,iv:N5mhIfJmIklmD/3YBoefzAYjLrxzsXwLRoAv1SJYlBo=,tag:SF7DDb1FJw0rifvQVaiYjg==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:ItDaWh2KbmG2HbTA6fCKFjBdNSNLkUpwEbJjfamg9W+v2n9gOEWmREjFJYWaZiCTwQLeMM/0udmLDzFQEdTA+9k=,iv:WgIvLqgJqCdAyhaHNqEm8iC1Wk8BSwnW+kxrRMo7OuI=,tag:kEZ1exIwlm4HSqhx/YesHQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"data_json": "ENC[AES256_GCM,data:JOLkH8z/INm4RDAQIeweF+H2SahoxSyPU5IYYPeqLB/GhufvJ1D72//ZHQz5HVDHle43/DrsNpWti4e5MyCF46Hk+7q2px1FqJ1hlTe7CbdKos1J7BQUUM5FLeAJ/2eAgyd2SmLSWojYjHClr38I6Lxg6JDTLU/Ym0J1j95IDnBg33CNFKqcNkeo2mYXpEcVhjrFN8PM+juSe8gzDStft+nAtm/Xa0a+hYTAV7GGivNt6pS53HGkAJLp8h1UVOWSuTOmFg2XszAKomDwBIls171OqHuCCLhAZesGtlLJ5Irhxu6r3YRrkR7HGi6xC6fFUAM0I2kMUIIcWdQitVltgjvKyCzP2MyPGznne7QCJfQY4i9qFLIMuGlQPpp7k0o7J3rRtZzYvxU1sVlj7EGUQH++Ju1es3x+jfI+9iC5LgFuq6mwEPJjq0CgjpVGhkmrScTo6bVCQan+WEi3kDPf/Lo+CFm7F0XLzUV6EnTw8QcCxEek3ed36j8i+7Rd4L0iK1VNz5Ip0D3OjVqRKfFrP6KelrKARysFiuDMAm5BbQIxTMLTBolSKFMF5z7B+1cB0Y3jnZDU5KDMyycyKSl65HUlFNJWxUoW5VDGACiNsDOz3k0QULvo13fqfliOWek5Gyb9vu4xeGqnAFgD+J6kZlVe1N6WG6G3jnX5dkkYXzU3Cw9RE/rVq4DCkZrPEizg2xJXf7S2mlVxkASgOVMDpsw7PVnFDxHSr9mh2O9JAmJLUsSNXlNNfVNn+VxXM52NLIFyISOW1fnInyozREzpctW8jccEdVWTQ5IV7i6qa3eDGl7fSKawqxGCieXjZENo+Rjb/2+yDClsImKnAepongh7bL8e8/P1S8BC9MyxunSV2c8nVPFN16naaUuNOsM3leqGu5h4jCUeyxmEk1hlnSbv4oMQVl1mW6lRf7hQ+1f7KRFhfU6ezeHLBnDHa4MUNI1y3F/fAf8P3KBwkBqGdKRSWBK17+LSPmpU4rE4wiKf22v+GwHc+WNmiuQigC//zqFE/vVtK/O1nF18eOrJVCqmJyXKLBSyGXWrql10rB4XCDNCLTrGkClwot7n+FET7doQVA/uwz0uEKLlLnHuaAJHiHI4ghLAWLg0r/DKi1FNHUK+dt2a+Bpw9vKeN/s+G7PekFr7Ea6sO3FCSMjgSABrlLc+2bcdqJpxyClyt+Ep9RDvGCw+2ZGB47AvSYqx3By8VB7cQ90/msgWzBySz/jF7s2Ej+IlEESLxSKjbHR8iXovXmUldqPM7sZ3f3WVBr/aWKzttGXd95HjXjrBUng2K4ygH6cnkje5B7nHXuGPkg1PksYyKNICEwGK8qQPNTolQ+6a+9qq8MRRfIyDv3xIlIZS8/VhuK6nTb6PB4a2k5j+Rg5hfR6Y8ROP/7QO+DLwxKutZcItCAe/WIn1zbcHp5FjxL4BYhDaaxerwtNfVgGVbmcz5vnuxbkEFRcPYQL/qUS1DPqnSBjB3kfV6l7e7+dh1g98xX4D2EUAhfHRSOWrtWXxqBTYyhKRZ6iCKQk3L7Zqfs6z4ry/pPyYoTCMsqU3syeXaID8si27mLAFjSBaNc85WX0mN97M719XotEMsCJoGdiOfKWcUyaSTBxgHc3CMbpxjaN3zWyrrGew093mSg2/BErpab97Ynk6coqsPm1Z2MK3pTShh4qdDsfAgoGDpb+0hCXtYLdadwBf5XveEoayXorz0H4f/rCIParHR5ak3jK3uhu2jpPCCGZQ8Dsoi+mdRIhQALmfAl0yrbhDIahbX/UnrqWmCjf0uIsTvhZdbLMSovNB20UV2ebRWg9hs3dNUJOmB7iJVQcG5A+v1vFqI6yCq7pAEQ+Y6xwjk0faLekaivfzSuATD6HLI1B/oAQa/TH3J8UOFIMBCXIua8uVyFr3J13EBz/RFoQdZsm/ebLLmspOWH4MxNlwVcvsykHBSYohdKpnP8dlL4N2MVVFOnfg3NfoNTwxUuyAIXvbeDv7qTwTxeEkKKhQI029fdP1o0w1Agt6UzGQ6prWOkaELBooae7ZMGzV4NSlbu7Xiaj+bQibltw0VpZrYv0DfnvLP833UGdaghP3rI6dIcJhN8L7H4KuEWwsOWL15/WweOvfP900lgleHKAtjtm26jS8ZMnQSro10jzj2nshXIzAAlnXNTqravWKQ5p3SdMgV0CDHxPEAl2MdwQxQNGD/IKTRV/gW2w+jqpUnCsTGnY17Rlf1O715FjAS+UXYKR766KYhl2eJmY2GEd6y8o3zKQxYunr+TptO26BrUgB4KJzK2vmcEbor3SPV6CxYwrIGEx/tf11qaoZ51ezCY0R6wwc3/53E0RzsXhzq6FLUfieAcFrxbbC0h4LxW2k4bjN6E513k79vGf0g99keuDEDtM+F9LVNKu1LWXVBtsGm70/+CGQGokXuRLHihd6tMgYjz8xmMkwWtO6uXVroDBj0TeJpMdUXjkqnngAUFSk/UAFLGJmV24uCuY6YLqUzrpNF14LReeBZGA1EOqQqaUeU7bksR6HKdcxzAaSPUnC7IUU/bOcxQAruYGwFONKO/z6fJR7efl4ys7P9L65cbkLn4S6QFB81q4an79Ux3KA+mnfMjlnOidvP7vCIgvB4B42EXMcuNGqW4JTwSVLtX/TjnK1wbRd/waZKHsVNHrM9vAF2csEzHxilpNN8wE9Gb8HjbwCORY/XM/nlQUw7B1crAw1TYX5yTBe90WHViaDLAG62F5s08n7tckgSgpgMppuZVrZVE+eIjKHOEZXMaHU5w2jfl0U8kH/kW+ptQ9wH8wvGuvqiZ9D6Gnz7bRRUn1ZorDNS1V9/RhO5L+PUV7vFSIwYHb6a/jcbnPQA/YYGNqBOlj+z6PGdp6fOdlVks1SZcbbhWhNTuiq2hR61QyZR/JfXTXmzilG4AkDIoITbKI+NlueBVP9iOAPXKDxJGuyMhzRNN5Ob2rAQ+SZhmz68imgsBd5pBTTsUjEoR5Z6kMBAvlhlmyp754oAgXvzbl/jAPAgFSANpRQqBKLIulRJHIsPh+KoCwnOQUw1pbiirk2ARlXh3TLuml928eGkNPPnI+cJwSSd4bmvg8JVl2j8rHiCq7zdST4iAmvgrZjFi8gRz5F4QzTmvOoseujinjeUiuRX7zaZcZtC5CSGMJJlWYKt8uwrwoL75b5QnEVdt2BVZ2t3kz8KCBBdcBHfdsWirMhzyKGO0OiExkQdKV8tKQvbl9vWlFd68E/W9CwEMh4FlWG2qpJdb1zU+cLl+RIhjG+rG2CYbved2SlJQX2RCbm8b5rHQF4SOh7YHWxBGiT8AXEUDCfBsvh+GbvFTvoXbDe/FaDZgCAXJQUgjnYracRbEP8z1gZYxp6hIPh0nOFI7ijcRmKc11RQGYIq3p3O6APIM6EDIu2S6I2pIG0NLO7f9vP7XFt+KshYT59uo2UiPfbSiTBNKZR8trEvINEPHWzsWo3rE/1tHzfQ7K8XdI0tiY9Vsh4uRZIxPRlFnx84HCFdHkdvCQQtnIOYYMg6NKY7yqxTtreHR2PeJDcYo9lCGRn8064jxAlw7RPyZ3d+hhU+PZVmKKefZqKKd359A+gP5VoyAstJQwoSIt9xcOgwCSnKHH9OXlXRZE6k8osqT1yU+ZgMVMuPqBekHoCdOelRJRrtBOv1LKb9NPgu1xBic3vFTpcnWqo5YqVofqBS/YeiPC+KrP4hvh+gE5otU1CntYRXWP4IBzYvDb5qiV3dNXmV1juJ/dgc3qMxqHPZEyY2ASvxV+M0mmqRSfmdheMoTl+C5pjSoxSN96WiQyCpIRVm8LK9yP73/ITMckkMwfSbfYD1f+R1tfgh3rk+rGSjmtks2nsC1+fqc/AxJwX557F1DxmzEnSr7hdQ3YUubDycF9MPSarXagSP2KpQxhKmqat7zo+CaetD8tpJQ/POw1+sFQY+NfjEFaXDe1u8jzR0nzbfT5iPbMxtNUt9AToMfFu7TbtO0QKUsxG/CNHMJ2ONLyVf8WodQKs0Z48QVXbGse0FOGUDPxmiVlphiuO+CJc9j/5Vqt
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"destroyed": "ENC[AES256_GCM,data:oymMu5Y=,iv:Ly791Zp3R/kpNKCY4PsdncV2V/zY3IPIKMzFNj3JiQc=,tag:ZJBWgcyf33gx2BVU3AQM/Q==,type:bool]",
"id": "ENC[AES256_GCM,data:eh7362wR1KMmO0ITN8zSFeIDMoA=,iv:mKDEL0b2U+mXjq1XDf6uGZd95m2S7hARp+KyxnSpKdE=,tag:8Xe5ymcZCgPjocmGMuhfNA==,type:str]",
"mount": "ENC[AES256_GCM,data:FKNYIfLh,iv:2/P8hGn+5cPe1xMVUbwLZt0lC08RZ80gdjV3wpqKMiw=,tag:XNq00f4uFDlCkO0azHoqvg==,type:str]",
"name": "ENC[AES256_GCM,data:6uO174Ts724=,iv:hFncBdfkZGLB0aJzQv9R1oPUPMaItH0MVlx1vXW9TYU=,tag:7aa0mFgp2548viKMGhudXA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:8GTmJ+gRdCzULYszEwIRwUI5MRo=,iv:ba0qmJBkscnAiKlChCEk70R9jpAolZ8LFXBJGdLb/IA=,tag:9wG6YoNtNf0Gfah9YnCZ6w==,type:str]",
"version": "ENC[AES256_GCM,data:hg==,iv:KgAGQzxayMOfegnp8xm07vbOkt2uVWlK0fXP7Bd3kVQ=,tag:VCxgQ2Z+ewXEcjyAV/ipMA==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:G60+DPXR7UqudjtRo3jcqw==,iv:KExpZ76juka8tmh97SQf3IHf92y3ldV85egx7CiIIL8=,tag:ivDX7kggujJ/cbIT83fgfA==,type:str]",
"mode": "ENC[AES256_GCM,data:PpYj8MF6eQ==,iv:Gsuw8NTX/DLmcb10ogkGrwGLIQMeBIamK8Rk656o7P8=,tag:iUc7W07L/jSXWHTOepTkEw==,type:str]",
"type": "ENC[AES256_GCM,data:nQ+e/2GVwNksz1Ca,iv:0fp5za/enjCxV+HjfK7iqrZaznHofUYX8aSMDws7230=,tag:ixg2liLZeSGrNYHPdf48Yg==,type:str]",
"name": "ENC[AES256_GCM,data:fmzxBy9Mwk0TVpST1J8=,iv:hEzO+EN6/a9GU2n28eIzwjdIhz+GbwVDf2yai9quvAg=,tag:aGsJ+UQ/7rstipEXwtYJiw==,type:str]",
"provider": "ENC[AES256_GCM,data:CN6yYX92MS41T/7C/9LYOXFG2w9kTQTarWgD2zN/ZM9PHu54DPRAJ+0MHbe5dKQN,iv:PMx04N38FGzQyQ+xei9c9yRgbX74UuG545bQK8jpTcs=,tag:e6NHwfso2wpVA2PkeFGR+A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Kg==,iv:41oQTSZwSZWWb3/Ne9chZrR8zikFsLMH+I3o8qRS794=,tag:ehVoH2t727yKA0PVrQIbxQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"atomic": "ENC[AES256_GCM,data:pw95Ww==,iv:8mMhRCZEaPNWrfxdeF4rgZCARmzBoXjZ5zH4IU6IRg8=,tag:A51NUV2VO83d8mJ7sGPzLw==,type:bool]",
"chart": "ENC[AES256_GCM,data:olZ2q8L6ESW9xQDtwlM=,iv:f8UTx05/+YNwho+PZ2VM+d9LcbQbzurXOOdwj5ZsMbg=,tag:mYO8tQ2b5rgYzRsgqAkjCw==,type:str]",
"cleanup_on_fail": "ENC[AES256_GCM,data:sbhmuzU=,iv:a/x1TiEfwvkiUTQwGQ/R74rgtFmH2FUIiGKceqS3qs4=,tag:LO7DtDxHPHLvGgY+4/mtkg==,type:bool]",
"create_namespace": "ENC[AES256_GCM,data:H0Lw7kY=,iv:1myog4xIiM3ks6G3qYL8HhNStpNo2qq/wr4Jfl8NIzY=,tag:roS9TV/Z7UK3YcJyjkLvYA==,type:bool]",
"dependency_update": "ENC[AES256_GCM,data:plT9S8U=,iv:+xI3d8uwaHiGCrW3dV3h7WBJax6bWAR5CV3ON3W+Quk=,tag:RvGeB6ueKRAPhPxHK5FZNg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"description": null,
"devel": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"disable_crd_hooks": "ENC[AES256_GCM,data:UouVKK0=,iv:jPVU/UcUvvnXfwP9Q0cM+Qb4XbXVNQzQTmvilCCLYAw=,tag:lThh1ZaOOG7G/HFj1z50rw==,type:bool]",
"disable_openapi_validation": "ENC[AES256_GCM,data:2lCyDEg=,iv:YKwCux1GhjGoHDNpoCsywqaN7gTmfIyDWhSygWyfUyE=,tag:kkD/wlWcGkhHkWLK5eIIiA==,type:bool]",
"disable_webhooks": "ENC[AES256_GCM,data:OIU2jRE=,iv:CYR7MpOZjmvqUcRRdyYf8JrZtd5Sb02naAqjnGNLEzY=,tag:xtxx8Q5V8YWZF41TxpycSg==,type:bool]",
"force_update": "ENC[AES256_GCM,data:mQafCxg=,iv:azoiLP6iHnvt+sIqtIoi8rPkBrmCaHAdWcvbk0JP1gY=,tag:8WhTmdxKFQMCxGfVQyeMiQ==,type:bool]",
"id": "ENC[AES256_GCM,data:Hd0jdN+T1qCycfKz09SlvxEQF6U=,iv:DAy7A2GO5mMwhOAyftZY3VSa+SZGLgab0ghzH3zLm8o=,tag:jSFllNH9QGIK9OUzUES8mQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"keyring": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lint": "ENC[AES256_GCM,data:IN6k9DA=,iv:7zjhVFLw8/AO+WTbm2R7kRCWs4Y6LtRiwM+oEqIQdf4=,tag:FPp/tOyL3rzaA53DT6/PiQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"manifest": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"max_history": "ENC[AES256_GCM,data:7w==,iv:rPHDCb87Yr4U10kywijezKSiOyZokJ2eDbW/z3lLVk0=,tag:tfTxQ8SzwygEtbCAIQdPfw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app_version": "ENC[AES256_GCM,data:TKzT,iv:W7svNjdXCPf4B6sRm8+89OBCpw1Uom2bF1V6U3s3Tvs=,tag:evJ10QBe/bzO8y+dPaifOA==,type:str]",
"chart": "ENC[AES256_GCM,data:BAnS0QGCi6C1IFG6/Wo=,iv:RNgiCVXfMwU9xM7lpI2DCn5KfZd3SYZ37jzSalqUnr8=,tag:WhVn5CoWwdQymhfGP45fGQ==,type:str]",
"first_deployed": "ENC[AES256_GCM,data:+uLN5VPiHF2NUQ==,iv:i8qm8kZTIinUPXWsvNYT0Jmfzz+e1Yw4ocLS6ZySY6M=,tag:L6KT/4l64APrk7yy+F4khA==,type:float]",
"last_deployed": "ENC[AES256_GCM,data:6tH96yJnHeKTTg==,iv:g5aEMpFID6NzFcoYD/ir6DFNdl8D/4sRJE8vhuPyqVY=,tag:/oxX4LDfk+nTfkun2H5NPw==,type:float]",
"name": "ENC[AES256_GCM,data:D3fRMdNqM84z+n5+tpO59yyqOs8=,iv:HzD2R1L3D6ArhaS2BYmWsg4Q+8lFhO6QBU64474ffew=,tag:Wi7nVXi8rFLwjl8wdiKtJw==,type:str]",
"namespace": "ENC[AES256_GCM,data:XmMyGev8dD4V,iv:cAZVQbLfncbyX7ZDlzDa+zsrhvshasmSjBuq2qt8WNE=,tag:YWOkk5nenrSjyhUEVVJeGw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"notes": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"revision": "ENC[AES256_GCM,data:TJ4=,iv:ONzC+M8jBQd6Zh73w0gQTmAAg9owp9hHGP4oAW14i3A=,tag:xLaQt8cypFRlQWkIdfNPBA==,type:float]",
"values": "ENC[AES256_GCM,data:q4J9g/3A7xXKY7MRk+vgR/J2ziK+ioi8YXClfe8a6lfSTbpV6wZiULD362JM1JEuSF5UzW9fJoOBafbUneGyAYttDW/PBkaKfqMAOnNsb0Dydh2nTOtd5bRutrRcaFCm+xA+YuvgADPvDK/E4bLpmuRQIcocqHV06kOWhH1qc/inRgBA/QlBSy4MnuF3T2kSYwL5IOU3Al/sSQ9mqh+4yFF3U+6xSsTM8j/sNnBBVM7K3+1zgBv7oZrLdKD1+zeL/PuBqMNR0jg8754OhBBPBHKFvZs9cK6eKqNrfpvG21odTpKr5WOb2i57akoYg+FueOgbVUo4QOnm1m08VBEF9Atq5k/Gqo+3vQXlMN3MNEPtdb9feJ9IOgFaPZmyqLBoLOgjKvoXahxfc4U0gNRnRVdOsF+q2ILIkK2IwXdZTnutFkDJ/6zclHN4C4MNcaAjkME81MMpw7DWctJm6aZQ9ImgSKXGLv794xpAZgfmp3PzWlD7JDV1ykMn4dBAMUiZN+HwPbGQ0fd8+oZyK0B8Yo/0ApL2HlQa4vQNGWmf6WmgKay7DzLbwJ38EswTsIQWHn/e91RqyWFrKCkVk5NGOMy0unoGcA3/U+h3nHtFXwwFM5YfV5SULMYSPyR8E23rIraePNP1NU+6amVFZrR1o19YM6BnG0gXWCJGhS2/+QFLfeuNMH5wNmszWGH51hwiPuEH6iybDZl4SvfX+fRPQoOrSRwTO0ZUe3Gv0jiL4xo0NmqejdGmn4lEDKShlIZAPQLu0vlP0M872tsLeEWPsefxe55qdPIEBtZ5G+OmEyD96c+kyKka9hpc9miYFG7tG04AMixdPG1bQTRlkdzQgk1JBRNHiuigAhKo3/Caq7DA0OqxsSQMlYC6GhELd/LEfS4LrnHFIcqeFjdldL6SZ25ZKk4psEdXJuqrGNNmraV0rSZErx49cF650hMAvAa6YMJTzvglJbbJlJE4InRrtXotRMKGvJKxCyh65YQwEFf80h8CTxaGOs1kjHaYxE5lLgjze14RoO8p7nrVLv1z9xchAcZeNHvdpgzIunPODqChV/3QahpD3U7XvoPu5kP/XSCRF9sCz5kQunEEEBtWjh4aqc0NbVIp1fI3zv5O9QCbvLTLMrBYy8G5dCXfm7jjFdH90SFyIO38z0e7oKImhSJAlt4nVIzKPbmbEkcshBYe2Z0dmwyvS+ue5KMEkrbAYQwCt9zU11+f/7gCMoLpI+OKPr6HPYLivrKu9ig4zFGDl5QUN62Hm4K0sgY4RWA3tr8M9wHXnNLBKjIqrroQq1kLu7EbSBp+WFDs6b4v3NMXAn827NDT9CSE9hfZV4+Hy1oGMskfss1HuhfsO0IsKEaFFpZk4VmsaFfIagk9FzLbREfrjnSVF+/dppcK03qy8RGScb1vKQjAE+j+zjzI6db5JrQLXc0Oy5vgGFdhcPcu8/kscxyDTn3c/tgt+QUJ346AkdZIyzAqHyovFDqZYwabmvZ3Di7jU8zcdqS5JbE8mwPDg2zA4BruYKUr1Chy48teZZohYOL6uRITnKtZlZkD8j24MtIqe315ESiEOVt/ywPry5bIzp2HUY1UN47U3RfrcT46Ss4M4hRPxWWsFgFHW/q0vkIEynYLvstXy3Ytzi3ycbo1Ocd3nClMmhJ154pTS9UZ6yOaX26OCyZNYV7fesv70b6QeLl331/UbSihY6EOrmal21gxmkcpRkTI0sHnYQLSVVT6AoRzPM0egSe6nn9mAtQ6BOiBipzMqO/DQUXK2JYq7csGLQvZEAftwBGJdgh1Q15P9G7m/Pzio6QJx5MK9RN7k9I6/6N12uijtD8Z4/Ohyc5gs3CoyEUuaKVH1g30fRFGKUUZhXRLTncYWMjNb8k/1gbaP5xl6GtAM2+RnLjrR4ieyyCEnNKIEqSRyzN7jH6ZS80CWZWiOjY4CAhvKB2ALFkJwr0rNojmbdp/IeYvvjWaKGj5px+2FZUEI3u+pbKIXJOwV/wkPTI0Z9wb0aARzNAGJP+cRGE1gX5y4H5nwL+gdq0s7H++e6r5mCT7FpwAUcucm/NeeCJZVROme383UnAYTka2vjzFl5b3lov7An7gelqPNZ74i2PUXI9upmlb+tO+LtUmXTbKWU7qAN3jaWvar2ZIGnCsv9hwWn5rYsDF49uclmhtKjRe/OhQDmuurs6TtiyHSqMr1x8bS7YoiwP26S/8Rq5wVuS7GFPlzByVwAvIRduq2e5vjZ+YHWYjMocwzom9y/qhbJaztmy03IgY9UB++i+sNdKB8/4SxsreUisBNoN6ouLBHkt9G/ZA9YImDOzjFBPH4B26+/fhR3atk75R+hpUkiua30l3fLKwQlVjtK57BHkeZ/F+xYkJa6a95y9k3zFmRHr2A8Ol4rUGF5GtnYNdyVRca2Xqkz2OiFowuzoBEDGho9Yw32nSqwhXjuHxfNR3Bm3Sz9xo9IfccPwYhC2zxzFODE7yxsH5fTzL3BQVo9vRt22JdWSgF79cKYFsaTfqrL3znTt0p9v0a6TcokPqpcT+N4uEo/VDp7hqRR4I1XqsmtEiAOY6mLno2SJbtyz1LLdDmwSMfomaWK7fsbzh6xpbrxKUWmnm3rH0uy4v/eqovFUOgvJDr4CNp+IMWYYdymNYhq0FFQzllKNl1erE/HzUxYS16BT68uWf+cYHRoi+vEp2SU2xPx0s5a76+Uj/+qumlm8OnPJ9lJFGk0QqykIX1EJH0NP4zfKX20XRy6gpbQwJPSSLQd+2Ucoqn3N93IMpXLThvaYNnCLGNMhDt8ryliFpWFJer6dMpHbzvfAmbb8s8cUdADRAfKhc6pvAIL6fEw+h/JfB+KOul+Y5h+e61VZfRRwTXfSuP/4xxzxV36V6su5O8snbIOG2dliRiV4kMC1gKRrA/DTSu/XbefWcWNWvW3eApYL8BeS4ZMsvmOROZvnoO0/cmpwxV/l2EgO8BALQb7k9O17gflcA9KEhxTeq4AW//6NiYjxye4QyNSUZ7Wzpjv0rIxLVxIT8tlZ/RMPkFG8HBF+2TR4stWY+LdaZ7Cr5cCP1TKazQNjScZo7aD/rVypJO93p4DARHmpICT7F1ET8FT7nuaJPXT5Krgt2FAp9tf8IU8yIUBmNEvGzDGv2UwAa0La6Hgzyn1s=,iv:Du9/CvxOfcPAvYdJJOkBynhRdt0bHt9KSOVDXdmAvKo=,tag:HFNN6HcCuvgvW3hSHI+dgw==,type:str]",
"version": "ENC[AES256_GCM,data:qEvVuFy7,iv:bpn1DZQM60XHRBjLN8uMIRcegheajoES7O2jVQWQVak=,tag:WTWv1s7qd94WjlPysMw5zg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:F4eYc7MIgPsKPXb02U6MjYR9AqE=,iv:YrkDkCYqiAioO0jA0HnvltK3AVZs/RWNP22V8FgBHwE=,tag:36c9ymRAi/r1q9QIfER4NQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:vfAXTPBp/gWx,iv:lejOQ+uiRuuNwfNQYe2ykx/ZWXa7I/TLeMmYhKg4H4g=,tag:0voEBjD4Y14AVfqEUiZ+OQ==,type:str]",
"pass_credentials": "ENC[AES256_GCM,data:+geKrcU=,iv:R98KG8+KiN5wIjzXlzEO4STgS1C3/2S059ArAnpXtJc=,tag:c0+chKshKZ9ZuhCfiysNnA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"postrender": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"recreate_pods": "ENC[AES256_GCM,data:DQWP79c=,iv:x9RAufDRpuKVpz/uY9eU9zznr5EefkKFzmX6mhN9aEg=,tag:wAAxPcLG1qrxOykUQyBj0Q==,type:bool]",
"render_subchart_notes": "ENC[AES256_GCM,data:990LkA==,iv:O+6geVMgeMj2CP70jWTdzewfPbTgFC5YPUi1c+U/NVg=,tag:5vQ+qe707Ijcah0g771KRw==,type:bool]",
"replace": "ENC[AES256_GCM,data:3v/9640=,iv:/CDNTIRlaDHI+ysOQI3/xORJTxnGuf1iyfMBU+5QCmY=,tag:dYotpPlhIMPJ3IfnuTA9yg==,type:bool]",
"repository": "ENC[AES256_GCM,data:Xv9MgUqnqCe+Cc1MY6M3hdfOssCU0lZ1La7zxpR5pjx1ONWccYzgSA==,iv:rhm70OPRsBUsjNdUXorlTZy78/rhqFep+jrewuMI/To=,tag:4w4uXj77ncJ0KLBbgeS5RA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"repository_ca_file": null,
"repository_cert_file": null,
"repository_key_file": null,
"repository_password": null,
"repository_username": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reset_values": "ENC[AES256_GCM,data:kfnqeQE=,iv:ePklDE5o7ANaZJdcNi8xp5xYPy7Q6xTeUEoRTYlQWGw=,tag:luBRJcdrNg2CYiBE1jI7Hg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"resources": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reuse_values": "ENC[AES256_GCM,data:X7TE/DI=,iv:M8fNZ134vTNzvkq6crkE5KIGk/O/mquKDdqpTpQfIao=,tag:/1wHZxPvu2HQMVNXT5iCeQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"set": null,
"set_list": null,
"set_sensitive": null,
"set_wo": null,
"set_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"skip_crds": "ENC[AES256_GCM,data:I5CTq90=,iv:uA2aESTVb+X4GxYnofnBZGn7nEphoCEnNe7QZWq1y5k=,tag:mDqJzHXM7mtnZSMrbFRp6A==,type:bool]",
"status": "ENC[AES256_GCM,data:OVWmUuxQpNA=,iv:1fF2dbB9lstxX4Nu5taN0+6+cIT6fLsukqTRxDRMt2o=,tag:mM6H+qJf3nQx2dghLisWjQ==,type:str]",
"take_ownership": "ENC[AES256_GCM,data:2jPwDKo=,iv:8rn1n1/U7lQRZz8ciqRN1h05g3b1eZGn2nWVPQUYNTs=,tag:0LNfHuVwhH+My6xGzf3xWA==,type:bool]",
"timeout": "ENC[AES256_GCM,data:fVww,iv:PEHFwNK0a85BQWD8VU2xL0alzwpJjUTZ3/3Q0+EE5gs=,tag:DJN1Y7Lsm8M2WNt9gltb1w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"upgrade_install": "ENC[AES256_GCM,data:vYcOoCY=,iv:N02GDiiO2aRvO7eRKu7hrPWlqNPFQsaDl80lvZZAwBE=,tag:zPA7wIVeB4anFnPXHIdgLg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"values": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:HtTQONAeQfwQaWvUrwl1qVmr2DIXaK2RPtGP/ysZ5nQTN4pgACWjMItqurPG7T2u8p9WOa6CnWcGDDSpqON0cla0p75ZpkWs814WLqKvi8+1Ju2D95HCWH06RHRBeueoAoeprR+pg/3m58VV65cEwH6/dHkGFouWQymDfe6rviSNjBUTBfBldg30YvV1bfcMNDvrIg57E6I9VPk4OqeMkbnEvwqdVGDZLUjoqyKYINJ3J92IYW1GbLINf6EZplqFp7elwWdwhu3XA5f1jDXF+XwkgzTDbwzqxwOElAF/euxhsL36Pk1/pR44cJvE/29Yffog6FAs/jfLVpj8eIIm8ltLZg6KLWOj5+VjDaxhuBO39Mh/7WO6aZhhMCUBKHGTZwP48bRDV9pIvLmCtgvi/hR3m8haXqK6B/lF0Cui6TlJNqig/2A6smEiOsftnPJO3ghEzkfQepJjoRw3X513mOICJ06d7BbtG1IJVNVM0lbHuV4z/P5PVWDSuBSlWMUb0HJO9nGULFvbW8tjtHUwCFOrVrzfLj0cwY5kYoRykqQhfhXxXtE7BRrr3VNFP8owBbKOacPRt4QHx5JccOqm0b+VzulxLmgKj6UB7FtGmwuB5Vx8so4PFaOc74aAUyZFzm6dw429u0xdApChiPEcIjvAG2PgeGqaLVy8I0nUQRdc3XttO99Xdq72PHPjKm5Otn8rLgF7puZhF0HeIrtR0n7+sv36G+vOcoiWyGVSK2rni/OXLIjlEEWmb1C2ZSwdpzoi2sIQGss+XiKLJ0bLEepzkrq9NZsSeQUDua2fxJp6bQ1waP6U9bmXh0bL+NM6Uz/0Vjb4UB3sUYW3jMv3T1zogSFiLDMvid+wiiNcLHEUZEyhpFjh0h09hOFmmyrOtpqSQSAnfEY6mZE04ybVnDygGH5QP2/JRbB3jUa7JziHyOlwNy/c1cAsu+5QuhbLF99YYBwOLVbu6LVPOsnTtBLpDfvV6CoaiPPuS4jy6kZ0ZegCE9uKcl/WbI1GkhHr77jWleRKH3l3S17v0Gelw7bIEX3PPtIHDkWBdf8UxPSVmaPNfnE4Qsbx0eEPeortZjeGiltNShv4zdN2FTldUfxlLmblOc+Dh9m/yCO2bPol5vCS+YlSACaWo0Mq4AZfFcNruOl3kVO3m0onTGbAgqvGFDRmFQsevqAbaok2nQegwdM+BH+a8VSTPr7h+Q0bOG8RLdOb7+2lv+dy/K9WkxTB/TwjBVgbsgJUhRkc+Cy1nWga0CRYt6CDpKMxNPL345Tjqd+O6imDrP3lLDflAw5WGYOI1lI0dPKmwk0hGHh7dikxcePLUmBHd47DHgIas+LsdSLYWWAmsV1DxIh4YGKynkdBP9uN0J7fk6q2hU8W6fjCGssA5r13rw83P5xLcpvneXe1LSRDnoafknPeiZ4JUndVmo7LrkIGGE+lZbqsdIEV1R+YDeOtKs0/46u2GRYeKF1ErswlpS4+iTSuGdy2ebj0SjDgdA7hF+Q7WtJBVcY2JCLaxNp/orOLf1LCUEwZqyoCRi4TPt7Uu9o0YIfgjz6HrZNhGm2ZVXnYJhXuLnMiu2qu8HbV7clp3LcXshh2fTF8czB5KvQ4ydwZkog4PqR1XI0JJsQ5PQeZwpKrhvOz2wp0gJ7L7eVjIFnsVcHd9FWakcWxHb+VnokZnO5ubjdwYInzbp6+IjIUbEYb2WMlsb0OD1QjNQaRk+sOvADemFbkCUvEXKMx5yX30PWvydiUaT3iu9T6iNzjTfc6KbqgDwynrWd2+nLcmbRrfPcBF3eh20hsxy0FN+a7ttXYfYbiPdcKy9+scvH9BJN+OOU91PBTwkvQnZYCWvDfQOQT8nXvGA7ylAvPHh32bRWoml89i6IU/Yq52bzf7gXQQsWljp0ZNp2zMFwCeBzzaU8YTwEtQlVZxIEhYQThG7qajgJaOc/C0hwKFh3KFje8/Ya9F1hNZEOLj2qrdOzFXqljOE66TkiBhp0+FbWWDnsZQDC/I/lkSJUgKe7kfbqxY3MFTl0ffIRQlfSEm+7fpzFEJBb7EKWvMF69y+9xJEZAP50FSeUqxYRFN6v0y1wmMfCnpdt166Ne+gfGB7lUsxXfEE/E0UeAZHgsFzehCiNH+Kvf9feCrgTinkb9YST9q4BBjbMMsow4Gev4XQSEHpV/BY82EPLFdS9cve9KXbpI8en8UnHEQCVe7Svl3DqqZbTzPIkl5nHfiOCUZklVxSPy3jo8Lil3mUsTp31UFnH1OENVs+YmhnTiOFaEuXRg1IGGFYc0eer1lsj44YykePacXlRtk6LioziLd00cfy38LaYZ6Rnfiidu6RY6MWUwV+R6oEBqpgLiLFNPsQt7ZKplmdtlJma5S57UtilrEnCCKqQV0nphHZJro3NNYsqntOHtytfJpALs6eHM3g6mt3IBB55vkaVlNWeQ/PrrEBSMvb3CxmlmZ/mPuGQIbGtl6WXEr7Qe814FG2kAKqYPWgVfu0xHQnkMP6McvlOrJapwIJ8BX8UQ04c5yRyWeDvNryvmZL7Hc4raMXT0LdglJlJJcsSZEddfZLkReCHpNin6CHYbmyTRwXoJ8qRWbpsIY4mVM0C0wxD0BMPT/LEm0Ku0eXnqO7VI+2ejVfdSTjNttpZXeXUXYYCUzL/DmAb3BOfgfHoMk7RXnUk5RoHZP94bBowLCsoBLI6CQR75abTFA8SqVXJ6xRv8wxFz8/gEWvI1xU+R9o64x3DNYQTjOIKGVogu75k3GrPHuZjXv1IsPzmP+E8ZO5wEn4nkqn5wWqi4i3SOGj6k32qw0gcxf5DJp8ntIrn15UU91SIgztQkGNqlXgMQwSh1srjuqL3L6KXaxzMg2U5Vvr9q8SH7YBxJhPyTo/R1HfF0DlNgr3E4MM1ozUNg0hqhWJ/LCZ4qLjAQq1rlaHmNkyyqxVH1L77AZ1sWxwHnAG0Epijv0TxcFjXrOsBo/CN1MWqj0AAxPI88XstFYh0+LvpKi5DuZOW30jweqg47PJnCGNf3xp5w+WZTbI8hY3OIGWrbR0zUXT+/uEDdBE7bK0YkDXQ/ECSPph2fUS8OnA2d+dKAZyn8MA095VSPsc7L626lU89o1gR6RjyYf/3Og8mJr++lnnqO2NTz1KpTPmC9eXUPO183g1ZT2vX8Rb3DXBCYWQHl7z/j1DGOVoydoLV7hxQ2BX750hfaib2aAy6nL77KReWFGz8zOm7V68VFLB8+SeVtdGH7BHf/cOMMFq0fC0o9LIyNwok1Z5M0OUBqJLI1XEt6OWm6Xu1sPTHlhJNUkMn1smyVRIXxH+ekkGPTIxd5bRLi1er0Dotd/+d0d+ozV3qHdX/K7GAFZiJ5gZcKoxq05v1r6iX4rqgfZeRNiygctzLMov5W7uHw+fMr0AfbLKndAbk2+XD4UTx5zhVGDcI0WyS62rjoGYeaYOLi/i1C8CJQlYP2/27Qu9p2EmGKdPK2K3gClgFEZ8WFUPk36nkiIgP2xVl92S3Qiy3YWy3iVlK7N313kx3wXsxMwmWhK3SQa8E6UwN49OBwKY9j6ZiDeIwJGWo3cyEQ1TwjUEBJdJQ0XOeb0OMaOEayX8Vg+FHtcSmVUBgA5CtncilgG253cy5dQM2JO6N1pRnWIn+Ox6Y9ZhWP6GK08cpI2UogTNkrNqyUKcZKJerlD+H607CbQCX/ljyBxvfuzykiMZfos5PCSD6vtNxf9vYJEuc5eTpu3BYcByfY9ecoMd7g11SiHIlG/l2H4CrP8taXT/aXg7x3ESZ70jj9IZU9IUqaqOWXr/cywiWek1B5bnAGfgofpqQSsBFVGDsD4D1akIkTrogl1zIpFVylLF5XEauvJnoN2Sisrdiykq/y35ILFbOcFifIMmKp6WC3yA4w7/R2yjY/qHUTSLC8oz4Z4Jza7H8KoPrFCs7J9Q5376Te/e+4auu/9xTX52eYo4XAtGspmpT9wuTwC8WjHcK0zw==,iv:znoK2YIPULY4ncljyDxAygBuBW8zBuXQWGJuGRq2ygc=,tag:cIpCdxedkhtNYrchw3TVkQ==,t
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"verify": "ENC[AES256_GCM,data:tZK+S/w=,iv:4TOYHg4awjfMDam2FBQ1+e5dlbkiJs64ac/+UET3Gho=,tag:AXtec3FZkJiDHvmVJVBDKQ==,type:bool]",
"version": "ENC[AES256_GCM,data:yA6vSWJn,iv:GajFCFiC8W61jpH3/WvybaHspfxDPBUZrV/jkbUy8HM=,tag:ZITTmsNJjX2GxGVQur9Cow==,type:str]",
"wait": "ENC[AES256_GCM,data:veOSWA==,iv:7xJwJ9nkNOL5CcAdjPCdemaq6MGpMK1Y0qDaeoHBxjg=,tag:SQJgZ+xk4gcyKYCZTUxGvA==,type:bool]",
"wait_for_jobs": "ENC[AES256_GCM,data:BnX0Z/w=,iv:5aTuUqp6wZ0MhqhfT3sEvIhm5JZhMMSVZMldr88V7S8=,tag:nJ21zzQqJA9GH7lrAFwbQQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:ouYrdXuZqFE=,iv:O6RRnriXfZA9Ar7q/OcC7USv/ZWwQhwqeTXEOUrdG4Q=,tag:/hfDwLwiOpl/dJofYLrauA==,type:str]",
"value": "ENC[AES256_GCM,data:K1VG4g7W,iv:vovU5jQvjG1GTsucKZR7vT8B7JSu9zaNN5JH5IuzX24=,tag:ChTaKIWX72TRVyhkL3U88g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:xFImnXU=,iv:gwwdtZ75MCM2Fp9m8V7HkrSafBQb7pwIMfNG4o5jk/c=,tag:G4ccIvMTwbCg3IFVKRVMfg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:rQ==,iv:JlFLK+brNz9HniOr48UNRjkV7vvi/ArPRCDF41fI4dg=,tag:IkFQpkDJm+8whiv561M6dw==,type:float]",
"type": "ENC[AES256_GCM,data:A05or5UY,iv:vrNIYy5KRKz/ZhJFJ6CAMQOaDAzXpcpSX5ycPJcGfCs=,tag:MIGs0PutHpjiAf6ca21ieg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:hxcfYCd4wRgudvT8t9qfBlmLfSYUCjYI/+KQyGw10g==,iv:r2Cz1zvePeezSgM0reNvpVfEDcmA1hAqYt3gXPCUvgE=,tag:pgT6OMuivF6NZUdT1q0geA==,type:str]",
"ENC[AES256_GCM,data:mrtOXn+oWvKcz41WnRC1Ef7f+GqCAnMs6vecdtcSwMLaUDPpJi8+baGb0EIj78k=,iv:4/fxJj5UNUOjMTii0ljpazpKpMTEV2hpe3+kK2GtuRA=,tag:wYlDFsb38h5ZC24vvCfJ+A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:Q5nKFZJkXGUpZKteGhKsSg==,iv:GXSYMV5STNfTBSbbS99P82PmjTuj6+RuxUDjGhKFf2k=,tag:0QsLPogPYk64WXrQ4DpGIg==,type:str]",
"mode": "ENC[AES256_GCM,data:1Tb+SdY17Q==,iv:xTgwr8xfRgybwi/wzlQkSXBDgWsbIHvLASeKVeteVUg=,tag:Eq60bDwlnF6AeF+8pnB49g==,type:str]",
"type": "ENC[AES256_GCM,data:HGmtfTubyC++B8mXg0q62HxvqUo=,iv:4gLkXqezYna5s/FzEgY/vBvFhQamBBwtXihCufQDi4Q=,tag:ml8Jv5Qkde/oAZBM5LiIww==,type:str]",
"name": "ENC[AES256_GCM,data:Vm14V9/+UsRJ,iv:rA6izeub0zRmZTQB8m04XthjZbmN1bTg2WYVbYzvHm8=,tag:3xDnifh8PhU6phah7CYFoA==,type:str]",
"provider": "ENC[AES256_GCM,data:2JT6b1DD+NDc7/p7eBkkwKsJsEQydVgZM8dFGgrZdSaHGLeI0bohbr5KvH2e6B0yBqyHYpYM,iv:PSBHKRT3amlmA/vS1B+4Vg/RzpSIMn8M8WnIrdNf7u0=,tag:o5HBj3vJCxnh3blBqi3MFQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:yw==,iv:8g97z6qricc3hfBH58b8fg7T/labsTaxTt+sCGld+h0=,tag:Pzjh8h/Ec15hkfv8k8240Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:jI2+leYL0i3v,iv:75imRScKbDaAFRFNLEtO/BN9U/S9MsUzmSEVElNQ0+I=,tag:UCS5RcEr/LDu11VKgJoZYg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:AA==,iv:u4JBq5Gah00zd4EDGCmR3KopK7O93tFEXoWu1zSj6pM=,tag:5htAAEVCwQnvu7lLP7sBJg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"goldilocks.fairwinds.com/vpa-update-mode": "ENC[AES256_GCM,data:r3dZ,iv:sejKJpuCbJsiGUD9QfKbY44MbI1J/B4SwOBsZ+qAv2c=,tag:4TC1a/UWm5uPU7khPXX+Lg==,type:str]",
"resource-governance/custom-quota": "ENC[AES256_GCM,data:spWkTA==,iv:vtKnz3Ft6wTBSSsoV7nVifLF1vorzELTW+M8BS21Lgo=,tag:eZe0Bu3HHaSFpqHE9jMaeQ==,type:str]",
"tier": "ENC[AES256_GCM,data:NQHXToDpAA8P,iv:KytP/o5OLf6qv383/QCcru9tS7b7Gx/cBL3uu2KOkww=,tag:u1mBNWpMvgfujs/jpIuaHw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:8ZcKHuXUUTrD,iv:CjqZ76r7eC5Tud5bP+NgWXSCW6DslkFyugZ3+yx4NgA=,tag:txU5yXOclK6IlzFqlpAbmw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:2zkSrEH6xaIZ,iv:a1gXK+NOOjjTJ8bK5/2TPJ3hMJJcSJZCGdKiZCaornc=,tag:a7zDBR3aZ92wtqn28atcQw==,type:str]",
"uid": "ENC[AES256_GCM,data:oZqKbhGUmfsL4eqq6nL2F/90m7g5RDGVmYyh2lGKzE90vIAF,iv:S2ruT86xWa1NoI/Nq0zaYr3gr5DIgAg248qCwXtuvUE=,tag:xZTDRKYJgiNeh3JJABmWkw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:KDXuU6U=,iv:wibypYoJsoi1+S3Ab32p1qEYQgSUMgQWZZ552e2Ooz0=,tag:B1OQXVQgqhEnE56+jt8YHw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:tHqDq1S2XD7LyIuWXH80dwxZtmehDbHg/Xgde18cKUBW9u6D28naX6cD3KSP2CIfktVfthjRlKtlRtCAshui8VRr/at7rQcFiJ1nKBRRkK5A+4RQ9wqiGw==,iv:M+xyCNwMU6HpRyK54eVbNKwl77KIx1C8ay5qPmxXDhs=,tag:80h8AlB3+GbEPRq96LzhAQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key_name": "sops-state-iscsi-csi",
"created_at": "2026-03-17T23:05:49Z",
"enc": "vault:v1:v8u46vXQhZowF1Toj5Idwf3AdZCezNHPR1gtWrOkNTpV6S3XEZkJDF+JdtiQC6OOOfqCsS7K6eSW0oYy"
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbkhieGRQNHpvUHM2L05R\nVXBiVTNTOGdZUnRZbWpRUWt5bEo3aHF6bTJNCnF4WHdady9Pd0JwNUhUdFRJOVZC\nSmNuNTdROG5Zb3FTZFNrR2Z3czBLNWcKLS0tIHI2Rnpwazd1UWR3emNxU2ZidzVL\nL2oyMTFWVFdvcWd2Rm0yd3NZT2lGY3cKgutsXvu6dknaOSajFl56aFdTQnmy4VHO\n5P+s40CKlh255CO3Ll0mD6OfPTRCmqJYb1wKendGpzI4xXd5fNdRtw==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4cTgrcnBTL1h1ZnIxWkVj\nbmE3VUlyWHFSeUlNbDJMQjM5OXFWZGZ4T0NzCmxId0hXTWpVUElTUEFkaWJhYVRi\neVAyMGpFaXQ1YzAzMW8wUis4dFRxU28KLS0tIDd0L20ydmZRRmtIZEJESEhqcE5k\nQlFpQXdvUmtWdHZaVmNPSHQ2YmZSTVEK8fqqhcPjSNtQPtNKYw1W4pgdDcdTlFfS\nMxwoWZsa831smciQ43bVy4SyTxMw0jibbKLTgnYBtNCbTYWFpr1X6A==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lastmodified": "2026-03-17T23:05:49Z",
"mac": "ENC[AES256_GCM,data:yxtKjYoEBapE+zVCZT8C1ZJVf14qrXv3Key8U4QVKO3rEztf7UhOeWzCUuDJfE85CsZ3RrFavicUND7h+qnIhDxuUyhl4jPQMEjxhYLhg1ujvawcv/LZft4hTCZs0VpDouWEu/lSrqGqz5gv+WZu5IVGF1Vn57ZvFla6H0hgvQ0=,iv:zTOTjBxUyAXamD6wMyTxJQRXuvv52KDMPyQGfde8b3M=,tag:KGWFE84+DZqeM3OaJLcPRQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink