viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/state/stacks/rbac/terraform.tfstate.enc

726 lines
134 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"version": "ENC[AES256_GCM,data:yQ==,iv:aqZAb4geztlQHnFO89+0XuB+ebyYL+y5AkjlIQEBAOQ=,tag:aA5yDGnTJnDOTc2HOLXScA==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:bDiLZhQ=,iv:hzxwzNAWmvST4PgO8kE/H3ZAGxTvc4+Px2lNY0EmYNE=,tag:CMfeqY0vgOZihLaXkgcO4A==,type:str]",
"serial": "ENC[AES256_GCM,data:Eg==,iv:ztRY/z3MUqgL3EgGAHv9mpBG0fDo/T2ZabaQOdXzPgM=,tag:KekdsDBdVJuW79tEL+1+zg==,type:float]",
"lineage": "ENC[AES256_GCM,data:H6b5zaeGCKovxF5Li9KDNz43A/aZT1ekXgqnRrr4IcCtFaH5,iv:qy1Usdu3XFJJrGtkoxpgguG31SuUYBzCIf11pI/Rl9c=,tag:Hbl8IrXEzFgn7NjEetcDpQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:5bzNTQ==,iv:ulOzzhCfKDCnsXi0Hv9xDp6bPnmY0tn5wMe5WnpbHKM=,tag:IRw9z43N4zk6BNfi5AG/ew==,type:str]",
"type": "ENC[AES256_GCM,data:KWl6oLXz64l2qJQvup/Tfu1d,iv:MP2AiKEZN9uBlKKiakoTRcZPE2lhq7ZPKgZu/mUFXdU=,tag:DO4Tpi/VP+fgILunnGjmKA==,type:str]",
"name": "ENC[AES256_GCM,data:f2YwmPH3qA==,iv:IP+6QapSWzuqXVIqJnY32CS4b5jOasiiv5W/FJ2/fG8=,tag:S1oMX4TkCFKnH2nbTIMzOA==,type:str]",
"provider": "ENC[AES256_GCM,data:bUpgga4/AwXzXDmlgRxtS7fpdulOIpn7zfr9hPj6qkW2cNIkhTsJgpmFdKmo8ganhQ==,iv:UXeUGenwnZmfVz9dZsvczHH0Xp/7BfdGLg5hJ1KUe5k=,tag:55j2d1kmWkumB2DTEqdztw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:ZQ==,iv:siULudtdTg/59qI/+DPz17hxGMADiaB6iACGjby0fjo=,tag:ZHF5mCkqhF/ueOste1rqpg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"created_time": "ENC[AES256_GCM,data:9/FL2NQNDVNR4o+j4E6d4+jNC9pUKfUhSOQM06Zy,iv:D6utbwsQ5mb/CHSMKK4Pn4iE60dwepw89pRGUAs1+60=,tag:yuIiz82p1DVnXCqry4xngQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:Y8HR26y7A8EpHnbsUmPDa94Lsv4=,iv:ML1TuQLc5zVL9aMQCkRG0x31yv7PCWyxd5iprahQiag=,tag:OgITorxV0rKbG+AtPrDsKw==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:+0VAW4QvvWjDEUzwcuDntMc4YOVoJnwVKhNf5nqIouktI2CxCaU2QKYnRMwYC8FLKFRKYI2V5+jJ6EQ/qbDivQHrSGiQfURNYkhf7h1FbzzN,iv:FZYAQDS+d859pUdbbmSRnHbZ5JcqHtylinFis8vdqKA=,tag:oN2MKcsy/SggijDwJVyDyQ==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:QBywxIDsI/jxfXp6P5fYfjnINBKfW4Gnlr2ivOo8vPLCcd1L4ibkt3hbqaXHYtY0g6EROodYoVswjeu+B4pbYRIZ,iv:RzV9aeFPxcnDFx7uaZb3nFX2oK1SBavyoYhgAYu+wGg=,tag:Zwe+ei/m5pkYbieEy7AfXw==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:U1wPrWE+NuhqWpZjWqHiBw==,iv:hKr3KoC7WM35j1erzCaac0p8Ngdv+gc95ZgztDK8pdc=,tag:L6bL4iD6fnpGqNx4SlcZSA==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:FKPmtl31Rv7aggxi143x6u2O/WcbLEwsG0soNPLR4GsQWGy+rNTZ6+f4dhUkrCdC0G8s,iv:iKhGK0Z9l9Ssz8Eak7koQBP5xS6OgZLSw0ed19EHVl8=,tag:TSxZI/SErbkpFkxv4UDr+A==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:pngt5ARXEP+sY69ZPkXg0255tEKIormoG9Ztfgv/QbifgOIP2w==,iv:L6HKjFN36kG6fU5QIyid0KDaJLOhAVHpMQxOTQdxbPM=,tag:+Q3AoyqDM1B0XRMUDXbX4A==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:n/t/2J4VL0k/PeO4GzlxZBjxIcxFwJTcCa/XgkaW658teeWBpF/YzeoB30S4mNbk+3PmQl+5B+UOJcJHDK47odnlTR/sQehrF+48h6fnZBFXrCCR1wrtV6NzEg4oS5ruRM4J101MfcviXSBroWAYtBYzrotfpClUZ7N1Jr+3zPevyPe1I+x9K7NQoMrrJkdPauyLx8Au1wBp6JpDaR/C56YprTs3a8RXXO9FlrXn4hv6VaEYhXF4Lw==,iv:mx8c5+LuygwI1h3H2ghOaWsSF/pkGSbZ1HuU4SXdtD8=,tag:+c+8XN79JYn5FTyZrJC/5g==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:guFH26lzYPaHvsplyTFy98DyGRo19tI08s9vU7JcTEXm14XtzpNtx9DJgw==,iv:DxmxCztBj7/00EpMcwwmeS1pzPtOHJCNPRFt75qw5d4=,tag:OMwimsEFsGl94cwjk6ax6A==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:cg+Qc79BtJeldrw029zn+LDSw83Pu3Xk78v5u94=,iv:8JeGR3J/DZreTiBNxjX9YnlEKQSNN9GJ8vA1JyRMFI0=,tag:VeFCQLgUw4HBpRoh+cT4vg==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:mY27k+t9X7Ads8DYmJtlTe9jKYxLnkkJYn7BBrxi6GGXI0xgg4tQXCLbYl1qs8EnJ7XpoSgVmnWfJzoZkSPB5g==,iv:BM8n3DSAlwoMivRF34gQtzDi2TkKkaUlgy3Rxjn5eW8=,tag:1X6IBvJ5yKgkFOF25H97LQ==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:OiMbfweKjIKUWLKOICk=,iv:V5ddhK3uO9fXBBMUzZD5F7kgIpMz55ozco2/mKBKTy8=,tag:wmxfOnW7QAecUiiusPr3VQ==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:qup9NUm4nzVrE8zpnOap6/uLeZHGOcFcAA==,iv:jkKrDr4YFLICcs8kaA+ltT0CxTylVEr8koemmxEIU9E=,tag:OOFkfqJdteLl/bzH8XrADg==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:nGO9/rTJ5fTcjSVjQJppcmg2RmH8xD1yivLG6Wt2U2c=,iv:iCyGbAkTYRsBkOAINIfgHpgiI3q8piqlEDp7xSlfD68=,tag:v+YecyNqGf+RWpAn3Qd4IA==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:ve/F9McZEDl/qKEEqGQR0IQ1RzogoKwvmXo=,iv:wIPHeHiGlC60I0WQ4ZFs38SYXSDvpnhUM/L2zR4QXYM=,tag:ONNCLFuvSBrNwQOrrJZUFA==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:nuSdvwVkrnuVPIsm4ZKLD2tb6nBP0B/dn6JL1g==,iv:mtM0maQ3oKxrRNeOgJyfdVK60tYPBL67Sem5it8uvsw=,tag:QUo+ryN43SEmDAoBKmvNIA==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:sue2MwzO68t212sft/PvhRHnPzA=,iv:yI/4lS6UM4W291J08O9eys4DT62OmiSxsDlmecq8yps=,tag:cIipFluMZWA/fGStHdfIDg==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:UcQZqyqkmu9UzbfHMLGv9aqHIG05,iv:6BD45qHEQyaWaQwuyQ84M6ZSBxM6kuGsr+Icn9JLVNA=,tag:YJhOvb1R75HhOk7ZC3O4Gg==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:zo18tBq8J+sJMQesiPRL/eMdd+DDylo0s3wjmcqjxAYCUK3IGYKVYWId2ZykgQIoGf96bphs3HiGROboYFW5F2UPrTdlEHSDwKdb2r+EHlY5KVw8ZUD3McYYspwj/pn6QuGS+9LDV/NyaQMRjLOIytF7sgpbopMXep/MdnwOsf81pG4pQflFImFnlReQ3IguAacPKelYqCOqUTjgoVC0sywRHa5JExs9ZXReXAOr1WpPO1ThXdFH,iv:dCBmpQWPl2iYG09mtYXs47CUwK6EyexI+Qp/Z/NffBY=,tag:jwKIRdBw5Xihqyv2b1z7iQ==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:DfJyqrmCzPAgTAXACT06yLvfBmloG9tB9EySJL+TFSL1QmrDJ6r0jgMI/0mxlReHJJK5BpMGbCkI7ay6bLi8NbuXv6276xujamC43pJiPKaHAZv5k9D7E+6R5vJRafPUsmaXNZ0kvcE6MTJj+sWQDeEqua1ZuSrPYsM9O+CBWdVRaIcVkJTAgG0TBRnnc5kFFBBTCfVvOgKIU6d8HszOV7qiwtY1l0uIivDzMLUfKSvpW8A7wBCQ4O9d64iGuLCm0XL78AuXaexnGU3DuDLr0JyDCjAQFQgrSaevaka5ZDApVpGHoKySrL2BE3ssywGiTmymdj5EE+37cbzzkP+DQxI/lkQ9NgHgKtrtsbkHKAl/HaOxcp8qbq3Znxuh8jvrtmyzRmp30VrLQd6psF16cqka1emAZMtlW5zOTV43YlJ8z6oH/Ext73+pJJ/9chbKiwqG3gbagUEzeI3hlARdfD6Mfec5MVoP52iuqXAbPseBSd1aqRyp1uwnB/fhR1q/FoAT6I6fi/J+wmZU4G/47Ll/Byhp2XGSX/vQM7Qqj15mRplp0GO7T8YUNcKs/WpornVIeFnvf9G8WHVY7OITQhBJcSK405mxS3JI8n2j2y5qz85V7fEsM0Nbq8YpvavIVth7aUF16lgeOqIsUWiuLR95Sc2OmxYVg7+ygFHQCjCVP19ASMnDGykmBP+pFeR5J49rSNaxNQ3zqR8qLEfv5Wt5EDB0/ytOz3yBj3+M0nw68ibMeIaPBMJ+rL21PtIfczJsgtUqdWq9Esp/aBHk4JcKINMkFZrLTinks0d5rMIIZ/bMRVVCqYovdFcGg+S8PmeUXKqW58L+cSBAi0HCwd7dVo0qEusL3URsL+dkgDSvuU+67/8KmWqxbrKfzLMveJyV1dkv5BOJjqriW2DX70USv0P4mi1I+zrLQtWNZRUyt8eds7IhJ+Nk5YJ7czy/qqaMsulpb/gQZSzp7VvNad5Wwatgfmj7UzL2PFvvFMXBhuvm7E095hKlgAzgaQOPpym5uhoFlfA5Uwv3pDDzsBD3rCkvuXPSceS+ihdUkfqjwSeJYR3ppwOb2HzzgGWSW3W1+lN/pFE2BmSSN3GSugw+IVenmbPOwmABNdDnlMX4okohZCHFfT6Hiid1gDz2Dh9bvL9DnOVvYDhF0U0G6MeduyHR/1NhszhL+8BuN9fxQpX6Hb04E2+Z1TftVujaZLyeLWqeu26LptlIYuKVo8L60/VEu8nqvmWc1umOh472uzTGgkSbmyjm0IS2tKbwJor6gEgncr6SrD5SA11zBkTMUMkj6eOBD/rQgHLG2xRLTt5dPMWghmANMJ8h9LnQ8U3hP6yaqRexyDVThioDftY8jiCNQMizZzBN26Wl4NTUPc53p6SQcuSxKMfo2GAMoQlitjJcVzRpmMTKUrNFTM1lDHZhcEDR9HNHq6OshavmzEVDuDcOsqxlw73pc24b/LIMHzhX1QtXxG9dXzcgP8hOjmLaK5ENmlPBqqYfMOUuXqQCUK9gLH9XCFWkqS8og6p+EaSAlvEKh4UfIbXGYTmfkAvZzN332fB+vbpe+tgJZEJr+K1vFdHx13tBsl/vADg2zpi3CBVFS44Mjk9QQpXHVs28b/Cm1KqIImr1AO+b9iWYcy7X5RL8L5sBE0CYduW0QLo5obRn8/0Ag6qh2Cam+Hq4Sq4NVPsIIy7vGjOA97EXo93WFdBlgBvGJ347/VU3y8LWgt61UwHEHNdwE4h77QCtBsGQx5bQ3qZUudlLz0ouPkYIIHAFBVWp3estbh2oFGkDgHGIgmB3Bq/psruUgBJT3iIC0OeOSb3i3olZPl62VrYRcA8FoN3iFcfu0L8jCNyb3GBD4UXIXYv5oVf5KKXnst0xvTDw2bGvZZk2ytJ1vCY9xfNhxR+S2PXGRAEPK6L0ga5SscFie1e5cQvzYzN0kIU/JyAkVVrENv7J8mLVsAgFu0ZdPLvwBEFu7xMnrOJaxANVipOjSMsbcJqPyeK/d7Hao+L9TqQTfkp1hMH51vVz8Pqxr34uEYxP9KvmCrJuXZ0RdALIWtUm64Lmc2svQbOrXFtpMb5i/J5lM3nYj4GyH7kLG+w2eO5Hrr9vLDx3jP6Pu/d7665KwE/eHDmbzTmy3oecXZr1bzje+5ChJ3+SgrSer1FkK4PTODK5iYerLVAYW04D7nPRX0zLLU7uJuQ7XkgWXf37YY9vjNEkof2hinMZ3XeQqleC7FfNVyjkXh55hJTKmw4sbvQO4CBJ06an+IU4Mh2c6T0H3uc5wlu7baqBPsJhDBNRiDLoXHxPRimXtTGm25H55PIlOkmJIsUffAsJHM+iglY9v3UtuVokk6kHfOqQPogMELCp5nkq5J1gvDuRHLLv7g356lqjAgIxCijPpQV37NDTdupWod478Ef80UGRTbSJFugalaJfr6KcJEdtgfBInJBj7l8v7FkivMTu8aMDEPAnAMdUQI/MabCNtmb0eqmtZ1aejqTDNSDMJ49ezA8MZEgG36wbKStrjA0TsNV8PrhmyQ0k2i47ca7ZhwqThIKvFTLbOmsA2Yb3Sc2MjLoNaWxaGbqi+lpHF/eZl2mC/40C0o1IFNSqyK4i0wXNDiS9fCM97sB2eYvo0EMXvE4qyTRO2XPqwj0kT3IqdTbZ5491phcUcCjhtvhigtPDbcLXPlmuWyMAxzgnnPcrr0CCckKvTEo8Ul9+CuRA6uD2M+yq9o4d11ZDq//6F8L79gID2Urj6Uo6qMi9EC7QMC0syo7nWxTcHQUDG8MgghvqPVSkMXHVQ++NYf1picOd56F9ADw/ytFJWBrSXtEULl+PslhY4XCm2BrEttjjdn4bXVX2LThpTtpW3FxYNQVZ+100pODxMB7BBXehO9PaBGCO2Apfk0nIfLxzVsrvtoLvL47QhGAVhHeKaFUhX5VVjZwQb+zZDpxQUZZubw5UA6kElCXSNXeEMCvsJTPx0jarWHzncjK+lhas/s7w0dVR+vhTVaIpw1ZCLEyuqwotyweUg+sxVln8kBmZtTM2PKvFMyNwErE60H+mEN0SIWRQU0zQcLcPegMqBK14IDrTuhUr49Uf5I7EhwXtZYbKg6LJD0mbwesZZh8rMwctcOM+YjAdJQMrc53NRtpClobNDeMIoZ8wkRpCBtCdaZaQs+sgMtFrFQi/pwS/qwT1LLZi8msLfOO/bLI/Sqckg3FZds264RnwawLbqXmoySkLzSwbLT1y097W96P1fKB5tB0dB6NWFfCFUr6cHvw+V2Cn1zFVHwXdWzXRwdeAMgfCw07Khd/8FBQC0Evkn+6Ag30uarhEOApu2nAb4c8SHsla583/YM6u8NEgOpXKu/TbsK15IfrmXefdsRoziTT7tOih/HjXxtvOM+iR+Jq6o2Vy5jBP2s/QAnXr3uALqpKXA1spW3U3Euii32X8SRC1phx3BJoRe9dwnyTCtDFGNpPdN7H+sJmmF3q0ZBYCNxHTI+VQahZOXCTBnzT83dUGsD+BWGGYxmZFRvy/yudBo2otxh/eyBkXVW1fyM4ZlsOqDS4txykJlaL1q2WR+vAnyjvMxqC2LMwPmpRIs0g1Bp7O/GO00cxlgI4RBEDdcbobwhs/9sIm7KaVq25LxYQGcUq6C5oHplisdy9SESbLnb0bhhnUON1cHvqVo8GzwHovbVolQPOOtbL1F9kwt1P6Lw9Mop6Sa3fGd3GY+PMMrd20Ehlq2Bx81Uf4rIuN91aRWUE1jbLUNit+wIO5ESZEdR0Qi3h6EDujCJ9tJIokbpyBdXxOD2oJcrvkZdGaInoZdHCTnSpYEb8JFNv4Ic9IH1/2yRjtul0VI/ljXgk7NpnwBn8TJWixzFhCS2MxZ7ddK8sMR8yoteBR1aEuDV2JmwBKF3pusDwBN8hp41yu1astuGTCz/bz5srEpJvp1GlvM4x76Q/wI5MWWG6knPVlFbddZ6xDXL2Xfx14lDFU+OaViTPhQ/u5v3FLqiWf8eVZ6HDfQNnRy7nNxbBgvGV06gFLx93hewnha2GyYK5aNZHfcO
"headscale_config": "ENC[AES256_GCM,data:TYymX7FkLL7T/sx5W4xIqab2ofC7lDhKcw5TvqcmOXNZOpKerCpm9za+PwIp66aJyW6iQz+IhDZWLUTtDl6udjwD+nos0owVndHN381LK2+1UoiLw2U4v1twRiNjFODPEQAYVhXOkpsWq2KlapqMfuPjUN2qOdLqEbSl7w2FK4eriFf31o9+aZVsMiPEl0tr69BpAeMbTFkHmE+81S1bJIMoZg2kWFROe20Zn1ou1uuWUCec0ZDcYRaxmtN1cbwTFwLxcljmNL/mZQfntn7tm4zJ7mKPtXo/bLaz7OJLVP8crTWByS5mnzoEZYpHP0m/nNqALNSXtg9r66RLUrcWkWXYwrHdSgNCGmCS2dZkWAbXXLfLpqUfAqwTZYxRSbbGvrXWv3QNupUsYmL29FNIOXY/1Uxw1G/NxkZrabIvVMrYTRuPdYNIq2VKTB7abtJShenp40VH35Kd9p0x5OsGSpwnJxzx4VMZDrEvH/l/1XLeVFp0AGkcKFUXKx6s+0JDZhS4zIj5eRIRcWFvXvsl7/Y3TilFAz+5/dcqAsYfBhecacFkLxxkMLcYa+APkqG1kCLU7Bg5zmnGhfmS/ASWuf76HGvodu/n/Rm3eFv4ZM7Nd0Kt49CDaNFsEtPlJFigDBfOHyzz6RCpBAyaiRMhz0JO40NRIoyfBAAET7gpPSCEC070KKgJdUaTHohUE2gv9Fbz3uXEt7pBfa670K/Qu7028BjaUa5ZYdQuSWxv76J83VNt3ej5MQ3AiW34quNDZWB5p1LJhlx5Izt/aSbjNcIgK7eQo2BWj8uMmJ3X5ye2V+R578IVaysLXtTfkUpsuH3aGbTTcXDdIHsJaKqesYHNgyyHbQn16qK1Y9ELM2SXzKJcmDZ2nuerv4WBcjPYNhUAZMgVLhCg4FjBHj2GWfbP9QRr9WLHX3ZV+tSz1xfL94aI0YRtemXgsWALsqONk1GR+5ACPKqnMJZMt4ytAcW3UGgVZbtO5AV+haUb33JCRldHWEfS19N3V3MrINfUthOxPMECAvGSSb+2R0gDxUBvj0Fk02vm8HWdAkj1aGFdpTtJepNmC7hp1DwuRDDM3M9QgsrwGAvmhu5o3C7RfgusVEvlakjDx5kY9gN5ycIvQemlGNulRzk429NdKdIGmd2WTeBWXWsVb+onh+BhZ/7RZzCmUAW3wxm4ttSim4498PuyObkUSnLwitokNgRlZEiQUDQ2V/uBXrqSNKNOgxKC6OlTxXhYrJ+2cYYX2C3XmG0EYhj2HN3WcPfIMQDUb5ISvbbQhdRvGxjmFJs0Pt1xPF6LUhc3M+5dHmKza3Nj8ViQFnfDjA7JTPgF9QzBHMS1EOQqFYu1ZQHVYKYTYyEYI1EHAH/tTAjVvUtXpPMKGTvSrj84CvJrBhAUEg8qI3/jANPSbquozk+epAisASfV+I/giFkR4FhxtzZouUyK6ZfWFdAeWmeqscsPfvT9h6jKJ3VgfWRLjB7Jr4aC3/t8JSCw2Oo1SM+dBbvoS68ztj/l4Za5nCiPtDXjeC17+HY2TbfA2gwNF1fdcQLHKaUBuxzJMjCS3kkxzi1gagKTxIbwToeQrxcESGvuxSGU5K0iG2K+Eb0FdKjSDeAPaHheAD6qUpCwVdj7ufZwfXOqkR/tahN67jCcByDZ4MG5que/4QTnBTDIxQKlw6smlzY52DGjuKNlwFkYYCGoE/TfTATdSfjXBWvkTKmYqbnWXSt58I0PZbXzhAd6QRkcxpOpwan99RZNdUA1LOTtxKWToQLvSFDOMm3j8NeVbHvUfBCJv1pLfrGE3HboTTkWl9PPjs4DktxdIGZMnszDr0xfjMDYZsqfZbs5gRzEgLNHwIXrIocmC/gOIbu9dgc/goAqv19KIcaj4PP886heugkS+gMBNowt2PWhzz5irLBikIqtewP7tawJmlTfVG/ekpragbpTXWin6mUrCRNF1x+iD1p7S+9Xxs9+Wv7ztql5gIXgYCm27QCusGVUC5MMMBt/avyESsWCmkJePg1LE2emeIYA0ezugr3D6b/4VDAtgOKSBJL5pDJAGwC1akvePXwFz/BB1XlWcf4rWQWMIqFtYLzjD6qFco2p1lEgd1XXJKCCLG6ByD34SD37Qab3pe0E9xDTnVxHRtScbts6WQx1bLzFx+zhAeRW5RWDw0lcAybgptA/3GGtiwNBKGyqhM9DVf07ltXgAQ+cBjYGatVak8Yhjvw6kROsI814EIEeM/1MuQSwIWqDT7mYw00wTSCYeA+pkHphGetkpqRqKrrv2dTVJeh89WZ9iZlvciRvAoxuQCNodqkrrgGHc2l6O5BBVtkkaRXb0c9+nNwoTUPtHlPtY835PtnBg5l6369EGse4XAzAoLBsWAM5+gFpwLTNNGF7ACNuzRGvnQ20uGq/x7jNgSYx1c143877RuFpoP/AaklYrWT395OIezm9kcoex7k7DxL5SuEd1sURrCTRL+72IUCqLgbQfLEx7muQA6obO2l8HPsmHZ2p91QMeuTCCrK4LjG9dbeMFAaUHUsTD14cmNXUt9B5TTM7uR4JS7eL0w4sWt3lkmXA6KYXJUTXCjjsLuBnUzrTdBGhDdNTdUJy8RqikpNi98cBJYY9XkNmVwMjSofnVHtHjT2RA8m5yz5VZwmWT/5WI6GHPes1PMsOfT54HaNu1IyyQulp9XCHEz+VEMDy0Dq9AfE17JWkWocfe2P7ZCMyCdgeEH1TLg3SFVd/fW9GD5e1xjdG1DQtkBXew2tEhqPZbqnW2jp00Vef/BO3F+g34Q7CqTTniJg9crSbtk/9liZqy3MzemPHdn/HFmMhjxz4MfwvARzFQekwfYafh3/o35mTRj/vHogi3Q4OoAONQ3Y8CE7FjvwB0kV5xxz9jbmX7wzFa0ZTC9sBdGAVQSoblLsCceeFB5o8Jf4NCmdbdbgOzP2Sh/MYpHCDeUaO/5mAOmdiH/oBZWZS0U727D/WxMYwFDc8BCKBQVGmSR+yP4kufWlk6QOVWFpwATnFZq2ldzZ+NiLziDykSdM7/JUB/6W/a4wPiz4ausH6eBhu+rbTNkKWKgI1zdxV6yceWbSxZR/9f1EBs0I6mLO6iUCO6C0qwhGCTLuDC2VPqmRNsbzXBT1XZTZjuvX7oMnPtj3n72hS+TKt/fRUeRwDO9or3fu2+IgZ7dXP88oM6/guUCfGufJV7kY4gWBE+Ru2u9sdyfkHK1epEsLsytfRsE8K4eZBV6Lrgna9v6FqV1h4hDfZ6Mbk/zPRJC/vhiWFV4MVmSLHZtjiS/siojaOOqC8FyPYGL2eLhBiR3v7LC4zZTvJruhXEDqi2pwrIY50c7kam3sMtk8x7x5d8ZwDS2JQrDgCWJu0UadOuUdaEnx6gjynKiYsXf4SVqWodnphWrdsaWr/dShYJW9NMn/+fa8MrPtDOyf3knMyH2G1rqFPTd10pAElBWXDZVmMm6/OpeiLtLw2/aaYZ4yRwWaAi94mWaasAOXfdgqT8D3BD88oyb6AvFu7ZAOqR+JqPUsNSG6fj4Gbou5CSZzzBZumJUYAkX8TbI//i6Pg2BxfcVVjroyw5aenN5Ag3GrPkT4wuXSGEL0DPKz+EFy2YFo+TtQMV0x+hWVmAHFfp15NHOXMDuAm6IQONuFrOtg1djDl6uEQP3FJPDWjTwkwct9ovpca0phEvdhG/vQR7rHYScDBiGX+66Z+i2/edjTDva+zTHfT2pJvPAi9y64sB4icbh33+VNdVNU9OzvB3iUKnTdusFmLXcMwNA+Gt+i5KGZ3ABKLtbVUEGQANqfz7Le/K+LN6Qu7q3HTk/A3/mKuUkzkZRzkq+R0v2wde8GU/vUXvikiVPx2+Y8PChPY6UlP0ZaLOV9cEDuzaev9a1bEsV3gU0+iVh3VDwY/zOYjeWltsETFxHAL8VIqXRfQz7pr8n7c+S/kK4tsr5jtuBoSgLeJPp9rDYLdtYnoSPry0e6RlYIoO2WtqIyfxnNQCp45SP7q5o9j9++UNHujRUrzaanJooO0LCZ3DKwZdZgEhVzRFcM
"homepage_credentials": "ENC[AES256_GCM,data:NazaNjuMjkzR5yII7G7xcyiWOQIbl2qKq9pgJAG28odtoi9g3lhACH2GX65F7goW2tX/E2obo7FqjpgzA8Rjmxoif1FdYJFuoFWb5vT7etTCN0RQswHWwMCvSjQplVxNIRa4pWEfCeZo7tvv5N369uLFTBoJ239tbobXvbjHWuHj/uKcIgzoLAXw5EnhCyrdnntsBs4KqMAi1cvAq5Uj7QS5/zjHvofAZxikga1KUfwL/bEub6ZO4ncheqjyEuzqiADAhK58Qpo3SbcuEc6+0YPIXWyu9bQNaWHhBRJbAUWEp4i87ov3OUXjToCN9DC7T5CMTBWSP8sz9TuYQ5GQAXrt21H7bRXs5p2rZsTrBZj1fGPiD4ZnoyDRgK1PxIzS4J2YtP5+Lsgrj0rNU+wkV0QvHgcA3s6h18/bmbTQwovoZ91kvOsfLQ4DgzyXsU0ZhjayQoghEnISgn8+w7fr//roEv6n+3ZbMt8ic0FuCvZ1DlEt4NOzHEvR1DrPAkuRR5TH8icB9yYa0A6LqU7Kzqh0lYtslQkqnV9QZhhyQIDI4ESgh4RY5lOSWnwR6wtrI168Jucfy9d5BFWENf9PRlka9e1VBR1Yy1UTdCT45MqjO8+wJo+uA2RjWtJD3EmkPar9OArjrvvjd5XdXPG2KhSKQSTiTIOfhC7LUXd/k0leZ2apki1chjkyh3joa6x7wuQ+82bsLYa2pqPvPkYokVWH92p+QaY2/r+JcDNBnWATa6yUdUJhhCP0C0v3QcZOQ45pROLQbzoi3qsQ93J0XlVASiEJtO613DXjZl8Ap6zkn0O26/3LDhddlYzTN+fkM+j8icILvJgA90Wy38ZHrMOTb+9HCiWjft6cLg/zZJFtWFbyuBvKvArBdINyY9jheaFwjrUPqSGNJ8/lw+odTnXJpOtz/cG/+Hlsk6IeSnNCc0Col4Q2Mtw6Wux9sas48cAH7j93pGSYdsjYJDh56rRvTqoUpdMgxHcCESPoi36crNhtM6eEHh0k4JvmlWrSygLd9i2vqV8zsIwQc1wi1Kjtn/zUuBQtJL4H/0wwJQ4MfgwGGDge2bXJ8g/Ur9R7QFXhBy375QNj6SZFrir1TzxlrCVX+0+GdFK38RQ3eK/picbwQMHpmjpEN3GMWMs6za/BAmOqC5xnXyLrqO6dAAPhk7ksPvDJYFJk6zcHlokkGYQtoYl1piaZ2XdOvc/zM6wDzJW570MpX/3SSPIKPZHgGyHvHkjSZgBi4AF+kV22XVhZAP+uRC1b63U5O0VKfqWHWP4JPw/3ApEmrvPBwbE4UFmbeK4hjBgv66mDdEEQewb1BwvGxMl/NoFEX6C8sy646SJMSCbPc6Bw/ylI+TCU0abAffT9juJR/8+uHFUTGguIqcZfR5Apaix8qTOZvTe/Zx3mRoJgg/fSxI8nPCnrs/KAkdM01VcSWL6Tt8oJnwBB0N+g1oA2yO+qyciSN4KzibIzapTd/+KMxobmtC1c0QmWBIxxMjMJG9K5Z8UGg9GSemZIyrtvX1adnf7zi5xKi6HkHGBMMqi14iKMfVSba/SiR5eGwrIm1/uJkWcK/9/JrnUMg7Bu9w1k9NZqgyQMNzP8/7C1g5IMfSNXSH+y0JgA1wphp/LyTK+x8MXN9i+MbQvmIwJASzXEoTZ16B3EhOyUjXoSDYqPInAL0/6DqZ8VriJCIeFu27N1s8k/uVpvSfDr3C1GspZUum4LWMtAke6aD3+C7+ayuK3cEWfqqas4p4Frqo14sX/U+hSlYlPTQtlPhxyfi/IYGy8kcN+i8/twAyGeRXQKo2qRR/bECz+7cxhYpRlUwI0+4KUiU2J7ZOqPs7QI8qLWbGjEOGZLfRP8bAIdC7z+Spo5QOj4/5GENc2VKg3XTITitExr143kfbNr8dBHiCSCDWcC6eJtS+qFLsq8FRKXj2/MdATcjCxG6GBMXokm1Fby5mHmJnG+KUQcClKaO2E8w3Uo7albv9N90JefFGJuSR0+XdU8He3b8oJTX4KTnGWwUbHWhSqkr2hygUtFOU25j9v+886xjavqKpJX4FEVG6dZhiq80O0QEUlUTDheMNSgd61UGGGuTOAguSHhBHiZ/9NwApTyTSECL9HtMVQsk2JdZ9FXlmwPfd9pGsLBkHczysbKShPW1ygA8J6pxlE3oZqXL/qddK7kNkMN+rnh0DGTqsf8VDk/r0FMQxO4vOzKv8XyHJjyXbcDzLoNx1X9H8ebngvT5pDCNrjji2fXxUZfSNqaHhOMflbSIoK1vXsttABS8nX3xr+jpEMgSNgjBfNU549ECm4ZX4+BfJTRcKu1S9MxS57l5o4J1UADUewgl5onbQLuIOS9+YgqIe74O1UCSeyYEiJMEJQ2Xa9Qhwkc5Vru72WivmIs3sMrOoM/WuXwGz2gTx5Yn//feF/OuaDGM+/GLd2fPUsAeKF1hBWytXgOQs+zGyxUz7QKa0GO6jOZHGW1EN3v0fQCiMvLMbOfS2/k6un3vJnPbua8mEgM8wc9qXrrXiB9otfhz4WsvB4/i9KoIhNVIlHhIFVt9T44sNIDCijkIsfk0wKk/KoOh2Fq0x9Rd9ZSItG5hC7sY2Bl6r8ElRghYQvNYAxMPuGKL36TAErJBcoB8D6TsCM2WXCbsaMW+zOyayOPDeLZQ6amBXmLrT+5MayLsGZF6MGRGrA9N+7Pvz6AP+i8sK//BE6yMe6Gasoy9K0forKpb0eUjNwDj7MhrKt2EKD21zKuVIMxBg==,iv:gpooESYVSzZQ+5K/uDqy+poJZ81KYYAf2J//D5Bhl00=,tag:LU5xY0016bOHRBzFvvFSKQ==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:ORfR7ia+p/ll9bbSvYFCfW2kliWbHQWTxwo4st4rI36YhCiXhDVW+dGuaQ==,iv:U18Q1Vn2XYe+WchwpODL2TtT08DhXP0jK5kFg7MYeIw=,tag:vy0OzIYB7mZOZtqlX7yakQ==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:Thg6kGWXgLYHuEGqmbA6cE8knwH+OermWrTQ4f+0DeONyLVAnRuyZNbz1wL7BSxGvf3is7slQ76BqRHOVNkNrjdS+/TXrFEYGz7OnEdbkm1Ktxvb7ES3C42JXYUVmhDDy5lu4eygwoKMacrVUslg44XEoUAxOseoTEgidceg9Nsr4OeM8HWulS/Wu5aCPHX0m9BHCMNpUxz3Xyd3xgBX5mMALwdsdczKy7PKhfI=,iv:QxE0q/+M7NeygCgSlHKQKxqWQ96T9fvS20QPiXfqiIs=,tag:2uK56lmOmW/UCs2KQhoPrw==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:ufLNpIAECP9l5sP2sh/V3nJU+/lM7Gm8ZmSCJRFAkaSGNi8nr5JIK/SI46VQRQwTSkiOo5s9Ux2cgYwg53sL4fo5z1y/wzMkTo5+3FJuNFEc9rlU+NrOlC+6PFSLMYSs/etuunWtJNSKgHurhb1PBe7zYBk/o43yTyPgEK6UQ5X8lUMABdItJTf8n3zO1BlSPe8GLgWIEuilqbykQBFvz7IavFBBKe7vngFSzaJxjoH1xGCoVHoNtsIK6xstaL+0w96A6cLXmNhA/F+pMeVdrMOm+yoM1L5aqswktlYU15Gmp7xJPxDCST82rgHgv2NypY3RR/y5IEZeXWUAtMrlZICQGgIgNrWvTeBYTXY0WwxqJUa666ZVIrcduOUHmwZlnoqyGtuf8e7hayHx9gT2MP2t66xhtmGflBnA2M+E82NV4nI4f8K/ZEzkjEMF1ad7LviIy6eVl1mHeHxGm9PqsEsXX2OdfK073twshvNnyUItbMaNvNHyePrZfTcRfSp0NZ7TYIQktJItt6tk0kw0wRGtqnsoJ681uxD1D38LPEm86Sl+OyLr/X04vO11lJGFkB+LGImNFIzDC3UeBL2SIxsJGmtOVrhiLbBI9NPpFoQ1nAOvSHohVK5VER8uJ9v2dC98WvXzGHi6Bb71xnKhz0o0s4w0M11rTKkCXtUdispfRuoCymevk0sTMEs/9k4Li3emH6tdqH+9rsLQJ2io6IK+AWa54OKJ6yMO1PI7A/B/5rE22pQrzJffvmiMIzs8kvyUnK62rj/rGMTfTVCog+DnJh230qfPDK2cIGAms3g1midogOsFdTmMeooPe703GLK+ks8dTj/qzc0jj5Dc+ed+71Y3dV2QONL8x5ssJG2xYj0wGnoyvAs/4f9nINWmPiD5aydOhQ/WCdu/Zb8y,iv:sAt/m/dsSAbeLxZktazXOLDRaQbtQHl0wQCwbVusVIY=,tag:86HavaVHtv7NICXxyocSgA==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:gOvFTqxBqB6ItEunLxN486aZRImjKNcDHZPrjz8fhMQqtx+XWYftuz5KeEF8h1/im2aJoctuWNwKhN21EHAd6Nt+CGTJn5dE8D8lR6tdrRqzIM5g3686dqtJUaTwvlm5DZwjM9yjXxy0hfaxYkE7xwWGUC524Rnin/qakkwt6kim3NwggEIQ2+E/7lFn6utRyTeqy9g8EgloSt6EFKtqJd1RsHuUHiL1KPsw0Y2IAPW/F+XXkJeVn+r6zUiwrq4pCdBCnGPlfCx/Og2RW61vgnvFjsr5K80otDNuTYTsTcEhftQUIl/YYA79OnJBG0BZajbiD7Fk0tEDamdjjm5IoinCX/iFaH02cmv81R9paFqbpBfiBSQAZCGXLrbPO3YKqOMAcFPz5jDc49jwC0nFH1kgTR5pmSq+BrweREy9G+D3TbCbsbSvLUVGKhqJNAAuR7h3URU0kfmEenjvGpar7W3zIfBrMU4fqEZVaP6VI0CZQmYxXnwN4WyJt9kz0k/FATgsk3NR0aBRmuDELKMpng31o3LmNpgG6d7GgD7vuKvoVPJdlZHxdsz3Edg/YH9uNlg+lykb6LMVaCq2YsxA0bj0rwcz,iv:aWv6vDH4JB1w7C5rGxWK5U1/g2RHYz0li9q7iurVABI=,tag:mPtra6GgsWRMzXwVYpdZ2Q==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:pb8jCKggS1VCGSMZgtHdSNCT++u8kThacHRvY7HxyaggkNuwVqzag5PMATFD178MKNE/d9mNqOHLgWFhjWPLPKPGWypFUg54PBpNBb17iomcgeRTAyWOn2AWMxaOktdGu+kPhVFUJ9F0lZCSRoQJ24QlDUf0c63R1RtwNI+tePvyRValR23/9mm4koM51ls/t4M2l3aMayWKo/r5q40x1jHcXlv1Vfo8ubna0h+KUagtNlI80qNoLRg/bzZEKBzNGohF2u3NVC1eTEL1xPOzOjHddsopr13bcLkhjgnxykzDSZ78/kphRHHNFfovvZC+1+roGAvz7odiRUt4BZLjbdZhhtD1ctYOn+P/nBxE3eW8nPo36ZmKn6DCB7NUOl02uxDCnPOQEvhfY8vtp36lZj4k8Opv1J+oxbP6gvOffQliCRrD4BUV0AmfD1WPwEAqQlaBumA6R3PgTjCnWsewwNItOUN6movrJJUUx61SYh/bgSj6R4k35I/FgRxiUnFFBbTfc+ZBsIbCGfGqZHfV7EOqM1p1hUK6lnCIaxGdxcHWRSgg8Ya+zH/rs8Y+n8T7aQD5asEAf8jzWmb/MWvqEc00tcXFTH7ApNd99wRtoWf357h0GayoQTpzizZQrwiakT3xwpcS4Rv20b873mFYDS9/BOvEZcr33i3jTe1Hkq2nfMeApzLlwF8LgvqDQ9N9Jm22hpIsa7hfFgavLqw3cIl7STim1r+XMcftAD9YRXW6p8tne42uV2CxxNhCG1lTekSMR0GbCA1OFVEiEnh4P5To+IswO+C8afjy0jS/44qPxgdtqnpZhetYK2IZ484omJuMRkrd3t8EDzLt+8MYrBBoTAw9LWSuLxT7EKd+CUsTqoSIrHZcI7it4ivZxCaVkbFgmAIx78rF5r5mxxGBe7l51CEuVbIwOduojni/i1USPOcNNp9nG+wu8FKn5cyDuwjIgxDQ1ljDBBu9yGWwtigx71PyjzSkoaox4YPMBspj+4S20uy2rgA8PF7ybFMLmO6P2FFrHYwbQGx05aKS8PIAOcEi3CoFomK0Or87cxNEVt9XY82B4sfae4tGE9lXxHWIvZM+Ef89izf7VqW9yw2fPIY/Wc6nleeAnRds2fwZruJixv7XeUzpxE20jz6CvsW/FZgmVhr87y+NPh9SbvQNzNlGshLwPTzakQr5sCPYOWok3i6pzIKz4dcYfsK1I3tPXF0cV73+jvTh30DDjUsKEygXicXoUrETn/PbfH/boYuPFy89op0ZVIzlj57uVyQIQQlVKFEN0e4+kEnOklNGLyG6BfnpnIr3BCWPvIdfY56AhDt9xUckyngMRF16Ym/hM10QnwSmFUqQ2aZof0MiCRUiBn7F8dLRJjDC1chy6CwmBl8erjrveMWU09mtbbaiPxbQHDg9HXhz02oRQzgvTPtxZqjrbAUoADS9zItwEOiJvjD4RRAkmK9ca73AGXAP2V4VzL+t56vHYdX/gezojjPDSsnCyaIjMitfw1UqdteO5aURUcQSAT6chIFDAekKa4Vjy7BhDnTgxbgBiNGRu0TBpmH83Gu5mUF/3KLsXxdlgspWDT3o3Vag5AbV+xt2qrPJgA1gKxHKK4o/tjDYrD9X2O92Mf4rkMDnWUB0K4tjaXs2+22JQBUVGamQn1vVx2hgzTkhQ6JIoC/rdZz0pMiOXKkEmf0k92FHa72EukskqeLe5w+HnB8bGoqNsuXHfhWnkn5hdY5g/m6lySonLNUhh8b5vXsIrQPasm7hgy3yoXcX+vtDW8W9VzLFkNAvUKjqXnZHweTzMEemftq8NBP/ThRIt3K90801l2VmGQ4MPpPEySt+qhxHU5dPwh01JL5pMSMYUP1jMB80FlpI0g0Lz5zoaN4go+YgzwBIIOFGnzFiLbI5zOEmcuDLkLarQMTYfZMLYXpY/FLWK+IWvzFgW7uPATnw2xVvBp5LjWztNm6/X4OYIXlqv65JUfxocRi/Btl/GV57eo2AHYxuFiiUWIKB4DfelcFNrHHywsZZPxyW3fBEX7B00wqOyoMkpL/p2DVfkM8R6fybmdXt9ZJKfQWnCiBcDfG32oWoQEWc6lKi1CJrLM/+LYroJHKQkxoEMbtvsDeLpSw1i1Lb7hdQONuSj0FVh6jX9GCqqFf9hOCTyIWhSq/nZaRBzNtxDDJaudFHnf8AGOuRl8Sm3+NeJJpkk2tTFLusggr62MUtsw3XgnXoRwAOX/dQVznpR+ALOdugy2dL5BWlXA433gYZiWabwoUoEA==,iv:UuP45Ex5Gj8cAx0yixp5FWoJTTIz42wbEKBBSLAogoM=,tag:9UjQV43m5C7RUnTycw13vA==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:Pch9KhD1SMoiPU4Vdng=,iv:ZlbMbljk2FFQ7vg8W6GL4/Vz80RqLbyMqhXddybD7pk=,tag:36FaOuzkGBcNkEyPFTXysg==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:KP9Pin5A0FhS3nfqrtLGVhU6WFNcv06ubCDvo+zn31V/UB6ddzTmb5lM9rAyta08+NPGAsICerGDjdI5JSTDNe50jbOV5kC+dXnC8C/VRMsdOL1o/izkgqfrtAu3yfhx98lR,iv:AYcouSMv9hRgRm+pe+fqKE8kvteWpIW/kfZDa2mA5D8=,tag:z0rVlK8CWw1RLMwR66JTfA==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:Ds6U7g6Z,iv:9xEWq1U9BgERj+bzgPJh2VJufDGYFZIycb8l6gO6/uE=,tag:hDnBFXhkCeTk0WtVEP3Taw==,type:str]",
"pve_password": "ENC[AES256_GCM,data:db14aieF6x0LLXdX/JGnzZwJYW552lNLNKJ/Nw==,iv:qljeXTC0qanXx+QiPHXtn6R6adxQjvhRoeNe7/NAKm8=,tag:Ejh2LlpJclfKjMy/iWVl5A==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:1HKspP/FGBA2g98WbmA=,iv:/dUg+wipnwWoyT29rH0HqnbuL0PM7VHP9ktU3mirEkk=,tag:g69afuXzP0GBZB3ztsMXKw==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:NFHuR/r4LcrSgj4KfKz17f+b82ozsbA=,iv:mBwf2tuJPSs1skdMNi1CoBNZmfox3XPoWpyBX6zyCXc=,tag:M4YBehdvPOa2TTL2vUgkaQ==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:dXXsp2k=,iv:gV535VTgcBmUxFedn2atSaMQAkGahS03rbK58HNTVN4=,tag:B10Tb4n5EtH5WpafQUHxkw==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:qOeg5+na5kd+MvnWohJoI1CwXrtR+A==,iv:wy9V43v9VAPluOFTo98YS9idWYbvCHPF1Vb3p/oRCmo=,tag:8IIEXoFX0NCK3hYkIMg7sA==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:f4Wap6ZdqxjLclgpob79M7aGaDMkiLjTBngKZEyakqUh+wG1KlvIv7rh1U/5eZJnHCfmBVzWgyfFcFTVXHGUAak1,iv:nKK0J8lR1R93oX/HiYQxz1BC6PvsdTuXMSTz0zpkh3c=,tag:tOVTxWcmFSfs6hQ1ma9j5Q==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:oHWOb7f1mCmkSnZiaAWOE8M5be/AcrT/QVdXgYWQ5D1nJUvukBpP5feuYFos9I1JLr2XbqtK9JFlQcUWcwmUnxjCN9Q12pWk29Nk323GvE1O+QEXPztasx8F1JHqmmmH/OQ7zGcpoX3S6C3q+SZ0JIHkN8e0lqPZ1aL11yY+van6i7Dqo0DTrz652Gi3HddUXCbp5SauYs2OwGmeL2X24bwKo0Wn5ZwdcF7ptH1wDVfZvKSye51/0Kg13YEefEYTMOlNN6IKg+6mT+tKopRF43JdRw5T1lL2a4EwruZUJMg06uxn9Ek8/fSb8h9JIzWH0T20dF05y0EmBes5kS8oUd7CIYidejv288qoEH8BGFtHf8CtgHlp+e3sXdNx66EisQq7edJYAcnzWU/C5/KhwHUI0VNj3v4c6SH4qOrZSmqW+xNKBJrw7j5N6ETUyadg4ffDtTnvCXgiS9yQ2RMT26nh3kmGVOcBluycVXCzRCqGs5rDkqbqXTOPvTzzeQaUKfEl3NsLKVX7D1xVf614Bykr6ZDV99toZfsU,iv:GP76YTBIHdAm2gIanYtPNDABmb314ah2x13jc7I1s1g=,tag:Ebm4yLwWYRqsNmkq/u+ctg==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:MsILCLGvJlU2EUn5HQJ9F3NFKiE=,iv:GVSt3WfqO7x/+bSp2ThsU81yL+A97CW7KdIJqzRYVy0=,tag:EJLV1dvC01JSpEmfv4WsQA==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:0rd1JMwSMp24OyjduHY8jOX7oLOmxP+A9tfRQdkL7AwV8jdiHYtOVA==,iv:6ihq8PWVGCnoy55mdJk9YdC55urzYl0FiSMKnaJbdtI=,tag:emYhyVdFN7zVaJPX0DlsqQ==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:Forw9OAmGhMhe13f,iv:OS2Ebr8U2BQfO+zJITuOr2sMCr5AfQS5adKyKFCmzaQ=,tag:tEQr2rdQpp/1nytKTsufJA==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:1cdWD40VNjdG6lobEKbUXLYnhRIeLWZAypCaffuAZwTAB7G8b5fsF1nNBp5/Bl1qqeeLtUyufkYzBrM1JeO9Eri5bXshOr7IgnNIQuJ8x09VDO2NMmskEnTCtregjkTuF8GwIKEMjGzAxVU7y4Pbk7kQWCdY4HZjUKlNDaN8nPACTNy4DAv7CA4WU9uSlAPPx+tPTvUvyQit+n35qyF9raihsFr8zDi9HHMpSnbi3HSy8WK/TxuiOXvCja8m2lf0IJ6Fl08mDzBYDyN444W7kUCGARYeSTGiKpx/0mnZ76JLi2vsZZss7yczgACGXUtfPVU4eM4treSmzJBHKjWar4Tp20iS8OTLeP+LioGTG49lD4dGMs4Ck/Ilzc2aZgR8ij13obxAafryxFUG/JrkTRI4jLqYSItYNfUWN2IDeRAvjrdOQhwLDG9piOS1zkfUuAliqL8Fg7v71+k8YJ9vnsQgzMkFYdaYCxMzG0ttPa0hkpi6v3VgXk0ErX4ee7uH406PN0+GD6oAdhTEZ6vDi7mpnQlxtojYv9ASzg==,iv:dnB1cBmIwbZiRp4gVX0ipnVGDqzcOqXt5NsDxgx/BDo=,tag:I1p3xq5F8ehn+86bip1Fiw==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:FcN3wtIU6PFWnmdN4AwDP9fZAhWv8LL8tG+amADzncg3mOJui1/wy+Fs9lxv3y0vQ47JsYsVDaPG3GOfLb7Ecr06BW5SbrB580igm0qH5Gs2Xs+Urv97BWAnIjsaQsZCDmsuYGCuvs3gX9sJCfoSVE+U4tJCuwhJbhqsDlUkix+MXlXpmFB+qO0So5l9cSD3AtT4nEuKDHynwn+Z/B1hop/tp1CWi+BCV1kjjCaLUDjIN43eR+TDc/rLoGtvLstn5L7mGQlKPIJksWVQEPaidi/QF0Jk8yO4CxzxJ854Br+b+udG1bBvTsocNs6nzI1I2UJ/NH3+cUHBvzS/2OL2i8XILVjf4Q+XdvAbPbmdneNxQjf3S+v/ZEPDh8LATcOKulALl3KwcnzbZorglnhRzNR6LXb3ihpRHY6Ykwrkj3j1GCrm7negyhxlPwZfP18gNiwfv1nXeqtWMvNcel8QfK6D5O3S5PbHMsFJOxNz+xGZsm9p2Bvob+520eVLanvxxXar4eKBeY90SakVfdam1jr/YwpVyU658MkEpZXfRNbKO5EaTTdHjEtn2yJuOfJWwahY7uzS6mmipaPhhnH0plpHzKw8ebsUQizJ6OCyY/BHbFNeR0eGRGRklUv7exK7Rz2GhuZOkNpDKacCwUzFr8OCd5LJT2eu1RF4anRAFFOCtRh495jYp+COVcnFwjCQmP/0uR7sYvWCn2o+WbCDMg6COuU/WUROfhkJUGow0sFGdX8g4jNTCdQj2ncuQRlyI+d6CpbsYpxI2tr02uPRxNfJgf8LAr2LoWG3yguCxKNjz6+tHjcTL8Pp4ymklHwSHKVisaB052Qp0+9OpSiTm8tCfPyfY9Vqwt/Shssb+9LzRAJTTL7eD6KahTtopMYNK0rm5zZXLBHbsdrFT5oLj+koo04iMqXH498cjKwzik5M5iip6yOXDK5/PAZzsMQp+kafNqcvLhq3OAvO3Jr8o6QrlSRGVGuVb1KcYeTP+jaFCOA8T+xVx3Q12blxoAAFTHDeVfB/rMvj4EWJ5VqV93OvQP20s4/hoRbKV2B7QO3V8pMNFfgndrRD7lj7YDw551nh2FRwxZK3QMDVd6SY0fk/BUpJ3yBbk8mUMw/gZrpKVzBNYx9d4v8zBLFuV3CuVTZYnINLVLpitlYyIOPFtb83eMAieMwjlP9zq4giLWUYxYgVcuvaz7jTxOPTKx++08oLTdb0aBwIV2/TNlJLql3+9Ak2d28PVHlVv1hjGvAK18DBGiwCp4BZ9pjOBcQuHUbBc6EXNZ7SSY9IrsryYrvG45lWtsmHqBDHAmQHwJcJkdu5o7kW+6JOASfWmJ7Kiyl33MleXZuxAujRmycd1M/PaDhgNi1EzzDr4AqeZGxaxJwyjqIHmCbpDB18nYMQuSNtIsOorsXpGDhV2Qxrhvj6ECF2F9XfJL0ygOVOWdCxUxUSuPdWUty7dE4J4HSgoMZeNvRE6YEGA7q5L8V7X7BIENA+AeTy5ttffeE3B/jMz0F0IOWNY+Yr2SQVX0FymyWUgNCAyRxcuki+vGHFYnF/6HQ44uEhNiCFikNGAO95Nh7QnaUpSSgMpeckhDlbD5xBqEDIsHLm8m+sx6li5TzVGom6dA6i87kuik0Ahkkon/dQGBmUbmQCGDB+X+LVyWK3vAIYibgF2uAikG3hvIsRLaOiBevdnCfQ3ddFG7J10x0sXNEXBtvoDbREQHmGqeWWyUlaE2EjrM/V8cifVR6CZx8IlbxbC08OheNofSwH49ddG6LoWQff3t1NgSO6rygLOHIOn/PqnewIQOdzDyDDuon0/a7f6OCmx6iC64P/FdZgyiC8Yu/UEYQjmfKCKakDa5pZvx+f/sphh8uF1qthMyDHUWFD4RcGNWrps599JlifEZHomojiV53Vc4X6tYf+nSHm0967Y3uWLEj80+IxifUt9Y/SeXBSHQqC6R6slXy+ZDaJUofDg4wK3XYt7hmhijREe07NbYR/+I8SB3c7kiWRknlxlGp3Iwn7SkT34tK7clOJTLkvwpZuzVR13Iamxz+aDy285K3i0WB1fjsD5FcLkMlaH9TmGXZn0fTNHlHZ+NOq0naBreCsMAzzJcmPNIhtU3LB//KY3BDblmx0NGTPhu2ISqTTBuglfA//b52XbzWbDQu8MADTWp2pX6V1AgUYIo6mGPAMQVPrWuu6H6y9+X9K8xfnrJROZTla1hrZRQguhPdCzUb2Or7KXO8U+iLkhCVEs4pl0rf4keSllDB0IgjNKiKd4ixziCFtrdLtagirTVesJ0po9ImdSa2i6hrzQACy4ixAe32VdroOGiYPcTol8QUsf3tNtox7NSc/+suvZWCgK+3tHEXdCVaej73TaROyzDXeBUNMdtwiL7LsNZw4QKiU6W8cpYWQEOrinmqA2E2VgnQYJHVoAwmT0PHSGFwDviGGcbx3Wya5z80hGjBm55Jt2eu543Yi9bfdCh9VzwbVN6XvH15gF96qlBmzDoeilAx0xoLppzG5ozz3pHg6jZRX4oQurSnfgvkp9nRVBMVKKKsKReRPnTXNisapWRVRjXk98U/KgR3nMR4s6QjLy2LyV/NQhR0DoBHf3C/KVXLMYUXWL9VnfUzOqn846I8WKAOovYyOi4YUr5ZX489/IAXR+3kGfSdOev/f2l+o7pCW8tTcHKMCW3LiSn/4d9ymbf7kaZFwh2AA2ZKFtHUqCQP+B5MnNxVbryedQ/IO6/+Uza1IdN/fQ20n84v0dEXnGrcAMLHnFVmHJeMvS9w0t72ZV0KiXf1gUUW7Ak/T265Xl03pCW12f+ZBwhyjE/gy430lEOuSUYrICYyR9eO720HrpdH6B4EI67XZpOIOb+K/WbNUQaYttf1NdS0Tll3N5sCpH/Y7eLZ4X5B73KQuke6NisCMcpKbr3JiObUynyU3IuBUFHtKjkpn5YEL2gswMCauksTo0A7wNaEHR15NyNiZKT6cjxZOyocnubv+UnzSljeTIc0e9uBGyAM8v42+mXX9cn3zbHKMTr/wvm9bebd7oGjOjIlKLZhOwVZTsHck27lsTb5l5r2dse07dfjC9YwZkdHR/sto4b7Hw9LhymfxUwoSUfReDfMLbfarstOI+h7ov0qkoq8G59JjVthc3uLTx1cQlOCXot5yNrLDAUUtlniB4W/uLx9AZZ+bxrTJB+RPCcIWBqwYxi4C0q5p5SsIixfHiOiKWDBScKfTWdyfxwZOkpEVsIEe6h9y/vAax37kotxNIM6xtKnoAvUHg7z5gwILWutyukiRDkOb5fwgKZ95bGwV6Ef/wSCFjbS7U+pUhvJR0EPWItsjBAMy5MKn740/5nLw5IIeLgMqcvew+25jQixohLdRcZ5AI5/JwHd175L1RDVAiMriJWQgzWg4L+WAZpOHLKBBa4Uh3p+fR1e9WxJrdc/yNJ7cCiYpQ/7ey3JcdoFa2D+taCb4zg==,iv:NgxTb/AxqRu1v+EsIA4kbTdpI0Hqje6Hfo+hN4iaa54=,tag:Q8/WZdjKPddOHSZEnurGPg==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:GiBaAf3HTL/XG181txbrkvbFbNctyJwsDBKdYnlGg3Jcc7LUbQhH/smpKUs=,iv:E/UNc7Micui9EfK45GnTOjY65+rdAjeenuJZdY744Ss=,tag:tyzjljyorH/f9BwVL4lolw==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:TEMTayEDDk2SQnjZaPPeDPifJ+0u0Xp4uvvUBPeNwqzFMQWeOxPmYuPZpaH/auM=,iv:3/bcuOS1ldJBcy6FcDJD3C9HEMd6yKKQVFKCSaRpYYw=,tag:nZR3xfsGoATcqlzUEGnZxg==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:1E9FSf6PzxdXG0QSRr9eNesSARd86/6+gJ40LXN/Ufu/msxrZa7UVlklQQ==,iv:lX2IRqiZUkPQen18kCuwHKc9Vv+pHem9kZwq5io40dc=,tag:HJtLCwD/OfPWs5fmyupIcQ==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:Rq752uOq3FewzufdT/B6WXpzL9wg40YVQMroUBo+Hn89uvccxcPZsw3rR0tJGTYCvCnbHKm0C/HzHcs7nM4V7OY=,iv:L4hQJnWnwU+bm+kBR3LYKiSHLQkqktP5E3MVRaEJp24=,tag:k8tQQejl015FRuZ/WBE1UQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"data_json": "ENC[AES256_GCM,data:WxZC1CVOQnney6Ct39MqOB2dYg1etQF3yd89yyj72qTxt2PYrBknwM5zpC+MGXMKrxwXnS+9m/5Eoazmy+jZglEDyLU+aUGBFfCmh88qfQZiGww81fhbVnFnledZBV9BE5dk4QuC0DRUtm//4haZiEerwxy2N85NH3AxESh9B4im2+KU8H14wv9ZHqQOpZzqzaboxXsIhrd8d74w2HlK8xfp7NmUZ53Wk9TzsIgYYj1xGvyXjb1f959E7y6qI1azqtmMJ1LUOhBegH/Qf5HGax+FOyIGwomhCEkvUfJJknq49XEmV76UKZMDLBxjztQiPtXybLJvkW5ovcpbZ/YrKkrTC1vOrwN0qImBOOTrgOq1cb1o6v10sdlIrvXe3HL8V0HRHlRwo3c3/+O4APPWEdrKnovq+NAvkGp32gwAZBwThY0gLBT5zGTetGkqcF62yrJ5ncXa6pGuwz+lajlzFdtNiJPkE2OnSkXY3X2n01lbuRAdVyhjVXUz5+voueEkZFhn63C7Oz6HOttcVyGZvwema3c7ghZy5ZC/yAbDAGx/5vhtl2naKzs9CtWq0rM+hwf04hIPaiwKouQcz9c2JDabecyqDbnFDNNydzEQIS5aeNmeKOIQoeoqqbJSnmaHh8UCLa4jF4NmEl42W+//b7XqwtJMRkfzzpxA0iBMNiavHnhx69vbN5AYYwaxRdeaVINQkbi76PNIhms68WCDBq3QVkS3mVrpfMKORo8on9Ytt8vbHe63pGWN17IE7Vi2lL556mWplSb8i8+kXwTd7wPycr2H9ermLUmKRuLgIU/qOnr3+yiWQ76L4tZR3Yu+w8KgNFUWcVwSzk37UbSef0CmlX3OBuOSewT32pmk55WIVzCcSm2o2vwUmaZEvIrfYfhwzQ/1ZDbw+RNRR6dRO4mRanuahL7PNfrwJPpRbOdfg4NZ8gaD9sFfZbJAfCfmucxnVWsA5xTWFSbUWgcblMUsOGbkDmNJv5SDloGoiWnd/qDb5XN75oZmSUnUx7AjIMG9SA4+nX1ghoHBUBHZfCPu1h80a8wUxOyx2FwWLOffhJNvkZ+RkS41PqrmVIwcT5Tq58mxZ5dAa7VZXCdTkurBPEay012GNL75IHfUQg+CuWjZj77iHQWaQbaeTCrAQza9riiIVN9DrMpxLrxv2OtSoJLtiWQ2y6m1uy5zS4mSfU65h9RelekcBFoCiZXkYp09L9i+2I2t4uU7vm12NzyWXYN/NOU9i3gond+pM4muQ+1vSMPlYBbykWQnevecVdHnOkQqcsSqZxsGkvMZEVHNepYOBXu2JPaJgLREh94xUXDxjZBxvrWM8Qw8L3jbOV8NIkbBG6TZG8VAZMccNUhNNgJ62bheBepdEu/0uZDs0D1DzbYTjuIW5sSJskXflyi7CY9mZvwNYcmuzKh1DxBA8GnHTd5Q2AXWXnNCqXDCpmEST8Z8R+QVbITcGBkQzzosnQt23JhHxC5XcLORIYp5k2tNO0xGxWZJM4tDbKKjCQ9tYO91539LA5VTh4zteUn4+GbKeOQGcv+8t4sCCskDWZU/NvYH2Bdeb/k1AO3FDvLV4DJddrz0I+4XFLKU7X70jUr0ZpEekRC9UNuCNpuj9AYXzaiTdwJ7ddxo6mm5dN4Z9pBf7OM3x+hFn2lAffUOiaTHw4IU3ACSbUtjxMGE3cW4tp6mzMqZF+BhtKLWrqh/lZNAaigpuk34NifQeY3E3wYkJP3ek1iK0Pb1CD2Atnyv8UpF3EX0vTyEs9AZ1YQ8d5372ShXwL85zh6JW4JEqUPbOANUkWkBnfJCbxgHKX0x6p98Qx+wrLvHZdz7nIkjUUFMJTZnxpCSSOpkG7CZuqUauk+F3S190BlSCHzStfbVokZw7Li2DN5kyORfOsOQ0v83pg7/5CVREmIiP8ieBdQe3mftSjSKeSuuT3YscY0acC3kCMez0zvUXJEe22RTaw4EVKU9JGbBYtstzA7NKytthrCjg/m4KQzP6msFPfhGRwieKcm4yvRiSR+xH6elohkMvW54JakHWaYBVz5HG5aNnGbhKcjWJ6h1VhwRDaZ5PiVk+qRiT2aqFmrROVCinBYu3zrig6E3P6WlXubU0Gl841BozZ47TCn5Rk3Bskh3sZNa7/0foAbWjyaDfedZMK2DpwSavmS/xdI8tg8ySZRzsrYLak1pxPTQb771rEXark4wUBIl27owGWere/+LuWQEk5DzTwK+bIaX1sAMyJdIu9XCUXQNLNL4gMkcM1+s9tJadjuuvCBgPtDuqps1vh7y/0IMF3WB2mVnnBTkzOGztIIdvnK0AuLqeAah2p5hxQKp4wYdSyh+WIhYIW0SfSnjdeNU7T6M13e6rE+QWqKz9VotNXoivuRfbK/4mMRrnycuh8aqz51oVnSQ4IG89lKOFlW/fCjVo3DQOZEnMseBcu9zrRGEeK9Fwbdn0JYKHaBcfiQs+tmtS/Dcjv1ih7KlIDeYS0FwBEmKwdayL+vFPUmJbMpQH20RRGM0z45a9+Jgg3/Rl53gvjMRKGBoIhgJuNUDDCi6X30leG75Rgbt+7zgmS2WkBFGDnreAwKrStizgeSu+fDrgYeRZ8BlASTlwnLF0I3ruPIFgyQyXtNdLXHUIXyyxXnEBKql/yWhvV76KLCkkAtpbN505ELuwCgNMP9vJWNCnSwGFEXGxVlWum3tN6aipyHuZzm4SHW4/Rw3YkQ2MFEfJlV3SqDR1URUoh/A7raPLEj+NHIPBDTjPO/2QWKUz70PwUl03wwoJVHz0DzKcm7PYo3e5viqAwxIBwEpjtXp8s7x9DDgsjkTjOTre99UMc1vbslfpzKP3i++eX1hsqWWyYYNyyyxyMqwv+vipXXOmYhBbrEzTkPioDZy4b4M7JMyap45gF/DMBBwKUCKTYWsdqFDUPRA4MVc88AmPabft0xczqb2k3g4ZhOGCOoNgH1YTr/MPTwqaTK3G4K6niyIVqr2FR1cwDYF2FKuRjs+uQ8MtoRClXMcCnFpSoP8InB7U4eLJQrczn/AGBSxXJdicSQMfaCD2Kd46862jDd2iL1jGRaFA3I5YFboSEXyMSHDX7LXFSz86ZPUZpwa7RqaSzyzq/vmNOcmLKaNLDLXShVhS2mloJk+jgERZgkud6iC93tEAVc+4oaWJevqbsY28yTJdvjm1QKf4m5NorSAHVXgRIGweQZEodVMP9eMGLeEORTQo/96Zj44Pw8mK5gLEslbGp0ZVe0ARTzYheJVSglNhuLYlMklLRInevn7WYbOX9mdIZAAPGu1eFXPMYjjXjDUlzGY38gKyfsgaE2jjEiSuMFCpy4yERHyDC5W2boQtUthet2hKXZN+YRmH3mSzDwabmZtNJyi12ZFASrzHOPiJI+A6uAeUbm9OB6AfZi13T3Sz6dCY5Qf0F0oDEPcW+E4qIfmJTHinhA0YJxMfuC+JRUPaF2b6DlYkJvUvd9Kf5Ev9+4lZOrBnGMY1ws+JtqrzNY/6nUrwvTaq2Vykcf9rQqxnMR5TEXFXI0My4QQ0LnYkhQbUfLz8qC+ZgdHuJXN7YPI/ztjmmF0Wl+qytovT8ObiDShK3pIdULoArR3q6diIS5PivHV7DaQfjY6RpfhHPHkW5cpx/o6Nfzo2k5gAfMqYui60OGgNc4Bicmxx4S/zvLgb/ACvkvQXb5wJRlalrBxNHdMUCBhAL2Ukt1VGjYvnBRQ+AJQH7WlPN1B+L3qxs17DKjxy1pYFK0Qol4iJM3HhNg3aCuYjo9uB/dJUem5KXFARfT4txIET8ZEURRQR7/pIQtW7D8h/c8hCPxxIbVR14H4FDFQsiDrKgUJ9A/kFE2adARILR93WboTkQiWdi7GkHT/Xuf/EaquMGUgdtm1bliSpRXy8FL6ghkI5xYCsQjkoH2EzQ39ghl0oG2JUSEaJxRQmMP/mEaNUeeLSfe5jsI5aY+ZAVetJ033fikpb/ypGv6MqsTVwMXwROz4/zXOTlUS8NB97ZHpFrnvDt4xJBY3blrpcEs62MB7sChptzJM23NBjhY2H16+cnQ
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"destroyed": "ENC[AES256_GCM,data:pI+SKpQ=,iv:c0RFFfjqYVBFs0I6GgTq4pcYRY46+aCtlT+CHqD6gRA=,tag:k30htL6pkddcSKZ/OVDLMg==,type:bool]",
"id": "ENC[AES256_GCM,data:v4bgPDlavW+gtcXxrMv8Ce1v9O8=,iv:kjV8WspzTYyFfZbj+rQNfSJnoTX6zeKzNEmqsVe+GAo=,tag:q93+MJIH9uWu/yrMQSobZQ==,type:str]",
"mount": "ENC[AES256_GCM,data:qEvTKin9,iv:8rKrKFWz3tJldcaqokcjW8m5z9Pz5SihQl5APgU27aQ=,tag:AovBVwjDhGrWJ4EeeY/DKg==,type:str]",
"name": "ENC[AES256_GCM,data:H11koZXURYo=,iv:/Myy2LpRRvJwiau8hJ8chmgzxu1I1sFnNMrWXuhIQIw=,tag:mMVqNVLlg2AdGfvHXB4PBA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:SpH/SmuujwBZjwwoP9FoZYbk8QM=,iv:b2cQn4ASwJJFor+KuIfBYlqb4Dx4UggtFNhwnwEziN8=,tag:Rv8KY0mftg6QU5PqERhQFg==,type:str]",
"version": "ENC[AES256_GCM,data:4g==,iv:TFYJ61kwjVkJ4WwQeDL281nSFL/xg7KTP3KdeX4uWQo=,tag:5TrtOR7dHB18MzQjN0qNGQ==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:g7tLJ4t8KxWouD8=,iv:eTJvimHvBT3+9QRdkU7MEp3AutjIgzuc1h17D3HMJhE=,tag:FqPbvw4FMg11p1UcM8QlXg==,type:str]",
"mode": "ENC[AES256_GCM,data:erxT+RcDuA==,iv:+Yd4MLwm9YoO7MzligDaEUKY+FbpJihXgYDCpAl5opg=,tag:njD7h2ySwX+kp1VuWJgAmQ==,type:str]",
"type": "ENC[AES256_GCM,data:aHZo6UBQe4ANVDcQl5W8U1cK+BLbENU=,iv:cBSHcFEJ/KSYASZO5mHzPtxf/4/aQn1Gtb7tGziEO8U=,tag:I8ChQXhGAg413joRHyukFQ==,type:str]",
"name": "ENC[AES256_GCM,data:nRifxSVvurzH16cBe7NHIBcqVHzrBXmK,iv:2CUyKUcNdhJfVL//cM5fu2ESVKdoAZhVXFeo5g+592Y=,tag:hUfRPfEjHM+xDzgTQ4kveg==,type:str]",
"provider": "ENC[AES256_GCM,data:RMbEpA3r3usV6ekO87WsTpb+V2pIHAXBopCeyLCmHST2OLwJj92iM3/yVRhFuI/b410q6i7i,iv:KMRkfN4CWeUU/9n7TGgKkR8aJbUgNx9F9KeLWYigSHw=,tag:rfPIYDKLEDfue4zYl0PR9A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:ug==,iv:BqSVhZh8vXFF4d1LOTjZVRpiouqtaSm3XXYIgI/zsQ8=,tag:joYtx6z43T6AoFDQt7ZZsQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"aggregation_rule": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:1rR3eUZWNvSrEJSZiQk+qoQkM0EjOpoeS423Oxg=,iv:b4Xy59o4r37WOI90HP6Ab6DCvYprNLLEwqLBvojmN4M=,tag:e0IQE/wQgVYgtwVif74qOA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:KQ==,iv:BvnM44P447jigZnQjOJNnmXmLYdvpSxN1g0u1k0MDHI=,tag:9pbp71Pru/g6kEJh6XjPPQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:U9NyDNv4TYtwLGqSWpJELRpR0PWF0+Jrug2c5sI=,iv:07w9VKNXfDHKQrC7eXHU+kEauKKv336Y3B3C+xHNXww=,tag:UMw4/CATFIn9Qn49e6t1Ig==,type:str]",
"resource_version": "ENC[AES256_GCM,data:PGJSmGr2ZvEB,iv:BhXt19SPPXlPjZWfv/PFKDAUK3jiOsBxAgzdBnoVQZU=,tag:QLx+/d4fSPtp0Mb7C1hiMA==,type:str]",
"uid": "ENC[AES256_GCM,data:wz34oadhNoejw4gw6z0rRs6JZo7DSg3Tki1YCCgNzkFGrzLf,iv:SEE71AczY7ek5POT910CYc/cYSUgnc00AIOJJ6Ff4iI=,tag:ZTUbHaMK2q+dvlLdoXUWLA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"rule": [
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:j7f7PiURxqVGgg==,iv:ow5t+/60b3qqqOcmIia4bmuij6dYV2aKJ/deqLpNUZM=,tag:9YlNFcMFJocRgElpQ+7BRA==,type:str]",
"ENC[AES256_GCM,data:HQiB0f0=,iv:884wK3l0vQ+Jp8u/lOTag1r96j1EmEQcb2quiIDyi0M=,tag:kr58/hblK75+XUNWEDKvAg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:tZPw,iv:nQH5VMcBVzgOVXwflBvy5KXkC+1F1ihfmy3rhItf7W0=,tag:6GqrBzc1XhzuwEiPOeTCzA==,type:str]",
"ENC[AES256_GCM,data:gWVL1w==,iv:MiiV+nVeLWqSV4+aBD/ZX4DcLKluUbrl8eNgA1KWde0=,tag:ihN0wgoWuK97j4WdmPsWzQ==,type:str]",
"ENC[AES256_GCM,data:zpi+RCI=,iv:G2FaY03Lnt+dsfp7vmdd1OXGPqi/o4zYXKJnh9Z7w8c=,tag:CwggACL7RrB0WGrqOtO25A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:s69zCw==,iv:fSydwEhTnPvPG0/r212Ii+Q9pWPckboq56W72WNtvNw=,tag:QgWeBteDCBK9q5C+0CGRnw==,type:str]",
"ENC[AES256_GCM,data:xUva4N4eZaY=,iv:3cr7EUUfKBIuqEqxvwq+fMdKFPLAm5cid+4hMBNxCCM=,tag:N3ZZPLYjX3BcqsR9lkb/ZQ==,type:str]",
"ENC[AES256_GCM,data:EuUoyDNtf2QuUg==,iv:XWJhb/unjjy1ETQhRf1R8pcZYIrN/qFwuDhjnq0aZg8=,tag:5aFcw1iFmYH7SIMe/TYSRw==,type:str]",
"ENC[AES256_GCM,data:1EoUYJ8A,iv:3nZuAYOyfbGdWKr3ic6KLBX9brX97ZQJE4JjQU/G06w=,tag:LK+4lMbIsVz19PkbprqWPw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:EYMP,iv:/WPr6UKf/xGwoqxl2dyVMHfxH73demOrONqshahbBe0=,tag:71vobaCmIHxgTM98u8bkvA==,type:str]",
"ENC[AES256_GCM,data:GmWsLw==,iv:HX+7nlnByPqLquGLgpv1H/QpdaTLqXH3QoUsCvxwwy0=,tag:YIi8l8VNyi9YQAftw6xy0w==,type:str]",
"ENC[AES256_GCM,data:TPLlUJU=,iv:ZhHUXtqvMR9/m1MVmDpGcXCpQN5NrxrW95Tt20MjWVc=,tag:FZ7gxfPhuZ3CsupormkiXQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:xpDBPg==,iv:mMtC4CGhyHgjLAF92n/iJ3KlRo82KkAyNiuxjjYwrP4=,tag:0wmf6O4OQwcac/qpOhvrbg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:xRuCPeKtBVwLbEI=,iv:YBnbEBNlMR3pPZ1HfqvPkEoQ23142fP/X/wCJRTA1q4=,tag:k1oB+W6jC0vrVFYP5Z9RRw==,type:str]",
"ENC[AES256_GCM,data:1neBSK2IPYvm3qif,iv:jKmyNwatu0KE0c9ng4EltrNJYcPVxS7FWGAJGLx22YM=,tag:eLzxfj+XWlBwMfZzHmnHYQ==,type:str]",
"ENC[AES256_GCM,data:g8kSqQbIOK+w/A==,iv:x5zTPkYyPv1TogLlrQXhuHT0paBHQKpLd+1Dthc5K6Y=,tag:6Orljfo2DaMrbJCt/SdQcw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:fvIJ,iv:yYkMMEame+FjEVrzBAXrzmHErBJbe1DQFnL06DTj1mA=,tag:mtZ51puo8XPW87ptv/3s2Q==,type:str]",
"ENC[AES256_GCM,data:YZzbEA==,iv:WgFBwuiR40LwsZzsIzEZTUAd7hJd3xnzKtA7GLHDTEs=,tag:2gVe5ffy6IEMcdy8RkpeOQ==,type:str]",
"ENC[AES256_GCM,data:Au9ogWY=,iv:TpVu3Cs1zUis3vByl0WV5diEqv0qkj3fdXmivMlpfYY=,tag:XVn8KkAI7BIMJ7hfWYdE8A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:AZKN1eovv3s=,iv:OA8u7Bfs42t9hi5cUtaFvjX3hzSTxBXwg1KitUgACPw=,tag:hoJCZJJIPceDFDH9bhzTaA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:bRcKzfEcRap0H2M=,iv:koKoqQU3Kah8pOfBQXcEOvvfFzk2CsIPMGI60JikmSo=,tag:i3Q+nKxIqvCmOTe8a41Fkg==,type:str]",
"mode": "ENC[AES256_GCM,data:/6dAzofV1A==,iv:WgKAsFw/vp1tGusFewYn2noob07sJxvAxHatZR3oOTA=,tag:bX4MdxzQ4Txb50QYBJixtA==,type:str]",
"type": "ENC[AES256_GCM,data:r5nDy1umST+r0w/z/rfUzgyXToJC9QU=,iv:gsqirnlfmSlUz3Bn/2ptrmvrVTwTutxxIyicWHbhskY=,tag:hnR7gBNtQez9c9gcWDeJjw==,type:str]",
"name": "ENC[AES256_GCM,data:mSoqkpKiwv4Plw==,iv:yveHn5Gxm0cKJDxsjd/BtI7HzUt7hFXzYRllfwmQcgQ=,tag:jwF+rLW1q7KmvfX/oLfZnQ==,type:str]",
"provider": "ENC[AES256_GCM,data:rOAFHIjHaATRZcINj6ZcHTsXXQHRTszbIvNkWM8pJumDdPTGsGKSBgkiiTb0/TIrPR2jh0jZ,iv:I+F1GL45xsOPGZ8wJNGav38pSal7X7wKaPFXUsw60F8=,tag:7rl1MI419Xdz/nawQyfjsA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:ew==,iv:T6tFtWLGdRtnTvoGeP9P22goTOuIkcKjDOdfUyUPdBI=,tag:vdyJMpOW+tQUYGbbfM0jCQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"aggregation_rule": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:1MwWCyo0qUzdU4YPARob,iv:E/HZ7pveiJscsp5Zjjv6k3KVOQtfDtRuNvWaunuQPBk=,tag:FcIpvjdF0GVSb0SH8e51aA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:MQ==,iv:zBS6AIln4D2RiZFg9hKC2uMMx7QOMsP6+Qo1MNt1XfU=,tag:lOwwTS+LRALFpMDMAkTEFA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:VaMwwPwmJn+cfoxHo/bI,iv:Pu26+aLGu889AiIfp1uz0Wt1s5PWSZZxEsMmZjiQJnc=,tag:hKPyKNcglSTJveDqp4GSiQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:oxyYJybTDrEj,iv:bEUP0zFOwnClNfEKvlgAIhzSJI6QsynqcXYgYRiCVBM=,tag:D29HY8wx80CYY9l8D6WVUw==,type:str]",
"uid": "ENC[AES256_GCM,data:Jl8EmHCDE9f4cOyNuhg49VYiz4mJPTWa1w5RhZsLDltbtGKO,iv:spdb/Bc2JN4d4Ocor4idlsGOAIkmNzcNYkwtfzKHBkg=,tag:jzX0BHan5VJztmu/VBk6mQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"rule": [
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:H8oRJA==,iv:KnfbZ8h8NOEd9gyKw0goedM/mfXnChOPtEJQ7cPni/0=,tag:bgysy1LbRTTIzn0N9VU/ww==,type:str]",
"ENC[AES256_GCM,data:V0xXiQDdHSA=,iv:y9hXNbu/+TdSuvXpmmVFa2zBrDViRvKQVJb8WPNI1o8=,tag:mfzZMkrEbI3YcJuIOmuo4g==,type:str]",
"ENC[AES256_GCM,data:87g/KnZq0swM,iv:CVeY+dNKz8x+iow+16qqboq31TocctiIIBlq4ID22t4=,tag:w4d7d3ReTadgaBEMjLsdtg==,type:str]",
"ENC[AES256_GCM,data:4Tv6TB7Xkdo=,iv:/oWMZO+0lZN0XTIUKDMhxlrzYORfUDhUuWIMiarS8Yg=,tag:rpxR0GMH/R5PAWlHVj9dOQ==,type:str]",
"ENC[AES256_GCM,data:J9vLHb/ZUfgQ,iv:PskagszZXacSRQZ+4sa886MHE6ljs9eyY+LRUVxz5KU=,tag:ZywqurUdKne/894AUfyeaA==,type:str]",
"ENC[AES256_GCM,data:BfADlV6nMfICSw==,iv:xmP5KXdfeM2dBm//muo4Zx55aojona/43dvgmO7tP/k=,tag:naAZgBZbjXantNutwDJrag==,type:str]",
"ENC[AES256_GCM,data:YSIdNxet3A==,iv:+/JKVZVAIz+4yeJrfHOhrpKa2elHOgaLvM8PCQYgH9Y=,tag:QnICXBRguP4Mi0tXKXe81A==,type:str]",
"ENC[AES256_GCM,data:SMVT/R2+FqT94KhVFQL3u3E/O4akqg==,iv:6MREc9d9FOfwTCUsmXjo5ZpJWNt9fyMmnx8G7ekBm1w=,tag:A/hgye2XmV33U59LHTdfuQ==,type:str]",
"ENC[AES256_GCM,data:AQfZdzz6,iv:y6IwkbqCkmKcE0qrKuM/RzEbFdzSyyxJqa7wQObbR/8=,tag:ePah0k2hYENF3fvUTdnMwA==,type:str]",
"ENC[AES256_GCM,data:uaYfk0phynD6ZQ==,iv:0R0gsweHxV4IdrsdAxcnghwJyuUSbuKsyCfBA+G7HuY=,tag:G0Zof3KrMFZdD5cXgZtFFw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:+bUN,iv:j/tjPdKhs5YXEd/GkBAR8dy7+3a/OhIlQfAozJ49jj4=,tag:l1NZyN9NROmJcoGmLt12dg==,type:str]",
"ENC[AES256_GCM,data:go/ukg==,iv:oDpstoCe/gP77rX9BsryXPertral1R1Ixn1Pb9dIa4A=,tag:Qeg3gFgvFeAq9qAsc3ca7g==,type:str]",
"ENC[AES256_GCM,data:2TnVCk4=,iv:y8AdXjdfgT/8t0kLltX5osXG18BDi4SqcQGbnHe8PLk=,tag:WffcKdI8ZhYHr09aQDYB/A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:NuHZ5w==,iv:XRtveoLFcQ9So7+4JktwfQ7Xgroz737lHbwNv/eOMpM=,tag:Y/EwtKQR9r+uGhtzxD/KEA==,type:str]",
"ENC[AES256_GCM,data:9k7zB6Ubzq0=,iv:/Uf4ZWnKp+bv78b6sMiqydUYQyJIiu2Jig56RwFN7A4=,tag:3qbg508FZ3upg5Ea9yckNg==,type:str]",
"ENC[AES256_GCM,data:rv6iqM7j4YJsHA==,iv:iRKr818mW6BIU+6z70yWRhEe3HQqYsnboyXoZcdPvjc=,tag:rWIQ8dhanuJD/jM2SlB6Fg==,type:str]",
"ENC[AES256_GCM,data:LDRi6TF0ag==,iv:SfqwIq7sWAjnQYmY27BVVLcqRPpIZlXqRuFmg6M/jjQ=,tag:7+IginlNNyFg5JFtgEG6gw==,type:str]",
"ENC[AES256_GCM,data:5TVDA1YDvyt6zp31EgKHNl5ZCku95Q==,iv:VTHkq6nLBzYzgBK1j46mFwNpDImeAHU6avkR1YyBpGw=,tag:9yIHdxQR5Rk64cw/5vBgJg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:RaS1K5aM,iv:jH5mhouCT4cxQ5qtPLR8A3csz1QLh6ojnJvkzCRoDms=,tag:XvZNvXuLcDdt7EOjpHOC/Q==,type:str]",
"ENC[AES256_GCM,data:8zdyoMn3,iv:6G1XW7E+IKcI0opNzauSzknZlP4a0lyGKmSfIW8NEsc=,tag:jMvw0mAYgbMcU6xVGBVx+g==,type:str]",
"ENC[AES256_GCM,data:0pFGH5w=,iv:3piryOuqcwOkfb/OWIff+n03KdOiDFN2OdAIA0gwMUs=,tag:zezrdBs+OxaxRhSRcD2GrA==,type:str]",
"ENC[AES256_GCM,data:IgYldDpY,iv:Wtb6riswZEssV1KBQky27sT9N+rDM85fMcxzNsymfx4=,tag:9UfVNVczVF4Xg/IktsvLYg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:iHq9Ow==,iv:OpHlKleq1o5jfhMPrTs5qMde/QyoUNTSIgt27HRG6UU=,tag:9RhmgWweOBTy4ROwYtHBvg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:RqNkaFAfck1d5pw=,iv:EczZS2z5/6idGFZUN+gfgr8z/ysPqYCopkDotuPqEHg=,tag:OnxJbQY08HIL8F6ulCoFsg==,type:str]",
"ENC[AES256_GCM,data:2FuJLK+NCe+u2Z7p,iv:hSJLMK3+1bj+6xPEup5PyzGJMNyXjGHNYdooFPe/nb4=,tag:VpkmgSUlOC3qlfgU2X+ZMw==,type:str]",
"ENC[AES256_GCM,data:yb3Pla5zfQdo8A==,iv:9tIXyECYD7Lg2Ed5pBiEgHrNZXkTaeoLVeNzKMrl0rk=,tag:XXI3spvJ9oTvcVArWSnjaw==,type:str]",
"ENC[AES256_GCM,data:SADoJmZEtS74B5c=,iv:5/zBruSysEQOSQfDUh5nN2dNBLABP6oEhRhYE6WeuII=,tag:KayJAyd7eENaCPZ8RxyVKw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:NmXO,iv:op8f6Il1BvpUHhoBGC9PY6vLbXOQawy3XkK2cgckb9c=,tag:r8pjqpNZtSGx3czLCEm/DQ==,type:str]",
"ENC[AES256_GCM,data:Vnkamw==,iv:2BPcyScb+vjtCkWS5AEvpbeUhMqmrHhVkO+BxH7Gdno=,tag:0HmKolzSyyoxjsQKGAj9Ow==,type:str]",
"ENC[AES256_GCM,data:UhTnyr4=,iv:EdEDcSetfJrT7Y3QibWwEqZnF4yEj4G9Lm0Lk1T6YBw=,tag:/2BE7a2CK1vZyqmJOVVa8g==,type:str]",
"ENC[AES256_GCM,data:n/WZtL8q,iv:J/taj0P82IM2P7ICdsWnqjZuOoMmQAdJQ03LqEVOvPQ=,tag:/xOkmaAslN3ySIY6s9TIpw==,type:str]",
"ENC[AES256_GCM,data:nDbyIAVY,iv:2YFOLNzkOJkzPpwVx99YmXkWwZEyOdVDWwG7jgJB/uw=,tag:4NBw1cY8kKkOOjM8M7tmaw==,type:str]",
"ENC[AES256_GCM,data:/HCSdIk=,iv:bkoE7ZBmgxbW1stqjebzDOZHhgsqDdvZ/xKzo19u1hE=,tag:32YT1mR8R9A0929UWaGy1A==,type:str]",
"ENC[AES256_GCM,data:HDaEATTs,iv:xzGM7evU+3S/3qhj+L1YpTCA9ajo4zJKzu0WOYsv+a0=,tag:o+SBpHrwRucpbIpYZj8mHg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:a3/zISE=,iv:hZ2TqBK6Rt68U1ck43zlb3Huttj2N1d2DPoLu0hd9eg=,tag:jxvEpUZzgfFIySicp8dePg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:GaWdVg==,iv:2fMWyrjO8/mkSBwNUqN5vxyZcVfxirrE+0+pYEgDhYo=,tag:+gr6xLQv+r4dZjgnNFNAwQ==,type:str]",
"ENC[AES256_GCM,data:21GE2U9Is8s=,iv:iy+7VFeOcxPGEqfY/+30/0+MMLurN/eqrd2x+c70MnM=,tag:2kYQP7+W/5h5E66/UYv+ow==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:f6gV,iv:ZgBQcaOCacPZuXWamNDLXf6B0BYGopGAgUDsLh4DnZc=,tag:fBTt5hafCoTDCK6eklWmYQ==,type:str]",
"ENC[AES256_GCM,data:2ytMvA==,iv:gkUhZp/hq3qrXcQhFCTaaxXF/TA5+bEE164ZGN4dZ4c=,tag:QpB2r4wRsSLRGTqPlXgRQQ==,type:str]",
"ENC[AES256_GCM,data:T8NFdOo=,iv:yA1i8XT6zGjcklXhNbFHIDN7KtouAbO2nVKjLiLCB1Y=,tag:nXcN1XqZH+lvgBBqbNKCyA==,type:str]",
"ENC[AES256_GCM,data:6lbV5luC,iv:C23NCynNeWG/0rDj1zc6VMBV+Uc/GAqHZhqdCOHs39Y=,tag:L6aNqrvYd7/KTyCWT0TWkg==,type:str]",
"ENC[AES256_GCM,data:g/HkAH13,iv:wxVZrQLk8WA4WY05s2SIOjaRRvzBg60bU882ucHuVZ4=,tag:VC2rkQ2ydvDDMvv8dTNQgQ==,type:str]",
"ENC[AES256_GCM,data:27M/oeg=,iv:yDSyGN7//SfgxdU37B97CMTfdXiH+Cj9xetmEDz0f+o=,tag:pIW+z8HjjSGxJhNPlxgTlw==,type:str]",
"ENC[AES256_GCM,data:rQKc/l9X,iv:UYTULK1WjJ3xVKNVOkqEw7Gb5KfDty2IjKrN7gt3I/Q=,tag:IYWcWPMXEKfxMj09g6SAAg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:18FzmZ7sx8WmHeQiqGkeHOY=,iv:pVooAldMws60Vul1XTv1BP3m6/Ka0VSaIU8Dc43DehU=,tag:8XUMZmHPaS6lHty2uUpAEQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:b/jOQT7TcGMs,iv:4Dn2S77ersRoFJH7Of/hprZ5g2VBFWwqXM1f3cDXKpU=,tag:hr3oVGUQXL3UdUbBAZ7JSA==,type:str]",
"ENC[AES256_GCM,data:eB3FBc4tWU5pBCo2bpFG,iv:WDd62hvyPFIlbY03GaTz8Rg8IgSUNG8EappLpWHRksQ=,tag:2B7mc2VGb6F90B2Md59m4Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:gEAj,iv:3/lbSUGRnIiqoabYNNXcg573jLaCwnsKvfZNP7rqK98=,tag:4Vgp8cPshEfSCYCEFtnU5w==,type:str]",
"ENC[AES256_GCM,data:O/xkVA==,iv:ST21qZEWz6KNIosZ8cLoYi2biEPg1yrONatUZEeXzO8=,tag:zRHC4evFnzYWDBKZwFuz4w==,type:str]",
"ENC[AES256_GCM,data:dwjsNk8=,iv:4Jl7Wv1ftYssXC9wJlyTmYFjjFXAtO27yhE0kwWzw48=,tag:6uy8HAQH9KQbFqogGkQk1Q==,type:str]",
"ENC[AES256_GCM,data:R2da/ahO,iv:3OlUhmXzATLr0ukHw3abFyKOsc9QHuoczGdjvk1G3Jw=,tag:WBh6K3PkljPYDrP6FS1OCQ==,type:str]",
"ENC[AES256_GCM,data:6+SIuBfa,iv:AY1mxR7fYUlBJcWTGLihWdAXNu21ZId8YKxZy/J2cYM=,tag:WSRhIeQxAVNBmDapbce+Pw==,type:str]",
"ENC[AES256_GCM,data:txXMEhc=,iv:fqXmku8qRZGt3VuOLD1GYwiR70ArpRGv0xMANrFi8oo=,tag:K7bgIpFvIkg/SJZrsb+ydQ==,type:str]",
"ENC[AES256_GCM,data:lDQK6uYp,iv:yGvIekLAaLYnCrPwNLF6k6PxCa8I7hERcpvDtnNw4AE=,tag:aSEgR15wjfPPH7+aZvDwcA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:aA5PtYjoN7YFt2o=,iv:vayVP7vv9BeIH6Sq73iczeXqAiY92aDfgjDH46BWlcQ=,tag:5LzOBT/ab+ClHznWkOrpkw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:sXAQ5x30eK/4PplU2zrTStDKklG6xa5b,iv:ievBxhhA8CP+MxpSe+mNwEHS49lnAivGseSR68i6EWs=,tag:UmaDDQ8nPU97CYHlqPOxBQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:QKke,iv:98a+14c0pvObhDOiYN0kvxZFoNw/ITML0uPoPrpzCk4=,tag:q1ovgObenWiMEmJV3UOktA==,type:str]",
"ENC[AES256_GCM,data:KQJrJA==,iv:bwRG9DsQ4UemzV5fTs+94PyTFVfArIyPc93OldTHYpQ=,tag:t9wWCV/9vMjXwDoVs8ZzTA==,type:str]",
"ENC[AES256_GCM,data:Rbzn4AE=,iv:6ac3iXsnoKbIqNnz/OhPExu/8aIvpQia/qRFvFQj/S8=,tag:vJjoo3uF5NQlFpuAZbOeeQ==,type:str]",
"ENC[AES256_GCM,data:OXTXXe4m,iv:JSEljuFrNnOACZgmSbFvboc9GY7H3+7vZm54DLuW/L8=,tag:E4CxLLMZOohD9NFIu4pnyA==,type:str]",
"ENC[AES256_GCM,data:jXqpFjY9,iv:keiCycoHnA+2I2fKHLUJCu45vO6yAqvXsreY2tjsD/s=,tag:Uhz79CaEeGplud4XF5E0Yg==,type:str]",
"ENC[AES256_GCM,data:Sn5xfqU=,iv:2x4XbFVRh4kNN7WpBPC1yGK/cEEdBd6QSxA0wW6b5hY=,tag:VJJgm4aKldL9zvCSV6wTsg==,type:str]",
"ENC[AES256_GCM,data:BYnPFQaF,iv:s3SCIH1DJFF95LkXU9lu0uSfRRpo5dhMNc8zhc2NWAQ=,tag:DGiGQmKT6CwCrs6Adc2f/g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:vcvoQaY=,iv:D5ugCJJS2rI2aZS27TC5p2AL672zZ+LrspveiwVMppI=,tag:j3THvituDugfDCewX065Ew==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Dclp,iv:+DJWf1jiv66Z75f2yICbMcTLnx3Q7/2fqDfp2eO3ym0=,tag:X9ntfIXi1STXRWWmD9u99w==,type:str]",
"ENC[AES256_GCM,data:44YEnQ==,iv:H7rcxUNDn4BcbK6p301T9aB2TLumzuvWf8uaZeQDfi8=,tag:hb6fMqKjDU3NaA8enkTRBA==,type:str]",
"ENC[AES256_GCM,data:Tig1nAc=,iv:+4jPi8+8tIXdyVg+U3Y4qBNjFHJSOMvO3BiEfFHRhTs=,tag:A/Axh+H1sj1Op6uh9CQTkA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:aoXKboFif0MPVxHcQ8Y=,iv:2LygwKLMLVjF33lbrR6GJsJOta5heLYKrvWEQintyQo=,tag:PPXD4c/XELkBw3v6zoFAqQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:ldZ9N/JYBr9R6q5Yy5E=,iv:DgNKjYSXeVCRpFW6I7GFs1E2d64Z0u7uLv0FUjVWXDk=,tag:Ro1VGTayy3I/Dr0OiALNQA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:MR0L,iv:xke+pLIyh3wyRebMC5zc1B2Ov9uzYO5W/jZ0588+y2Y=,tag:wDhzvcXDRPzV3y6Yf1TjLA==,type:str]",
"ENC[AES256_GCM,data:ztcEyg==,iv:FOq0KdJS/3NPQaf8bbAScYdzS+gNFwL9okmypQs8MAk=,tag:XTbttOY9+wc25BxAkIn4Ww==,type:str]",
"ENC[AES256_GCM,data:weiBo0M=,iv:o0gtJ0zshYeRvJJDcSXLNKd2P8lNhK9XDrRkxtrJGFE=,tag:HnIWF8Mte4X3ldocE10WAQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
},
{
"api_groups": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:s/Om0V1k4HTiG5ss11lzSUhl5I0OztpFtA==,iv:BOy6/jDu3r/cMF5S/ByptXeWKWZL+JwRFLw/lcuSNEY=,tag:qPHsLzb7dvBijKlHbLbBeg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:HYLQdOXQUEKDM3bI,iv:/XiYnNkYs8ZvJqfzscBvF1En70cXI2z85Irte1DcUuU=,tag:q7kqR1Am4bwMKkQYtgd8rQ==,type:str]",
"ENC[AES256_GCM,data:agDP7Vmr/2sMp5kEh+Y7o2MuNg==,iv:cLrU2omJ7qukmGD1lmJxNkHCNRiVgX71kE8Rccx2q+A=,tag:WGtbII538d3s2KqgClo5ug==,type:str]",
"ENC[AES256_GCM,data:VPYmKag=,iv:qPOxVD9Kj2JhzN8uBPP14hEWh9N/UGlOcx8HpzcLioM=,tag:Epb8ohHce8UuL8UxpzIU8w==,type:str]",
"ENC[AES256_GCM,data:Ccy37abltgTmCbAp,iv:oHee/GlNu9SRbJ0lEXstLPeyCwKKZRhsfPqNC3GpcZE=,tag:zStIs2l1JLAGDhNSgViPEQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"verbs": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:JSUt,iv:CSrCyihJfiJ4lYzrZwmMmHPbXtSLrmISg+ESoYnc7JQ=,tag:CnH7Ea5X4atM2t60D5lSLg==,type:str]",
"ENC[AES256_GCM,data:TnH+kw==,iv:EJTGCtO8v7PbqUdazlUFTz3IdkHC8x810NMyI11Jtu0=,tag:ZBjwu0dVcWkQTfvfeFOMLA==,type:str]",
"ENC[AES256_GCM,data:sPcAJRU=,iv:vHx3ECEE/KtjWNJpm75zYPOmyrkni2GAJvxZFJXWm+0=,tag:MRgmdxSrmsmxVvXiUn8oZg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:8tdDNZariYU=,iv:APiA+0DEW5cM/ijd+6jA1gTq9SXVt2G7J9wsNTXEkjA=,tag:eJQ7eDNxLCAc6LvXivHhMA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:NTnW9jpFMGFLntg=,iv:oPeluLquJf7y5wcg2V7kuV5iqdegcUiEqcFkcfanvHs=,tag:F1QwDKRM9UfYLowNezxeKA==,type:str]",
"mode": "ENC[AES256_GCM,data:FmnXwA3TgQ==,iv:sT+Wy+qworUEN2UjSNaRPIM69sKW7gkLsurqTVgA1pY=,tag:wVa8RD8r39lcYDUUwFbLEw==,type:str]",
"type": "ENC[AES256_GCM,data:JomyLYUUTlomHYjCXZ3+1TUjLDrSlM0GlfexYlDIlw==,iv:70yfM8IIMIFn2Uwq8LU4QamyNnIrUAHULePhc2Ek+Es=,tag:3zeVtrc7lq1UlgA/f5zJuA==,type:str]",
"name": "ENC[AES256_GCM,data:N5jiqopOslZBLZU=,iv:/5F8J4bmeiiFUTBzE+aWNFAwQc83SsuP5pbZ1AnUneU=,tag:1iwki+xNyVl0Sts52uyesQ==,type:str]",
"provider": "ENC[AES256_GCM,data:57P96MbsxDnNfgz9CTABiPeydo5qMIdb1axsVBjPIBn1pImRWrI+Wj1J9GmAMsB7RX5s6VMA,iv:V8ry/q2iKQSPmIkgIU1sexfXtYmq2kx+YsqieINsKas=,tag:EfbQGOG4umVsyAOGXVFiww==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"index_key": "ENC[AES256_GCM,data:/NyirIhk,iv:V6fZoHF/cJULrdyc/k0XFKPCQXxnKZ9tsKq1OqG6ce4=,tag:YEQaY7Aarl+kUdgTtPOyOQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:Ag==,iv:g8w2jZdjXZiXwvMBzgLr1gFamozE+Tj78wpYJA4M/QU=,tag:0gI3P3NaS7gKBI20LDaE9w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:SwSvnCaAMZTsIvQaRbXyolQ=,iv:oJz7aXi+boGg6Hml6DLOROJgSKcffqrIwPJlDWKjM3I=,tag:Vvcd5tm2eSReSid/x/39DA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:ow==,iv:hIA27d1QVnAaNHITRF+wT1GwVf9SfMzI4BPCsEDE6LY=,tag:0MN1jaAtz6sITKsUXyTWvg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:ruQCMENFYEwzUhw62l4Wp9Q=,iv:RY8buiYIPRsJI8k6TeYqotL7k1034zQDovgS+VMhCBc=,tag:CPkzdrolMurS1E6ycIVI/g==,type:str]",
"resource_version": "ENC[AES256_GCM,data:CCqvUy5RtrDJ,iv:OZi+v580a1S1GIBhVb/1GVD5DOWQo+VpMlFsrXnq/VY=,tag:ya3wPI09vkAxWVtflLI6Dg==,type:str]",
"uid": "ENC[AES256_GCM,data:NU/VDEHuqjm3N+kpMAiDtHxJxZ+hq80OTMH7lVvs6VHrwjnh,iv:JMT1opMEhEKbU6W3DQbx6qHIH01i4j87V0ZSVhpLwZA=,tag:4EL0570fEDYyTj3PmDu+eQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"role_ref": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:7RiGWp/FLWg6lzAElxWitU45l7MDl6OCAQ==,iv:urT+pDaUKqp884PYCDD+vr5J8mIWDJZ72UoqLJCjVww=,tag:nSP8QSNJiXEr8cvd3mE6mg==,type:str]",
"kind": "ENC[AES256_GCM,data:xEv9CBypEFfUg8s=,iv:HuFF0ZQf3q7WpYuFliYXFlqur4hmseSrcR7U6l8UGLk=,tag:7YbyUbyoHj5DrumOkrwfCA==,type:str]",
"name": "ENC[AES256_GCM,data:AGeaqJR9GWglH33wQw==,iv:bgbyDJYukS0xmvfTgRH/jy2+kYz1ZoU7ZuPU/YIHM4E=,tag:CpBHM5M2IuI/xJXqdTKlUw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"subject": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:ddvIpq1rGg88i0eV6LO5fQ8vsT//Px9Pyw==,iv:QP4IjNIT99iX9Amcjo3s8RqV1ma1bm6kyldWwDdhbIU=,tag:7GUlt4GSjNnx3aZlxDrJOA==,type:str]",
"kind": "ENC[AES256_GCM,data:JzvaCg==,iv:kFGdKSrTVFj/E5OH6xYqTfFBnb1yUG8agh+9vtC2qW0=,tag:R1iEMvpwXUHi5BDISRoqAA==,type:str]",
"name": "ENC[AES256_GCM,data:1hsIMqJKBu7M0WIuoZffdMTrF2oEpQ==,iv:T52CoSrygZHhelqIZGcbTb+ZqNy8Dz+kXTBu8Em+aHc=,tag:OQiJt2MD3YBcyvjnR2G8Zg==,type:str]",
"namespace": "ENC[AES256_GCM,data:AhDi73VFBw==,iv:HDq6KeKbLeer4JmVVGFkQYYHe4e/sxX0QhHJnDdle98=,tag:JmP5EgK+q1aM9Tcprs2UPQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:WWKnQUdqYZU=,iv:iCJIONw/M26jRozRfgIeILme7PpemzXhSqsrdhtKlV8=,tag:E1DLswHPS8e0bGE5ejhNDg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:4RHuiCDjb3FLVvZDMEC6dVC4/mIzXYa7jQqUc+ijLw==,iv:ekgNSqbniAa8qzb9zgcV9D0NfBGOMnvRRKS2V8POXzk=,tag:qY9FZMUeSfUB6ydAR2RZ8w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:4Fu9HIVjev4l+pc=,iv:8WDPLlXRpRMrieF2S5RWPF5mm155leiHyzU0SJSdG5Q=,tag:YwCNoq8YVaRTshGlCfJt4Q==,type:str]",
"mode": "ENC[AES256_GCM,data:dZ5/4ABjyQ==,iv:4CzByiUpq+nsQ5t2s40WSMNtV6+wliSMjurao9PjfaE=,tag:jyiEg4E5xXWJKsRVXInVZQ==,type:str]",
"type": "ENC[AES256_GCM,data:NBMAy/BSLJ1Zw3S7SJYH3trwYLoYrEt5BjgffU9HaQ==,iv:KpGqejB7+QrYVL28NRxAYTCle7a/Mb0+4+vccMC3JuM=,tag:3X1ZD3NsGXSnjmriJkT3pA==,type:str]",
"name": "ENC[AES256_GCM,data:tn7vtL0ERrIz9Er21LC826TWDmTUN6QY,iv:aBJgFDvZWYQRa6KlcI1z1Bpm76E62dseB2xn0F6U+sU=,tag:k0ID2tmwYYao18/NRO4DMQ==,type:str]",
"provider": "ENC[AES256_GCM,data:O9R/jGOXtY2SFwG9vOmc1hj/G2746IMd3RZEaZlQSW4sCZddxzg9GkhsJV5+rTwt1G+A6BcZ,iv:I5uZfraIjIe6upCY9oXaINJVOpYtpiQSrO/Z+l0Oq0I=,tag:IUE9ithrjzy+CjoqvICOXw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"index_key": "ENC[AES256_GCM,data:JRU+UA==,iv:QfX74rUYEtuFNe4fg5DKJ5FKRwtSWIj6mCUcrbzL9LQ=,tag:uVTSULOIh1fn+n4Jaqpelw==,type:str]",
"schema_version": "ENC[AES256_GCM,data:Yg==,iv:ynKOmKWAEO9X5sDjYgIF1zwyrs1B8/xSSrhJIuNo6Vs=,tag:qti+eNy6ORkWeb6r7xmRDg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:EqsXSVORLrhBkdlkXANEAnPWJzFOb191Ivzi,iv:OXDZBfq5gHvkjS6ftrd4wv+LZ5GoqV1cx1dwMG8ptuI=,tag:y3cMBh7MKx8i3C//Jv8DTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Eg==,iv:o7TIDP+w0AENxbsdZNCiDt2ZhVX1N/7lPk0Z8cOckVg=,tag:TkC4kLpXssFglZIDbnkMPA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:TkYpeAObEvGFJyYjDZ2PBdYsJkWhZwfpoYHH,iv:RC5pDjHRQniQG9/YIVcdOUHq3gBuk16YkCLxny+byVA=,tag:QlLvF/U/g0fMxHZF482tLg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:RwOdkp2SUkY4,iv:UXkx+WI7pZlIPiel6URH6abqVJo5OCYgSQpoxyHNZlY=,tag:4If2G38cebx5pRiN+vp+Mg==,type:str]",
"uid": "ENC[AES256_GCM,data:8Mb1Fsts9TnweYPfVDbdqDFLnP5X3T5Mfxx3wD1PK2HRMq8+,iv:5UvPF+myFmLFx6hKOUt7G11A9Ck6sHMb6x/oWDxkoKM=,tag:3NncmQjwKcz5lXLLPTEELw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"role_ref": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:fd6HC1A9Nw0Ge89XuvHuA2u/wFxryRs8XQ==,iv:FWODlB0Mt5NfDliaUEJlmn8pEgVuMGIDc+r+QJTei6I=,tag:uH+5TPPPhAipPFKBwXjMcg==,type:str]",
"kind": "ENC[AES256_GCM,data:nJFnDMvUp7hbRcE=,iv:fhc7rIhIYYz92fCkMQ8ntXWUN3v8o2VcHwiB83ZgiNQ=,tag:5VsSqLefC5A8q+AteVsKvQ==,type:str]",
"name": "ENC[AES256_GCM,data:OUqDQIMELpuKv0lC8Oef9w1qxtD88QPg9ff/kp4=,iv:X2RzCc90Gtc8nCdgvNL7wyMj30puFgZPK1BAA/a8CNc=,tag:f6jLNwSOx8NVconrgo7qAA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"subject": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:bTFhDdi/C8AEktOxwatHFWXtqvj1EQ1FPA==,iv:SUUY2hBoGBP90pnlwPAA+jb+lOZkYotTfMvWB+KhhEo=,tag:xtN8ThT9p8yT+JHwdROHVA==,type:str]",
"kind": "ENC[AES256_GCM,data:laikWg==,iv:u/b0JyZFa6CEREoT/JguRh0NJQzARwWFfiE9DUzAo9s=,tag:Cf4G1b/fct41/TV2booH/A==,type:str]",
"name": "ENC[AES256_GCM,data:0ULZzHzT0J6ZMOzBoqlLxy4opZ/X,iv:ssyaAt9q/Q4E9ZTzUN8yRSH4h3CxbPa67lOts3heakA=,tag:060kuC/Z65GhnLHhW/uqBQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:7ZmoeDCzDw==,iv:IrHisx3LhHe7yv/WlPdSdkXTCTacAPt7ZPYJznYzPEM=,tag:eMWfzWM+ttq4B29AgKCOUA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:37vVUbKoSqA=,iv:y0+JK5EubxZqkUiNfq2lnplzH/2LhPRaT0DUs5hwuNY=,tag:tg+JIyMP4Rrp0fFAg8TAKA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:MlC3/cXtYa00XRhIHr2SE3yi50oxpu1BKQ/e9JgGMw==,iv:Dx//Botqr7Bj00ifc/nu8YSYkMQcXmu+AzIVtgQ/iXs=,tag:twjsYZ+5L50xr4bZTSRNbQ==,type:str]",
"ENC[AES256_GCM,data:Md6WNXt69BvxHbl5LPS+NGGyuyVZRkLvQQrXgONpScc9gqb/oIdHIhgLDExNARKqTKTk7GbvkN01QbNh,iv:k7uERC/A2z9u0EzUNNdEsqt8ADy1faBEmNu0GXR13gI=,tag:9MagiQOjODLFKlJzanJQww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:qcl+M/XoTjL1OIU=,iv:yxHf3Sb28Lp5qlNWgaMRNpDitqQsqfvBqOQLzVO1jjs=,tag:ublHHWyjMj/bq7TmHMQvbQ==,type:str]",
"mode": "ENC[AES256_GCM,data:4BBdbUfVPw==,iv:JcDVF1LjTx5XkY7mcGKFb6+fpjrD7vtGMvvRd7mbOHA=,tag:0zbTeWBjEO4AVpMJ7JycKA==,type:str]",
"type": "ENC[AES256_GCM,data:gHBItZHj0tMZsiY1/5cblXjRsXp/,iv:Tzf4aF+rpF/nUm+Vj0BfGiy5P5SG/uvcr5REay8idb4=,tag:ECGDb0TfKABo/GTZxfGNTA==,type:str]",
"name": "ENC[AES256_GCM,data:RLjO8CcDSfIOiw==,iv:vcbGhQz9FIQVra3SBUDZUfXq3XtFFyc8YuQKlWVFQoA=,tag:6IZgt4WfT/kTgjP6wE3Hbw==,type:str]",
"provider": "ENC[AES256_GCM,data:287PcI4M/rE1feL8YMLCTwwdefFxTQuhn+OaoLY0csPt22FO0Ey3W069nfslF6qCXkTx6TE7,iv:ECsvDbB9SgBqp2oQ1mvHHCdtfVWFEsrlTfynhcgW5pk=,tag:kZcNNpDs6fGiFmvLRx00HA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:AQ==,iv:QnsYvRzte/hP45fWNOgqh0gc0uvdJpOM/rcArwmh7z0=,tag:a2Ce3+6eY1ubrTTgthqVTw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": {},
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"users.json": "ENC[AES256_GCM,data:p0nG5MVwLMaeftOoxpQ93gwkFy7RQ2exayo7IHRJ46bGOKL0cFjugCo9Gq4Jhahxk275Md9HJmSjBuKvEZQ/U+tEAPdz7qWDEV0gJOLj4adghVD1qNw7i8Cun+X5UUk2bdej5F6VKfrW2Bhyel1pIwmmgLydX1MJn9oNznrhoqSW81WlsaSFlz44zoe1,iv:pl3bRIpFgqFhOVOI6PtCcGtjI7Shn6FH9FfyW3boW8k=,tag:aqcmAiQE6z6PPL9ChhDdQA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:DQhvyZMOlrjiYRksHRNpatbBEIJE/gYjlQ==,iv:EMRzgrKpyC64Df8aI/Q4ehvKrR9VIF51pAe/4bfLnLg=,tag:QjpohdaHx2riXMZ620R1dA==,type:str]",
"immutable": "ENC[AES256_GCM,data:ligOwac=,iv:rrt3oJG/ni+ap23K4z6Bvadn8TYc33uy71xYO7FDx6U=,tag:H/yx6aZOo3rn/A9hG0P+QQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:QA==,iv:HWh35qWhBM3ofNZT/JfweJbCRVEiEHsv8lMHWXykTHk=,tag:d0M/cLjFrMvGHVn3yDo3Mg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:EtLaLVJXeR5SprdTDy0=,iv:yFqSCpwprFAbn4xyVmn6pns3kwCCHSiks44A9cJZeaI=,tag:BVffKRYBexguxdQ/XO5hoQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:1860h5z4GHCIUA==,iv:OYhYp0XzXVvWQcTDrfuKQjHj/U96UMeSayvWtInHubo=,tag:05ov6NoKb0OOLB7Wgxx5QA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:Hx1AfpqENh0W,iv:uoaDO+7kOvSMJifas8G808U/Ry+JfHWLmtbzpwkKSiA=,tag:T7yLo61N+FApZjvagiKG9Q==,type:str]",
"uid": "ENC[AES256_GCM,data:kgRgk3xthgWfA/YZHxRVwg6Zv4QY80AbF/4U+wzvRLkTxGU0,iv:ZhNgB9SsQ9sK/+I23g/XBqUMnzd5JbgPSj9Vb2PlA08=,tag:Vzyq7F3L50wrHML2AsgEug==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:DNiSxKJdfK0=,iv:WW+cEL7trjaU0JiG8naFO+qc/lxkW7dkgVhFmwTp4ng=,tag:Kv+j8dZqvfIMPBB/n67hKQ==,type:str]",
"value": "ENC[AES256_GCM,data:RniG9w==,iv:6pcO3dBuNDPeiACHtptyjrsq86MhPYSo3Hbsw53u8p8=,tag:GQjCDDvv3OtBxN+oZa3TrA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:IJ779EE=,iv:HE1Ie2OlbWWuKN7XM/upF4qbrZ08Pa5coZam4387bsM=,tag:MuC0QQAeD+BrozBfWBY3hg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:3dWeAii7aQFDpQ==,iv:vHl/4QFUYC9t84ZYmX1DjvUpTQcJloh9W24TiQarKMo=,tag:id+z0fdiQraDzYtZITdyWQ==,type:str]",
"type": "ENC[AES256_GCM,data:oGG1rOKD,iv:/TYZwTAYLqMLOtkhstI9tQ1GFQsvlzTGD8Y+shlCPWo=,tag:lKwODQBmqaOjxGQXRyRe5A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:rqBqvPbaR0w=,iv:8P5HwBH34gDx1iLebGhO3KibUvdM9VjOoAMi6ryp9Tk=,tag:BsL1T05HG/CkGVdwrkwVuw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:B6HxYhBa9hobgQnj2VQ/U3r8OWx25Jx4VTgdNava9w==,iv:E+LzCSfU3qlaGexTQfkg0R2BaQOvyIHm0Di+MMPpLtY=,tag:lJgqbWi6tSZh7cxIsbEbZw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:lveVc8ljPEhxHDQ=,iv:fofInSvcdnCzNsxppIIn21FE2nNkuiVAP94BxZ6Tkyk=,tag:9sSI2UoWHCv3ftmOdIhc4Q==,type:str]",
"mode": "ENC[AES256_GCM,data:i7az1BCvkg==,iv:gCtuA0mdhTfYiBgb+WYwQQhDOVCAy2NmEofN7ZsdW7I=,tag:efV71fTnJ6F/uHXLMVgi8A==,type:str]",
"type": "ENC[AES256_GCM,data:3annQEenOJGpPc+X+9h9a1fwnjHrG8XL2A==,iv:WfE4vHyOJO80k6vtU89XNC9HfNzkpeQ1vRd31HoTHfE=,tag:F0QT5lrT7iksitgWX0PQBA==,type:str]",
"name": "ENC[AES256_GCM,data:SKXUOBHO2+i6Ns4YUDCYq2BLsbM=,iv:6w06hIeH4veEaUjtIpwZixyFUyM4v2/tSzKP7Xit5Is=,tag:nf8DbR/LYVXEcudYrkHINw==,type:str]",
"provider": "ENC[AES256_GCM,data:xdA8shtVe8AihYBBQ0IDmzR4JBdlVJJzapW7LqZFVy4vI3yQtFcLN6lyd63ZroJmcz6NbJ0G,iv:IreAAkfVpVDq8QjoXGgMcTrwHojIMK19JH1Nr4+hrOE=,tag:l6rXWUBn4IbDK4UPI6qUWQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"index_key": "ENC[AES256_GCM,data:J+Df+lQuvnaHc3eQnkSe2KHV,iv:MaOmImnsROznYQoB4S7LPtAJxEVQSYezPIG3e+cVFuo=,tag:DrvJ6LBLjU2Z4diTiYEEZQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:Ug==,iv:cheroh4HEhLCuG5LlZaq8v4uqctEdeRYUZXnt0t5S/o=,tag:C8FwjA+ynDAeu6pmmDx3wg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:RiUITSbZ/cSGe2W6i0eNkzw7lcPIOsMZ,iv:75z638gYV8uuIuqe8orb50ST0aZi9fouQOzPemXLcz4=,tag:SzpmG+nksRseHsms5LIKtA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:bw==,iv:7I9k8gfrFYfO3J29uBKJ0xVQJ0tjHy46GRRtg6O/eGE=,tag:xFVEVQedksiCMin3UuQCkw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:3ic32WjoHd2X7Q==,iv:csfGceesc6+TCxvQiGzA3syqlp74VNviOzmhuyNREPw=,tag:LcxcNx/v7RC2dDzLWROlQQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:gYWFooYNEvH7BDAlNw==,iv:JYt/K6tI5U6qM0kDgpjfsqllWWyUYc36OY8S2cVSJG0=,tag:peXMfgoLeQV+nfysytedbA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:2tYAQCT8CwpN,iv:4Lfa2c7BDS5SdIhvim1u2r/FumYdz2wNYgEhCuibOMQ=,tag:b1TsquWfv9sBf7pB2K/Mvg==,type:str]",
"uid": "ENC[AES256_GCM,data:wtRmiKss5S9hAHbzptfWtaQwqqzFM+xsqELTPawfGkEubDFZ,iv:2zEfqI0mV+UTSq6mayZ8Ud1L1vtl954dyJUu8dj5hlY=,tag:bfZwb1WuKB5eJBuB4205bQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"hard": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"limits.memory": "ENC[AES256_GCM,data:/LXB,iv:2nO8odhm+c7BI8erLMoBXi6Yz5BuZAMFCCIP76U3Yn4=,tag:y9c0UeWr9TavhNukiyx7Iw==,type:str]",
"pods": "ENC[AES256_GCM,data:jro=,iv:4Vb2jwkcCWrWH3uhwPDvYiQDK6rwY6eWgW/E/0UUrkg=,tag:ZYB6U4ik0vdvQ5h4Jz+7sQ==,type:str]",
"requests.cpu": "ENC[AES256_GCM,data:oA==,iv:MlMzJ3/7FTcWc9OQUDY2C8CdKvQdM1HRReUUhKb9Wg0=,tag:lynJC4blgJhMbsu/enVBzw==,type:str]",
"requests.memory": "ENC[AES256_GCM,data:RCya,iv:IKSh6VGUIy5DR1qohanl/Yb/C5UhC+krGQK2Roj8aQA=,tag:1CyXn3ey4SBBiChYO4zLCA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"scope_selector": [],
"scopes": []
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:0QmXY74d4ykEbLWHnp7CV8tpmUYAKu/e2wD3XTpYdbtL3jfG6CnKrPEoap6xHB37+IG7fnOxTGzvd6PdHatYv9LyterHSvqkF4bOQ0Xx+9DeCFXv77X/qP9JDkqDZaEIFLWUe/3tBrqkwRTDOt8r/Q==,iv:bYjNRLZdXJ4lWQ967UylfwygxRV7qGV2i06lsS3MM0U=,tag:M8drmK3E5AELBX2cWMA+ew==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Ojned0vr1Cy5ZebFlUeRdT4HUNNkKiIBV11OXxuMhw==,iv:lb2l34H0jY0DGZOnP3t0VxQLLW8aQY510iQlNX6VGqQ=,tag:Bn1SZQoxskW7ZN3xTy6CmA==,type:str]",
"ENC[AES256_GCM,data:WwaQSJwM7XDPoXnKrAoaO2ZOj3za95P1mUSfBeW9xaV/papzyitnGjxFVu2nj0C/yLM/,iv:gHY7SJ6V74o2JsqzDbhVR8uxFT+0blpPFMN7SDZ/5v8=,tag:LrSBoLkGxMC9Kxfn/hO9Pg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:jsZCR3oU8ruy1EE=,iv:FgzIuQKbB3vZPbLlpI0y8DrYoFNQZntzP0Y7e+Ou+3o=,tag:V05Zsd5Ac/Sqah9rwJMysw==,type:str]",
"mode": "ENC[AES256_GCM,data:Yerdg7S8qQ==,iv:rW2PKBH9uRbSvsvrPapRhWIpu5RPe+OBbEwXALPWSwI=,tag:Mr3q0HsvG0RUbHVSVrf04A==,type:str]",
"type": "ENC[AES256_GCM,data:Eo8auX2r/VV+1y8+gBJg5zThQn3ktNM=,iv:fFL92ktNFYmlRHL9vgVh4ufGcAJMdsoaFqtU4vxUivU=,tag:eJCTOh0EFduKHK+ep1G2Gg==,type:str]",
"name": "ENC[AES256_GCM,data:RRZ5UnLAxBmwIH5P4lie,iv:8kcEz3SRPdzwSQLzhZ4/4+f4cBEnYYbgbPiHNk1fIjI=,tag:hUM7GyOQG98/q9mdxZekLw==,type:str]",
"provider": "ENC[AES256_GCM,data:31TNzFwngMT6G/NpkW+iA6+jByS4Jwi4Q7dqOnR5loMWMQunftt0141YkZIIbFv1a4Jume0a,iv:YzHejV5xjBdFu3sJJVQ5Os+DkhJ8X5huLmpVgaAbyFE=,tag:HtJ09PY3lBEdlVwOkLma9w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"index_key": "ENC[AES256_GCM,data:hE4LNk6c39m0vNyN6IXF++m/,iv:9Nyg315qyxGEvh5kHZPwvLJc71dAmCqF1e+snGxE5KI=,tag:Uat+kqTX5+/+nUGV8/MDiQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:yg==,iv:66J41/dBrIaLyaBbE5dKyE7TmjGBLG5NlnzGmDVD9zc=,tag:+hB/ILmxP52i8DK9a+NBCg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:ApycEFUYeNUMPiyXdU2WkPkQYaCRovNsKB4F+PBEDUcYyA==,iv:gEoUoTXe5Ylzuz6/c8cxqGqIEmxmEgxXMR22L/c1DOk=,tag:spvSQUDhsVblIs86voBzcg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Ww==,iv:r+Nu/ITs89jtzsYDYkcTp0gtJqGf0HAheYKd7+Dhabk=,tag:27zaacfzvxZgFI90Fk8G+A==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:joABUimhWJ6GTCWKvjqYOO2UCZc=,iv:OMd90+NK5et4DjpwCMsbqAKcXAb713ituP+ADfDzpyk=,tag:COJyhoGMvWqn3PVnbcMdEA==,type:str]",
"namespace": "ENC[AES256_GCM,data:0TZNWM2+oxP2jVxrng==,iv:mAuYqooR1OHmxBBeRxB3zswTCHJAgv1KA0Qed7WQUmg=,tag:8ZPLcCFnMjHPN5vB+dSRAg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:fGwmsUYZR7wj,iv:/q/ykCvp2uO1o2MHvEON4b3X00O2psZOmywoeKeILIM=,tag:ul8DN3vLmmmfaCLC6MMGnw==,type:str]",
"uid": "ENC[AES256_GCM,data:1um7nxsYGu40PxILOAyZ5i4wbLPeQBxeOCF2i+OiGGc7fLJm,iv:29bJRQ1SUWz5th2aoEBiTsewKx+vpwBf//eEyxBztzY=,tag:mA0omU3IRgK9AYAzgJC6yA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"role_ref": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:PM1fww2K6D7SVI65DIByeE4gqDSmXGnH8Q==,iv:H5JSxthlntlOmDYOk8JheuptPomHaVGvGyP5ATR8c5M=,tag:CCPyrPtSuJ3AhmEbcR5F5A==,type:str]",
"kind": "ENC[AES256_GCM,data:sEs/o3uvtZobYTU=,iv:vcqwsW2H4OS9k2TRj3SaWZ3I4hXj7Xh98kNqylmL6c4=,tag:ZVk30BBDIk3Bw1oIylCIQA==,type:str]",
"name": "ENC[AES256_GCM,data:9Uyun6k=,iv:TlCFhZzHjwDqPVzAjUwaVLt6bHY2vOjUK70HvLwvStQ=,tag:5A9u/Ev8wz5w8GHs3zFQRA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"subject": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:iN8Ubx7f8vPV7LG2xhma2EtN0qTh09oAIw==,iv:TI8nHuHekpk75oi79erm9yXO0qcFSlGTVtj1V6ehXss=,tag:+QTEl8kdG2Yut4xdQxG66Q==,type:str]",
"kind": "ENC[AES256_GCM,data:+wbDaQ==,iv:eL9wQj7Vx+UmBXvY+xjiU+ZEeOkFgpGpdx1a5pMLfzY=,tag:05dc+hwwkDVu4mPAp58PBQ==,type:str]",
"name": "ENC[AES256_GCM,data:s4SU9VA0/8PLKxQiWjz++LJeIb8H,iv:njg1dvNjQblkPI+Pfrv9ysGkT3MI4zmq0aHThunpxxk=,tag:6wiRCYNEddmgvNNg3S2wQw==,type:str]",
"namespace": "ENC[AES256_GCM,data:m817cZSdow==,iv:4GIdIsgUnGk3KAebLFKy5uyrLGjFUbYnXTJwRfgJLT8=,tag:S14brFU9kKP5LlUIhwc9LA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:LtBSOPrwfXE=,iv:qyjGf0BTj+oELMhazDs2gM97TEOBEKo0ZOMuqHECboM=,tag:o5Gp7SEEF4iYgrTIQXzm3A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:nHPT+xPovX75IIWXEy8Kj1oXS6tL31hlPvP/g2t2EQ==,iv:bNoWGLkb8W4imazGKBvQMFh/qHbbkkNJcfIJEyL1D8c=,tag:ZR2qSVOM63clLy1drBI0OA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:uEMg8kA69Xu1FrI=,iv:/q1nBK/QsBNYQZsfly0+L6NFXiBNI9y/Rqp3/OSDC3E=,tag:TFTJ0sGAK5ZwBKDYZJVETw==,type:str]",
"mode": "ENC[AES256_GCM,data:FvYQtkMfjQ==,iv:ZqbkGHjIdrleRf9/5Xw1x58rWgHF2y8hnOmC2eiiL3Q=,tag:9j3icu4seESdLJ/KNbCG3A==,type:str]",
"type": "ENC[AES256_GCM,data:hz/rNf6SRhoPU/JJDA==,iv:ZdqeE8+3c224V96kTE7komeLJD8+ZjbDh3Hvbrw3LuQ=,tag:1VdWIbHqF7hPQrlwNtK6fg==,type:str]",
"name": "ENC[AES256_GCM,data:a3sgue+mFMsfPaZsAhNPCaKZ//2k,iv:swddSsqx6LIDE0rLWQzJF+rsNIIPkgNwikjBexyn4Pc=,tag:AYR1HfEyl526WloQ6gksrQ==,type:str]",
"provider": "ENC[AES256_GCM,data:4FpFeAttmAnsuNjurHjfs+Gqd9/jBk0kxWvfICaJmedfj4oWU8WlU9tJUF6WD3pQ,iv:2hMM3uysapD8b4aYE+3qoqtbqn/oOQyNL5OHrwZgFwU=,tag:lHpVj8+PnYF8H51kU43XHg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:kA==,iv:SNfdkfMB8PVOrxZsZ8P/JJ2MlNlRt+4TGCZ4LRJNbLU=,tag:7Tja5/DwRLBubDqp68jMGA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:DufzqBXKWsD4+PrgY/NGMb3tuA==,iv:+VWeKvisNJqT7M719LvLWZd+LP+rbFT/SG4jcKkLEaw=,tag:vlyIxG6VIW91QcliI6utPQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"triggers": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"oidc_client_id": "ENC[AES256_GCM,data:Uv6HnN+PW1WCNw==,iv:WSvtW9Hq8/yN+Bc0luxNlI625CIW+37CLgrAhfpcF7A=,tag:4Y/D0JwlcuD31cYjYMTyAA==,type:str]",
"oidc_issuer_url": "ENC[AES256_GCM,data:B+Udya0LeOOLuRR+fa6fdStHDJ+L9ZIKYellg4jxU/jIhL7b7DojKKOAM5NLToS3B2aTdm9ujxoYJrQ=,iv:cUBXVbkjA67BAQqoYkD+v0Qe6ERAv5c85t7dIn4K2ZE=,tag:ZSZeZpe2KDxSbYY0tL5fPw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:J/4IStMI0dFlL3w=,iv:ovlocwY4ntHjJ1x1udPXxB2mjEiPvSqP1tShX1C4XjQ=,tag:7KLigLjCpvzbJ6uwMvq/Bg==,type:str]",
"mode": "ENC[AES256_GCM,data:VXNNDwG0sQ==,iv:2PTtMhObkmQG1c/La328/OVSdJwkqAw8ICxMoAqeBhU=,tag:+kyX52D1de46JjzK8ttdmw==,type:str]",
"type": "ENC[AES256_GCM,data:zLm6JIPZWHMwAJNWnQ==,iv:a9mqBOmemsaR8meP3Z+cGGXlLlje7ch6wZ/G9AT244s=,tag:/fOJ2PqKonFyuInYMw8D7A==,type:str]",
"name": "ENC[AES256_GCM,data:a4408h70SZUKq+Va,iv:s5Ilu7VCAbEn+s4S+BIumjC0Us0HiXKZqK5HyfLqJSA=,tag:8zO5HybUM2lw4eWE9GaeZQ==,type:str]",
"provider": "ENC[AES256_GCM,data:O+stlzkp2xzRNosYJf5ujGgDhL/9o5gXtkgASyhQ0GpIJLiAfQ5/WykKFMolGEFw,iv:KVGHiAeYO24QMKsalopv8QwfqNzBVUznc4LQxX9Bp6g=,tag:CwwmjLn4SZfm8j7veKLeFQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:RA==,iv:xpgnFA1vbSkM0NDKImWeMdO6KSp/xJDNhK1ulGNQde0=,tag:j88Tlxuwkv7EhofPMKifYA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:LU6R9Qw7nuRzCMAE3SUv1OAE,iv:A7ij+sY5eAzSibRrryJ8gxe3ew8o6dIDhCy3FAYGotM=,tag:7nwxc6OUE+4lTDed5Ux9Jg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"triggers": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"policy_hash": "ENC[AES256_GCM,data:JGo/w+TVYDgLDVzKfFdDXrhBKiuZkFtthbpz+PocEOK7JYWjfPyBk4zEdx2BKBc+cwQ1dLmLEf5576JwRH2YQA==,iv:eRQ6AyCuGZ9XNR0k5x3ZcZoA2Es65IW1gIjfMIiSodE=,tag:3pa1qzIaObiylEH9gtUYjQ==,type:str]",
"policy_version": "ENC[AES256_GCM,data:Z9s=,iv:WebFXo8tZvOfwLKPxk9mRlDA2AApquvr6XFF1EU5Kz4=,tag:q9wq4iokBM0I8RsDfCxHOQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
"sensitive_attributes": [],
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:n2uioT9vF+amvX6KQC/KvDkmYOo4VvZLfNppYLpO5I0s5nvZrwTW5Q4jXoDQ4Ho=,iv:eJc/j83L2L+w0p6IdhhxGwpqtjILQUQIpptFIfPnU4c=,tag:2E2ipcrmqrHOS4ACDb4//A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:Edqb2bMcdMrtmzuXK7C8oQvtmH3eABuzy/B2bVXSHrj5YnBVkmJrgMa9Cm4cnXbQKFLQ8yRG,iv:OcRHcTzq26/X+eAogRnPhGIRzN0Ftj8ImUu/MqOOyY0=,tag:z+MLp+o/NVonQZgC0mPt0A==,type:str]",
"mode": "ENC[AES256_GCM,data:7wBL7fi64A==,iv:SYJjJ81jEPhCWO2hnRms9LGzUaZkfE20R4zLU59nQX4=,tag:oE5FKhm7HQYwFXk8SeSq6A==,type:str]",
"type": "ENC[AES256_GCM,data:oV4mzuCI7L9GLl4NSO6h5sw=,iv:al8oV06Nmj/RjA9pJlL6+CSm3NEYN+NpaFUDuicq7Sg=,tag:h/G6wkxvlbX/8zkqvdsOIQ==,type:str]",
"name": "ENC[AES256_GCM,data:VNbwqg39M5cZmQ==,iv:1QISGvqtUjegIFNB9aQfx/fJZdVhFipvmFGWMXwZsuI=,tag:83GwRhjpzB8OsbvgvOgi2g==,type:str]",
"provider": "ENC[AES256_GCM,data:ix0islvYQmhUp0Q+vvzgdTYbfrCRNTNZ3xosNHEe6jKmZt0uBFRkNE+fWnX/Zjii0xFSBx44,iv:kwQroIuRYr5H4+GduaGnxsKazEuH2q7DFvVhqyc437M=,tag:qcMxsem310so7AZZCM4EMQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:GQ==,iv:p5Hl/wUlZktb+/6p+Na1XpACu2PUfGyrJ+W+LBAERDU=,tag:g/Bu8FhUDWin1cuD5bTAYQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tls.crt": "ENC[AES256_GCM,data:BX6i2v3m42nAZjwl+XYn+tSFAXbmHDW+MGAavgm+0Sb3yRaNvsr5feg20kDdpBaur31OJqIiXpyJGTC5TdJHm7beJbIyjrB/IQtDQRFluyYq+rfUFMg4nbBJHCLlDhskcelJOyCjhN6Muo/Wispio8EPEdpKCUvJwuY0f7CDVsCAioSI27rOh8sNMWftrd1X1W0A7ljtjvMXg2Kdn8d21JOXEWUlWU0BjnjoFi4AQJShwD+NUQxdvvI6quhqzIR4kj8UWhIJCyIodyiSYs0ClGx+nkw0r5HIQ4Iy4VamZ/O0OB7qF8HxIaWRyFRZMqv856UAETUZfZyaM2c8baY2UAONGPSS9N1hhuw2i+hCbjnob1LxXNzTtrSo52Udkw4BNlfyEJASAUvCZvs4tlOf6gxonBvrW44sNjhogNPp+haQeJi1YjCp3YJaj+shyR7pfYCimJC62n+KGm01cX9ntv1n3SpbZsPlc8+H+vxnRXyAzAri0+n4ux3O6C9uLG/MndOvPq6f5XxXLRd07MOXsewfh5nQDHLP17ClxcW03ix47lK8iN01O0b8Dmmm5ASF0tTl0/mIn+RisSwPVPC/hTUBeB2oPRUAFRyvlhfyTa09mV0nhXxYyw0irI3MaOj3W9cOuGVmsoAyJ08lrn5uGf3+nUtiY2BMYFfY9pXPQXqJxg1ib7esjjEh+IdwAmEv44Jxv999XJ3veOmtTZyyFzB5rITvG9p3De43/2H/pzQVRBv+hSsYJAHEuzutNlAkxgBfXfq4zwjX/FNAbqmQWKI3piy1Zdz3S2iZ2+i++5B+JNK0/Lwr1JRwgVP5IL+Sy+x2EC02Kj0OK/AVGUj4Mxy3jbTJDI04+3Xb2tzCpxw0ub70+BUoRs8IQRYHu7kT5EVezEWVhrJMlZKvb9S+x0360HJZuqcUO96kVZnwJwmtMIl+finGmaZZPKtaOFtbc5Skn5JInYZRTYCQvPSU0vZYJb/7dHm97NpWb/9C/NcHz1eMaWhKG9wbqkLq2T6/EjbQHwe8DMz0j9d9CYGRIg+JIfbsnW8W7vxgmgcKDK45/DbRpc676qL/JgikDKYB/Z5faS+wJj9VeC74d3QQbYXx07Cpo81+8HUUdaVU4FI3x43wwf0TRcunoZYU2lTpMUC588as3enJiKFHYSG2PzAXNELwkOjMQls8chQWvKwLNXf+r6Fj0Nz28tLCpTz7r/YDDQscrub4yp9P64bQZiivkFFK/LZcqT+9OvlPettpF1PscPxpSnLYwPGa644oNiarYcWU4ZqWe6ONQMKTGlq+cJSB9E7COBNQq2VgynvByyit5nWTMbT6RgrejowyLaFuHYD0W5Lkfh9qbGHZk6Quc8Tz3SkJT7qDSciS1PTv2Jd9yNdKTJ/J3MEbYPvhNA8HE7Wa8B1woRHX3q9A9SY6EVn++YbxVGxN9W1yJqyM5SGbrd34qSP+KGsGCZ3bQFqIzFyRF1JX4fuPenvjmAoJU+PAtkeEQb+ieXwUaleMTtDbJCEsMELqydouRjqpqIig+61PekT4UaPZiJfKdOjaZVYAsuZD/w8aB2XtTeRCvC87NQb0ODonFud7NXmEQlsgDa+HcJhDeq225p+eJS6itQ1UzA9RdHU2csfUPrXDfPJ8NWvzjGYMy6dJduFqidTZjeH+fVI+LndcWeM65LgLKwL56jEpV0ZJjSjw6x9tdRRhR/HIFLOkXPoJ5DxTDnyBYeJdqqj/2xtAJegWHNIkB7j8t8bH2Nv2yW5hmwgN2khmG7nNgycdlymCvaoZHX44yMTNtcztOXG0gQX6EJku+U9rL3kQC5LYgpOhXXR16OsgNnYFXjVXGnN4187mnPFqcVzrs65NMc5+KMjiLVQPv+mBlODK096ugJYfGtHeJAFjFHrU6VgXuPrw15UQfS/C4udz2Jncwe5EcYLJg+ZsuucFtE+yZg3H7Fm6Bxy5A2C/oG14bMexzbxJCBSxPQdHrYaeo1+qdHQiQR7rEhEaC7SNSKShKBZ/wF7d8u+rYZRCz26p+K/oD/i8yA/kSzzMAryvCYAO9Wv0NmDpFhuud13iQuO5qiw15jeyeNJ2o6zdDKfjt1wFRyA1NdFflxLzMzNm29x62DVVEGhy7gaYjX/13Q+j6QhA1IX6tQMEf9du5F/DdpIWC1vh2UDmP4bmaBDjookfj5mMWKXlFAB5ygHZlxtdpZXnF3PKOK/6hi2CZGMrXKbciG2V5doeGg5UPxAUGKxgMju71YTRRhTYMwqtk/EbLTPiOex5gK4r6/T7hiKvII44StfXL1KBxewH+svVHipp+6kx4pyJ35W0SZzCdwErPfhzXFtTm7dZpM9dmTDOEEgeyMboQPrb/LC55b5P96ZdL0AiseX1q9OUM5kcMshAMX3U9A//JHfvp530pY6bcJI63V4Z3ggfC7+TN6qutIJ/HhrPbfv9xsAB8lENfkjvQDExV6K4GrMjqBxp9xyv4+abb0SdPhbdGG3QzwL7dGbRFZVBfBQAM1vafVip9RNLHWKblFxiJiWpvUx/bOU3R7/KZqcEuYqXSzXSY3clD6zId/FfhxDjS+72kVC/punDricuJt6/yX3gJzSkxL1Ofc9aNt3H9E9R844uZeLebYrzLIHVUzv7TtitN1wnWlLxI6oh6a9HnqSNCGEkDmf4HonnKjASksOqVzTZDOP4TPIEgpBlsTpfUONiUr2ndwxiWRfhU1GfGsj5BlxrZzrCxavQnE+jrggU9p1gZoAwOY8nfYCjsMMcvI21y8MsuCLY6TF6+oRS93SHLJt10ckND01GowsSjtw8Dbsi5P3Z0Rws0Pp1XBtU/U2xlRDkpXomEL+lK6f9+OEE1awTlMuL4iLo7K8UD9oXrCgbk6pi3Fr4Bc2V6wHCezEQFwMWSSISvwMP5TbF6w5NKMDWarBtSYuPpwXJYLRFfm9qhnTa+7BIQiuIOtIWDsOu71uSnj6ij+H90ioWF4lxMwzmlwV9jDSyaFLtLpMKNL2rKS3ePxNkkOCqdT311+cMidP8bZibHw8HzJLjIejAMUmCOMUZ6uSUVOnhIsO7kYASEcCM4kgkA+MYdxvTlyvlnjhKG8WwDPblBzK1YFRbe3zFIyxO8lWMQN2nQwLBq0WnnnHf7pYZzhHhSEbOp9N2O9f/dye49iwvcy02PlNjLXFmf2gbohRkvz/oXP2WX1S0xbq+TTm49pKo+9uMpLaKSggm7i2adWlbfwnIkdbMG1yW2NpIsxMgSMBL56jzs0yELkNYly2ICdW8f9LyEOGSFe0OZP50m25vkA0IZW96vyVZ3nI2Mq6yV/0e56sIVj23I+zmK8/CacsUaQszWRhsrjulqx/PnQ0mDv5LSPeSmvAsz8nwKkb1LaeCcQpbiWvaMD3AKa6XX2ULpln+LzDIkBtFNPODNTtuWQP1/6PHibR7OjWnjrxpbSLnD6ui82sRDSq1BzNCSCl805FsuO7kC+/8oh7jZo9ZXtB8zLAKwK1iU2x5cin+zGTU4ffxFEV8ndl9X3LdH2C/fLSITS8zHtsa5H5EVAl19/OjztmtDuKTLb2EdMSV7P993nnRvsg4Sv5WrDbHPZzlwurKrzWzclMfAd1CRaysjkfl8/DDC1zFsdzoKlGAqPbtlD/79l4lsaZ7yHPCJtK4EB9O8ArXTm7enI+nEFB1JbT1esMLQt1xkTX2H5kd/1Lt0fbo7jemNkL1Kbx+9oL1orEp7Es2T3lYa6VRzeuv28Pei2CXw54Vnk+gDSiJlScnUsym0TocLRkFFgB+YS2Z2dOmjsUqmx06N8BjV8PQDGV4N5LbqELC,iv:kC6os91daJJevXN68SWpGzIOlchn92KgqLFx3y8clfw=,tag:/PHKMFpiWHVeudSTG+mmuA==,type:str]",
"tls.key": "ENC[AES256_GCM,data:zNDw2gg3yP6Qs3oQRJES0x8qqxsuMAQ3hZz4sLwp/CryDSlU8ZPS5O570a6mnR/meQL1+g/I3AGZFygPtzl05FJDrokiLtp78h7wnWZLBrq//OjoHtfUXkMiGjvrAoiv3t83N1aiOz6Gp7bcKzZQ3Qauq1FFiOoQKCPPz9n4VkuP4e91wdb/oica+5qBYxtda+CGw6LEw6Zf8vnUbTv36zhi0fnM2PF99d/Y8/fnfrL/g/X89pdLdMYf26POQBJCiEEcnswQxVW7A1CVI3rMmLkv9oOqpLGB+dDq75icH82o2St2idT6fLJSSjjAT1Wxwg==,iv:B2k4FAmA48zWsakt6jlWU9AUEBfJcu5JzdtcGpIW1wA=,tag:5cpl97Gg0nAJZ/8xLKiObw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:eiTJUu0Yfo/gV2Tu84/OUKb74kISUssn,iv:iziMlmM1HKEyngHD0+rIoyjA59n02YdCiQUjpFuzWyk=,tag:Ln2Ql30RS8PWsdc1gy8ToQ==,type:str]",
"immutable": "ENC[AES256_GCM,data:9J64PVY=,iv:sW9qus1bKxHiboC+SeTpFXLmpy4gU/2T6+rQiTdF+Qg=,tag:bblbG74AbIo4hspMXVkGjg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:qQ==,iv:gIChhO+3kw5+Xz51edi6NIenqSQkWAiYBAFJmuOhk3Q=,tag:Xtm2O4NYkxTrbdhySpi9ww==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:rWDX1dXHPxw6lg==,iv:2Pjoe6h8wlJzrF9iTg0K+r9Y9CZts/yyYiUymcvvqqw=,tag:J6L1BccMLVvjzlFZKRLmpA==,type:str]",
"namespace": "ENC[AES256_GCM,data:7hZI0iFdQxytPOpYJA==,iv:z/D7rOZvweCAPGKBBO/b3vmPsGh8cUUUuQzAsgvvNo8=,tag:cS8gNuCa0Ra9rsGk714QYg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:Q77a97p0VOBW,iv:UKtI9nMnxuJLVHj7T+gKORlHxPIvZsehrNdols7jirA=,tag:fOtZI4AAW1NjCEzNWz6oFA==,type:str]",
"uid": "ENC[AES256_GCM,data:rXv6/j1oCTpUGfMuvOranTS2I7pyIjlEGGbOz4szDklgeSMy,iv:JPMqxqpnyjBsrwRRcCqgaY6fv2XPV4WUqPyftTvWPA4=,tag:WS9csC6WodczdIaYttJgZA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:9UWH4Cqyz2vXLOVKHhyf170=,iv:MtoLoAdvsJ5QPiwh7Oe9VKbV4O0WFy3icDOuQObYAV8=,tag:5iv/TRF5bPqHth6kxuWBlQ==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:RrLmMQ==,iv:dPxC4Srk4MvHK2urUQg41DkHjdAxVGMFmdwp/5z+1Rk=,tag:8Iv2mIBC8C8cKMwlAK5R6g==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:nEIXz7FySpoGTgBYs15Y7a4OWyiIrDQDo5Iz+0Y1ZSQiRE+KHNvWJuKk5jdZzDHcCen0FYn4uj5G5fP1FAIEq1/+/++e3PB89xl3S0AItA28b5F+,iv:zsgQ28E7fHx1C4O7ateiC3tXKCQTYTkWMLCMvdXPhJY=,tag:RPJZpOoLefdarGK6dR2GZw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:VOajGspDA5hH8aS4fnPuz4eHcn7icEFLA9AJYVPXFQ==,iv:SQGIk0SWXgRxwXUbztie+JRWBq+zrJIl2jrRSNs2bwc=,tag:xWwu9kDuRnucBfVtwFWtWQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key_name": "sops-state-rbac",
"created_at": "2026-03-17T23:05:53Z",
"enc": "vault:v1:pCM99qM0YjzEKpvwrWwvbzXDr1CBAiD8V6H0o5qyYw/8n7YLvcZ60QtyTofg4C+QwdKUN1d/GfrnTA4b"
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUZEx3SzZjREpRdkRPOURQ\nVkh3c05GWVJ3RzY5M3hjbmptTG1qbDZWY0FZCjFFcVF4R3ByVWdqLzdZVkNEcFFr\nblZMV1FMeXl6Nk5SVmd3UkZFQUgvRm8KLS0tIHZseVZGNE5kTEVaUkdKK3JxRFQ0\nRXN1U0h6Szc4dlA1cG1kdWZvT2ZrMUEKUBzRBgHxcDBMw2LUPkW6JiQbUXMZQMqV\n8sS0n5OqEVngHuxZjLRIixNXxRHSEVKszANZHi/8N+ThA4vCQIEbWA==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxN0NLZ2JzTkwrazliK05M\nbW51ZWZJSlBJd25mN0hOem9sa09WL2NWeFdzCjRCek9OSVFtM1luREthTmZ5Mmhm\nMnhqZlZ6bjNOYUNuNHdzejdWY0pOeFUKLS0tIDl5ZGZWdUFwL2c4QklkVFE0TmhF\nWnBVM2V5WEhlanF0TTk0QmEyVTlTVzgKElWSp+y6vih5jCc72Pms92H9nG4An8xt\nz/A+m5ZMg2T7QMWloPaArCVdFzGDaA6FJCpoKOen6dxXmtneWOee6w==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lastmodified": "2026-03-17T23:05:53Z",
"mac": "ENC[AES256_GCM,data:3aGC313QX3o+Ya0sdVlYETGgoW9nyPxYs+Pku8s3EKVg1ardWjVFX8KN7D6ZCpx8Nq1DZYIy3/OVxUWpvSuZuXT/SeZYZM8jVnLFvhrZFM9itCuZPyle6wP3+lzGNglvh2fvw8OCEryvmQ8EbPWUM/Rw5xxx1/AfkW+gBaaCGNc=,iv:YWxfGfIbiTGQQdjUVjjkNjwwNCL/MPS3G714vpNTjmw=,tag:kzQRUvY5AKrs1cHmubrcNQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink