viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/state/stacks/xray/terraform.tfstate.enc

1016 lines
150 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"version": "ENC[AES256_GCM,data:0A==,iv:C1I5+i9GxEay4ZZI/ssDGRl82+h3WNNDlKpHMzxV8bY=,tag:Fp7m9E7jlTEETJCUoF4hRQ==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:tAgEWPI=,iv:VWjbw4SfYQkTBQId3kHTF7FOUY9427qOPjwTwWjhvFQ=,tag:BJegwGk1WwuZGQw9+Ztbgg==,type:str]",
"serial": "ENC[AES256_GCM,data:Zw==,iv:5o/X5L8TVdmB4fA1FPFyooAVXLRjJ/mkLhwhjuNW1xU=,tag:TG1nDCyXfd89PY2DCojr6A==,type:float]",
"lineage": "ENC[AES256_GCM,data:RNTUYNGAzMnKXerzh4LxYkrX3qjrwHjYscVD85ahJB29eot4,iv:Y9lZsZS03VEGZPBv/xedndhiyen1gjsOOpKAaVJHs4c=,tag:9tgiGZzpFgXR8Po7ZWqPMw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:Yvph/Q==,iv:RA3A3Tf8ToEyI3Mbrh62orKGP78TnoDeY648Uw2MKlk=,tag:chuYd8Sab1mTVIx+fNkFQg==,type:str]",
"type": "ENC[AES256_GCM,data:n21ADeT+RbduMJllt/UtY1jy,iv:Ly6Zg9llRwL/jXa+r6D++oIK5npbWmBO/RhG0Lsk5jY=,tag:JvsZyMFvkYfQqUwb5rH1+w==,type:str]",
"name": "ENC[AES256_GCM,data:9Rvfd2L57A==,iv:nX+KWeHPsYcskMVAdKmQtRL5w8ms63uqPcYOVBAx4L4=,tag:42OB5pa2sgEg9sC/ENGcnA==,type:str]",
"provider": "ENC[AES256_GCM,data:23PO5FCfhfbB4j6vURLGh/5u0Ehri1LRhZcmuHuq8CuaQKWil3IpWCLE1pmxB2u+yA==,iv:PkFRPbHWZomfwNL9pW02sGBAQ1RSyNdq+1CeuIGRO58=,tag:R91ngd6/iPmsUkKm69rwrg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Tg==,iv:v/DTdQLuoBpcTWEq5lFQKYOPzBefGaX+f3w+SxWIGxY=,tag:nP4KIWTcsiQoW9+zodeRhg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"created_time": "ENC[AES256_GCM,data:9HL7cA99xGGndixl8Dy9xH4e5nZqf7++mHkq/K/7,iv:JZ9bFpDIKKRF8Ip3KiGSwTLMsW7kvTS8/D/ePRg2ps8=,tag:1xVNz10PTXkqevWRqyq59g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:J+ZT37RkShi2AfQcfRK3otvbD0s=,iv:CZQYRa4OYZKKxb36oQRAmkDfEmkXnZx9laxGNZA3Zl0=,tag:ZPB0uqjrkNjqA7liG1YdoA==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:jMIjaH6dpMe+cG98SFJRSFn29uJtF4xGkMdeAPaascuyiTsASFU3POeYlYgi/cWwqJrKxruo5eF8JSAU7L09ASEpJ+3p9SA//q0JK/c7IWux,iv:eTDTC1eo7KkS5WnsPvsPfqxTD9085G0KDGdTMDQiHPE=,tag:02MEJE6R6bYf4PQjq50ovw==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:tuuDMl45xt4RluNNSSAuertnGJugYEUQHvjV73h3fIUojuAdpZYl76acYlIiHgZSoQcV1tD10i2OWxeA6n/XVtp2,iv:3ZGdV2kXwbJCDjRDAoq+8Gg5jNcPEunlvcQW/QlAfzM=,tag:UblG+9m5UZjDfccdYwO4YQ==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:PRsqjkfVN3bh0mrS/v5Tlg==,iv:tLKnGqXIY2aB5PqfQ9IqL+L6O8lr3nnvEwSSDWYebp8=,tag:9ciE7ZxSTasxz4bz83OlCg==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:Cw7wnREHSU0va641RP3LzLGOCWTWPl/gb6Ts4Iqq8iLX/9a72cdYIyo97kZGw85v1pI1,iv:QZ+bFGtjxwXZ3EnQsftG6e82kA3LIr61jlP6yMY7Ybg=,tag:0A7dbWVdMfZOTYPfljpjKA==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:HkyQLMjUH8AzbVUMGo/81asDBc8qFc+4uSq5MIWyeI0uJpk0ug==,iv:leyZrbpFPWkcJWgTu2fqv49MlTuTReIMSgCZtyG8WM8=,tag:AVDRFjQ1QMQyX94F7rNOSA==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:qAZ9cVDF/MEW7FEG6HGcI3oxsJ/M8QwkOeQyHg4ni1Bfwx2tp72OnCGcoeqPYT1+uy5R4VD1eRYpnpCCVqqXSiyItUTbc0J/FlgyepoGWzKwP1MBiWomFwEth7AB4Kbwc6yoX/9UMXz5/GpjDdq+ZcIHYrNepvE8lksGgobt/Cid52CsG8pjTept3uB1ihs+1V6LaWWxjQEAV8mup9zNAKLCeUh1FBFInJ4wOMkaz3tBp4AXepNoOQ==,iv:ZUQHSzblPba7+GXV2cWvlEYg5gDN4NnW2ocX06IhjLE=,tag:PcOxar/hi1/YddsoHsrQPQ==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:lQUChtT9tz2Esark3EB5hALBLFDAEAZ5yvvTXCmqacX7BxADEU0ia6/Icg==,iv:4sUT9Cc1xAWxZ27cnbRD+pXPZ2jSNfs0Eut+ov3//qI=,tag:4sLwAWUEFZ8FGxokA1u1MQ==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:yyUVaj/oadOsqSK4yyqOeDUK9p3k60LLPlEkAJg=,iv:2NTGGmEbaoT4OQY989mptb4SJpNO5aBfUAgi90TIjYQ=,tag:73Xn3+nRUeoeV2SDrR9V1A==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:QXjG1EFlkFogXVTFdi1ws+/L2C24YZydTYubcf6jjg1ADFJAF5tofLX8JZO7o9qH36c/4RYr0Goz2J45sPOsIw==,iv:enQaSlLoVKJLThQCxwOPJOKiEEbMMcVXlbVKJkcEX/8=,tag:59AYv6VWsiYtx+TuDhFeSg==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:3m2QJEKIOpPp1xUXqng=,iv:sQTt3k3V1nBpSmo0SfduhaHLJML3Vk1dLMgMgSCCHV0=,tag:O+bc/8/lLsBI/tShBh43gA==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:3UAZ2VJ7kRWZMrz4ujf8+HWdrHH+WrudNw==,iv:zQJeWgxGM1nzgSCmgPhzX8e1cVyFSFx2H7pGMEQ2oAA=,tag:QfU91QzeU8kr2Ipa6yNcLg==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:aVDNoRMQ4RljyTUwksRsx4Yqn1r1FCwXttqbuahiRVY=,iv:iLeXIHt6EtLBPgQdTGpKAW9JnJw6jlka9EePdqtP2Ec=,tag:PeUz5cKScpuE97va9Wx8Rg==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:3KrfpupQ4fdjaxrGIn/VZ9OGdOHXefKcUd8=,iv:mEofbzrwW1uQO3dx1q8DPiovsvN1DZ1cr+7t3hdass0=,tag:MjoMtjbAC7MFVHTUVEPWnw==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:iNUIwJmvCO+64e/7HNBeq1YA7FDK5RKWD5xS2g==,iv:CBeO8oW6t0qYwfFRMUEFhdChOwTH+0sj+qg7KyU8njk=,tag:oJrZh3rDmJGatu01oyyRQg==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:D6H01sl7vDDNFBPvynR40Umk4iI=,iv:kaqUwoX0BryBfoTDuGSa10oqz2cZRy/wKlHKHL3Xwug=,tag:DUpvEwzYCR5S4M8D9NXoGQ==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:lFtn+iFvgTZ2zIaRGTKz2gLg37ET,iv:wpGb0IAyFyyD36hPSVxi5tOfAdFbKnpRamwdQTWebJ0=,tag:WTF8uOKmjR3eilLtnVv4wg==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:8LeSpObOWH/X9sqMzVl3mUaIUZgJrdljmAuZno+AO/cHdmETJXQpSvN+I6zOorMuDP/b4bd5qBpXEBDSNHn3bNjsas4ko/fKOsJPJw8JaJqyoLnC5nuA19e3zrZp9bO/N4PjrBNXBh3OfwEpv9YlferO6WX8p78TY9Q5VGMdP6xog3xA8exMhK2MLnGcE0XsLR4+2+xsK3svIUVOR357knBVcYYUC2n7duT3d8xGOnrR6R20T16+,iv:mZy5xk79+psAJn1+hTPm3TabeS/E26PwitULRppvBRo=,tag:1+3n1BSf39QJR61OuKP5vg==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:te3i6JJALL7wDE8NsVNlo0EEYERVHlpH6uweyZvV9Q1GK6pQ3hwAMtcgpjVWE6Fm4aoTsBpTj0oXywX9lpig6U0eLDYCRpRFYkZUs8utWYQalC8ZBiAtBjV+Dr1tH0yh3m1nOgMUqSdJYqiyPsHnM8Mh1d0KzCXMmw47ccM1LfG1pvZrwpnfQHVw6mExUW9EDn2izgb+jY4nqTjjjeIxzAhrLIYpMaXneGrOCBvqsuWr1huqOvwCEqjiTCES+/QwsPsbhYVokme5oq8IXqEwrCIx/01vOGzeOu2yt9rUg3TWvtFfTENjLlxQ7HL8HEITe3PqHhR+vH+5CF12F0lbKJChW8PO9X8nuj49vHJ5kfS9KKhr1Bva/l/sdpWBeu2YkTaejed6FS7ucplkUUv+vpCgnmmqZ5+KAEuAsvn9GdoOR05pcywH1Rm5YAnVwZf34eXToglmllv7Oz66lyG5dy2sAfMo8LFTXuCvi7wd9o8n3F3aTZzXsa0qtfwHddbNVa74vyGpdQY6bMoX0iqqR2OydRgYso6znI22HtSKJt0/E4v3TT1WkVVDhUpuCytzjC1OVLooFVfkVMGQcNy7CX4AjEf+lY7sW58aM5Iph4UwCbLWSrhKEv6FWEzM7q4fDhVuaAOjId76bJhcsy5Qzx+AEU7HfJ/Ifjj/FqLMLQWqaTsCkroR6McCBS8tG2k3mVt/15DKrTe1VVPHGsaE8F82Se3OxgHBvNxbw7ob+pMF8/NwT57+jbcCckYE9mz+iZBJzidQr3XaRwli8Xq7Vv3DtOcjwiLC+nhm+moKYJkgFPXpJfr+xonuagHSqx2osz+FJlU4yC4BntNXzsjh/kcw5gBrJg7ji8C5x0BMj/P0aqRYjjuHhIDC8NE+LNb1CSHaO9072CFkBjU5dMP9FvfAfNlhaaYz5AABUPS1A2NJ42YUynYZmDJAG6VDWtO4GannXawRHgCGmkY9P/Aey19eAY/K2e9+ceJQ8MtO/9NaOsLi9vDbGO/gZv8I0oC8w9mGt2BSuW9PpvrXqMedYIdMc4wTS/Izx3OJJ2Ju5/96R1bLdl+9YtEbZjfKCP+O0wZ8/M563EvzP4huo9sRcxTmULUTaL82Q+MgEjPUoDVqc+OCd2OCu2DA8tkLzh6SSeEK92z02Vgl9hAotLHXVSnWGzA5RGI527NIRxoWYcfNmxvNDKiF3kI3kJgziQGb8P6AbXWBFxZ2do1h0X9K5xPywmwYlr0NkT/Vv1rtNlZYz3sPI0YVay5QGF60dXCzpzLp5c2kxRfYYnY1+HLgHp2gIAgQe9cBraeFmA5/RtTPnccJ/KO5yliyDSjLwzBGtebnVhaLGlV74LyPvHFoSCo79Wdtwj2oxYROu7TjD3UMhWoKRETNJjkV1RTIhwNpREH2pckam9mg5ANK0RQHvGhNFr5dY6UiILvoEnPNhTU6EEYmeLFfbywYIb48psp+15pfC4yEa8pWzAmlig/XZEazGaIAP2mMoruVPgdNWFCS1D13e38SiCwyUXXGyzmlKm6E0mr+qNLHs3I7uJlzTwPt4ltSAm5zZOWwkCu278tU/nQLbiWGeeEAYO3dAQW0cxlEJcg3KS0qHimZWmjOhNNgl1jOsZPVjIpsLTbvVOxVjDR2ZMsJ0UAP+tu5/oM54GK2Wq7sr2Y/vsRuwrY3m+JYUcaAZXE42lXyEyCi54o/mxGpx+weIhr7rLBWV4VGAUeKEoUZpcrl7yvzYHRlgnlEV7Qh3qe9JHrrjH5QtM/azWH77n8Zae4kV97VWCsl9esmJelAtooK+2nCJVWgVd/xnST1ZgOdhP1TD3IueiSuvPBYjKliRQSw0fNhWq2NmdKMd6uGciQsEnhazAFtChrYmAYtCs2IdVyUNNDlRu4v0DeipQNEY337N8D3rLzPMWUjR2G3PJBqpys4XhwSVYQGeQQnnfLS9DRliHQMc2XMn4Sa1dKCzB4TczuOYTomG9WanCYTVlNnCb+zP60Sj2VO2teCBqK3eaVde8WCbyU8sEKibZHN6BzJAnDKafJhopMaQd+WdEASouFqpnkEouD3QGZ+2uDLs8NVFsBYqwOT7kpcr0KreBO7xP/obWHkSMlKCAgJWjApb2jkJn0Vy7euuipYCKh4NZtc8ZiNulo0sf7rH7IvEaD3Lvc2REN+CMl4r5XwX7Pv8VJCFiyVY4vjRT1DRQ7yJMAxitXbZ8x4NcwLLUpXGrDzv+TqJEsEXP42lHvsd9voMyJeCYON+HRSMS50r0Ht2Ygdpa7VdSURnkIDxefOedXaUGESJj3cC3kohLC4wup807JFYTEX+e+Hw8nlJU9D9nnKmSDbJbNr2oeMiJMgYJ1UOAGyyflj/m1z6t13IXzODDNgxhqOAF5hurN6bxZeHF8mIAOzuXv7EP6xK+I8V9guFpvHdw8hVDfnGpxCIa4Ih+RiOUVEpRShuQIVIbVGcySbPyHGZGtwuKtkA008x0eDYuRsKustBL0Kf7s/dlEdcQZ1Ne0zLngVezLrUviwpPUMXg2nvzvqU14U7d/wZH46JLOcxFgNrkOOHJglTFli2u6UluGhORxS9wD3cyiv8uTEWVGvZEWQo1+3NR1k2xfcISk9P3siC20BBaQMnyimLadV54Bswl+WPQsLG2cfyuq0dPJmfXq4ype20WjS5YDqXzbYV0jVlD3my9tyBxeRA2hR9+yPwBly2nuTrMFHTL0GkMh4uqqYZNh9wvi8G2nRptB9UXwkQ15E2bxlXT1Wd/SwwToUSFC7ThatvRsjJ440s8ht84aKbGpRuyn+XCxPub5IvIM4J+T/Az+HM/zqmnTA4uNtSExpcKfpXY6LnbY/OF4TDteCIH5v5dvrmRH1lHTJWhE6cU1pi05z0jtx327dxS3/RgPF3QvAs1rBF3x6ba6fmtH3tDli7lxaUKl7EQjvLw0poLDGuG20+J49HeHeN/3Sfc008WQFOardhDaWR+ebN2JrGhArDCjz7BZoX+VTWzlYf2YIzC2ctf8glfn0vzJ0FaYrWIieGsFybeAKvQapp0XK6BlCjYscszzK4EsZejZl/2fhnu07M1jmLfvZyIb44Ugc8HLkirZjtaLngl/Dzp9ZexhqyWOYqqAVpnm9QxbNdoU0cAsXwB7qIi31GUQPFCgdwUCV1gixUgsthQVkvhMfqwgeXJV7J6LmuL8THNhkvB636ctp+sRXpSFhOAWBvCb1niZLzMgpOpBohgFXmRYikJRJTrosdmR0EaohNeE2s3Yljr+m+67q8PA8Z4dwRyL9EpI7KyxRtl+62piUmHz4qQLFoVhpWVZrfjtL9H8VggPrfbrlcffQhg2tAGmpj1qt2TohkFiqKSjhjhaSv6lMiJKQUkfnyRnsyNwIdXK4zta6l7Y5fmIZrlO4ctKQwVQqeL22Lxn/nhW0bDKCoba57Q2Cw7LI7EOfz+JddPdvI0JAp1RMd+OKbXwlQJiNwJvm66WwrjWcY/oHjARpu6RVG5XBQ91AThDvLkORgXDYgiOYNfwMpfcSlzLTH8YjyIRYlPmLnksoWN9/9irW4pg0hveY3bDXDgHTHDY31YdSp+W+yQN+hQl64QB4FFVcXoqI3u0nGple2LR0toy5+eVMt0uyPaSGfbNBiVA+P0JHnuJp60VUcHDqJ3NcPTmWrW5WaSM48ymNrLMtfxR/TAIe66Awdb3BcbukhFPfSir9qz9QV4WaKxYKwiIIdpeMQv0YF8YIRuAPjpnYn7SAJ1dzVsMJ4sqAgy5qLYoy4ZRRPjVpNeZvPlNP+gylod9zoDANchCuc61HQRgMxE3ctire2S6925OH5zmJjSbAKri032hELoSTQCOP4x8D2PN0lQyNXK+PPvC5WUQuicN2Nv1iWdLT/dNM7uL9FKGbFEDy1V1S+fMiZV5WqyOpmyoJKRwTvc4F+Z0ETzB+80aujuxlhHhEeCooM2EPJEaAPxSzTtO758GlcJxt7PX/LOM1lYWdaIgqBXsPDjhupe/Vy/1TABU2FUSuku9TMIptp3XpUkmJ0Kd12QzTwnIbNv
"headscale_config": "ENC[AES256_GCM,data:GqUgqHBVQLmAHdztU/ga67WW5FB4i0e046+VSkWEGIQ4mA0AZDk0KEcVHxdQ7AfFezNeAXMCggDBHxQ+1jEpqj4VRqpy2UZoZd3PJiFLcSwlKwSmE1tZ5awJKt3CM9TcWaCxG8kKYRRkkA9y1TbPmv+Plt3qMaPgn9vdE87oLkY6zJTYZoUXhlKjN30aNfRYTqMA2PWDn9vTifGyeUrgh9yv7+7I7bynYgnd1Fg91IeAAFBcEqFZQspVqOYu7ZsG0xlf3PFiSxGuRVdrt0wj/7LetnaMHeI2hk8mzzhxJCAQtNqsEYxFPmg32XDI61HXZ4A9nzxzXY714aOpN7LY0m9wuEMOVy5wAT2COrQ6Yn397bawBE4f44jtTJ+ehIBRolcrtMj7hAYbDlOEQkDoAnY71+uxFyf/Rn9Gg2yFguzC7drFONoxbzGDRPP2vNb7OU8w/Uc4f2CuipHmDbOS8JU3FzvR3jjaVrOPou5AhgtS66euoFFA6qzRFxLoexbCGQic366r5zL0j3rGa8ls6uzuFYuxYV2rF4j8gv9pa7HdAL3BgH+cfb2vkWAIsmt+oOJcJr/nE5/wQaEJvCUZhRcUVV1gFsFzFvHa9Ug9li/u7B+5vKjX3Do9trmD1b5x6XF1ajOqdUIs5+xJVegvWqNhWHlaCCcx5y2Orc+9dBWl3j2cF1TNC9Rq+AcaO4iR936ydKN3F6ZLW2+QzERFmM1zbqLtEcLRh85C8PpNCoJbrNnZVZ7G9xhbRJEb9d9Z4q3TRTZeZhrG2xRw3Nl5bSsN0N5MULBt00j4/Ly6c8p+55b8pG2QxEI3bcJ0Tfh4YtdWPq0Tvf9Z52Qes9hwYvM2s2RifD+NZ9XKedYr4eyKEjGPmCFDdTdKZy5ah8mKAovbVFTJyraqiYvBPUrTVP1abjxJ3+7vEGNzwUgMUmncOX6vVp9tP+5Rv9CzvOqrgmBAZwZuUJ+qXP9rD/+WLIrlIbDdvjbzqYenwL89nxzEt4epfV7wKWHLZ/YJEXWJtg4tL59T3llg5HB0VqS85o4iZhIt1iZkMZmae6QqgAcbsMDHtMTubNgRSp8MrYLREWIx3kC6/m9joLjC6j85SOAQCa0Xu2DZ9o0xNxptLRTywR3BTkfLjr6gGQcpd1lOo3i3ItM1BI8D+AMDJNoVkcMceejL8DFz1AgByKK/FA7Ws3nWRcQ0RiURo/4P1zw7mVT5tulH311+u+oFZ226lx0r5dr1vOg5JV6MZ2cpdnz90lRkRHHctA/rQkxNirngPjm1AxggT14CNl8NmhQVWt5DO2iHOzIkxjO/gcm7P0YrbWGQjoDI7hHNDsT+rdtMah9r1Jdnh8MXdF7EPDmwfzWBzANitBVuQgHWYt8mz7RzBc5nFjDvP1s47kCY/3xUiqE1KwcvTHmNOveayFB/r6+JPtJUgqLCWkIELkWD6ruH2mB5mqA8pvZFjD0PVFReAjF4t1geBdkhuVI1vT+d1/h6/h2piqFn/nQzyUiRkG2vCqpsvF5yhQSDBrsupGyXDbehgJF0wE9QIP1mgmK0zznZ3RANBGJIMLNUAMlSzBIxuARBfr1S8UgqLf976Vmku6vrhY3X4IIymKfTnjrjaY4LMHkyZUPU2drI7BGDD2P4oq2XVGTX/cvmBW6rsDLoBsx3Pq0lTwLBuRMBd3HB8k/LL/bPR0VDcrDFTe5dz7Db/PLtX5g9QtAzFIiMAEeWYIJZjcwt3Bhz2EPLd/Xoj7//ISUnt7o+97+sxSNhANxXYdeY0ZmRtsXvnSCO+b+QWoWhMU70VGg0dqNnYROPVU7mpRS8OCrpOfGRm4pIkebs+RDvJ3RxJGQoiZks4chhLitMVAeNQX4BPJxb0oYAF33/+9g/UAjcOScUFTCmk84AweEkQV4dTamZbVO0t9DE4FYhqv/W5G0AsriWhN3Qe3gw38uFsjOGTs5NBI3+X1LyphcEcf0uZ1bJmuXmDvheZEE5Dcizydy2lTVfUfR+bZTTq/9Axi95nGPnlb4OARVLpV+JkxhTwJ71hDe6UBSm5mG/E8znK5Ys7zT+6UUX3FoADpVK4ZOrPGOAqx4UlKq5+474vXwkwN6wnbeVwgwlFKCl52AGCb/YgKye2yjcOk7TB4rVlCSNKqsz3H7M2NwKZuN8RZOFlf5sxlkTo6eL0XplRVSrT7l9THwlF+Y6YOv6JX99e5JTgQ07RWWz8OTLlpCaTWSdSBhQ0kvy16Ur5KU/IYfsneVVBDeUjYxqMER9yS/u6ZEx/9Lqghcdhgea6xuMImUCfKp+YadYeeRnHb4yR0dF7y22YNgSvVRvVQAe06Op3YxcFksIoubuV979HfAMdzWJcQ+oB02GxBwjb9WFq7px4NbKXYEumPzM7Cz7lt2zV44mojTQDsNkMUvcYTRvDxemgDetad8fQTES7AkiooIn/otLZVkRHwooNFfyOLHckJF1WM2pWQkprYphGTM/g628iTlMDbGJQrVW/bjQdxn356lXW3y6mJ/2G7Bdg9PxZSZJK0VXXGtSpeWsTvp/hVL7mIQtDzs6l/JLgBrP7CihgoBZO5uy85Ti9X3l5M7deSKM2vEkmON6eBUpO51sq0Eas5lyu3qI8+DrAhuIGen59lCyQlzVFiXqfRpRGJxrM6dbb2bvTN3j2lShYrox1+YTmVh6e9qBhavQ4yR48pBG+0dtfpzFEZZgvWin1n4KcqRD0kjym/f7SFn6Th0YKBosWz6IeOkXOntfs6X/mFn7IrQ4Zrv+nEfDIkvVLe2Ygk8qQ9jGph0euaG/MXUMJ6PDC1r0jsO+hLNAGrDOsAhWVqZPC5RVtCorvm8CQ72IClGGET1FFleJ8aCMbuyIQpi1QPqLbjvj3zGhScSmIWstna9EZoUPdoRgCslC41QNu8WpQ1D6jdBZMWA1/K17KXE4OqVNFCZ7nETZcgIfFIhPX2Gxx1Z4NCrBzUpodMaGwaHrlt0ulS+OnYxPvjPCmYIzUUAM7GkuA0m6fM/bh8hiU52gHj7KyZjA7ASSPFodDWqzsZiALB29Mb3aIrZPef4WgbkrbQLBEy9V0e4OwA11FCbPpCxf7J75i20+tUlWDh4RkmeBs3Q+BenTCwc63zTamuEv+HY0nHMBlvMnYJm7wNLcOBuZDGi6otgg4j9jWPXi8obhZYPExRF/UhybPv6U6BMSCnn5L/Cp6Oc/5hXs5ojfNdpw+CBPFsVgKla96C0EdrkatvbqAEnEANci2hrj/AmZpHx3SVWftv7ztJEEi+z1opL+qh4qTH72yOP2RFQ3jweRMmPQEo+gVzNWtXG42/pgkORZqU8UFOhzgiVxHVXOGC3dhbcau6lj9FpzvxcMNjkITku76T6XihbpZBqn9MmVPs9cJHII/7P4Q4H6brlliaTkPpaB+6lq4T63Yf7WPooQAMScpbtLL/BknVQ+AKTeUutWLtAuJnRgmcUHNQdm19/czhbaOzJsCTp7nRWH5fLuBFqCEoCuBtA4tyEjWeIaW+DqITtG8fVx4E7NuNo3zmSsBGG6R8ybraxuZgnutq3zsAAj2ERiDtHPSTtgCvP8IzGFmfEmmzqcjZWlP8Jvn572liTPPLAtNVBJ+jvBhFwC7t3wQIJEmaj2w4LKlcfjoPZ5ZMtF8Snopd6MqkmeAoJHRRhDmzXJXyVw5FHkTLv2kQpcPTnKeblXPjeJWR1NyKuU3PLT9KtWdnvRq7ylIr4GzQ1W910Ka0GoZQGrfWZBEXTzFf+0jer8GFibc8HJiGllqBrS+Aq8Bcr34IScLV18ENFVGTx1xZA3Ahiyi78+4fLa6L0ByHi2jugXm2Sv1pCZozz7a/j0w0Pwe6xsbYxR69+f8Kw0x29WhMSioZ2rL2hGaiHOacdf5uCHBFvQJ/xhJpxsx3LB5Jo/YbaF2GxSiFh4vb1M+lVgfUBjElFcBBNnTfxgSw1YfeFQ/HdDBmQl3RVZcih3KyiOBkIhJX74LHtP/YShKooV6aHoRXwPQlDmNaohr1WoL6a1OqutkzbIwC4cY8MDYZCP7EFtms2
"homepage_credentials": "ENC[AES256_GCM,data:k7Iba3kGuX163MUWnC1rEFIPTbfewi2rUFF+3xgvraK3hMsIsTLx652MkzNRhR/TPEncAncXZps2YyjO8fZEcekeXUNStsx9zlJqkUG1lPDa4rvgvLm0KiHPMkfnH+CHDWTagtthwAzsT9+MNyA3EV+8rUXnYS+gUhgPahCT5VorKCX0+4PeHnRCLqeLb39tpLvdzMg35ujuEHSYUOl2FuIP+5TQUEEl/Kpl1EShkKcE3LsVzFZsDJCpX4YIrUdJwy/ljwb2jdUZtr/YkhIxSYKTpHO8S9TQya86QJ9bHNTl3SbZWSYsR27pNTC46EwnaqgetnT/HEaGxuFQLPcw3lNcefP5o79pjSXm17H5jFdp5Awm1ihPskvIfpuk74Me+PfCraSsCrL3GZRpZw2ICDB+P86KAiFdy78sXFoUkazV/8JCnMRMX+VoFVmlNEJwKXmEn0uq5sdscZ8ElJaR3JR/SkjjISbkI3q051H9RKahN2kXNhCM/LZYTqAzpyezVkxUMe4VfMCCTUk47GdDfj6XLMv89eWetxthC0G+9XtCluFBj5fSMK4JVntAOR7YFhuqV+eaUwEGVKBMNxTxgFBfm2T5XdgWWphJs5033h3a0d4Qf95tbkuQ+zxsLRbhOvd2I5gio2zbLXdakfXPZ/Ix6FT+72CpsJtAbFV/ciHu3cYLIgJItr04SI83OlHACTXxdeYnS82j78y46gV42CGaGM8HVjR4rNKEegDd4amDS44Toc1+YNINzglOiAU/D7JHOSBr5BDW8057AwCV9nHCwAXX6ehb9k7/7rltzsPcS3wXr6Mwhprt6mJeF89qQ4B6s5qEkQxTKCR22Y3w7ExjSPADujkR//skEWgOFiw9r9JPysSfIFEoYWVxxOFlLglFXaecit0OsxI+YceHcY/DDnUrNsLsQbq9x7JZ9c9BmIWeehxIQGBOY+VxzLf2xljCsgw9FlPb6GafDDHSSzfq/L7oPsI9drDR2mPQVVP2ktX4bh1J5kksqnpRp59HwS47qqTkypPfbzTi6eDORPcHJ649yAjCXtPgdiGXym0CpDfIhNfd8TTi8+M4ajn81PNuur6dEe4uVr76quAzaVapZb+8TrvmNVD6qAWC2wtycfEg2h/QD75Tt+mVQnQ1dCBhYNy6t/63jQd0apQSaupfuue/HqGw0PGgtlf9ZlygNLJ8BEM/wyuVvBUXDmpNdftieLjhoz4AUJG45s9J2tJmE0S28IJpidw11B47T5SjFV0+kn7h9SmMaFIM4qLIUWAq/FuN/q/u6yAEvFk7rVf1IWC5E6CU3nV+cZ9I4rvaKHRjVqnZuhF2KTeYfwF+bRpb9RRqB1k1IQgXb7fR5L6ASPE5ERq3z2EGt4oAXwJ+amtbS8bos98oFVLYYRnuIxCMr5FRV1okouWYTxKyoJpxoJ6hGFbsR3cGJ+QCuNGU4f448bx13v2eOGZ31texgeQrDLROHZvHOinulSFvjVNSsTi91AOooquF335soo2r1fMji6KiRVhylnQsNHJvw9GIaDIYEqK8X8pI312RURid3m2zUPvzOv4YrwaawjkBCvwyaFu4leEOdI3Ap8keBR94+10gxavgzgulfipOZGTlUMcNmFuma8c04qYFuSrjjaUa6lL6QraYIwTvvmlU1HlaoUrAwIz3BeJuUobadkScrA0PUrP3oCg18rXp/qAhnC5C0GioNaxl2gIstjGhcfzRHlnz8YOnzvBgiB4mgptwmB3gD6AsgxYlqeMdSygFcBwmvpxwDfiy6tNc18FdWqvs2SUYCUzS5Qr//NMzEeZIxBbEvx878Wd6C6SdLg0ZHn0ifUlgC+j/iaSw9G3I2Hql8IfVptMV2b5kyPUKLMLMkS+32cOyTP600Yjbk+Z2oVhtOLubGBFMEOPzf09SpgpwD1pQY7ixDcOW88BbGPRK2N0r4nVKKKtuv4gKejfFCV3ACpdk12EhKgdYB6ORbV8Rl66J8hkA2UGCiShN4s0N8AYzbW2Dba/55/KIXhIuROTM0jCza2cJbbJeEp+8Oy+T6EmbC7dR2Yi/V724f7mtuvKCtFJLYw8JCd9bugIepcUyxer6Pp3f9t/1O0Dj5yGSVIbdZo9ByyfShSIpmPRIL6r0EEfgh/Ytejk+pJOcEGYwcDy+gOi4xXyY+v47U1EV5BCUD8bcLkuLxbcX2xze3+FsHyrl0vuEObRer2ZLCt5eCdktYaxcHrSONiWQ6a9zfcGDHifHPbv4C7ybxJsmYGw6I8yOSsmJCDqJH0PBsIC+WzK+nLdMzNjfFGcrqpt391qJBATf1CL7kX9GOZroCIfnMJovOA0X/uLW0ACx+rMT6uMMF76VxZkQ7ft6wy4U12Sev0VsnQW5HnEJh9uo5Y4Vod0/jYEZ6biPrNo4LAksUBsfVKcXQSIcQRRguGxmlMj3KiEXZHGJWdHB/GwgU8pn1+WcTvPh36w9/54jUKyPEnCu9IxULJabNiYY2uTG9qnyYhyAF0zd/QyMRdPZ4Rxaf5GehkFNo3DGHIz7218Bquhuo8rL9bur0VnIiESWpk7GAudxkvj6YHTYhWfZrxSBBVTYoC8sD7ennkshwKrpVsw1daA7KR9e2C1IgmFDb4yWOM6ymAH29je4XPee821D0z0SX1D+BM8afNm/kSwHojJqBTJUTj5vDezVSy6xxOUKxEZpkNvepkcdVSAnkYsXRZxcLWtSlmiOJmGA2fRrRScEgcZ+qRx9BiO0s1kT0w==,iv:JiIcOvbAo/KAhEx0ANFkaHtqee4lSyQhasoNaEpdJYc=,tag:r9QN/SxypXhaVUc2cBiljw==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:8ZLUjjZiBB2LDYnbvElJZR9zNc9PUrUNDqRp+Dc+Bw/MjRP5W+Tb390cRA==,iv:ZvDMw/jThu2w0EN2sUThNdtv23fAJfzQwq87I93GSqU=,tag:j3706O9sDh/zYp9KrOpklw==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:a2jYZ2wS7J0qdS3I+DQm9MVEZWAVzTRisDxh6VLIDID9IB9WY/b05l95ZutA9FAOtajZ+nzmFAsrm7UZq/u2ReO78c+QIK9n0tnVQ19eQCN4GQAdCKlZIcu5Pz23P6gN0MisgPmcJnN7zV6TRec09lM8qe9qVqwCeM5orXPHCh3t10SZAScmOdifcKv7jXi7XUvjwC5Mh9OvQZhvOGhHbmt74HkjxoTMz5ULNpI=,iv:Wmj75MDLMN4jOA6zcVdE+3OZ49ImU5kjruZzy3/aXK8=,tag:prCbLv0vsxg7i1Q5lh7i/Q==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:fRKyba8pNiEcQ+k8kJkFiobCxHb9LZER4nENmmJpl6sQlJzRlSGx30LLGdk0m15zvFXEmGBou1usk0WYDi/U/ol3Yau7VadlCFKW52pI+etXEHB5fMTZDybCeKgfAKsQFUsjZMJYjekk5uGqisl/UW68DIgNp6MCEN2fR4CuKbV4uG3VLmqKLLoZuKeOQANLxTufO/5wpdJNKqClxih8MbV4IrZKjjV/LxsjxUM9H6FYTb6V4ogv9yY8y9qjwzag/GE/4KLBubgphMxrZK8JQMVPBS1mn8vCOMDqy8rrBCMFjD/Ja8D3V9/OLjfFjD/SJsTc/HN5Cwq7TjZ3OXFvDdOD31H+F13G4oQDiiQqPaP0VZvFkN9zKUbz2LN0CcVJjodkk6fUapUkRuxbIvEtheizJKS1J2g2rE/9bGxkTfFjBaaDPYlVEWq8gsiZHGkWrkVPBsF2su9g2zVHC6XUhGAR4svFoYs3EdNgzX2N2nx3P6aNPGUbnSKijSYe1UydYh3oOl/j1tL1WG33Iihn4R4HyzMW3/j/MyYMKc3TTE3U+RfiGTj6nfLU83iaYeoPD2/IgOOPZulr7ZPtDGCN1h9bJQf5tpPJEJePUOxhghdCroUqaqOAulH2yhasFIdngobHaSQ7LzuMmiDCuKOyj4cefcSj4FazMTdr3MlgIN1rKLTX1G22cra7Irz/n8WwZbAVprQZJnnhjOyz9hUhIX6896nBFw6KbtSoPsLQZc3cwt2QIjmkO7zP+sIbdQzEZnHMXm7blqEw9X0gtYkI2KJ9xN3P6GeWrAUhtMWCBZQxnKwmHVr9Qu1HuekSt39F6DRkRJ+huuvr9CFp74l4/P7vYi9hnSfOoiWt+vebdqa5XK2t3v2ZXZFt+ZXahbWR2r2KiN/3BubxZ3patQia,iv:1kULnGnSjlI+ZzExWuwtAQVMyehJjsVda/5w1lYhWAA=,tag:7QPMAh9mKBUissEd62Kpcw==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:dVzfh1DXr0G1t+/AzPiJCy/lQ6MVIeQKo+dVpgxCERJWbkxXPvY3BhNY0zmHRaiwgWnmXdfenZroMKRkAzrTEyx1KTvWpClz3d7fr9DfJ1+OWx6h3XMWkEGlMyuoddYBTRf7lhl4MeqUFTr02FXFsAtu07/aaiugnVMtQbvpb/HS5/2kqz9/JtE4M8/+cn0hONEbRuxmDhEmSEcMIS0+h6aoIweqX60Bv6xP+qchx7w5zCwDt9nz41dCo63VGInSoWpj5l1mdpeXZENkXddIwv+yHAePo55uc928JLtR68jpbJ89PSwQYhgzSOu02DVXLlGin/3mNEmTH+fOzwqxj88ALEukIg9VZqBg+xMDZOh8pP88du1SYfx7/OxOQAnQnN22MUlmiZE0Lkh9x6/WTmK+pWBuNn270AnH9yjJHZq5XuiWuPRu1nm2ZyTZmGHDT9kajvb6UZ3rBL1ctXONaK84lYY6a8anWzaXWUOQLGH0IGd9Q5ldaYUMiI6IXNc50KYneqPUueq55xCrG02dAbcL6efYi6UoNksGDlOG/URdbYiCCWPbLHydf2xHPhOPKf9QZtJncuHLufkom3wARblRJZ00,iv:umU55IRGQnu9cMPQNcuJYYmqjJkCsXLhzG2vtLak2T0=,tag:bTp9rbX0odh2O/l/bJ3Fqw==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:vjqP65PaXAnQfaN4ClpsUpHoDlNb1tY5C7WUkdrcc9JVG2u9awVmw9IDnmUBkwD8l2wf9hb/m/uclmNYwYEX18hl9KZFwiWApewtXOMBWBxr4INEZMPkfmKst3lKL1S3ZjYPQMCmVu1ov5k7TtOETC7uK7wHC45OWlgHCDIcE716KF0yYLdqM6KEFV5sn8dmMHWgJeLfTO8uQ/lHuK0pJ//0tDYvjyRrnBZCRUnpP/8civ8WgFFjQj1rr99sY58XPc1Q/8ojubpWL84a5Jex13f7AqFdLguIqH7il4cs9TB7l3KrF02neWwOtiQ7238Mz+s1CTDMMINMgDn9/rfsymQyo6xZMbTLihQ9dzX2h45crhdXE5VepYoQpqZjDvyyEte4gtgQdAFJhjNVzDageV7Xef6YpOkf0VC49Fnm4RN8FWHjKLJ9h4FQ0jrqoEw8RURE/WwQiR8bh1mEdMtTARORiqary12cCqA8madcXrl3Aq3ry4uR1qlRxEUOHKC49SOWhMYfXaX7HYDRYWLIVeUfBmwlAe2tcB0uomfJ0Ja9Qe9U4+9nuQ9uYkEc2fK6hAigHRHBHAYTzBQ9WRV50DDFdzCm+S32doa+FoPy5a7k1JtWFw9FKdcMAlLabTeDZWMtzvIup+uVsnsauspp/vfeUkKYgDqh+3RyOlYTRdIOqywkFio9GWEoOSgAeFkAjX0H+7fCJbBFG7n6knsn8lETxlwopfJm54hGM6LmlyuQgrAJ4GbwmLTA+KChkg5v+I0bYHJZOkSMXKYDKw8zMLNiAWNdCK4eSsvDM5C9IR0VVpZSykaNy12LCgAjzYq5DKosO7J2pZgGXGl4YvlnYNOTm0m7jLhTg00b9fGnLlyij+lNjm5rZVqwmjwaN4RKUpVvbOXztqW2sdXJi9k5+90vKkQK3XXi3VT1YUmPWDA3f4dK3TO4gjD3U4GCeLpAL0sU7wiQlZfS2cKKmQrQdEUxg9tU0xg73eQ9G1B1mB3oW3/erBXi2/eqtkh619OODeLSgjoOBjvUEvnm0eQHsfQjiVridp5/wQDg03ikeA+OvookpU+kb5CXmZ3OSHVvM/khAsrAaWu64MQUDj9AosGzE63Wabkyu1xNzcvu72dt1uu41HVjF0DSZ3UlTCOUxvUdH6D1cCfVVTK3aUWmHIIlEsNIiB03V9Mz+9GGf02be/NQtnweFJh41+APoATg1nYWngKFDeV5S6fhyoV/aJ5+JE9SRRU6vdmfL26Lhwkt7qJHIZ1nFXH4phkpOVQ6HtSEIKmVi7Y7+poc/9Dgv1boUGiAEhe3ACIWmzJQsiWDwMiBJORnxkRbFIauQfVydCmTSdBKPF5ZPxpYlGhxkww9yzEPY3vNuDAB6KXVxM58kCSF9baUgnLGEg2TOJxYuWL/DZ9FcrKfzIzwWWpwr0+fIRY0lQSJBxLSmVATqD/fajrmEH+Cbp2Axr8mTFuXQlG0rl3eDFP8/B2Cqil6bApVAWc0zwZ9lIWGrQkAxYtwhT+LsL/VcEYnybVLFFvZHRcyS/zFOh9iNIuyJ0cxs+edmtSIm43TXqRXpjuddf9u4OqywL+EsPsxGkB8HWxTdHRmG9Yul1GLiX+yktg3j4jczrZDgwByDpzFxZE/ybp48WAcvWw4kpcPfhJx0fxYYueTteWXocGRmXx9u1UsUWwovF3ljgHQleN+i8DA5D1GD4O7VLXN5bzYp89O1GFJUir/hwB3e7HnI39dHlxkJQsBF65AFKEGcqvidyp7DA5hPT9RCqDnnQhDoYyCwJpYSkAgRYj3Z8vnjFO0SX0ADqasOo6EvO2pEVcbz9LcIQuIBSb3Y7cIiu42sh4AdumMTANgTJj7nPsc5c9N2I/Qsp9PRWxt46c08q7JR7a/JuZc4ZrjJSXCVFC6o0jZs+mE6v6Zhqt2JxsKJYEnZMsxFB+5zXqgDzq7pZxSnj/HApSEjvsTitE/OGAHwRHYe+EuDXVe9KRT1QU9zJKnlfJRKvZQTk5aM5te6OYGgECRso4jNXwKuPz2ZQmEABh9SfPPRZkjlKgl4BIggtq+uoiOX+rB8JqMKQlAchKQZAnrPiXdMY31aefg7W4L2NNTxTrYSGe7K1YQxrLhPS6sz5oibsursAYcA1cBaTGVfO+aMPDv0zhxUjO/46lIcQoxfkBbG8kTFWajY9kcR3nUwlL+Sv1YMPSZasbfbIjjp/dqRpEERO6w7RaWz0/aqjmXYJ2tdbxQmFQYuLrQJAhvwlXxULkcwEciDC7vRIa3QQ==,iv:rtjO0HPsk26ag1xsZv7q/XZrNtT+r+1MY9cpelhf/cM=,tag:jilNbmIiB84OLs8n2ZCYOw==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:czf1BT4SLEUwQQnW9RA=,iv:Z9mXFcg8SrNvOXpx7LIgiF/z8ufhqD52veRiUwuLoQI=,tag:NSJ28XhNzq1lqqlxZm3TXA==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:0guSzuWcUsUqBevgCQHhKxIwRMclf7hQDhOmscBM8q5Or8PBHfVP4IaCNI+gVjznv3g+R8fxXr3qynyQFAES53lt7r6kXrHJTPQ1wqrZZDb1kB9Px2XKmagrvFT7R54el9lh,iv:Ze23GTSN85AciohlaYynMVnXOEejkQe0haLZONBvzTk=,tag:zOfOCTt+yc95ZgkISW12ew==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:EJfPONL6,iv:xUpu+0QNp2LE3MvM8CVCxNTr7AON2AYLSDpyqgcV3sg=,tag:3Gy6/FEYrESxeBxnea+t9g==,type:str]",
"pve_password": "ENC[AES256_GCM,data:3nWO/JDVtoE63g3xqtT6Is2ozbe0vRkv3JOFGw==,iv:TdIHg0SaVr2uTadljsnOxbgllR4712bg2/ChmSa7r9o=,tag:Pd6v00I5Cg3ZmOQWXwYRsg==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:6SsDaDoC4NuQ7sRUBRk=,iv:EflrAH7HhWTkgdhPnYym0o+bFg+8d0D14Kr/3LD14zY=,tag:RGLNoVXGdOSjP97FVLBNPQ==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:nOxeb956CPhlr2Mp5p0bOpZeVETfrpY=,iv:BFR1ASylqSKcy61zhHQgIGI3HkyV1kXZ8Ejus4Z7B/A=,tag:8mWt+8++L0SmrkeqJFZAPA==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:smUqS4c=,iv:Eb3MZ/uR2dkT3ayP7X9jrTHsXgBA86AT2xhC5SGeRsM=,tag:pQO695ZfJq/4mgmglDfE9g==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:6r2oyAp1swxRgHUN57KXKpJYZmTTiQ==,iv:cQEO36yAXsTYyrZIRucvAIorUUHQgFEMskEBWzw4aWI=,tag:sfBHRQOajYxt2OvM9bynug==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:xEQhfgcKh74Mar1HaYtdQS0aMs42oncLqeDGlDdvnvP8GMkLaYyJ1NJpcDA5mXd0PpJsei1tjizHwl5+xyLvDaWi,iv:UWmQFBuX/f7l5UMSYtQKGz7BCTz8c+Ahw2GPl6wrduQ=,tag:j7+VXJ30Cck0e3xZJ73WJw==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:z3BtiDUuvn93De/ynq9HN2N22eKMfjop3ZQXUVcIhOVr37SdIlFQ4XnXWibIFegsweE04qnzO91g90zD1F5UK47Ejnsx0Jqiyr4g2SSrlhiRP3tvRQxParP8fqSprpMXHy6sJ87HgD8TPJUVGx+icH0OUsssUc81Bv7Y5cUbWaWRUV4AEovR15tNSQvnRf0TDy2bZZ0fy9+ZKkrGQClV+LABFVYFQX3uAfu7cS9YiHJ5T/4zpUaMWHSX0wgK5IitTyDFm3kW6CfIWHiC9dQjkabo3ZelpzBqCe1UW6yoDhyaRKzjr81kiWp0k3ePyPgiHRkKi3Ve1Vf8PrZKNqnEt8WX8S7zyuO2v9XOJQgn39lD1gCLOfJV+yd5eMg+7vL8VXPPCnih/OXN4ql2wPtk2h7HJwrx8uBsQlR5eKI8z0FIT5e3EKNJTz5hLc4rJXULGlqqHviv/L1vj+2Ro8wf2mhpeT+Rx/bkiwSJdOSghFZjAevQWcHzk1Z6o8KyqhsV7mCrVcupvkvUtHCD+Cw75foC2soGCcu2/rnW,iv:nR46AIvelgdP/+WiA63xahmbc/cRH4qTVPAy6Sx0Lb8=,tag:bak1Ck/DnhWUndoKBQfXxw==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:RYfXh5ekRGyLUQogCtkbv6deGs4=,iv:o2ZoPNoo/8QH/yN/cc9snQ64OTMblfw/vT99t5Qi4Z0=,tag:ltgbj4WLoqdQuZ9NaIOIlg==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:j+CaSqSh7QB1D1GpnLwi3Snq2vQpw/AVogK2lV4CNwlQ8ICKjI3qag==,iv:sJxlUjil/Lm617rc/fH/7QPyVSJDpdB4DaAvSATWpKo=,tag:etj4vFr7kV2ZOkQsGg5FjA==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:uQ3OGX3fMrrcf7S6,iv:BqK/POPewicKWGADWNVNUxzCapafUPthq4Co6s5CIEY=,tag:+bpZoK2vBY4206TVMtFceQ==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:89wffMiz41X5cdTI3lOQiCquDDJGOmwsZWj7hcCLw3kvsfezfXHN0+2DRoJCwkN7BbkRDgZeXowed5KAUGVcscywZYsft2WIpsj7Ya+ax9SXaW/EU/yw+ceIdbOPmb9SK3cdkJe+JY8sE9FMgjYxukxTeC2TLqqPDxs9j7NK42sZz+V3CeAw8Go4gNUediT/8U+Fnj3gppQuoMGU6y63EWVloJ9SVE5ReA80eH7EYGOxiOSVfxrfuO2Yy710hzzxvzEUmtop0AxuxP0XT1ulm9lcsCPUXw2ah2cWEUh/VSWB9YicJbYRVvIladWpMr+PAMajLAFsyPCBcGVYpjfovC79qo3Od5XfUEsRu2n+NNLormZ4fa+I0+583j+D6DRm4f1X3Q+JgghFepdqpfR5ka9vX/oCxx/FWNwF7Isi53lU+yhyP/PuZOZtIZ0EaoGvkNh1lLi1HwjGs/HWTrhXorqH44eA5HiVflfAibEE5HTWavOG4YXcdmHXTHTnLeDQxtrPdI3VOK5iicN9Wt1GReVhOmfaZpZaebFv/Q==,iv:awrswMY0oLkitgM1PGwOcDkIaG7ow6rrzWUJ0UivYwQ=,tag:HI3zaMYGjL3df2ERVwmkqA==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:COg9X7YxD9z6wyAfKPUX2VCab0s8owdG85Ju71fI2MHEezV5r5SHkY5aFWrWTcW1Sgal+ThQ+aSovHiJR5ITxl8OEhDxq0Hj45nwUoA0tQhEHNJ75NEoTLrMFaz2EWlw+XssNuIqQqC/v6SGooq7xabBLW/vkNNcYbZEPMx2pYs6ZUHj63WJ+xtQtTQ2jqcy0ZjWGJ8zLTx+n45LCDtqFxutdu1T45e4Px5rSQlltJZs8uhTOnxEpgTqXmGmwr0o1I1Zk+avwZfD2sDaa26+rfeD2rP93y+EjReDRSu0m+To5DpG14S13hRR1MGLOTJ/Ovjv3G5+RVLLi4fL8SOupe3je+C5By0u9wJRpE2tXSW/9a7ou6FVlLaCNd0RaDyKIbFuhZL+WdyyiHj2WqWvav/iwxYypSf7E9Ji6bu57gA0EetI2CVoi8URvcTowqEvlfIfZCuGxWQsW9lTcPy+APlUfJhpr3Vvz57/twDb/9qUAbWOgpqDW/K/EZKHk/8ADageo5rWuFG4n7dRomfeRnLYZ3vFrcetNV7mrKeQ3SEirsH4GApccTy7A7omQRpfLs8sHM60jyjcpJyciBXW637L761BcF2MJPmeYoL4PUZcc/H5u1/J+uLlhx5qxvFZuyobs/6lGInWEI7eyMyLChvHdYA6fWYB4jfSwBtHV2gvFhMV1PpQKBMUFgD0AI8Y53DzwWsbitC+vap06BTg0PhZCbNonYSZsyLDmUrCowE4J0borCt28OBzuu6sCrOi27e/qjKhpe4HNa3DfAfWD8yLXJOtrOcAisoFGTA1FusxpOATkCNF6sP1IU9s90mC8rsej7R1DM5yeANGrVeujIT0Z7J+C55wiTlwP6LmSztK9OesEyfmI91iTD4nqaxKyAUoSIh9v+Duge7bhSJGr0pnuNyhPqeXf6HJYIrsXG6qWCMDHBlCame1ryCTU/xm3EqOoIXmIXgACrggv9IXmAn9E1CE68v6aCSpzST5ldjl46tY4cM0pvvoQxeVIYPbzKNB3YCRou7uOQOVnELI5mABCm5q1tjC0wIQUmnpkyAAtkKOQoV1i3wsuCwdsmMHYiyC8Z/89FIm/Hz63Umnp+/31ps1ak3BwL8e9kZo8EJK0qlk6vvDw2CDsCg12v91fGWvvj0G7ktxqj2iIVAxjLU1fgMyHRLAhEOpIsvnndNtndnmkYKK8YG72EuU3jFrjIQL/9zPoqmljY4KJoiI+rA1h3r9J4YyPNVLPNP01jVoHmeuSWW4nZW4EcKAau+8Y+GboQZsGhv4bmSCD/CrmHghs8+IMqBEjzQDvLSp16b+HdNDmhaZHz4nNI34UNFwdxjctI/ZbU3FCIjqcDU64x1uIR1XDnyiJdE5N75UE61h3xkiB/2h8taczi23Gzt9+YSJG6cjCH1z2zcKeyLrkbRJPSoF/P84WvSz+hDJ8c4uqyGm2kLoY7B7XD6Nmf9InIPAvMxte6XGExzC4EDhrj1igb0Ts76Y4oxssVKHZKJgD1J96Z46dmhJKGb6WbdkeHsq1ZC5DX9isplMuMp4BVewCw0EKhvKiZorRJOiYBAS+ew9X0VXjDBnMCxaNMQGoGR1h4ayAdMB9hsAtrljOitQBBJ9veimHkPbOVn0FNXu19bAB3mRotZxxctRxKARL95pGmtWnsrW2gc3yYxuy6UdftC8yQUXWAQX62fcLdqo1/8m1ZGXHe3Ga1wI70YMtkPyRcIJeJC5GM9x4bwIluGMDigGeyPyzkMmY5kNL9O/YanxuC1foELxUvLd7AUub4Bstu6M2s0TEHj653yXCRRnrmw6caf76TVH59I3UyMNd9v3BslaRalPSlZDW+Cl4p4ssgQ43Sq2jmX4prAJFnJnlywkWsUHpcXxOu61RP4WwhMNodGoZu1VHnM1BWMcYn4/MrCenw3338Cz8qoHuTXaaHyh0gRxEwZAz1T6iYkhtnwC70kbnJqgP+GXj/q5K24IJykcLenLDnhioDAdRoYB2i+uY0tD5kGlYaS2qeTAEIJBTgXi1w+CMKEkdG2PL+60Rwdm957xTjsrhpefP2I4Cg15WZr1PtLqaCgLo618UMOFEUb2Z11jPxvXOstxEXvM24Juzb99YXECb8n/bIttVxYOz4uYbbp6jo4OU1wjolvvL0scX2C9x0bfAuTEhSAy/wf3EfFysTFNRFpuH3h1y1Md+UaXlduoZw6UfaMfgFl5LglpRM2Q+01fys7WH2nAw5K532i7ITxmKZPHNGnHD9+bzW3MU8hDC5wgBhrnMFfEjn7Y4rp7F942rHcpYVupgoa3a9NJVRrUfh0wekFTPe/Lx8MbSiW36DPuoZ2sIn+jc2i6jZvmXitZIbhs9gaLXf0Q+iMswtA4y0Vjdhs66w0rAYBVW67YCbft4X6ojHRPNPKjiZyD2CskxmAY902PHuF7QtooHOQXta01/0GfByHBKxvcQaPC7Uacw+KHtl3Y6A5BVeBuARihXPkQ4KGXLjmFLXEDphYrvCoihLXHFZyM8kGesAPKxWBTPbKe5pKPlem4KBget/+Vsn+uE4fU68HJnqXDtEnIQ5ZzuY64U2X/32p8d/L+Dt+IvRm0pALagBkp58n35CZ2iJEjz0+P3Li+GVrrfWGnVNF9mYMvU7r7OOajGYO4YWFrUEEMjf6B2H66k4TaIrMtbb7nBe6FBNC5MVdCCdiPOXfuO3V2p1k3g1Iu2gFROOYEgCubb/KL4RxDcYHvXP6JRHZIqPcn0veqC5Oc5HlKElcUB61ucAKxgFCB/Zfx47F7IxHk8zT9u05A8VNwZDClW39dxnh+bLrea3W6DXsp+SKb22T5PxtZi5B9/42ObNWfYNvCiFY/hWdPuGvIfgiZyVJEG+Fq+bvvb2+tjemsnFSb8H2DkvOV3vDg+U7R6mlFrkUJ3YgHFZoE0Rv4qW9mjxRjGttcw5U7qE4wgEDvQ1d+QaWw4D11/QGzunqreTbea29X/y/dV9iACgLeO/mr/5yK8ycCuxm2Y977HJJVCFJJ8Wlo3H1KMSYdu+bPg1wlH66hdAd1ZDHjfmBARofYBOr6CPzQoEHuBTALqIJK4OELExjNj3BSKuBQLRrXoWTEtVZkws+UQF7ey2FLVeWedfUdcoA3DbCh6EbzVcBVCiwnSiEkPxXQOJYGRUiRIfZ367IA56S4zspr6lcYVR0rJvWJPz8Yy2/XMIwJOiPRTYZx7ufzABI0bDjYD3IqTHsS6eMMOIyrUwqgyHIetNcqJ2Lc/EIOjPXiUExG885/vduGDzNOiDqQ78MLMr4ZVZYXsc//isGLONksAb0etq14rPQxTFDgAbgq6ww7IaBmK6r2fRFVr7FOPR2x9vpRE87ekDtgauI8w8eJs6SalQSXEH4ehCeDx4ZI9ywoQeY8lBl6UWHL0yLT/T/guAYXIO7F3w5IX7dROCDj5dgmYKWgU+VLVZVVI41kWqVIxg==,iv:bXJNdHILru0L6RaM56QdwoXl0ywgyaJlyp15vXsCmk8=,tag:zAJgynmVHAYeajtkIU5pww==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:Hk+amrqNKqa963chFSrJHuBGF754CZY85vlWwcyks0pClMfBRMFohKNW+Lg=,iv:DEpXugKgXPuZF2Vr84bB2XFsPHsINYhb5WC7Om9hmGU=,tag:aBTaFPLgwyQJ+sEDBgklSA==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:pnwfrsx9wLvSnwcART5GmpwciKFtEdzrDxKDncSAH6b9Dw2xvTuwgqQmNMEJi2o=,iv:tE+he5YBYX3htmblGkr1NBqaPb5lOxwvaMmsmQb4Mlo=,tag:NCEppWV4gO/RQXH/J20KQw==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:MjYGUaLLGlrmJRV2O6aUgdm0+bJ9R7KZQm91SKZAvRDi0VuryPaqqkgDeQ==,iv:feQSCgxSph8dPoxZRMs3hAG1uQWpmMlCabuEFRL/vzo=,tag:ClcIYFqKNT5Fy58SKpQVAQ==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:TGZINZVmqU2/8lVxYBxL+Bw/SGhwNijfGsrDBiFQDFX7FMDPRYCKKQQn3j6rWeyLUDvUOI6XU5YSj1C46ZrjUMs=,iv:Et7ni6oskfwRiQIhWi6ow0ROiUPdGYoMd/SWUHi0170=,tag:WIAzrnTd9YyDwD2C33KWdA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"data_json": "ENC[AES256_GCM,data:b42GsFpHs4o6IRT7ARIyclzAHy9bYRjOolv9OSyEO4J3yMVQbmFnt3JnezLhbs2aTcqePiKRMFn1qqLnkXqKCyW+oWGxm0+qTkHjsBAtagXoF0SGs7BJSVWRIi8A4m54dPSb28L4u4CX6ro0fm++wrXtY3xt39M03cn7WLpvQ+YwKGG3q1978lYunlHDtYIx6ggelrPfX5S6/1mV0FKcdVmpEMceo0erQEl34g85ZP2lDsSI/jSOsoJm0UFlgUrHMzD0MAseQv+YVw3nsP4fhzjMA7WsXXn0sGcEZy7LbbsYlM1MH0AubieaMjaMXR6/FkNdvds6/PNwZt2pooOBNgXKOd/JQzLgWQ9XApJ19Gke/E4JMZgB5wHvyZOG8ZK9X56x7j1k5xiF7HP3h0bdR0TR6iIIw192Ihi7WFuiYnH6Sxnkq3EK7ZbZ8FA9OnjUjYxyG9QpgCk+/MEr35kqbuRIzyDZMRBMj+5CGHdKONBJOW32S8S7b12H45VX00Sg5+9cHFTIbEPaXTSX+JBQf3AasDRZk1hU2BlvoDoCVIHWjaPPXOhqSZ4N3egTf2ogtQNJwd26ThrWkahIhmWJ/QW8NkRioaXUcImBk/4OfA+WhecBLqvF/zVQj7yga+y6d5plxODfq18cprMUR9/gzHbahJkiwg5YrEomgM33cuvF4Ik8JrIV/USIhMu6XAppopcAgPaFsdfQ8FrcO6CHtcaEuRO1nOMDG7wXSlCA97rNokuikIwcFrEA0DctE+pvvrSpQ/XTju/ljyekABAYl9gHLXTOMWMqJ3hzUDEcMOIu7WOGev6HdB6LJbfNvVz4sTepSUX0MZnx3l4M+oO+Wc764Ztbg0D9/+e9SJTsa+VAhE3sEW2dwbpkcdlkSRJJKNCbzdEXKkbb4JjtiDd0Z/e+mvO+bLdPHTtaTNlE149/sA8jMeEypQHqEjm2UuVR/p0yMRXqd2eQYElChteB+9Zl6xtrfG1X+r4xOn6CCr5JLRwf99zWcC1dl3hEQzVaIull9yW3bTaJuPLVSayN7hDvd6IhBhsdDwr3U0O8Oh5kQCp+uZEnalbpHeLoclJDq3/4lJMkSVol3gwfenVakWeOVty/5UVxhRgqnw0RPOnJEm6TS0vG9c4qrRP0Nok+6DRmZUQc1Jk/w2Zi10EfivWiUHEe9Wad5fAdNExTUbK16p4WWGVabnY1VlGVM7GpAU3FYW2trjMzBrmLWkCgFKl3PhQM4t987/1QYQkGA+qC6GXbwHqW+YajZYotj8HjdVsG8ojXkfXWMpFyeBynnBv+dlCS50W+NztiPKnpO174kLFVkMcVAeeMmlszDI0ypEtHYpxyErt+fyoCrnMidEfRT40v9CdSghKBscsjjUlosPSWc6T88oAcoOPDYOjc23NadrBpvCQs/JAHGGuLvK/5Uwme5CqI7tF9uyGSND0AySTOa7QbNZsidLzzRQtlZLtbAhDf8UGM2eVCay4RubCLlOgBmgx16bcBt5GxU2HiXLohCuvLkyRCEIM9S2U/gDYl3vRupolizivcXImSrOgXX1DK4puakmAyPr2Z8y1XWcMTk9IxOExVZJ2xMPImTypepoOvn/K27wFnJBoXlrkkJb8UNajGYf7mFcdzWaSa4XFykehfZ7Ct+1DBH++0SbtshDyxWM3u8/QecTlEFTqMXc9Z50XwRgexlT9GeZ4OHLhQ0VE3taLXICuJ/Mb8xxK7RCcJrKmyMxgUpGiPR8Hp0d3oTxIEiz8+Zwos8JP/CZSJ71rkRnryU8C6b8bUIc2XKoWCkt/f8vLLVJxVJCJgCILJ3gFi7M44NYA9Bb4AJYyTTwPiRtMgn7H7ru/PnrmpjYjhbpx6ToVP+4irovtV80nDceuQu5EnDR2Py/QBgx8KpZMO1KZ+Yl3JxwqGCCY/ujmh0A83orx5eYXDzRhIcc9303hf9IJkdPm1nOx//mHhkNpNNcISfVwt6Yz40+ejMSgjP08leRlx40kdYtk7f60vRsmAyITkbhoHrT69gWkva/uBjeJcAWx78E4LQoak3asJBx+Ew48HrAbqloAgbHjuObVYnMQuyBTtlBlXc9kQAtgoJAeDJZUj6hVWEfc8Mdq6SzUFzwi+Tg0yTm3N5fOJ6bKa1WHEtO8Dbr/+61mLB8xGPkCWXngdtvjCNzJRO+dKBXNQYUOThxOLZ05qL8topadgPcKYrlUOL7BOEgmPAKMv2S/eaV0Z7ZsXiXJkoPb2ffpIgdR3sDaUq85qa0TpGRh9d4cusCCENYvYXCmPtnOjo5LQZQ1V9PA+1Xv7xYv/2yHNHMQyIYD+f0T/9rj0IRlWMA7UpXnYLGtDa54omFtCPSZwuydFTxcUCm7219yL4/PpBKFU/Zr358bdqyr+Z4O2vInjiR6HVey4ZAJDLZHbG/EBpOUPFUaShgZOS90U/myXocwofAz0v6OgyOWL6qpafNuTn36h+PELIl6cS00nJTDak8DWuCse/45kfuwHSMDP9/Mut5EE4AhOK5VUruMlOypeDavwLKRyNKdr+2R4pQBhND1EgWTcfWC+/nrgnaA2w6tKEXJEbQituBY8gKjb5JrfQP0jyUbkHznWjhkSAQO13MBti/UFYvU2N0aoEj8+skTgD1/grTQ35mklyQuQTWjJQzBUWcgVZB8nmMVB3Rt1A13TWdzEVgHflq3mYxd2E79U1SC6CzTUS5em0R9CglbkbnrxK0ng6S86pGko3tZz193ZROQbA22QV5eVCGvga/EphBYHkh4LinjiONKR/43bjE35uQ0FNrwIg6rOqZuqSGp6O0Pd79cVvwUvqq9VDf7BM4ZtU9RwrnpedQGMkXFfyqjPRCL9AJH07rsLPa2a9+J905fiuc+P1tSt9liIb1Av8SWpCLqm9g1NaxYs0VPHhfd9cEwm8pOVUktzL71/d87D+l2UC00h12jtgk+xGcXfTwiq8WiiCA2J017XCOpGG+JYGlZNM1BNFf5zNNOa7x5qth+A9RoOhdc8vDSJAyuCpedt8r3/vGUWCRe23AFSs7BGHT9jHTQHWo053sNrBqc7mR3dC/3aNXnSgJPqqTzbu9zvgmVW8+PkMSEUPI9gqDbLzqsfo7tVvIBzUG7NQzwGQw5VKIASEZiSw2oxb64B20K2Nn730oEU4GJMq4WMvv/qUsAtbBJ1Wr77444qFxZqWUJOp6Q9J1f2vtBA61dzUjs4LV7+rdALLTv7Gc8n1g7PB8lAH93Gbppt3w3+G018+qlMx2ERTVVqx9+H+NndJ76LXlBQpwxdRaSWlLeUJCxTf415NXW7OMJsJSH2N5MbxuNJUIZb46qdjd5hI9b3rOn30BkGA0tRfrlSrJyxUox1hKo3ySWlcWJUuyNrmNPTkYgmhmYDo4NKtyp2XzCChMH5/j5OVtBnrD0CavaqqlhIP/uAe387yJFug2JLjEy2v63vSMxCakVbs1NZo1JeZgPSNutK5hvmPcDqhZeXHIpqAzLCEGgDLQbZSGgv1/uKxzWvSHEkrcZnVUiavNGzN+6D2JZr6/ytZg7r+Egkgb0fH73UEdL+sYjIblMKrF/BxHkLhriTEbgL6acAvJtenII+GKAObYbqMuG1a9dLIHHi5C6Jk/up6ChzTU31jSyMG/gThz7rXFuar02KAbOtyJ6rPQlmITJILP38cr2c8L/bwtz2xDR54egehPdWJr5fOIEL1Vmg+uNkrR+FeE0YKtin0BKASkCjXZHjXGTddWMzztiSLrhPcoHzLA67bZgri7Dhjdtk8pSk5Bn1mwOaIcP/LDAqnUPf6uhNV2xMT4uq7pZZaEe13Xdxw1u1BzmAsAKvOng0d/Qm+UsAp5CL+/BZNQZMYWIo/Y2DUCkjhn8IXh5iqM2jUYEfa/javcu569VwFtD7xW+Jtn2N7ATGhbZrnxX7+3jKPhkaQUMK4APDMIMtDx//r3M9Rwq0k+NaoPNdld1Zq6ubwlM3BZHb4PaRrFtfB7UVnm8iAXCLSK+4MdsGrUyyWLQEVLsIqIAKe1ct12xKOHPcObp+1mxsrp8ixc8
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"destroyed": "ENC[AES256_GCM,data:7sd4Tco=,iv:MWHc+M9XzPsNSMh3OjlGTv/iqEAa88UzwJI4W/5mQ/w=,tag:6QildwnOcVlayz9ZQIgAfQ==,type:bool]",
"id": "ENC[AES256_GCM,data:WRALH/6OlcAnv99QLX4TAdQrNlI=,iv:KgFwONgJzN//QN22jkWtU2C/GymVfwtEOV33/PdvTGE=,tag:G9sdFzYvhjJWZ+AJ+bvBJQ==,type:str]",
"mount": "ENC[AES256_GCM,data:YgweOaKY,iv:xqQhvIwKYlBPMjmmmmKOyAO72U7yibzesFp4Ai3c5c0=,tag:NkGUp4Q6dmiHzKTjJ6GQpA==,type:str]",
"name": "ENC[AES256_GCM,data:LQyd/TZT9GM=,iv:fksHQU4f/tpSEjt+lUcPpbS7AmNFP43DIslyvPQQ7B4=,tag:vbVGy7y6Ne8cyAgn2gcUGg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:L0oWcuHATL1oXv6TOGRabGFYjSw=,iv:Gbi+crzfF4nT2MMx9lUt94k1wktv9qAVsGUaoveL540=,tag:tChMwjzYRDGWAA3r22HaIA==,type:str]",
"version": "ENC[AES256_GCM,data:yA==,iv:j91yZR+UvRiDsY4j4Odvyn1DI2f8HVUfBnEEk6UZP+M=,tag:j2fSQagYoZ0HJ8ESUI3moA==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:5JQIiGr5WMF44jo=,iv:2BB+2zvg0pCs0Ah13X6/sjmdCTOhF55ultI5/EOQG1s=,tag:jSDrWYzIm75Cr122lWlFxQ==,type:str]",
"mode": "ENC[AES256_GCM,data:p1Qj6Lqudg==,iv:m6jwrmqK+QM7+xfkaQyiLQQYCAQyz64iyXiQeyoP6mk=,tag:y7I04Q4rR4fesQj0aZhoiA==,type:str]",
"type": "ENC[AES256_GCM,data:j3os5uQNw43fPDXdmxgEmLC1JybU,iv:H5++ug6Zrcpyvcavd2g7HMD2BfrTUZ8BVFTzJYFUxkg=,tag:eN7bdelwoLz1k/yzB0hpKw==,type:str]",
"name": "ENC[AES256_GCM,data:0X73ZB7YXNpgNAI=,iv:3aOqOAsdgMXDx6er3DIYbM4l2Df/M0UqhcTmIJ9JbJo=,tag:qbteGj9brGzQjPlVTzYi7Q==,type:str]",
"provider": "ENC[AES256_GCM,data:wiSnHvU5+DjhYVYNLPOpQQOzj+nAGtQMoZu8qZrCwzR79tTq9C9n9bB/brCHort9sg2YoK6n,iv:jASLxHNd7V8Q8StYlaLT2lCHEnMTX42VbjkExIEKB6E=,tag:J+OcbuRMNskee/b4S9FaUQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:xg==,iv:32YW1TJvW+ssx54MxfQ/TRA3uNmY64ov9Dqq2dz5W6g=,tag:FgNQr98hZ1aRiG7zLqjSgQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": {},
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"config.json": "ENC[AES256_GCM,data:/fPM7qO3cKsHzx4b4rszIX03RfKbo8kfed0eo88MX0fCr7ODhi2ffHC4DBTPNj9GmEVR79/VhrDAig85/xInZiU4CktdZeZZ3Kk0FkR3HlXSn0zXPKFnLP17wDcepRsJMgkhzva49uFsvhfqtAIjt4dMNUQFiTAfLS9TLK74ET36QqdnYXfV0NA1VHmxjqzHjFC887KgDVDJe/CKBTKm5OoQTc39MCpEOTmtL55fuaayLITkUT3VXxpvcnbHf67Mx5FLjVrxioVTD3UpbV/RLj6LtjRwJE5jVDxENHO8N9D9KbarGh+dx38WQve6ca0f9BzzchiULw/R9QcfmDUZxIX4lDIabxXNsr45Z6Vxk0igDiHEQNQD8ULo1m6x958qmO/lCmBQdCB12GkSHJyaeMLNbC1H3A0pM1Zq0pvsTEaDRU40uUiShKM/UYg0gWCOVxc0XZq7WPvqcsCuMuEWISKGz8YSPg9hCBvnAH56NyC6RcoE08H88PNF2XrKzxIwkDD/uwl2gEwnHWOZw2UUzebZSYDv2UYLvh6bLkDWrxD7CHdzLZKCkMRoT+qiANvdnWueOoduNf9+WdeCHB9Ee0wj+pcaIvB4NF+GlAqiNR771yoEoBSznQTysn5tJq7deT/Fh01EprPRGJ2lWH2D40iWWqjMg5HUWZ6POGHzhRW4VWf83uhQx+PmXFNSUu5dGXOgqR1W32Z1FUgvPK6C+GYGOQiTbYIQZwPkpyojmwkyS1r7jf48rj2jN+EYK6QVU7Oa1JWWc7pcHTy/LVlPZBm0+pWSwNFrGbGyId2iVxKyTikDt3gYk6wQ8pTQDpUgRL+iD9TyTZwUQRxTZR2h4QjsxEvtkHZmg3jPOM5ij/9TVQPbAOuv2sBINAUlb3jUvAbrMpVU1gp9NAAt8kRPn7XIEsYUSc1sYQk+u7y/2GZZHUXmlyj4g6cZkbLmI3M5LkGNCJ7f/rzAp4fWvT9GF4ntBG9i+Pc285sUT4VUvFCHdyoucVzfDiQtBlHfgMlmuZySVr932DgsZL4TnN1tJjb8QbnHeMi6WVAOANrB5pdh89gJWkS+zOJrM4Wb54640q7AI/OYAsVG2RLZkrSmI+ADqxJ23f8K5zSs1rpbja68NgDjOHxcUhVhr9TFZH08jhVnpKiCqgazSXZtk+zfZ/DD162N+fx2aAqc0WzRn0DG1lx7ov+nvamNXEkBQNnRnzRp/l6Y9Ly1URBzUTH9YaxLQT13ww3JtPLiNXdZ8uuT5crLQKW8xfiv0hifa2AY8Vxd7RXIKTmKZLOwUs458a6eXAd1XHfqNKR1vH2GOjcxuguJsAJIErKtz3xKzqgnPhr9V50UfFh/FMJFI4b/wnR7VNZNM7H71slW1QfhXWisjIohrRV3/iaKQN4rmllqCLJKN9Zi4/Ec1JWkrIXXUfQA9NyJTkhgLVU+pthBxCndJlZiQ8VSnHLafRIA/fvEZlhE5CBtjiqPw4CgXAjR3Fnv2cdpX3iwn829R8yTsQ8x/G46+TwXbCqXaJzWbGcNTTAeLjIwUrwV+fbn+Wr3Ss5OD4gi8PfndtYDrrInBhOEXtR5XycLz0yWnkLLi19zdM56hO5aNj5hHz30hz55wzrYnYqmD8tO1KLQuXOfOUU12mVdcdAGzFihNw+tZc1oLkHNUHEocRIDvrAyWogyFlYCTLkTmCQxEcK00D7mF2U7WI1vbqQ/GWKEFuWeku41VhmRkdtD2sJm78wVIbv0ChNFKOHlnKcn/oDiiUUgV/D5IzZk0S25ok2BtOhKcL/xQswJLmHgUuYKCb+WIgSUluYbo6+/SBklb6MmKDobsk7zPKInGbp7pBNTQ8pMFC+Aqn3hyzMz9Gkf7CQz05OpqeG0ePOR5WoR65gEx5PK1E1AEyrbtvN1YtuHFl7aC/4JiUuCKKYehMGkC2wda8T/mY2MOk/4lDu1Mdg0kfvoo3G24ttiS7eWP9gS1Rcq/0imSXea6fq+HH0HVIOthVx+cbZUPkZeKEpbXUavrpOsNWMQRgGOg5nOokreERfU3dKHN/J8IkhKYbPyFaxP8Zc4Jt/1kg8LdX56UzDfRZ2TeMyrveXgxf/LMODSx/X94hdm4yS4BY1AB23Se4lheFnqHbX+5YMfpJsBk2/Pb3j6Gmb4ba7yLM5tNucm9dzU87WZcLt+CSn3L4oSRfStGmWE3grFzGzsfs14+HDt5TSkbDYWEmnszV2Ocjj1Bg+mG9/4CdmQzl6doevMQGWF/hasUgmWFRMIbN1q/93BNRVL4522aL6kLLFywQZBMJt2+JIrwZOBIEyFrKvm9dBmC2Ofi+t3a3681T9fC4bp1yjjhxEXe9p2z6PaIcLEC6wHYM9IzEzWhqjjIfTpzJxy5EQleihnHNyKTmsoyRjaoWFBPxCMcWNrhSXc0zpjhBZ7Oyiigwny35YIzDyU61VQ1BIYQu+o,iv:FP5rwBA7nk7C5w/Sl9/DSbWMlzz1z5Z5/A9N708OqiQ=,tag:lJjlRMixRVzHXuJXKTNKxw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:ykfrVsAOgGzcdst+ku1aeA==,iv:zD4qFUQKLkgNokwBQHVepZzQ3vKJslzgrixzDAKnAwo=,tag:AAaSEx9+yVQWrjr3oIxK5w==,type:str]",
"immutable": "ENC[AES256_GCM,data:/5qP4ss=,iv:b10V7PcBP4JrrCPZL+CeMLi9gAwmG43iQLPxctcBFyU=,tag:uOE0kdkxxKeGmmdN8YldRA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reloader.stakater.com/match": "ENC[AES256_GCM,data:Sf0vaw==,iv:C2tmpb1/1Y6r+zdd1+mCfsvcxHfTvc/qSZREEGCKRGQ=,tag:VOWDKCKv+JzRciYnQlLfxg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:UQ==,iv:o6VUlAE69xmWEbwAQ6C7SS8w3kExpMHtFqaHngONJ8A=,tag:w4M8AYEzRvgeQT5yildvCA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:HMbdIA==,iv:EVIiuWR5JsXMFWWoEBLo4MXGl28wwZJHeGLBIo2rzjE=,tag:O4ySebGBWN6i9IzYQgt2tg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:uPdzmLZ8vpC9So8=,iv:Ig7zfaX/r5HdA9R+MlXvXmMKjbQNuy49qeX6lUNENyE=,tag:G6ruW8wSr5bAWgBY74GrOw==,type:str]",
"namespace": "ENC[AES256_GCM,data:oSmLLA==,iv:JxdtRL/ZRdWCeV/KFj53TqCSDC/rEcg08/DdkAYsVso=,tag:X31iELl/HTlAjGIhqQl+zA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:UnSkUdd3XKaZ,iv:v2sZhAlyflFiBX1EO+gEfEtyNQGR7E6goJut6hAcl2Q=,tag:J2qLJ5e3BKMRVtbmUyDPpQ==,type:str]",
"uid": "ENC[AES256_GCM,data:aIb3gC74WbjxVVtqjaD0M5TCuOE4FHESnbmKnDTUgg0ctCIu,iv:d74m7V6iVFFKylmqxg6sOSiCxWPccJFTg798rvdSP6g=,tag:hBTFoy9/sPfZnnSF5Bv/ng==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:yIeHw5J9EVo=,iv:UjyRRVQTMnQVfPfS9Lvi5Xnpoa8NOIBtzLprmttzRFA=,tag:VnH8OupSLcoJm1MKtGKrLQ==,type:str]",
"value": "ENC[AES256_GCM,data:nSyNWA==,iv:mhxCoCL+tErJ6j0iqaujzGg5EeuHETmGFOSGKYJIUL0=,tag:15S9SKlxPzz0KWd6SAhkbg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:p7nIWPE=,iv:1N1xjz5Z+20UWeSN5AslrRQJ180/Ad+s8C9Uc8AccbI=,tag:NzbWk8YSYDD0D7kox32Aew==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:i/jPnNQxmxE2FLE=,iv:zkcgN+r/TMOQ/KmKS/3dgqGjJB8b8d3dMJkbnidWAnI=,tag:33VxLXDnn269taZAyE0u2w==,type:str]",
"type": "ENC[AES256_GCM,data:Yl4XXSFE,iv:BMPjeuc7U9t2y2OKZk1FIdt+mbfGVw6NLeTAe0E1gsw=,tag:SINZNvLcBaRNwsBehauMbQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:EbjH8L+2g78=,iv:IlCICstbAqFMYKRY4hAzC9fM6Ha3Q/7epzNMJCuyW3U=,tag:CmvP0m6+Bz59Siox/pLLJA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:h2PuWJacHCIgdZ/PnFivjOf6s/xDVosDGNSSS8tAhg==,iv:atWvMdnCFhHH9ItUFll5MGglLVE/QZ15pnh+g1m6hiE=,tag:akVBkH2ifsQ5aM8eslr14g==,type:str]",
"ENC[AES256_GCM,data:5VNhdAwa7+OL7vrU8o8hgxSnHGDAhTc7Poz9ZVf7iTAeiAhIRQ==,iv:/Rq5yAyXQLIBEHtp5zxO5lVs+Rg6Bkswj9xmo1R1nn8=,tag:1vE56jk8M88OP86hAbUawA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:yMp/Hoc6Rk/iB94=,iv:nRwACfYEQRGgPNvLas+Q79ZbO0cDBvv0zCEAYkRxMeE=,tag:N61ECrdnAXXvfUEChrw1aA==,type:str]",
"mode": "ENC[AES256_GCM,data:UuUuzhP8WA==,iv:t+MUEeHEHRRxnfKv1IkJ7eSWm/dwBoBfTh0o100SpTU=,tag:gtmRWHhmoecsA4RU7/PAIQ==,type:str]",
"type": "ENC[AES256_GCM,data:asdsdGV78ZYDV5TMoqKGzhgBvPpw,iv:VaolmNqOuuk8n44iSWLCg3V54jYESe+sYTlq3G7biyA=,tag:qEWF4MLMhz2eDXTB8PogEw==,type:str]",
"name": "ENC[AES256_GCM,data:0kAGVQ==,iv:BkC5emPOMbk9f17rzykRRCfZEhoyQ6ktgYcUqBv4uyw=,tag:DBxbt/hZDqHrt5B2vnTdfw==,type:str]",
"provider": "ENC[AES256_GCM,data:zQ3NgpQcbcxetQVKgbXURyI+7qqPcMidWUzNyzZ1c9qARUwkeZ5CmPDtT/pdkuN3O534reNl,iv:gBDFkbqN4uj3JTKbdgTqfGPh+/8pw25xI3oK33C8S7g=,tag:NQgs407sBQqgVpc/kWfk1A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:5w==,iv:ScsH1LBjB84uAhPzZtXdXewWTIbLVgca3LvC1TEzeZI=,tag:J88O9gHHwAYzbxqDKri28w==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:QDSd6IMQVedE,iv:aogFi9Sj0wmmeWmG23+h2l9RVw6GiUsduFXmM51XEUU=,tag:W9YubTj9s7ueHZe4EjPV2A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reloader.stakater.com/search": "ENC[AES256_GCM,data:B10WmQ==,iv:aMyD9EKkTV4HXWXmq08lja+p9VIOQR9WLmMBT6mdBSU=,tag:bZkFbJzqdNGD2NBE3kUEXg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:8Ls=,iv:cv7J7QUXdScHJ+zPuQIG5+1BqVYIIkaCiuP+dNjTuio=,tag:q9S0As/rICNIZ21Dbpn8EQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:P1yVuw==,iv:B22D1RfyCmREqyG43L8o2YCamhC4vA3RXVoBWT+CnGk=,tag:FF83sVd16onsIlc8vGuEGQ==,type:str]",
"tier": "ENC[AES256_GCM,data:bZL9sEhw,iv:H9tDqxNTpxHFc7sCx4ovP1itljV+kYHagxV5Dyn133k=,tag:A4aoO8c27OwXA6GiP+FDJQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:t+m35g==,iv:2oeLouP7Qvo2u9FEBYXnDLb9QlKH8T2CS4Guroc///0=,tag:1WFhLccdSzjQye27eNjEVg==,type:str]",
"namespace": "ENC[AES256_GCM,data:7/bwlw==,iv:hRvN991ysVhbELLICB8JaCTGIINj5MlrG9PLnnwqBKg=,tag:JdtXq50rAGnXvC+qFsDLnQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:kxZsadKC2aza,iv:5NW3R2k8eU8H6KAaZWFyuIUEumqTWoGHxXK+BkfpdW8=,tag:BEcHP65d7jJNez5dHg+vYA==,type:str]",
"uid": "ENC[AES256_GCM,data:t53v0VRd2pRiqnTeCl8proUTPWs539NtFQ3WUpOWECMB+fw6,iv:IteAJzripqZZbyTvyBwOww4s/lE4lI3WV5xiHkeOyoM=,tag:L+rLmXpL2BwzyU5rkWP3cQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"min_ready_seconds": "ENC[AES256_GCM,data:Og==,iv:uJECmBXVvckFBJWGjWEn8JsRevaLdcrSkxEvbObc0Zk=,tag:jcnY07fWzxmI4Gl9kYxneQ==,type:float]",
"paused": "ENC[AES256_GCM,data:QsuYoVw=,iv:4CTDmNF7pwukufNFAYL++c6otzWbHZyYTffo920K6uM=,tag:9ydBR2mtaU7e8hiOWUXnvA==,type:bool]",
"progress_deadline_seconds": "ENC[AES256_GCM,data:ma1D,iv:BARI9BtSIN1qbolRsksw5Wk/J69my2ktT7/3ZLLZr9s=,tag:iLGhfs2X3aTyb+PPvmDgdQ==,type:float]",
"replicas": "ENC[AES256_GCM,data:cg==,iv:o0nZ6TyW/PDfExZ4vJMYCOn3yLDEn3yVpb+PhJsQ7As=,tag:CY1/UJXOmLk7SHqvGy3sWw==,type:str]",
"revision_history_limit": "ENC[AES256_GCM,data:ShQ=,iv:D05u9n7OQAk1U6bSTPbkipCm83fjl02HRUUhKIWohGw=,tag:inGITdaYEDDennWAq+W2vA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": [
{
"match_expressions": [],
"match_labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:m8aDkw==,iv:k5vejVi4ZLahdcU6Liui6QKQHFBjuN6sbr99sDBSj88=,tag:7BJnXKiXF5+ACjYs4CeFmQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"strategy": [
{
"rolling_update": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"max_surge": "ENC[AES256_GCM,data:Dg==,iv:kmUtPiow+A5zykp0QapcgdZmwy9bMLJirYq/mAiYz0c=,tag:IomtpK5IcT9nsKjJEYQtbw==,type:str]",
"max_unavailable": "ENC[AES256_GCM,data:nQ==,iv:M6M0ZLwJPoWTuoG6pXRw7zWI2/B7h8n6KDFAM5mxRCk=,tag:tP4kL8RhK36MICx3jROCyg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:DaGL/XQkk64vAY+bLQ==,iv:lRW3ISnPntXXKbYSaDyE+VdNij6alpP2HkGw2MObBG4=,tag:jT5D3nodjvPvPagV6xQokg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"template": [
{
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:hQ==,iv:zWkem8IE4zrJw6+ldE+e1azNh06w5DISA9AezJhvCs0=,tag:7JWjAXjw8yQnFQU1GxkiUg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:xmsbyw==,iv:NU+pZfMbwPV/UJaXzoPW6vPycZ739va9k2I3nuuKTvI=,tag:W+99Csci78HquYy/dgwEzA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"name": "",
"namespace": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:Mw==,iv:ZNwBIT6R46RDNMfoL/8lKnGy0Acu2i3r3mpmsJ4ejU4=,tag:/xsf6amXJ78giAWcQpHqdw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"affinity": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:yZqLtg==,iv:qcV1ECB5LIlfif57Cmyr1TCaSCUqpSW0WjlX9Fnb5qE=,tag:mQxTCqNlqYdRdv7O9KEhEg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"container": [
{
"args": [],
"command": [],
"env": [],
"env_from": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"image": "ENC[AES256_GCM,data:aeMX1RVoEBbn1fxUhA==,iv:KL3i8jFbp8RjFL9X1l56R/JwyszhokQ0nWUQrd41Uvw=,tag:Z5h7YZU7nkv1QJt9J1xevw==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:GieU6z452ntc0p8f,iv:kc1L3n/7BVXhAgfWSQ/yee4AD6zDFnZrHba/YZt+P9A=,tag:JSD2r5tVClMEKyXGowLejQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"lifecycle": [],
"liveness_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:GYb/5A==,iv:rrc0hwCw1e2iYHZhNa+MQ48ZWJeFtYwaJerzDEvF9/w=,tag:SgqsN2pcy0d/1e0c0cRCpg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:XETYYQ==,iv:7QPVxZOVr+0EW0GusciqDgrJGrRMYpBkePBjhg+D6Wo=,tag:tyq5TWwpMoZRflGBnkfhSg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:Bw==,iv:6BC5YaDeGMjGSOPr7uD+RNE70BOFbp6WF2ZkeNTroJU=,tag:C4SG/j8hDtGnZ1VuaArxJw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:jglx,iv:fOCTZnWO/Ydw4Yw8KL1YXqSbFn6B6qRy63mh29FLxTw=,tag:+BtwxVgih/fFuPCyevWUrQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:zQAnvw==,iv:MHtJrMhQlJkwUXDb/3WAkzPMqu46f4n8u2PSA5iHpsk=,tag:u/5iw34E48XEecFXthgR3Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:0Q==,iv:a+L9nd4f1rSSF/UmmX/u0vZh7feNEWTx4qwy425PARQ=,tag:5MS5TkrwIG7pKc5elCn+/g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:bi8H,iv:xmW4isSmzh+gf+QoJmjP/JCEMFYvzSxEqQtd8wKyFto=,tag:/WsKdjPPt4UeGmA5B6R7VA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:xVQZrA==,iv:kDQYXTrU508ParNmZnDFFlDtciFjF4w7/pfC3qaLgrs=,tag:K+eHYaSCB93sReBH03HHBw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:Jg==,iv:6fc0JFre5zZ3PLtay2LSxMP4pRNeZCMVuFcbuY8KvPI=,tag:BL3tTQX3tDMa80DfVrW1UA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:IcXv,iv:Kgtqvg6kKIg2ud/a3x5fde/UlWBo3aez7pXa0nYXVYQ=,tag:0f7A0MCZ2k2F0bdrl/dQ2A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"container_port": "ENC[AES256_GCM,data:aYeKJg==,iv:k/eaDkPU0WKRyO1DyUj7xuL93JgUgaqiJ99lCx5E/SA=,tag:O+OLLlVK+sBH4tnBiAv5Wg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_ip": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_port": "ENC[AES256_GCM,data:CQ==,iv:bZ3VCriY/DASgYutdXQsVMAoNv4MZUBUPBaBTorp14c=,tag:NLuObQ0mD5lSiq83bzjg6g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"protocol": "ENC[AES256_GCM,data:nVPM,iv:lpQFDL3ikZpnu4Zj6U2pcXSgVUIrUN2EEHK7AsGR0ds=,tag:g8vBDc1+eTujYmjoJxBkKg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"readiness_probe": [],
"resources": [
{
"limits": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"memory": "ENC[AES256_GCM,data:j8eeVA==,iv:8oX616sGRj4A/trxjYeSYJCZXQiZ27F4v2LEtfmaVj0=,tag:QCjsppgGiyhyy6npDZFGfw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"requests": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"cpu": "ENC[AES256_GCM,data:tMhx,iv:cnSUjQwHQqu7WkbEjVq3iHF7P55gHar17tzBZGcUpPc=,tag:3mA0RBg9DQjhrjiVZJfUeg==,type:str]",
"memory": "ENC[AES256_GCM,data:cJkIQw==,iv:HUVcdt6PP+NM/3Sz2Wx79JRldBapdpzP+C5Zm3fW+Mw=,tag:Kb+BbkgO3JZSLcvGgLQYlQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"stdin": "ENC[AES256_GCM,data:dcvwnlg=,iv:i25wLC6T7lECMpJ7O//hislV/UGHKnV1Mwz7gjvo1po=,tag:gUXfePs4yCBznkVxD3JDZA==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:1hhfJQo=,iv:vElfkaS92P+FHcRI5IBabW/x/GO/3p53yxbWASMN5iQ=,tag:m1TL2aVBbEmXw4IQgxkJSA==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:AuiMaKi5bcPGABUc4XQnKPRPnQo=,iv:8yofa96HsRwDpV6G2kF613qS/9Jtpet7KJaorOJoAzA=,tag:JOw5RO/5nok+AGCImRm0EQ==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:xX4VQg==,iv:Olk14uxk0i3xy5BdnTfHoa8bxxzvyowT7Ep2scPypII=,tag:BTwhoGurwOU0m4SpTPlRVQ==,type:str]",
"tty": "ENC[AES256_GCM,data:tWD//1U=,iv:OAZkAeZ+ZA3UW9K90MyQS8mj+oorpIfN80bZexO1CDc=,tag:6bFrJuXOCupqCxi92+ZEEQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:jZZpSS5weaIpPpiFiBxD5zU=,iv:fK/O+0+fqSk4oo4WD4zJM6O4YocV9aJ5JC60fqBLxoM=,tag:BTxTgUCDxRLmO2iujMN5tA==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:siGXXw==,iv:05309SzdvCDq/9oVXUdCa/zrD1PoKV5sIvGmMYOWWZg=,tag:dd33yDqXPsSoXgIf1OTF/g==,type:str]",
"name": "ENC[AES256_GCM,data:cs3O,iv:KFrHeJxU1rgtx+Qw0Soc713TO/NjoE9lcv2qlXh2fT4=,tag:zF9y0E41iBVWBx7DfIRCOg==,type:str]",
"read_only": "ENC[AES256_GCM,data:BdRm+3A=,iv:GEa1SuDzAlENCPDvHgA/CUhBvjs0scU3zKubMWxBqyQ=,tag:EXwv5sw7nf8GmbngnYPDDA==,type:bool]",
"sub_path": "ENC[AES256_GCM,data:j71FF0G1bQ==,iv:fqBViRLkhtIvRAqpX4azE0HQZ0KAP30swG8nV0yNLsw=,tag:M5eTWIiMX0shzhzGXI23gg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path_expr": ""
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:5bk0zj2Q1EnOssi6X9N4Ld0=,iv:ER5o6AYwDOx5uUutZPDjXU1pzMXBd5qcgoVv4Dx56eQ=,tag:UtX8s3WAd/hYm6/utPXwrw==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:FsGluA==,iv:N4u47i98UZcb9J6li9sNMjsq1gOe6iBk94CltxP760E=,tag:/FsFW2pi5PpO+hPAQCS3+g==,type:str]",
"name": "ENC[AES256_GCM,data:YU49,iv:gkGglO3rH5Uu1d5JE/8hoDOFJZddRaTTeY7Y9vWpitA=,tag:OjsyhI+JQJMpl/JwgYutog==,type:str]",
"read_only": "ENC[AES256_GCM,data:qi2q0f8=,iv:7+S2LhaXOtrto/kMPPS0z8vuD0K7WBTJhtZzc2ajVjg=,tag:KhDn+m9lv/+uicjmxpyZqA==,type:bool]",
"sub_path": "ENC[AES256_GCM,data:TmliE12X8Q==,iv:sgHJXPpAF9Z9e4LW7Been5kI6LhpceSecabmg+ua0s0=,tag:A1HcMYOVn2AvfjwbGvPlMg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path_expr": ""
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:sMI5JbX5Mf1Wm9TtW5O8T/Sc8zQ4,iv:lhFZUcL/PeKljyExd6AsBlKd7v8U/qlnEWAAYIHqZ/8=,tag:/LmbDF2C9TLAObK3sPjFkQ==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:Wpzc4g==,iv:HQkykIbtDkf5bQ4/SKRvJLo8eYjLZVoEJxwN8eyaVv8=,tag:ZUMVvkrd6EqTzJz56uTvGw==,type:str]",
"name": "ENC[AES256_GCM,data:dNU7tBxw,iv:y9cPpMXh0Ms2r9Ov1I56AUvoxA9cWVZ2z+3GiE3/jPc=,tag:Y9qJM2KoraiherD9VEnzCQ==,type:str]",
"read_only": "ENC[AES256_GCM,data:cpZgYEA=,iv:FysRWxoYmgj3CpehJeS2HY+P3qMA2cliTneedIobhrM=,tag:XWQVz+gUkns2x9TIsZq5ew==,type:bool]",
"sub_path": "ENC[AES256_GCM,data:kik15WSTDMqPEJc=,iv:yR22HBrITKuTFv09/hi0a8/+z9biPaN1X87fCZllSis=,tag:J1KE/eqXF85deCSOfZGEjA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path_expr": ""
}
],
"working_dir": ""
}
],
"dns_config": [
{
"nameservers": [],
"option": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:4/nPtKY=,iv:I40tSqO51+NwKSCUcCC1/j9CMl1ybYwREsh6rXYM9zA=,tag:0BtXqmPCozpZnk7Xshg9Kg==,type:str]",
"value": "ENC[AES256_GCM,data:lw==,iv:ipwNKIC2cRf5iBUZ8RCiY28Cjt/OhQPE/tPp+p3saRQ=,tag:ojvbJcmmloJjSojKE2Jegg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"searches": []
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"dns_policy": "ENC[AES256_GCM,data:lb1bKqibVbboLDgD,iv:jk+qxhwZB9drsfNaFwMAVRRGQhFQITAXYuTiZcRDibs=,tag:B1Wv1xgu9JUX1LFFbKuEBA==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:MgyyXQ==,iv:JgjUGTr8B+9LSGhE0rej0OqujRZvn9TLP4pQaQ+f1Yc=,tag:imxXfL6BAd1tDOZPxgNDUw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_aliases": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_ipc": "ENC[AES256_GCM,data:gJexliE=,iv:8hGx6/FiCYeiAbs3DXjKH+IkldBSPp2c5UL2N11u7ak=,tag:Ljofzyv0lLn4b1YFEvvSbg==,type:bool]",
"host_network": "ENC[AES256_GCM,data:kj1df+I=,iv:Q3eJprjQX7ZHaIpFuEHkM3Rpk2eFZQX0AFuN6JPBrDc=,tag:9Su8BmRvW8qNgxDR3GNADA==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:5Zp4a4c=,iv:wncfch233y7TzMxz2iB/l2ycGJB+/5StgLB9699/QR8=,tag:HjImjRzxQiPOpLUrOJUYEA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": {},
"os": [],
"priority_class_name": "",
"readiness_gate": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"restart_policy": "ENC[AES256_GCM,data:Ot19TsMq,iv:tLxQYRrh2xCQYNyZON/TfpEBiANtSgih+iMMS7ES0Fs=,tag:L7W80wpDE/iYYWBwWq5YEA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"runtime_class_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"scheduler_name": "ENC[AES256_GCM,data:jWv0Jl8DnXnRHVZnQsZtQkw=,iv:81mKMCrw3gywzcRthc1r1/vJjQbNdZ+6/YA8k1fCAoA=,tag:enhlR/fjWICQ1Dr05YqfmQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"security_context": [],
"service_account_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:mCJJ4eo=,iv:MIqj8WHet3vYSTEIZv4Y9G1WrIdDdFsIQaH4Nk4J8AU=,tag:npAoVYaEIeFDx8y5hnZKVQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subdomain": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:Fww=,iv:OzEaIuAuBeMfn9P+cIN158uR2aqWr+W4S//Ku9ZK1hM=,tag:67VAyLK6+lh9r8tuWwt7+g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:VEHU,iv:FRBdYWUT/4hsncHFkBaVWUoqqJ/2L///oiN96/37rnw=,tag:dDdWIS4LqyeYUDj0m/8G9A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"default_mode": "ENC[AES256_GCM,data:f8e3fg==,iv:yN31eOuvjUxU7tY+hpOJhkugGUgSOFMLYKejxYkMuS4=,tag:eXfDsBpMm7oHnZUgug2PXw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"items": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"optional": "ENC[AES256_GCM,data:4FQ+wIQ=,iv:m+5BedluuyhKLMumLJfosiyH9/BkyS6zixLlCdLzpF8=,tag:b8aiWBj0c0gU4qaXwzhf6A==,type:bool]",
"secret_name": "ENC[AES256_GCM,data:BBa+qriiUJgSPQ==,iv:R56maDv8gcF1VarlzMN9AG7LL1smb7uWznUH81KzKbw=,tag:rfhZHOmPyTBmPMpHiRFIFA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"vsphere_volume": []
},
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"default_mode": "ENC[AES256_GCM,data:Ld0vhg==,iv:BksiKBA+yTHMUYZ0wGADv44IQdCmCpWEMLeZKg5fvvA=,tag:79RAGgORcbkDPwATdIWe7Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"items": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:A/6Ikg1sHydztpo=,iv:/bR7s06BJz7t9qlW5plIaRON9ZBlxlCUFsUFxYI6lA8=,tag:erdMXQ0x9gNWnrE/s+i+Gw==,type:str]",
"optional": "ENC[AES256_GCM,data:EkJnQzs=,iv:4k63TqEtYNzncjMDgJG375E87xZ6yarONcniZKVqksU=,tag:QX16xdkqIezYyJIqmGsxoQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Axh1HMBX,iv:MX7BnuFWumviJvNQ6TyNwQHFbqOmoHSC6Ok3Hm2mxOI=,tag:osD9EKLRRlwc6M+NbRiKQQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
}
]
}
]
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_rollout": "ENC[AES256_GCM,data:NKR8OQ==,iv:WHyFQjcXULXyMGLxCOsT4bLSkXUgEM9zW1Ia2tCGZbE=,tag:LjFO9PlID71eA2WQOl9Zeg==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:VSv5HxA1f4Y0Z5znhzqstmsG+wLJpXOr+1JNPYgSebbrOlWKwXhb8+htYB9eNNGqb2FNWWPPX7X/P6BtSzflilBvJMfRJZ6ZcZrgVFHKGb2WtDmLPq48bIX3Gh402WYx2J38eSIPpVJPjyrpWix2yBWdm3jjlwUZV533R0l6/+Cz4MCL2SltFeOoeShZp9vtfMXJhhrnuGgnuaIG6f6EvpThL3VGsVXS+ttPvQ==,iv:LmhECOmvysz3Crfe1IkIuWoKQfeUlyJIqL19y/ED/4g=,tag:eIxjDgukhO7PJm2GZp/e+A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:bLbVNL5F5E4ZxPPV2/f4no3dyljluu1g7XcIIno90304gg//lw==,iv:ivmvB78gyk7vRnLh3FxJgkzczE1aitecnPucNtdLUn4=,tag:AW+4WcS3yahMUOONUMFWWQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:HABhJAE5CG6hdeQ=,iv:F5ku2IgIJtNfs4zwjC/Tz99zen56CahWzVC+98V2BXo=,tag:JYGmCIuVOAW6o05jd+Z8fg==,type:str]",
"mode": "ENC[AES256_GCM,data:+9KF4FVwSA==,iv:w/nhpxWPyROtd37AHJ6BCRZTh7f+Fv8miUNoFuHQeeo=,tag:ue630TB+w9yWydwi1DQwgA==,type:str]",
"type": "ENC[AES256_GCM,data:KNbAyLkXg3JaRyBw9eWN9JF37xc=,iv:onHKkekgYXfyTWa+PCDjk+igozgpRDmmUPU50MZrbgQ=,tag:5xV73s5KH03lW2b/heBBHA==,type:str]",
"name": "ENC[AES256_GCM,data:tFfHqA==,iv:GM5FiRiPlqZ/3C2DpfY3iJ7lnjyBwW/ypD6b2wu1n4s=,tag:E6KkZhArhM05AQyPAglxJQ==,type:str]",
"provider": "ENC[AES256_GCM,data:oSwZa1LdNHf1UJLC/vKFfvIDSCFfr+1+2j2VqcOp32Vn3+4son8nc7Xsjscp9t0Ju+Umo31i,iv:/G+v3E8Byf6JtsB5IAGjEkC/z65GlH1iUN65oCwOcjs=,tag:ai9loTuE2D6WZuUPbz0WVA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:mA==,iv:ilvdeWFkE48j1DEfm6jzxCJaKOxWdEQEqp6+0LdBTBw=,tag:zmyVD5t1QW2mJx2b0S2XzQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:UTG8oA==,iv:F4nY/K5u2FnRssVbWw77GE22NFeqUJ2wcOppdwPo7eE=,tag:g6sNOGrxJj/4osHjUl9dqg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:PA==,iv:Yk+zzt86AJmltr2DMPFInBIhlr+Xm+Ca4qtvDVUh/XM=,tag:0uc5gY6qY0SJBhnDi5u5Gw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tier": "ENC[AES256_GCM,data:l43NmaH4,iv:L4t1nRwspzMI4NnrLX7frAj1VognQJLcPJOF308j3DA=,tag:GiMRJFFKg+VMaS57q9ra4w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Ovb6gQ==,iv:6pw4XRV4kGjZFZbMtA8jzTxptPbStQb36g4qp/CguEs=,tag:EeclmHTQ4h6UweY58Guwhg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:L7p7ro+a+kMB,iv:lhRGRxhIeYK4+r1aXSKNR8CxDPCMrlA4gXXqq4T/MvQ=,tag:r5ohL6imhJYq7ss5DWqUyQ==,type:str]",
"uid": "ENC[AES256_GCM,data:SO4j6SzcWtwW5xcATerUqnUG59d6fQI4tD9sZg//G1YaYUSe,iv:AcHqLqWCqpkDE8T4ANM7I0o6Q4rLiLd61QfXq7MALEo=,tag:/AKiKaXEqb4TyR8rtJoYkA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:Ux7D2T4=,iv:+o1+oTe6VTZOCYQ4tDzqhNeGjCex5DomVmbdgyU4Ez8=,tag:k52o9AqY7mFA1LlJqRDrNw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:NMAxHM9FcfXbN4CElm4oP2P+1MKLNNZG8foGTCEu5qV1SHfJbxEm4PmJkGry+cfFQ2ylq785dKe2h6JGYqcELCdVnySbfv7voHU4nUrfkDtSeKfFqNb0sA==,iv:L7bz0QjVHkwLN2s3k8udbCgR1J/sZK0MPcWOjs4c6No=,tag:mekO3VeRJO0LUlyzgoZPuw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:OvNdPeVoC0JAay8=,iv:y0AU0X2km5TvmGIezloonUpd6AJ595GXBcKCOZL3fmM=,tag:Ipy/ze5sCTS3iJ2WAWmtDQ==,type:str]",
"mode": "ENC[AES256_GCM,data:wA5IEdhlXw==,iv:u4vyrE0W0zr9IJcYA1MT6mh0xdtbnqRISeSf5eyxNdc=,tag:9CpSWTVGtwbIOwOhnukBVw==,type:str]",
"type": "ENC[AES256_GCM,data:/Gq2JI2rvZDwN0RdKUBo3kwx,iv:wR2brg7DgHZa6B46td6vJBWz5fcfDIUP/Od0V+EpI1M=,tag:iHg73HzHzCiuN5dW1QBC0A==,type:str]",
"name": "ENC[AES256_GCM,data:EJcP3w==,iv:7BFzxvXNXTrpVmX7Wywr2wKy2AWwly+h5ZLnzdFEzQw=,tag:0+0PW1L24uMk0ek4YUF4oQ==,type:str]",
"provider": "ENC[AES256_GCM,data:Y53Mw/vpCQfPomPfZmCGBxoP5KHVO2G+YIhwsovbaScKstBYR0Egvc9eG9HhFwdQIFAI2x5a,iv:TQK5NcbkZrjcMyS5/GCni6C97tyYy9Wo24hK0Ah4aFM=,tag:EPFJVqHF4dK4AJu2QN/5dw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Xg==,iv:dtN3j60mPqD/qW5AgExaYpjDmvPG+gYDn586uLCMO7Y=,tag:hp+w+XMKgzeXdaWoJ1m/hA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:UqB5p2qjrQqG,iv:2yiyrz9h3W/VsMIJNKVm2uZJ3gmhahg83ZI9U44xZQY=,tag:QhqrRBpPOXZeNnHhqDQJvg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:SA==,iv:kajntofZWpM2csg0BXbT8eYHhi0QSd+MfP2gsZkWKrs=,tag:Ax/5c3lkjqMh3OSlUG6lpg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:WUOQ8g==,iv:5RFGZzcqy0oZUtLXKoVqbyy0yRV4RxqSPIjWW9TSCn8=,tag:2YnwJ76N2EaI02Qrsy8f0Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:e+TEqA==,iv:qdl931VA6OYs3c/O/Coc2NZKPPoRAiKiAU1gePlcGvs=,tag:+LvPDV645XPWVLJSioiLgw==,type:str]",
"namespace": "ENC[AES256_GCM,data:k+KDqw==,iv:wUCTWr5fRCMQD6g3Mjtk4ChX1Cfs1FatFtFcrnrz21w=,tag:tTJsKdOAjL6VrvFUM6RwTg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:sTOn9Xda/CCJ,iv:pdGHv70Yg9NN8Z3ADaUvzFN910pGLozZ6XAJiXK3gPs=,tag:fWwM/c66DA4qwcJuppxSkA==,type:str]",
"uid": "ENC[AES256_GCM,data:+Re/hLkDTc0ydd0rgg/ylQ7kdKCAYL1927qJR0MSRzlWq+jV,iv:/vJlsILAPZ6H3bVHXFc7wz5UpHrJk8RTk222tvnOATU=,tag:5Xyr1UWlQhs6tD/sjwtfeA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"allocate_load_balancer_node_ports": "ENC[AES256_GCM,data:bDpJfg==,iv:zvk4RDGO4oVL2SnmJUv/n4hzukJaXVIlE20qOOaVP24=,tag:bKrjFDVNjS/pvW0Z/5LWEg==,type:bool]",
"cluster_ip": "ENC[AES256_GCM,data:VOKk/GVH1RoN06NNhLw=,iv:9xP2MNmAw6iKt0OCxAlAOX6bRQg7n/1CvJLwZ1PtsOM=,tag:a9ZRiRubiUyuW4ZR6ZYYTA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"cluster_ips": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:omIbS3AhcDDiNZ5gzCM=,iv:VxwAXOgDfrBc7YVNKWC0N8PMPc8eYIaJop17Z0sVcGc=,tag:prCtL0rcCckLDRchMZR7rg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"external_ips": [],
"external_name": "",
"external_traffic_policy": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"health_check_node_port": "ENC[AES256_GCM,data:eQ==,iv:Qt45SjedfaVtNhINAjEGg/uSIvbdqb/LtGA3G2uXS68=,tag:sjkKNTGgUBRwLo1loZZPeQ==,type:float]",
"internal_traffic_policy": "ENC[AES256_GCM,data:dHuHOs6Vrw==,iv:hO0qhyVX14xxRKFHEGeG1glKxRn3iddfMqIsLlW/5qc=,tag:IDmAyaZMNwMi1pg8n0y+vA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ip_families": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:pDaWJQ==,iv:YDppqA/7kix4P8jRZDcKHzo4m4UyVFnWAoQ7pZ+yQcs=,tag:Tz71VoEXbJCUtJn7zvpw+g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip_family_policy": "ENC[AES256_GCM,data:GClCTToaIVA3m/o=,iv:tuVcF+nhCARVQOJpwSpk6ZD3axABc/Sy1u79/QElYTM=,tag:S+27D+CnApjIIMJbCOIBTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"load_balancer_class": "",
"load_balancer_ip": "",
"load_balancer_source_ranges": [],
"port": [
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:ql3Z+G0=,iv:IXwnIUHr1EJhuxI1uVfdM8YKMglbLBEegRG23vfF9Cw=,tag:S9w5gOvzO0lH3cC2MPz5vg==,type:str]",
"node_port": "ENC[AES256_GCM,data:5A==,iv:VdsIl+JGL8Sakz8goCL/q8g4ev/kOol5/9KVssilu/M=,tag:9bfJwkCLppICXPbYX4hRfA==,type:float]",
"port": "ENC[AES256_GCM,data:/tK1tg==,iv:qP8f5HgykueVsjQTtBMG5e6qrhlI1NahqzNkfwFUR5Y=,tag:jq8Xce9vya7ZfkSFd5VVcA==,type:float]",
"protocol": "ENC[AES256_GCM,data:wRds,iv:Bk/aXvegvcpya4g6ADBlz8mjcH/eUV3dMgfcOPqWtq8=,tag:KmetX0Zi4052jkg8kc/dHQ==,type:str]",
"target_port": "ENC[AES256_GCM,data:08gVJQ==,iv:zAKpToy5ipIPC3Qpwac3gG/aqiMmdRQv7ViAfoqXFb8=,tag:jFDVqob21oLJNqd3cz2IGw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:rkXrzcGYNoSw,iv:RHMauMJc2A2y2twR7Dz4dmS5ny+JbGwdbHxygw7JcV4=,tag:cCLe14/MwXf7Bz9JfkcD7Q==,type:str]",
"node_port": "ENC[AES256_GCM,data:nQ==,iv:l/XzI6awvbgCnG8T1xRsnKaP5Fyol47YpWWS0xSQaGg=,tag:vutDlru4PbF7TNE0MbF6zQ==,type:float]",
"port": "ENC[AES256_GCM,data:6iIo0A==,iv:9EWTlMxHmBONBUUodaUPM2U4Mz87G8hLyWKtuKVevzc=,tag:mFHfOvtzpU9f9kWjTjD7UQ==,type:float]",
"protocol": "ENC[AES256_GCM,data:3TiD,iv:thxocBkL8s+8pwUQqFGZLrX7DdEcYjiVVewgMu/NsPk=,tag:iKmXhD7VxXmdjqmAFPLNYw==,type:str]",
"target_port": "ENC[AES256_GCM,data:5+LH5A==,iv:+UYMxE89H/QlghyD+lK4hrR0YWXHd4we7aoqw9CwP7Y=,tag:hHT9c07UW0BWMchNXrbxGA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Go5VOw==,iv:1JgrxCY3rWMQl+PaSP4g9wsvXOD2jVmSTnDB/+Av7xA=,tag:8ja8Q3szh3Qvx67hsJsv1A==,type:str]",
"node_port": "ENC[AES256_GCM,data:Mw==,iv:WfBRJWcASn0p24SltNAkwWLrXYyBF4qVqJfKIE1ft6c=,tag:hGdHO57r57KcX2v4dNu3Fg==,type:float]",
"port": "ENC[AES256_GCM,data:drWBqA==,iv:wLOE7+JR6vJ0a2etoBnkFjooyzr7T+QOXgy9gnTHc/o=,tag:rYbFdpwV2vMWDjWyCWWLyA==,type:float]",
"protocol": "ENC[AES256_GCM,data:nFbB,iv:4nydmbGugosdPYxfbI7BpGRy+/Y5rAt5GLC5abuiCOo=,tag:FEHLw7BWwn/qIpUiNl8mtg==,type:str]",
"target_port": "ENC[AES256_GCM,data:xqFNkA==,iv:kkyiF2oz+NZfEr7Sjx5gGLuGYrtm/Ll7s1HdfdMBhWk=,tag:M82/nH6Cn7DWnCuy3VNtaQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"publish_not_ready_addresses": "ENC[AES256_GCM,data:uTv8P+Q=,iv:SI26OLl+OA+OLYROXNoBRFT2zduz8cfvhCDogluJlbQ=,tag:9+51xZnTKbOIbtNjHakURQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:tDTm0g==,iv:qWjOJGDdInCClWPIyiNhChq3z0ClAa0wvc+VXAVycC0=,tag:fswOx0tU8AlP+aKTd8GNGw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"session_affinity": "ENC[AES256_GCM,data:2G1Vew==,iv:ZnJQ9yGVj/XdAJ2WM6A1gAE67Mv6rXxoL1Z/3Unn4ok=,tag:I0wAEkh5zNufHK6+77Z3DQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"session_affinity_config": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:XTkgl6LCMeb+,iv:gUkufbsKs+AkXbhNw5HcIIWQ5boxhUJ1GyF/zP0ZZ/Q=,tag:Smg8n/ARuJRXSNjE7V06mA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
{
"load_balancer": [
{
"ingress": []
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_load_balancer": "ENC[AES256_GCM,data:tM7ySA==,iv:W9fBwWoEg3/dQAWYnD+CW/REIHiifkGNfnFllJmXz0s=,tag:sx7Phool5Tms34tHufseuQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:VIewgg01iwlhOG05paCPMyKC1k6h+oLWlo/p+nJWXqsf+1oK/Cic1ByLX7KGT/RfgCIakWvYvYX1mayyB6jT5VkaGDRMAT/E5LV2s/hBo9rZhz5Z3m1dFOsEwJcn06jMTs9bNLhtoHk4bXQvgUJOQVrusHE=,iv:t3n99gK2ZHWA1EF++PMGi4fUt3UaXvEOy5tG+8/tfBk=,tag:DcJ9fmuBd0jTwuzV4dlm9Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:WpTzL44Zc4hVruIOg5IqJGL8IT4gkbOITKGxGa/LLBDdfEeGWQ==,iv:289Yuxf0JBNssG/1y+4d26Qj8JbCYidd84CGnX6Dt9g=,tag:OgbLAOnPAgvVZk+shRE/gg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:oDM3woJblDGykEg=,iv:Zx2Uq9do1u8tA2p59tdiZgHWamyhjfZv5VEOqWE7rNo=,tag:XwwrU432mN3n+KVcRHEUOw==,type:str]",
"mode": "ENC[AES256_GCM,data:7OCI7b6hKA==,iv:MWDVzegwVDSEqCqbRJLXZpcuJDkvyCHkwqNvbvqb+9c=,tag:a1p2/xpYveYCkZeNoaOzUA==,type:str]",
"type": "ENC[AES256_GCM,data:WnDdiRnyEem7DVRRXSCVD8wA,iv:ezHnBQJIiw66XLhZU87eZo0UmjI1SH+i0HsIc0lLXwM=,tag:qN6COrfg+zWl1Zfbc3VItg==,type:str]",
"name": "ENC[AES256_GCM,data:0wNvM1wa5kXDEZJ6,iv:OiyrAEb+KBX6oHlRZPt4mOFY1bq3kflrLD1PhtUMopU=,tag:+C58Ky7ujAk+gDesSaIwJA==,type:str]",
"provider": "ENC[AES256_GCM,data:G9V8ugLzCarZGjOGTioAK65b5hUBS+o7W6BAx8l6GXiqgdt+ErN+pxG0UmlWVuSpKOoAnNlN,iv:JrZIQ38xqUsULyDr52WmMXkH90OTOEFJA2QPBeN3Dw4=,tag:/qwOJ5pV/JRDuu7xhxQo3w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:jg==,iv:HnQpp1VUWgQes3cPlhNYZwvvoXW9mP95f7WSI4bWlrI=,tag:R2djAGr0CrZVlk5bPMC8Dw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:xPot0mX1hQ+WhIech0EGZEs=,iv:Sl/EB9F2PGOHsqg3P5bYZx2YTSNtIdLGuPovGQPK/w0=,tag:CKV1AF4pWe2zOO77YY6DfQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Dg==,iv:26MS4vqacev1ZGlbg0Rwv9j41yPi6pYlHuWz79vofU8=,tag:f5uiNsPWCrKpSgx7tCi3Ig==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:eslEfw==,iv:bCkbtOar/+Vj1zEgfHu7PLu7AWDrzPQOoK3g5DQ1ztE=,tag:0Nk/+/Q6fdt+KqNS4pjGYQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:dD2O4F7ZN3b9DDcJ,iv:7Lw6loozUdbYR+6T+XYfSLUG/KHwFmKrX7oWhGiSQZI=,tag:ieNUkhdg4ZK41sXHsJdLHw==,type:str]",
"namespace": "ENC[AES256_GCM,data:+jg/yQ==,iv:1N6ZLYIujYbxMMaMUkZ6DPk8mxswsB7fw9gjIRhwZF4=,tag:8O1s6sNzl5nzKoQBHvjQAA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:belf/TTtzMSe,iv:nlNuzPM1uVA0L6EYjSw6PJbEKc7V9gwepqD3qjNRFrI=,tag:cce+w2r7OumWMwrN7LLcBw==,type:str]",
"uid": "ENC[AES256_GCM,data:eEqALiBbGRLZbdmZlZU3OnMekoBUW/gsQtzOl+XZucULrwoS,iv:yN4FOCzmrIERfeiKJLmK0W0W1IxlVfT5J5PqtVgzpcA=,tag:T5/77LihkSSMUvTdiA+x6A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"allocate_load_balancer_node_ports": "ENC[AES256_GCM,data:kkijqQ==,iv:FTdqN7ULF6s2W4ydehmE4pSR8UKonR9Ej2Zr1rEoXvc=,tag:g8mFyUORQM8FXWklNxnb8A==,type:bool]",
"cluster_ip": "ENC[AES256_GCM,data:oTTV/yAy2tfo6jX+,iv:4I73H9IBENqucPWTC8VpNhaqXxsqZRgFH2ok5D4NFSc=,tag:MgzGpkxG3PRE3n/fN1oXiQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"cluster_ips": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Mb7xbB8FsDIuTplR,iv:tYMifSqJWwgyWco8Gnij7p34bNudSd1ENyXJ7NsMQqc=,tag:PO6R3D11nzJKR/IRjTLCLQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"external_ips": [],
"external_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"external_traffic_policy": "ENC[AES256_GCM,data:mPhle5vUeA==,iv:Khu7iRQzwE+PhHzI5oDK1DK78WPDOg5YLayU8F4r/24=,tag:j2+uE19OD7RuBbDuanD/ug==,type:str]",
"health_check_node_port": "ENC[AES256_GCM,data:fw==,iv:lLxSaWolf/uD/WG9P+Sq2xXbiazdo32KoRunKxM748Q=,tag:28zVraDwUimB1COi9k2nrA==,type:float]",
"internal_traffic_policy": "ENC[AES256_GCM,data:lT2F47rSuA==,iv:D73jmnClswIc5IAemrda7jhIT/l1u7EVQpX75fr+66g=,tag:RW23AIi7axzCmTDpD/gDUw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ip_families": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:a4v/jA==,iv:RtEXbI9g1/uEMnEx8jGGVA8HPGSNq3njK2StTK0i2zc=,tag:f8QWP63OeH0C5sUeMrGLwA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip_family_policy": "ENC[AES256_GCM,data:ZjlUSG4ii1cXu3I=,iv:+aCuXKEfziA+HG/vjL9yn+r30+9azCoHE2TVcwzOj6c=,tag:/h96mDKpHPJ5aKeS26mhiQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"load_balancer_class": "",
"load_balancer_ip": "",
"load_balancer_source_ranges": [],
"port": [
{
"app_protocol": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:MbrLZ3yUoQ==,iv:FiE1wR8DlJZa1ukmXf85BuZNjrC428g7FoLmuhgsK58=,tag:AQOhmIqUQQ3UWhFfIlzQvQ==,type:str]",
"node_port": "ENC[AES256_GCM,data:nkFDWQc=,iv:FtXAeVGYhYGxEOmKDEJaDjmK6UACBlCVGzgFw9kn8dE=,tag:8I9vqYAOFrObvy/O8JgDjw==,type:float]",
"port": "ENC[AES256_GCM,data:QYlEqg==,iv:AiuNbWBsYoFWtZOnmHWZCFtavhrG7IkvEemUAVZpzDM=,tag:j/Zn5yN7dMzc1VTYHuZ0uA==,type:float]",
"protocol": "ENC[AES256_GCM,data:oD1R,iv:nU2k2tw/+xlmJ3+MZk5bkOos0bw5M3X04YE/dOYkTwE=,tag:qs3HSVchd1GQXyIJnYeikA==,type:str]",
"target_port": "ENC[AES256_GCM,data:hupYIg==,iv:N0RyQzXl50fppz6//2ryeUn4+jqMsE3vtVH4ah7HInA=,tag:/GkY3r/w8FD83/pH/EgXqg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"publish_not_ready_addresses": "ENC[AES256_GCM,data:hX3cYFI=,iv:HQboojPQpVQdCtGtGG7VbtocPJNwHcxVXfS4cYUDV3w=,tag:dllpOvz2QQLYt2GgcU1stA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"selector": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app": "ENC[AES256_GCM,data:aseDHQ==,iv:PQo6PxX3GL3ptJsFTfUpySKPJwueff2KkGYV8cKRV9I=,tag:XRm3/bq/W1qkNf5ae3k7Sg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"session_affinity": "ENC[AES256_GCM,data:Ds5qSQ==,iv:RxftpuCdDxB8wb0QjZKzB62CHZ+b0zwqtqNPAkI6yGQ=,tag:u+/Wt7P+66i6gGzJLw5S8g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"session_affinity_config": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:gUWYu1hexrUoKwDJ,iv:15vsQIcwuikHvmpxO3D5hX6Bs3ImnU9rDA0quCWNrds=,tag:Jb3dnHdlMDl4gztau4IA2g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:fPmliJoqcaN4c6o=,iv:hGyEfGJAEo1Hzh7abzt9top0ECbxBlTD7zdMf/E6wo4=,tag:8a15HRy4plhBQ09i5chOrw==,type:str]",
"ip_mode": "ENC[AES256_GCM,data:hMUX,iv:gvcULR0dhbSg7KQTL3r05oA5lY7K887U4BM4Xm9YF2Y=,tag:1e7uvZts2FS4AsdnUWOOAQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_load_balancer": "ENC[AES256_GCM,data:90BGMQ==,iv:Ghl9Iow/nziOuk2mV9DSO3gEXPismjpHsKW3feysHlY=,tag:nnO4mYfrGiOnW1MQCyADUQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:HNRc1d2X74gLsEbgob6OB4tVNqWnzxC6tYHio+AK68O9U4QhyzF5mUyCWhJ+m+AWdgW3dP5dw2u64koKJdSsGIakzaene0WlWGLPOXFJ0ohqDUTt3Kb7XeYVr+j6/bJyIgkf1vj4d5YHRdCiwF70mErhGkM=,iv:XELjHbmvIXOB+FkfkKLxX1nuBSdkXcVRw7HspC7qwRA=,tag:pSZrIv56ad5HiPQTEMB46w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:AaA8HtzDqYxDRFr7oz8mducDVbHpLdr5p/hWn8akHGm2pdu9UA==,iv:fF3V6IFU2kbcpLDb5w6k2HYM8XoLEYKXdg8g8JU3VVk=,tag:DC1RV/PrPUElL0wSaVFJpA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:WINt7xi9I8PGm1cVACS1nN4YAmHjbjqQKNET/PHUDA==,iv:71+0+IvDGDuFGEp/b+s2JRdRq1qXQEuuGGYFo36Amwg=,tag:3B0nMRp8rU2l8jtpc+LV9w==,type:str]",
"mode": "ENC[AES256_GCM,data:oAmyZy151Q==,iv:2uTIVQybCBpALFhiVZr4tsH3NF+0Ayw1gr2IQmQ42rs=,tag:U6cYs04EQ6SgZ07iMJ0Uuw==,type:str]",
"type": "ENC[AES256_GCM,data:rqwtGgN6PX/rcFmSi4jUr6ZVswe5,iv:Rph82++2MUm3NbqOK7lcR7JKusx3Va2hsEI6tvZHaYs=,tag:xy6pBdnlafBMy2gbHW4oUg==,type:str]",
"name": "ENC[AES256_GCM,data:+qG3d1+A6X7+2CV7Cl8l,iv:eOZOCjRN7iSxe0bC6auJTHkq7qmjRthZcw956+kwhtE=,tag:EhWt/dmSq5fyh/kxFBZKtw==,type:str]",
"provider": "ENC[AES256_GCM,data:dXZgGQ/ACPNKdxho9HXYrfzIiedp2khVgtu7NGPK8hMsxsKZG71ITJHMJKzAp0uxJPORZ/jc,iv:cLTid1sNFPpiBIX0tJEZ+ef/IaEFUSNeq8DlaxxcYpQ=,tag:I+1sxAnJPniynziIXiN7Vg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:xQ==,iv:g3BaPnRKYrF+7xHyB6LzWsFYPiDBOtlXpNJWoC7/56M=,tag:PJ6GaNBv4CDvCYYmObLX8g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:T+J7BYd23NqWJFS6KNE=,iv:79yRQr/YL5nQO4SxFxPNIVA5Q4eymGNDydeZTQ9wL9c=,tag:magOYAOkZSTA71ZBudHuFw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:ttaDdwzdyhcj,iv:/c2+rd3RIuJxwGtVhrruZzhMok4jks1e6/WJSNZxWAk=,tag:FQtdHkFOMlg9hQMPyZFmZw==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:Q8SdcJH0XYqGJ+r4yW4ZVSGa3Puh5AUNFutBDwcWyBvaGA3uEuf9HkYP4z3mwWngyHxIlkpd8fXXSXdfZmcwS6UZrI3S948Ado/uHmJpoSmXMOcxJf/v48Y1taR4dpYhXbNF59n4kf+tK8FTDJ0Z24p9SIY2ab/Y3DXML0HZ+De/WkWvXe5eP0i9fYKTBO9h7REvCvvZTb2BCakfvRu115baJsFjVliWnJdv+OkSyW3CyYXkePWe4tAv4xYZE/cK3N6TZFTHu25FcOefSWOSjrMo0KWug4w6B/0HyMpEiNZGDHXoKfSfXZgODZ9z3q/PFwW13LqqVRmoRkPpWVkjiycRvqPsTJRhTanSnEHF5AruaqMcbSGiV5sSdQ==,iv:jigFisQQ2IsEJFslpHSa/sjWyT0MmoVP9EWfjHUL69w=,tag:CzIkJQtegVdbDo4TQ4xTIw==,type:str]",
"traefik.ingress.kubernetes.io/service.serversscheme": "ENC[AES256_GCM,data:nU+3,iv:wknHhz/8rVggi/tOkugtE7IXHHDqv1CD0yESaBXUOp4=,tag:0HDDiQ2+06AYsLp2vj2wNA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:gA==,iv:U462XLQRxWwoyAP7GrsoT/paNy0lqOlkGv9qG/lOC/Q=,tag:5ersH2j/qAQeohWJ7UA0UA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:DM1A5+dYw0zB,iv:+dxG6U8BZmyhbwM2Cv3JJvJI4A1UB4U4lqMbfpHMhMk=,tag:Mc3jR4ViMS2MqfxNJSR03w==,type:str]",
"namespace": "ENC[AES256_GCM,data:GOtGxQ==,iv:vMdM3eOhZLMNEkm3X9b7I5xaXjaqeT61MbmcsvNqPFE=,tag:9inspXk8Ft7GJNXpjSVGvA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:E24GFlAOpqQq,iv:BFKmZThVu/m5K9Lnyg/MJfH8CvFATMupVrZ9aGbHFVY=,tag:Jtzp7mBv4gfGTSy+Hxtngw==,type:str]",
"uid": "ENC[AES256_GCM,data:8Bsu0tsmlzGN9C9zdDrqAAs6PtOHXPdO3hAePBAECilO0fs6,iv:q5TQyd1hcYqO6fYmuqIDFtOPrddkjxxaSHETPmqDfUI=,tag:R27phqE+aJl5D3iKinr13A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:kP1yLpNqRA==,iv:By4KK1px504+715cRhfYY92quzMcDby8tgtSPuqynj8=,tag:YRMXvS5I0FBRUwLFsoNKVQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:iIYj3xp7Jt9xo7qlxqdYhjqAZvNr29IbBQ==,iv:siOWzmgHOojwwZCcQfuD9IdkERTMLXhdjdsI1+yquio=,tag:W/1tTMtOzr+Rg2J1bDc88Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:luiZEg==,iv:9LZ6TVUXht+5rMUNNCpYTW2Q27xN9Xp4liyApZMnJIE=,tag:Yz1xQUx1njmCHRSqlcnfQQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:SftQHA==,iv:prv1Cvxys8pyKDXGDLA9zD+UoDkF8JjcFKzCm3uNmU0=,tag:oW4iNXZkRg5h6YrY4k3eUQ==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:erHT+FmD0go8,iv:n+X6u7QM6gapJYPswME9YUwfgXB5SI6F8bN0R3OJquk=,tag:ooT4Npfx2P6dNoWRx+De7g==,type:str]",
"path_type": "ENC[AES256_GCM,data:2H+h0yWC1eMj6rwsGcT7Ybz9ji2jgw==,iv:TEposhsptmt+qfSTS0ZQMUirTbumIIE0yz1tIuwj4Jk=,tag:82DuQqXD1rY6LykxsMf7XQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:5LF1LgUMkcUnc4HZSUWJIoRpGMUH0KI0Jw==,iv:uQrfPzLERUI+IovyGzAgqenZg39/pzw8aM9eH+b7iyY=,tag:7We4HtzNeM6ULvOQl6lS5w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:g3arGms0vFuBUQ==,iv:ZUZyzGtp/FpJTLZ6CXn74/v4VeW8GEHS0ZjS72OB32Q=,tag:KKqsUSmMq9Qwqc+VolIvYA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:0bBvjCdyR0hXyWM=,iv:mAmhrH3HIWW352LghE3jDX5yEdPhmYG5DvFlS0Fubm4=,tag:C8ml5ICIxlN3I5TEpS5VuA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:Ngdq1I3sb+fHFk6ZOaGTQNF7sbt0sUyueIxY10/d/7KTFwe5w8zQvqwI6ZpeCIvq2Gi3JwdYkP989RWqdVQ+D3EWPOl1XqdbV4L4RK7JkToy+SdP4K8+MDq0iD1Ip52QjYROsag8/gRkXDIoift7RshKRj0kRCnl,iv:PTmkwm49iyZhZ+6IWdIdexk9YvkE+UX0uwva7CCrc6c=,tag:7jXDlyW9YiSKoUAW7dAOKQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:YlVFr1DVwzTnht8yVgdrdM6mv4VO2XFswC7bQFGgAN1QwBq/cw==,iv:roComiCWrm26Y9cKGJCW9lDlRp1xvDXc253xfJg5hTY=,tag:VNXFnb3hPpgpME0jAboHpA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:ZWng6B2/QDpI98cBhTLyYnXgnK53DGhTY86dFkyFnKo=,iv:qWFapqb76XyWZ02ENVtvx6SCIp2t5hRfNcx8Uc8eA1A=,tag:kgfcu2zjusxY6MjKIoZhHw==,type:str]",
"mode": "ENC[AES256_GCM,data:Tz1B0palGQ==,iv:sH4ka3QX0sl1fx9crfhi+tQRuCaOW1T/Di/GZiHCOrA=,tag:1JipHG5yGvlyfEX4EuwW4A==,type:str]",
"type": "ENC[AES256_GCM,data:LhxlEZjCFRkuj6KlKWKH9oUmQabe,iv:rsTG2fh0y4aFiO4UkqBBkYSISQwp6HxWmsb84F4BTb8=,tag:mZvOo4COUNGtDkIi0muQ6w==,type:str]",
"name": "ENC[AES256_GCM,data:6L/iqkKHjYMdR234T7mH,iv:8xjrgVcx0oxT0BOp6jigM8a45LqoRAORFmNO9s4Fzi0=,tag:4qpmmfd5mmspjvJZLujNeg==,type:str]",
"provider": "ENC[AES256_GCM,data:Nun1lPVzyhNzvVuHXIefOPqpttbM0B7vTQi23XUtRtdjbPYpUmruEwThPoHWP7rM8f+XQl1a,iv:n+cJwtrSYZpn687WsLFOeyj7Qi8+8YG1nEdLZ66uTA4=,tag:hwhVyvNRVSKnFX3310pv9Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:yw==,iv:BiUXOOAtVbV1OFAG7pZJ0+OwJX8oWWydaf5LGH3ca2A=,tag:zpm9FY9iEmLccMeg5RViOQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:SSWr1e5hD9efZU847lUk,iv:hjhExJGEWKygujSMyZlAE21uyGkXIW7+CaHalV5tEQQ=,tag:bu7qnsy75nfBw3ktayFUqQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:ZEfc82L0H2kd,iv:ABf9zcBrofwKZwneORr0rUOfdPeEL7wbnw9RQFQrEYM=,tag:8/G2l4++Mb2qw6dVcG8AHQ==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:OfgBruWbNMQfwSX5jYD2NbawG1GWsvXshJJ1mkVXurp8hP3ud41BoQwrP9ZEtBjv78gxj6Cx8brIRYBZwGUXMP1arzxvl/HimL2nZ8sPWX7YnuBlDK1UAbl/xAyNLWd2fR+1v3v/VeCVdPtswP/6dEMYjaiOuy5KGZikp7IEjmykK3ZJDCoUT4rU4/FyC7wb7PKwgH2sp02YlAD/cEqUk7/o12wGhd9++DDdwNlsLoy0o+XJ8btfETUeDXCK7wV4JREL8hJGQLf2S7KdanaBXtFxYnSAgdKfsoZGPRo+JtxJBaSI7yrZbt/gZR8Yv2+t1pQH1e2+a94BPdRGbqScxFgx4Ft7k59Xcp/GxvGiHzeFaAZU+SwpMIbPUQ==,iv:L8RIWCjvyIViAWZeNa22hpwYzx1uHlJVyWR1Y4BfY9k=,tag:jG6C6Y0L0mqiWcxhDnH4rw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:wg==,iv:K8iPYbk7MPC6na5rUVuN3wHvG+0Zgo8WsEXDCYoFm8I=,tag:mFcGjcedvH22XwyNd8+k1g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:7kMOCDpsI6l5QA==,iv:Dot2Vu0jtf5smpRTxasDGHJzeHd+s2BRIgJaVh8opzY=,tag:0xMeT+SuK1eAZC/pVfVvWQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:MbwtVA==,iv:DT1sZDyJEF8rwYHJNEV70vOtKhfUPrRc7hxQ634ysuo=,tag:4cmg3NtnUJOUQ2p7hskiug==,type:str]",
"resource_version": "ENC[AES256_GCM,data:XFYBHYLHzXAf,iv:JhMATzmsv69G8tU4LYsHZF9BTI8LhbQ3PJEMYOd7HYE=,tag:u2Pse3JXXY2keiB/RjqZZQ==,type:str]",
"uid": "ENC[AES256_GCM,data:oi5eU8jmLbgg4wJmN+SoVga8du+5TuHnSv+mPVTiV/AYYyZh,iv:JCR1zbd+NiXrN8j3WPW+Ghnvs0HfKGFZfGMCRySaYjo=,tag:v3+2aauDYYKLZakpOhdAHw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:td+4XzuVhg==,iv:4KNhvT+t6XgWTYHFruvB/s2IqVLGL86/Yh7iKa6dADU=,tag:AEl73AU5yiqx4nGI2qoCTQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:xdtIA+lUbbPsPo+PyZyIdcu1y+oka1fuF8I=,iv:sy0GTIWafFz+SRhVVhqsmLEYNGRK3H3bZg2X+xfQAOM=,tag:viRbEd14DCMbkJOej9OWQA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:MXXHHA==,iv:fXnvuHl+XHALeOcuQdR2cVwJch6xL94jfIbZYfU0Fzo=,tag:gg91M+BThXTjBKeMSYSSVw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:vP6coA==,iv:5tJzmeem+Fp9GvdqbtZd4nyvTB77U1ObOblFfRbOHVA=,tag:QzvIEbjGU0T+SYkGV/bwVw==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:qQ==,iv:22vD5mt3epwvC8BPgNLGhVV+zaJRG/xjWwTQUvZp81A=,tag:UXFYXWaD/7wohYANw10k0w==,type:str]",
"path_type": "ENC[AES256_GCM,data:C5oVb7v9wUAB6ktr4nwSo3Mg+WG6KA==,iv:9D/NYXD5XwrECQCbp5+kfKFRdwf6ZX0MUQY4uj7dTDE=,tag:XXLCMtjNeMLqQqSVBwj3Iw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:57CyUhxlE4IeCHi06jEZwQRlp8nkMU5MeUM=,iv:fhRTuZFAmjtIZpI09Kvac1sP6kam9AsNTF1duVtJ2fQ=,tag:8FTPG6iCReaUZzESqLF2/g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:8018R5Ifvpli2Q==,iv:IQyxzijinyT+6nX/NCHV3qu7NFub+STLEOaNOKL2tUk=,tag:1fOtT9d1r/aiwZYy4zKzEQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:Df8I0R4+Wx+pPI4=,iv:yAxJq6wpEM9gTCgilvFUtOXhzrDUoBwZxJNPOjaR00o=,tag:wFW+im9zwMyBZGPVxk6E1g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:BFyWeee9X+kuNih+QYiDLJAC3ZRoOGJ9/kwFZFYgiD9NHY9TvuTjFnubcseorrXNbF/VqCpM6x2UQRAL2Z80c7zntYQu9/LyuH7jLXRqFYq68dXdnaunu5JSpMSnypKcqW5+efGVkgGf276SnlFcVBG06hDGIQsE,iv:p8ToNYHiL3FhFfOZOr9QlpoA1yEQc/zGSKH81QH8Hw4=,tag:Y8Icl40/qrqUHML1HKnLYg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:hBcU5k42sUBHLrsOi/NuhAF3JN9fx0a8bhQV/p+lL0J2GHivSA==,iv:7NV36Snehfq3EAZRGwXvqaU46kSJ9bAnYpu+xY83wPY=,tag:mYZDG0KjypWpH254sTPIDw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:Sxqvkx0lOnpwTOJldIqa8M1C6CNAz7kIv3MpC0A=,iv:Bl8NjPGvd32DOA6VyFw6BdTAkrM1Rjjl22SH2wnBqGk=,tag:p/O1/D6OgcbI7epnk25whA==,type:str]",
"mode": "ENC[AES256_GCM,data:fLCdDisAXQ==,iv:QukxmVM4hkgGVUXlu9t5c+GMczjX+sa9iW6hQdKnaUk=,tag:PVX6tNtcYM8KNotYcj+SkQ==,type:str]",
"type": "ENC[AES256_GCM,data:Cd8Yd6u1nzQ/58xa4WqnXguxnlYY,iv:9vp3/M2W2U4t7VXUzx7xB6ZL3ZYfHHq/CaJYMVRMVEE=,tag:2bO6IIz1Jd0xMmGu9/iLHQ==,type:str]",
"name": "ENC[AES256_GCM,data:IqkewKH6MJ47WufUS4Nr,iv:eT7ujDZDy8t+85LoSZhhOLYtAMwMN9SfiYysBhQGqiU=,tag:dLrWWR/Fw3RROTtGc6O7Mg==,type:str]",
"provider": "ENC[AES256_GCM,data:2CfXbeEx6zeyYD6sjmk9kIGLTh28mNQeUGyNoavpFCWx3QC8Ua54kjDmzipmDXB2WmfLDLWI,iv:ydc9vhO1+RmjsNAzNdQgax6i925Ebi1sj35Swp/PK0c=,tag:X1bkXRDWlMkExEb2DQ3Sew==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:jQ==,iv:XPPTV8FOdvJ7rPoiSXoh7hVJg+eTokCjlg5PBn3gD+I=,tag:jUbPTjlxdy070UEzlhiqTQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:Hy5UWD5Yxb2zVzM+,iv:w1wU5Zv6QFWhV6obzD852laTojq+DWRvo/gMqVc2Os4=,tag:UK+D8wlYxzD3mjz6SaCBfg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:eVn7sLs8lPdk,iv:a7RJMxtrNDinHKRGW055uq1PrC6snv243r5bEYqPFHI=,tag:5gl15AB8yR7QvBymJDoFfA==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:3d15tSt3S2HJ8beQ0kj/fjPmgk7HdHZPFkJYihYy0FfIggiZeP7YN4dh0AuvNpGP0gp89ED34M7aFpsEpMqKi62ess+sDWymOxuYnE0xviofg6iI74RTITX+9OiRHlj1fD5EDYjDSnQU0RdYnklPa6wKq+keATyjz+K9moOGWPbs7SvS3JbzDJPEvk/TC6v4LvEKff+TB9Kp3mXHbEvx3dvjzWvofRevP/VU9uF/hp6CqeQPTnz9GBjKhrdv13xR982Jeiglz+/tq4QhzgZ09KN8VOVxPQyF+dePp+2NZ1Qyw2GuGzwRigvSFk4KBtmgV1SL8RMSE06PpeZs+iwGEM/bjQujBQ7zMtOVhS6fIZc3xeApgJ5yxw27Kw==,iv:mbuizp9EOme50ZW49UeCsNfzJhQtUY/GKVKSfg0d9J4=,tag:R0zbeH2jqvRvQDm7L+JpFg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:4Q==,iv:ll9nTABqB6yD2kefgj5HDB++eY3u0UpJBHdyndTlBHI=,tag:EjJld6x/JtB68ctBJsWFgg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:a5EMra1v4A==,iv:UYBsnT55mNIDHIMGV4cpuupt2jcEvjB1ixDdr7QTtbc=,tag:x0PMAy7OFslS1HqTwiBWHQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:3be0Mg==,iv:+TejdjUAP3XHELrCE5TLYuiUgfvuEyx35yVGIw4NSvA=,tag:9Fs/pb9O02Rn1HR8Q7Cqqw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:PPLcXzVZEFh/,iv:UzfNOl4mJVRVnTLfrv3xThaZ1EYkA+MnQ2wiW5u7e5c=,tag:BDauD68DLQo34K3AVOm4KQ==,type:str]",
"uid": "ENC[AES256_GCM,data:qt+jyrDZ42ASt7d1abe2t5M0vIGMYvFomBqBGamKStNOn7hk,iv:uTjqg5iBt0Vo3SBxRnnOLPnrM37LyQUpKFalKvHnS7Q=,tag:jHYOrJeVksnB4IbCexWYSA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:77fdwO46Kg==,iv:acOmbnm8K0LgA6iLjfVvZmSQ0wmV5NAzRbpy1m/jhmY=,tag:2tRzS9eHI3bzqZ4GFrq7fQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:GsX7SPdbmRLHQhQudywUlZYKqgJSTAE=,iv:+TPqBFbQzRki4yVoZ9dmc3LrjLjy0xRqzktGAigrRZ0=,tag:END8OwDTYE7y9CnLS6MyLQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Wy8t9w==,iv:Vm2la52Bunpk8trGhiKgg/UqEUgEn/iwl0yE6i2qoQM=,tag:NnSTaD9n1O27wBDOlrZr2w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:7elPBQ==,iv:5WdbcxxZp0sO4bHHqFTtI5jZ5njjrteSCJ68arPTDNs=,tag:CVWpmWYGR89ITJXz8XoBsw==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:ig==,iv:JD36xLVk+dWemVG3rr1cLMsTR5P4ZU7hoUd7Z71Bme0=,tag:hLzO+WLYuI1UHOxNdpwtVg==,type:str]",
"path_type": "ENC[AES256_GCM,data:ZsufzjtvgiGckATkgiEdECHO0lf1KQ==,iv:UpKsrA02aVr9mrvVA9jS9nIgF2x5jGSXZxL+KDEFDf0=,tag:4t4V28x+bWhInUc+zEx+YA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:NmF9yFf3hceBgFZ3B8x5GEt4KIaDCy4=,iv:qlCm9nHLY+7cTykpDxEvd4JHHn58DFOSaZSk1/Iqkxg=,tag:CIwqCB1vL3pqmntnCpRytA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:0kV1RdlQqhJWyQ==,iv:rmOyBofBt5MHeyMM56BYz4In00GQfnLEyEncZRQyQZo=,tag:gRiGjPavVh5miJ/GR59fVA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:9IaJUbAe32/UCKM=,iv:vJ/91FDyQ5h2sYYh5nzG0q4Pfg+/7TqqFUihtTRIslU=,tag:tFh7RCe04/W9D+YPWJmgTw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:SXvMG4qoUNuYMfg/WDIZdR5rm8Y7Vn1NqRPiBWumIV3NxKJHWJ4IKGozH/WIqHHBnZDq5kQKCI8/BYI+Buz3JIgK5ZKD7AE7iGOifOlY1ybR+EJnnE4s7NLWpXAlscg5BFKxDbn3Oac+EQo2plOJxdnmkFPgRfJG,iv:c9HCs9SSjZvJrNton+JthIFGKuuwY+wlURzPxW92LaQ=,tag:BDCyO05U4gXI6ELZSaoM+Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:gJf9fOKpqNqZI/v9wdsYkrY7YLPhNmn5yko5YZvlakN8vjCEFg==,iv:kYaGXMvOk7JSfxE0bs0Bt1EJvSezdqJIRJYc+uQ05s8=,tag:3Nu/+7BnZVtgug5Uaq7nDA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:EfxODlcRcJb/PFVQ71lboqZFVa+1W3yEKDFOdVM=,iv:wjEP5JYuz3vSG8HOpgxfteqn++m7k/mzS39pVKMD3Ak=,tag:Fpg6QAHkpHx7Ql6H4hRZHQ==,type:str]",
"mode": "ENC[AES256_GCM,data:sxX4WuLAFQ==,iv:i0y4McsSng4ZRjOJVDeHBAUIp/6mMOBcFbgiOk3C3yk=,tag:wDlWFrvVgRxbtT7asyXV3w==,type:str]",
"type": "ENC[AES256_GCM,data:CY+M4I96TdyrLleF0xUQuMo=,iv:dW42HZaed7sVZnFMzFO450gWzukbeghm4LmIpv8le8M=,tag:Blnf5hJJqtp9OWH4bFJLRw==,type:str]",
"name": "ENC[AES256_GCM,data:p8wkuhMymQbWoQ==,iv:3G8h2UYl5UY3f7vXFWeMgouRlgu1q9C/Vwu5iZzM64k=,tag:FexWL+1m5onRKtzK6H2ALw==,type:str]",
"provider": "ENC[AES256_GCM,data:yBYrJhaLtuSDgZCwrxmqoKFJuoo6CV+ZLgP6H7dpyJ4k0szdxCXo0ssZKJVkJHItJhjcnC46,iv:XhUOfOiF0TmspAc9dW7JJmpA/uCYXV67A2v4YhTNKf8=,tag:4qvKGIPg9WfDkcWu++BEDg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:SQ==,iv:VbE7gP0D6xYr0CL9XdsfzyBg8IAM0MrDj43Kd9xBNS8=,tag:XUhZmhTPDC5zScgyb9sELQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tls.crt": "ENC[AES256_GCM,data:uRGWLS+JuY9qbkwtDCYPlwbhCoHJXSHW2yHjx8AUeZnKYSRh62XdyVrbhZapP0wCKXJKNSo1HIHfiJQKQUA5HsRe2II04jiv3cDAYaVsP4A8Gj3gjM5G1h+qCIVUyDF4YoyFrjMi6PvWExwZ/j2yOzJNQ31g+unkyFWW9vRMVy95vhLvlwCVtclkPq6yTwa1fi17zITdc7TJDlSoy1eOvLTM6uBMsKcpiN2ioj/4+90Xlc2MG586NXda3EhqkF17uOP6WpqzF1nK8sjYPy7jUhZv+OGRxvMcu6tL1xd23aYc694fszHXx95mfSCEs2TnRXlc2sAaZeDNovPARpbU0rQskjyxh/h03cRtINy9Wv+wTBtssbl1z1kCBqSJb6lpYYrvTOI3dDYAbZzOKOEaGd0c1RryxfqIvrBOlqd9RByYSOJt9sBiMlAfD5R49XDgfqaK6qccu1EOWYYK0YweTrv/V79HFcgKlr1bIClhP8pgmuo8t9fNsZSwfcx16g8o/XRnG1EA0vcKg4f5itZNfJ1gLLmq08f1cVBoZW+fVMsOYfyXvsb3Dw4T/Av3JX2VTPZFt5wOjoRBSwHfJhJgg+t/nkWKckkFSwrRE78mv6ND3TLEq1zQlqlCYYjD7oQauxMfIBjm8vcKm4kwaFE8wpYD1awUr0Tlz/tZ7XeupnsFkc7fUiVCh1ZMVFSioxGFVwskQO5Qajx7rwMIHlu/En+1gWi6nxV493/cD21kICNBR5U0s9f/B1rzY6vY/1AAt3HFw6LnjoI9eh5Dim3tjWWF6GLiO8O1kEs1KYKdHVRKPocKzydflgc0rV+E4GLdiq9qRKNUbNE4bo+0sR3iUj3GkkrjH80pi6hx0fSIH2Uz5uAv/J3XWZE9BdkrxlA8FwPyu48ERx6+vBIktuEdvWi9zmwz/+QrtD2EbFsLqgYnodCDsHAfVDqWUKRVB3pKjxa4RHOs3VHBYrrCYLdDT4WMbvVjoPMAGXlKbU8dUg557TEDGnUVwX2Gl+3MDqxn7gxZ4JDIkXHfRTDU655reWQtG4cDKcTWTx+d42wpfq3GlZmahO5duhoD8FbWUbO4GlEb3r7q2fOElYncOuuabll2+GL2AM1WYtgzbyLPDVrMu8WHVpt5eR9SrqWU3iqdbWGcgqvqHyQ37TR55slGAZx3TuOn7o8FVBpflh1hBgNFlWYnYN1Ksv8LiKWp45Kr8Od2azBZY4M328+zKQ/3MkaTvGPZd9VS3CImhq6aD7PJeWv2r9lcIinkxb93TobcGsYAajDiFbXnGPRMucRoE4vOv9S6bhM1Y7vONRqnl09/3WC5gaxguo3EtvtjXKaOd9VCnnp9tVif9DnOA459vMwtnkNVIxPHJcbs/cD63CFr2NlWaloU8UX2iBHn5pD3xjvVQkfJH3l/dpRmj9sa93u0D7G8QcIqolm9iMmRNgnoZN5nPlrDFeCxAXGneKWGtrP2oHBA5mYdj/qSGjJJ1jjoqrnfzMxSoAID/o2axRSvOb5Y2LidMkRSLPwm96sjKKPk255lMP3nRi/WafFd+2PxpGgdiaFA/+Yr2JMMUW1aA/1XVhMIfBT0rx+ppeaj8hcLttyUYkTi5THPhUG33Uj7xLjpnF5JJzty27uVpx/fHXUlJVqmiiBmf2IA5440ma9i3i1rSM9oSv5Wd+w+M/xNYM58XtcawYS3A9ADKHT+0R6xRF3wR3UdDUyQRVcK1U1qV+07Ac+WNw4TN15YkB7kKFtOEYpelzTa02GCH+4lBKiuh6cfrQFZxGPAftXibjbx5DmvED6zjAKQDEUNvP6Vh+eKOTLOqLsyYt84/9gxMMiKX2xm3Q4WiMJAlEC/nKWF83SJSWgCplZ/Vbe7qyZ+A32uYUi5hyVAnX9zLVUobXp9i0zoTk4uCpLzWzj/Idp9OKwPJNC8Z4rK0uofGFC8lXmFeLx6lZ4XcRnw1jTdZBCBKc6T1D+8EqVZ/95KMlBxmNqkLBhpZdBo3uInM0keS38eGVGkKgnA8gC3CE8e5ACr18dsB2QPQkxPzoUvoYZ2h/FNjqhON5YAyaJtSe/7p0gPJgtmd3KhyB2VVxeI6HqPELL8mM+pwxF7Oi6eJEOVdOMnOF+6WTfD5WLRGOOTuqUl1VT2bchAN+g58kQpLp1VQhVgK96vlwM9ETVPe1wIK/vrFbfm0miIjHod0Bd0zQvEEyKBqwxLYsaC0SAho0IQ/UUgvuoTMBl5+EG7QNaqcjEnxYOIk7eK4WusETiyjSCjIGFHsCDc9ls8NCtdB2Qm9Gn384FeysGnEfcob4UrW60NhbMUkoH/ngKrj753n039yrJzoTJB/zfmT47sONJNDtMBI1nZK62YYVA/PnzKxu0qJA5J9+28RZ7AHRnc9jh6pyCARAP9LQyNGoYWH4JLqhlzC1uJTAPrBL4Vnsm19/B362vkQpjn5+GV1jzc/RMUwBzo0zut+DYCTwbjFBW/sUJ3/2JLObN1XyTDpm+yI1NzRkF12bHzrQsgxFVAw14YMoHqd7RDZX7KnzkEbeQzfkw9EslelLitSwXI9HwauaqnzpstShyt3Fs5hNhaVWRZpGHDSzbihxvuEqKCbWA+GrxMQ9fkNxwPHLHrXdvZj3BWwTdwxt+p7Y0n67wuTFuYELjyF5D/G89ICmlEiSLWy+HZ5Yss5yESHUD1HEi/vxg3MjcFckpLh7KcgY/GGGJF6AAZ6sbhh+GEHw13OdLF9C7BnBIcTwH3KNHO5alQf7Vs9Iqnpko+0N2BNjra0WXa/JZCdGATQlBZ4sb6JY1t9yXyc0VgOP01LBTLnh6MZxGssV4DAD7kW7FZGQyQjXnoeg0w7q49uH/sopnvYatnGEUJgJs7qCkrA7NQTnLPMJlhDH3SVg3vYbO7xDTE5O+TKkTWD+zeMK60y9J57D4HwEWJHypNa3NzMjV525v0HzLGitmaa57E4ziee6sFjrUxY+Z7xn8CpYWc/OvDxyABB0lxuM+i//VvQ9UZTDmUsjdT9dvK/jCFKpkAJ6xLmlnqHjYzCWzT6w2qLk26bnJTgG8C4bvfjzq1Hnff0kfLeins/ohK6+iQwaBYIl2gd1cXWkndLzi6eCRAWONPguoo4yb6RBBNZYnyKWUNn0X0nQcK8TfpIqkbFdAH3JuthD7Tvrc/6ke5/020lGxaKd1x+zWc5CTO0C+iQzD3L79qIPchAyfj+entquURK7hC6lsY+JM2cLwmKyVSZ5I7aiKBM5J8AbYJRx/CwsR1IH70VbY0PrcTO13wA/zlTjrXhkdAqvY3TAaEZgnU4RTL/Oa+fvM04YnwO1+DV0ENUxtwYVgDqk3VxtoBNYGXPAgThSuS1cjHKwWiw6MQOdcALQitS1ZxTB0VxfrcZWA3BPEq+vLMOl1ZnsB06dnF+Cw1AqEQQ3ApsH2FOe/XCkd4Q0DrheQmTSHf/AkG2iwtInYM7cL+EMjhQUt95kVdh1W+50bN7FVHBXJHKZuo34hNWu74WJMSlAeA+r69gFIEEpcUQYTeLkF22yPHMHoZ9oHQoZirJz/hz3zpwzIfB2JBeKbl604/Fz77fsNqRyuM8VBxqcTbwzcpTLdtysghgE6VqqHjlXfCMMCI1lqXuuFHyzCGWlFUfLrXZjiQBZZ0Hvj2Hn24K22I2krRINwUee4vYCLjP6R2e/v4GkH5c6rj1yRvCkKpfHyBhdehGsIqUVBxabLovT86oAZxpu3J1ncNTrnpqn/T/MR8BVxzOavxBYKg/wq2Ba0w1x8q0/8PupuytUsK0LvuU5Z8VxsEHXVy54FNlkrQSJLt5/xGSoA5Dift,iv:H+Lcnb9dqotlBGarkGCW0wbY1VMWXyPs2y1MpvjB9mg=,tag:jdi3dTIjxmV0u00g7pHhiw==,type:str]",
"tls.key": "ENC[AES256_GCM,data:EGYhD4NkRO85ApXzz2FDcwgkC0ze+IVwIR10NtT/+T7BwqsGZebnl9Wlc4LVGKhMSAtCzQ7jBdvbTpM/W3Xw3KVfknIe91wvQIuQIAnlkjWhoOMWXq9gCmkECUlToJkouKMYaL+2Gfra4QIKFVhLS+Wvnf/H07pjmXnY6aG3W7Gj1DYaa4NZPwkSDYItUrO9cS7tIbHJAoSTy38yHBM0kk6beafQbRE0muQUMXQQ9IrNaq4imRVrD1Ya0OQ/3JzpY5g3HKXNZwOWtdAzJ8Tqf55RdNsjtDWycJVNZyL7iQPBNIdBZBk/KWOySDyNJH5XYg==,iv:Cw3/yDapz3GGaTY2VwQXSAqFp3YPLOk+WE7W9WfXsjw=,tag:lfJPbjDmhPYPPxgo2Tmc8w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:FRwhPwDCC6WAjN1mWFPa,iv:J58/Xsgr2+GbJRkQ/zQvvaU+bYTHFYVbnPf/0YvmwRM=,tag:ru/poRxTZG+KqL71+hNm7g==,type:str]",
"immutable": "ENC[AES256_GCM,data:bEnLd4o=,iv:nwAeDV4OURughW9QK3Mr+p0GfHqv5y7Kow8m8uuRs5k=,tag:gHV/CWFX3rwK29NGyqaTQg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:6w==,iv:yMXE6cAFn4XCEkqGx0Q7MJnTx3pxmIwgJP6Fw9TUNDk=,tag:5efTw3/pIKqgXD4wMmTwfw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:RJhdNgT+VDBJeg==,iv:4lYre+6q8kpR1No8oN3BHipalX+shhOnpXl0wlulvu8=,tag:SSxIiDREOKq5ISUKeL3gPw==,type:str]",
"namespace": "ENC[AES256_GCM,data:UjjTYw==,iv:b1XEVfCAtiRD203jh3E+4sy9edv4to/M2Aih4O3/yFI=,tag:IAoXNdfgcKnyNki4zHnnaA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:dVDS/VlDJ76P,iv:SMOXuiP82ZnWLlspvGuOl7+tsSV34j1Z0GRyagTw7hY=,tag:rBVgBcnWuHoCPsw1toBF1A==,type:str]",
"uid": "ENC[AES256_GCM,data:jnBde1v0SrLgztK0Rk76+IjL1cTrHe+9EJlApA3U6+/ZP/Hj,iv:dr8XOva0xg+4mGJWw/UYG591KNQucdnZriLJoB51pUQ=,tag:VGbhA6J4pjnMSQdX+59uog==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:QjhiRmk6Ty54x6zJfBgkuWA=,iv:Yt3AT0eaZLrIaM2rxFZZqwOU8SaCcHuid451QtEeRc0=,tag:CffgmCq5XD7ylA+Ok0865A==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:fg7B+Q==,iv:1WfvS85SzZnCKC+hrJa5fkkUUBuaIKLy9EF5k6ykOXs=,tag:YVkflhTsGxXu7vRW6cn6Ag==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:I/uygKB2RJ9Xt5XE8z6ijfvkTF7tJ9sB+17JG/zb5QxkDu8lWiRHdwzkYSktmrCNnIK4HiBL3p6T26wpzlEXlAF3BBjkpYCAEGNTm/Qa7QnP3F+P,iv:MK0t9SJ66lOKkYU77ZFoUwkpuKv+N358LWX/aMNGBZk=,tag:2xOVqh+cYRhE81GXvawh1w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:DbMH8DKAiIeNWUcPiXjVxtP7tmwjV6SWwbQXZRnmrFl7rhbcMw==,iv:hZPzENnnfbF/fWulwDlVcad1TIZ66xmRYOAGWYL8E98=,tag:7FhiEuosM2dIOSwTCrnqkg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key_name": "sops-state-xray",
"created_at": "2026-03-17T23:05:58Z",
"enc": "vault:v1:3oDNxA5KvnovuJAXR86kT1j0TFWLR4Zu2S2kFVDXHMAkdM6WyLiQxM03xpQbiAOdkG2Y3hQfSUeT9O7d"
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZE9wMWJaeDNIamd4Y0JN\nTWZhNys0VUtVajZrWThZUGFIOGpXTGdyNUFrCjNzdnNhVUs3RG5odzc3Z2N5QXBV\nbmxVaElzbmh2RU0yTE5NMDQ4SCtnMk0KLS0tIGFNOFlCVWpxUUpzeVREcGQ5WWFw\nVzdpUWwyQUl0UFYzNWw1cTZyTHE4eDQKbXad9HwzL9pnSkB3cn45YCPgG2kSpsdp\noRQSOoyurfc/YaeiE0P2LkF5fdJD6fxMER50p8RmpFjl97jZce/dFA==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKMmJqZmUzeVFCam1ER2kz\nR2JJVTBseGZadmhocGthK2VadXIwSWJoOW1vCmhqaFZweW03WUlhb3l4NHdnK2x2\nQmJtZXpYVkRtYzdNYlZVOHd0eUJPSjgKLS0tIGo1amlsYytwdmNkZTUxbnpBVmpS\ndFM1cUppSkdqY1R1OVBYQmJHYUFxTUEKqaUa8O1Hh7j3sRcwr+Lh+eO6yWNu8iMz\n8A2L8PZKjEiPQ2/7L5Skr7J+L+FWIG6Y7Izdt6g3Dd9+4oOHR88ekg==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lastmodified": "2026-03-17T23:05:58Z",
"mac": "ENC[AES256_GCM,data:cO0aX8CXkD/Gt9aAHsY1F5H+Ti2eVdzBGmiZyVHsh/ZwD709opFbt2ca4a7r4aytO9F2oFpHiwjgz5CoERfGJblOACxbkR9GdvEoKAhPphyqaclI0tE6mJDPbCCEVnoNrUuA7hqxx+z7lgaxC+SpW/G7pdFOMZP3HNqajyE2d6M=,iv:KfFPsDZ2A76I57j+b8v8NIG6N/VP+S0fD3OUu2ZhJ6o=,tag:7yx0fYLaZXlb8DFWgEKYOQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink