viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/state/stacks/woodpecker/terraform.tfstate.enc

2139 lines
238 KiB
Text
Raw Normal View History

state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"version": "ENC[AES256_GCM,data:Sg==,iv:fFJByZOkDPdF2Esk2SbuhsrcaVF/Ku2PEf7Ls6DcSrY=,tag:y1j9dJTlDY3rQ+4DsTj67Q==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:8hiVzAM=,iv:CW1k7dLv8HGuMrUZ5WBdd5r9vZ2Uh1kiHl4SHQj/fTc=,tag:utVvL/kIaOYhGTE98+I8TQ==,type:str]",
"serial": "ENC[AES256_GCM,data:MzsR,iv:HOCMGCUM0+qdZJG9V4ByS4Op7pW6tUbnRSpPiAgyaZ4=,tag:nx2+lL15+TpARf623HTdiw==,type:float]",
"lineage": "ENC[AES256_GCM,data:JwscQeuJmTLkHIUWF0p+bICd7mlvwUfLc5kD0g+fIg/rX265,iv:w7qwEQwv0vggf+kI2RMO8onZeMJUJO/meYhVAKIEPT8=,tag:soXmMfxSRwIPuYoUUL4Ssw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"outputs": {},
"resources": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:4Mzcxw==,iv:27CvqjmKUqgP+47QV59UXMevMRsdvwcgwqiCRodc1bA=,tag:DIBdFRMpl8zdMhnT5FiXdA==,type:str]",
"type": "ENC[AES256_GCM,data:llL4bBAO1c5uJC2xN9yTlBI=,iv:A8w3wXhsJUWapGGpaT/w7Nt3dDmheMaO+ZtY6Ft16e4=,tag:tuAnj2hcK/gre9jSlwDwIw==,type:str]",
"name": "ENC[AES256_GCM,data:gyMFGh2GKxI=,iv:LxZ1FLJb8xGS95u22uErHMz128CJC7zSUeoM5eCeun8=,tag:YnbsynE3Jq9XoVnRTNxVdA==,type:str]",
"provider": "ENC[AES256_GCM,data:WGYn+Zw6vck5M3qsm85U0HT2hV6rq5A7mcbBgOPkwfxkuJT05kRGiYuk4bxPWRN2Ub5dFh2O,iv:oS5V252WxBfBud3LytzAIZK0iv9fMHOFCdjHCeZdYfI=,tag:MVG1A1Aqwl5AoE7N2yp0Ng==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:8A==,iv:j1B729u0rItAAUpMXz5YVUItyPw4NoJwhH70jk/b2KY=,tag:Dh/ZwODjpzNoP1UZ1n09nQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"WOODPECKER_DATABASE_DATASOURCE": "ENC[AES256_GCM,data:6/5NS8rXKCXc4Ut/Fde72G9jmGAS/I8DQUBEanhnSbuoDNB0X19Wr+oLMDDz67N1ZO/Kd8oHkNMdIQv0OqeYV2IH1SV+MPGVSngSfY6mGv4oH5b6P9V3rBxaf9tFl/5s7itGYbdx1QiGPScf/l1VeA==,iv:EhrgOk6g3t/ox4X2/ktgCYw4BKYc8pfbw1+ClEipUDI=,tag:HjMgMSmmXgTLhnn7GdeFxQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:ELnrF1XRhIKwQybKQga0V1SWsxVWkizbaPfZ2RQP,iv:Eq/7RTegWo1PdKGKynkiMuGT9HC2t+/9mN1h+08/M8Q=,tag:wSRUBnlkQ5Oa3+4zzL0m5A==,type:str]",
"immutable": "ENC[AES256_GCM,data:abA/zWQ=,iv:/bBscQsuln4bkqVHREXads/X+y4C7hwvJivCVgxvpbM=,tag:HWuxQRau/NLwi3GNqxzdQg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kubectl.kubernetes.io/last-applied-configuration": "ENC[AES256_GCM,data:aZ56X+u0NL/iZa0dC4k2qdwXogFoe6r7yaLAbaNQ1rB+Femb5wfV2x/P7HoaukNnItcsQSb1Ivq+siID5LPiR6YvBq8kRzOpGJfLaoSPAoGwg2mv4R2r5Wk4Per49ioJLk/vcEuVIp3XCnOpVtd10DO48A+hpbKOaPcGQPxRPzfo8TkBZoEwqcGT3xhTDnTdyaPllY6eikQnol7Rm0QyA4+1YbGaBQR/s3KDKO9gEjEmJ+0G21ZZGiOBhsM4/x/ZRrCr9OKmnG6yZVnhQqt9yQ80ybWyhKAyVwbMH/0tm8Cgb6xjgmCAcC/Pmd5BNNF7opzW0b7Oe4VX/CihWJTH6Hfugp/cYDIm+zNdH7o86vLeWmfWq+IwHW/ev/80wmR2ITnD2k87Hjw502U2UM4YzY3+X/nx8r8k2K24px8dGB9HofWL74RvYgFFEWvDsh5gxXZfrx/V9ju5b4KH76etjqUiqxdPnRxmVgn4MGDfFfPRWYs8fLCeLBAuYsXf/9KHUtFtH0j7Prh+6bfXq8GCww4ubm3aV1WiVPWf6khL/iBtQXFWisYZetgi+W+b1EqQcg+zGcYAsYKec7Jl7+PR6ZJwVUrea7Cl3gHcsk6BZ8ihJ+AA73gFQr3Yd3bcIHQsgqbPwJb8lMozch9h8u5D6XXmvRUyLkP0OlPX0ABpx29q2xbvsNmwCBSBfUY1ew2BcIhV23gxV5Lz1lHstdzcXqTFCuHQjNdjrSmPo/d0eJf8LU/aYt/ggs9yjT0LeUA/VOFyXzrAlDJD6LnDMzOhEBqUK/M9KXyv5dDNnel/AY+zjaEChWm0HUBTOFfNC7MfdNMG8kV1OGcRJMeqTbjW2ybI0A0s7IQd9RYr8tQd+r2Si1wERdhAZpfIa136pU3vh1h+JfgKo9L2oxveGvhGK6oYSmhH5BH/RT1FNSkraNn3BUZ4bY93u5PP8r0aYjjkOTLzNKnMd8tvqZM2HMZWpZLGL6IjH7wqmJai+p0pNDP5kvI43LcZ2asxLvCJWGNcZGxNZ/Cp832M8n7Qqvdgu5fKnkiOFuzF5i5P/+YVIX6Jv/4BgpbyOjodwSqtwLKs3safmATTI2J0LeNMsmgVvy+NeA83LcZEMhvp3/HWXj8camGtWA9KWkuNaiRbwLevfYo=,iv:akE/NLMH3iN7ZPKMrx6DfpeSfVFgfRAPX0jYnkLD3aA=,tag:FnVfsaz4tSla1cbCQh430g==,type:str]",
"reconcile.external-secrets.io/data-hash": "ENC[AES256_GCM,data:XznnLGn5yADCr7KpSA44mbXRtkbTixEcQCiXmS5v54g=,iv:nEEtJuauMO+dGaX1vLE0FL8j1tnfEY+5jI2VxB5YZDc=,tag:1evQ3Dbb2WokzZpLpj1bLA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:MQ==,iv:09wW1g5pYErTlOWDSsidhTjiOROajrwzHqrDNxcfzd0=,tag:TpncUPxgMdEk/8CkXeCMxw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reconcile.external-secrets.io/created-by": "ENC[AES256_GCM,data:tK57D43knnAKt0a9YxDPWUEQJKXxmn+nekX7aDhxsUo=,iv:NveyFY18zfMbM5TbTGPKrIoAr3Ou4A0uX4DmkZPjoSg=,tag:YDlJenTGPd509AQWsKef0w==,type:str]",
"reconcile.external-secrets.io/managed": "ENC[AES256_GCM,data:kR3lGQ==,iv:j0g3jLh0zjhkbigMoxIB0eoSpOcAebnXJ2ogANHVszo=,tag:qasC9Wsnp6J5riAJchwNfw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:CC4rwDABZZBE8MwvflpHHNYCIA==,iv:2vbB0tlHCPt8ocqbKZj6zXiSj8Mdr9OcnGarNAYmXUk=,tag:XAODiCVdWTv9adgKEMT21g==,type:str]",
"namespace": "ENC[AES256_GCM,data:Faj75BQ5Rxa8+A==,iv:0fdX7vlQzZZuv4nXk/In6b+/6J/mrcF1md3+2TRzQFk=,tag:q7jAS7CmkaSbsHstkCptLg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:5H1sijeBUbDW,iv:tQAD3+eBr6ew/vyzrklbePKv6uzpkjN8Hi4fJ/l3rtg=,tag:yvjqLUSUd4iZ1u28W/V+TA==,type:str]",
"uid": "ENC[AES256_GCM,data:kHplFsXRH9j8etuO3Aq927jZGL5BvulEBMM0092ynKMk9UDx,iv:GAuzWP6o6RnUA0iFvRUOUP2ItUzkbOco1pa468aTRQY=,tag:/2SpX2+s0UbUYxVkKjhY2w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:kfoF3oZ7,iv:W7EG15GKSVMIoJFvkf/iWDBq9AE1JatR1MDYGKkrQrc=,tag:yM86XNXiPtjrw998wR5rAw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:AwUeiw==,iv:FqvqfFlL9E/vt4WJcM3SQGCE3IXjrLu/3chAAH6V57c=,tag:2mLCeb7rE7lPEZeuLnYyQA==,type:str]",
"type": "ENC[AES256_GCM,data:goWPC75BDgKgFQWBAE6+KBJb,iv:Km+qPVoicgRRZOVcxhV30fz+4tLAcWEgiodGgYXfmps=,tag:gDtgzoidA1XB/ga8c2F77Q==,type:str]",
"name": "ENC[AES256_GCM,data:W6uv3l0Up/s=,iv:ieX2bHOH2XHdjPwiYyS5mMnul+Oer59Mv8q0mvfS1so=,tag:n0oAQscJ5l2IACNH0jU+wA==,type:str]",
"provider": "ENC[AES256_GCM,data:yxzyYcyXFeXv3uMDethXvhcRyBHhl6Qpt3Im3TzowlNy0sRDaIr1KBgCWUSh49lt8w==,iv:pF8aqHhomoJ9I0k+rtYtCMWHkcabHxR+21WAwHmZrp4=,tag:Cy8kubYoBSzGJbYiz8zgNQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:hA==,iv:ObIh03+88KM9O0iRzrpcv/939DYQRFL4D1HCRlQdEbo=,tag:tMVkfR+bWze68+eUGmuUiA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"created_time": "ENC[AES256_GCM,data:akLhL1YriZbcqH6mgKuu/xXDzeAJ4iwyDBDm+ee0,iv:0ixoKCmLRq1zPQ1K0VFwncfBV+5aXtME2tyVBESpbOk=,tag:l8Z38DEXddGcJJYpoUBaoA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:4h+quRn9/5/r1JegP02CeapHuwY=,iv:IX9io8XcZak4oIWOavKd3karhaFrFnFqH93J8aqTfAI=,tag:TUFoe+FF8JgVbUYW9UuTLQ==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:s7Xmf1Yq+xmqV3TroAjLz3hAe3JVonoFbmMf0UOZmZKUq5E1CCMt6TH6RjvZ3jGHgD3tyeaK9pfaZ2L/f6S3nG2pvkHKyb2Go+q0AxKII6P/,iv:WGdMRtEb5q6PzSwvPhCtnlBR2AOkAo2cIJdP9NVCQMk=,tag:0+oEmNW5/PKlC0m+haWQVA==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:z8XWrOQTQF5c5pzPCIopoOOEtHgIUp4/xD0coJtfgARTEQp8uJQV0S7HEQ8NCFHIOtKkuXzm68JpPXxNBXhhKq9J,iv:vl2qP+vlCxnQqz98E/jURb2up2Vj41/4i6jupXXsQXo=,tag:UV5F9Svq46ZcTbeNtHSCmQ==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:HZIiXE5YXifDep8C5vO5cQ==,iv:nK7f69DEUAqXIrRRBltgdnfyOCzwGzy2I+Mmm9mVSpY=,tag:gWjx1LkWA4lsQaHFYBfXOA==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:ZGyMjnqNosO1FHxGRL7f6aiqRDV9sW7pNCE6L3rOxh2tzT8THCqcpHskD6q5SEejz79Q,iv:1CDO2jxEZ72f5vxdMbmJhrT9+VXSJrcEq7dj654hPoo=,tag:82NznyFrjkxgYAmEMIswHA==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:dEbfiSf5Bh+l6aANPZO/cVcD1UF9IqL43HGCgyFiNvaxFcvHfg==,iv:uNOS6IfINOS5qSlYfDLMA8OVqi/FNa0EsYpvgiS6OZA=,tag:W//XVVzz9MMiGQWBWedp0Q==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:tDHQ47pgMu9HMOEv7s53F297e4qxKVx2nYXcJHteT/eiysBcl8lr3EUsqGC5q+3cEUQXc5HUtUMQApkYzUzTPxDlq65NZw5kDU/W14eqNOKCED0VDBdyRvLKoT9zNepRWJl2taX0uWL5gmyb4tY2kq9okFi4PSf6+g87FlQpQ8MVeCC586BqZnFQLnKcWm7UE1tmbnAdAx+iwftxoAbKbu7hfKDrj42LZKAC95hxucJqCetJCqhBSg==,iv:jPe2smaCDEQ0pxcDk7xnuZGzrbhsJ+keB8rmLnHrOmU=,tag:J72V+VTDRZ2p0JCwzTYmlw==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:q9KtRJHXF2qr2Rp0hfZk7u45mKBa9lZbbuqeVIR1WJ9//pQFroIUU3cFkA==,iv:tqzM79Z3PqfKacLq/KCAfzy7P8vyBfButxeIojflt3o=,tag:YTQB8/ahH/TAasV0hYvvIw==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:8hzmVPjfp/BUq4EisLtLkb8q+HTEDlPHx1Oi8s0=,iv:P20wNqjdczqOB0+FIhfZZWIUxMGrscE9fStn8xktfxk=,tag:6IbwunnUfY7l+8o4RiEnzA==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:EfNPxd0Iu3NLNr/S2+sPSyOBwoGIkuB1ocbszXX2/nrjczthlIMtmlL7xb2TmAQ6OTToahds615OAMpgnf6DtA==,iv:h2WATBR6UJSUwIwesbqcI8RHsebmwprxTDMgJopFOVw=,tag:IHM1lGVCQvmbgql691IWxw==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:2VRAePOAfLdkRqz0T1Y=,iv:V9+q0WHjsIxdbgrI09UhLmpYIEM+GT93biudgTYa3j4=,tag:WTJvlRXAShbPQ+PvglgetA==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:NSsX8nJVuHcmdoiguzH7EIKAudQMisbWkw==,iv:nXPV4ckZcXe8SYxaTaL1oZhBHafIdEvpXHcdwQFTNjk=,tag:ptEyVB0HSVhwYdQyDD95Bg==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:s4vyWOVHwERJbjt2fOh7JztaNehih5WfKWzE5H/lxxc=,iv:sRfA+K3HUDiOFIR8XLUHTE4zKAN+t7h5/holF+syFRM=,tag:h6eyZESMcjAEUBfNjIRXMg==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:36PLwdiV3NddsACofGDIP9r6j1/KNpqKiNg=,iv:vkODcSLCwbhMl+f+hDrXDoVyY3Ui7eiXd0Ex3vfnUNU=,tag:C9ZxJ636sniPrDU2eTUKIQ==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:oimEsjG4ovrqYI+EXRCLNPiB3pB1tOnNQ7Zysw==,iv:Aj66yUObhSfVGbJ1cZuQmPrO/B0k3vKw9142z4e9yNs=,tag:mUHj9Sm+3aUH9QjWdRm76g==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:JvRWS4wfPT93Mj68B46PZHO2xpo=,iv:ZRraCwUfsZXVp90T0IeI1RiWk9trKF2yB6RU7gYTkIA=,tag:9Mxx0C1DLkDvGU3S/G1JIA==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:GQbf12ChuKirfXmbvPTz+8JMYicT,iv:26+9Hx8fhd0wSj1yzBqvOiZmgbfU5wHnNPS14g4uoS4=,tag:ULwJLtvJcGRxdXyCGenpWQ==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:1InPuup/N2p3AO8UKLQI3rlKnxrWXwvwNgXzNy4qt83s6vYHWtKDwsFFCcmLxvY/gvV5E1X6o1wLKzdz0rTT6LPbZjR3f1Ji5Q5VqEF7YKH+WN4XCV9MpUfNeKFA2NRt3+e8hIbRQ0+ks6sARl63fsTjm6cbncqHfz7ayeHCuHyvYZI+knf4BokCSkpGY6bJSdQerJY7A9ARlt7QJq/USqhsCvd7j5CuzaNQG8LasvAe/NWTNDwH,iv:xl1AXUUXqPpt8hIzMzyFr4gWKRRYB2m2hxoc7WSeEfc=,tag:cgd0Jhq3EKdvGigpd9FVDg==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:RZ2MYj4HdKiap+tNw/Up3lNY8p2+ZGC9Y6sp3S1X5bCN1Wa9tCzTptW7v0NT4EYJLDLj9k1m69Sug1YCUJaH7gT1umEhWUNS9qHt3nTs3VrdV0cX28gnSc4WRYNPszJbNS/jbgmGamuepLmTeR/3zujXKFhiuFRzBvxrgdmnYjDwlEYjVlnjmioPGc70QFi7Enxh4twHARYlPb+pHE9MMrWMI9ZugyLDhzmDxydwOLbsgNyc7gLOy6syZfi14boi3eL7eiz8PSCO5rf5DQFVQvyFT/MciZLjtHcsqrc22LeMkyJ/Sw9i/xbqmub67Lim7x4uVXAIkuYGid8H+tN4kaXpa1Pq8IyK9I6AuV5gga1WFWaLTvGn8Z6Bwbu0ajglD0Sqhz3MtkM+RPJzEhYvu13WZpvb9JJc1oqspnJsJNChGk+T5JHVFbYCOzTQvbfflGoVVyayP9U+hnGtgzAwNdIxGXPiidVRAs9PHp+j97uPVQeyPNwOwXq6eRAo3sJZuxWuyJoxQe67tbu9KowDQuMrmi2pgu964lm9bmPeoxERf+3VsNCcXVKHf1WG3Cv1nP3f8TId6C5e2Sa1EuJY8d/QrG9esG2OIP+oAKNhUdD9RXm0tgM478FxZklUVXhC57U4LlKvezPYL7DarfZInrm4j9BRAYXMU2w77h6dveOLu1VFvgAFgINSdfNjqCD1SNgUCkUQyV/h2fXy07NhZlc9q/v7QoNOifBxWNPAgCRHF1SO3QiMl1DacIIgsFuw9M43lVS/lRs1FQXT6IVbODRHRqQB/KrtgPxAoEXIVHY9HvBbCaHURv/KkJSkHiVPNQdbEc8ckUDQTEiG/dnanZs1q3PbKtf12s6oWXjhfXKkZpMTtfrKSdeq4EusFJmQdKpZvjzw+gnKu0Coo6JUDRSunPZg0HUho12YPQJdQlUW5zJkNCdyGhZbJNEIsDz6CQ2pNgsjvtkJx9G4k28/AfZgr1jnpOLIG7x2EGQ93oNZjcge0mbzv0Tjnl3f2bUD9izPT7lqOs3Z5qhsY3pgDAmtYOxpzDr2DkqnHN1OtA+PIdZlQlKSVMguVhVhI8OTDDy+IYeCqPSFX/5xfnXpYYlkTN2bFWfl1PZq4gDnXynJE82EN/hSaM3eTMaVbpBeJimQGicKUbUAI5xL0RSFflHsMqHVpZ/j8m1nz2if9PFN1ITDhHOSA1sa/CwekDos+yt1l5+w/1F80waj9CRKS/St0Uwfwn+ddqqbg/BdCInFvvze8Jsu0ylG4OIFi7D1M6gOmrwTqs1MVg/KQNuXx2/49QVt5DEpCuL2HEXzs2lKhXVHlY2c8a/taWNPrt3epjF1diCOSD7s9iahHUXnReCvCzq6IANAYBsOf8xSzCtq7jNNtQ4rmYLAIXqsMGcY8aILCtTthf4GKGx7UjmYzb/Q5Y+IP70uXxNTSqcLVAkFlX07eCtQ2uC5x/yehd64w4cv6I19/j7q1X+uJFjU3W33If07V+2z9hZ+wWMYSueDuaHyTE29d1RxBkNiXU0b8h6kN2gaKxcsqQH40iW4YC+5HAJaR21rPpYtFPfhbTDvAizQbmOkf43wcrRwLYVbz7cfrUJSQKyIYSYAXVEZuqjH21wgFHERO2NYaLnc/D9/ISodKe1m5KwR9GLISI2oXIc9APpR/LUemyiPHhCs9uD3WFbFOfX0Nt0b6welXMcUtyJrhpi1iYArrBAR3fXatdJXtuxogH1ZdnkHfyywGvWgL0UU/f5HI9lVFcmnoGb30ufqKzhVojC1uJ0JzmHZcrcK3YqAz+FuZESQs25mWj2BbuISE4IxcH+jscKHCGX+r9tMk/rDksSgYUngd/cCBgoNR0E2gcdyk3+PsGiO7BHBx6y4wrYEIpxFQfDl+IVA4XA+ygzErjAiFYUN9DiytvTaTvkHt/OPeo4Nd8S8OCDWv+2SdUJ0g100fM+7sxNlZ+Zn8RUWRWshuIwak9e68kqZfr5UgfMaiTk6+VqQQLLWIlbQj/tjghEwojGrng58APtdlUVPWuf3GxRpZjI0sL4NPDvEDAEuujOKVD3rOWD5g5Mz+170cksEUhXgSErdo2ZE1r6k0b+MJ76GSA8+pFdx9gwPjGoKSKSv+UnosPYBxwfxpokcVfOC6gj9GHfcg6Ix6EaTRKpukUhTl1KZdOFrLFvgQ0fvtD4rUknabS4pcPY1+VVF/qtlKxH2iRyYSnrrwKhC9gILOqieEwY86gO0Ht7mDnAjh0UovaFMSYclWQ/dmbB7/HJwQHRXbEtjQbb095SYUBUVSK3QWe643rEezFEHXnso1Oc3i2jyXGZdEA1+DFWnpUsWjhwJ27GVe2k3lYHBHp+BJZUJWmHuH8AuEEV2po/wPwqrth5UBeKK8fiEVaeK1GqCP5yGVYaKbf1YEDfJ22BG44O2G2Ezn9ABzYwnnB5eU5Ts8+nnVqUhGzT6S9JUvMhBTFgOqrVUKz7hCNXjGTBjgDz7v/psf1qajW6aTUjWIacy+CUjGx7Nz5oX4FT+l8rGZGfVY1IIuEvCPc757Kg+KNsRg0i7ZKiYY/9XQeLlHts/HGWB3kaEOReM+l9muYci+LRFuSPNKNR0lfJRKU1YiypTMiTmTb9XUSqR1P4CzTcM2p4f4m/XTB/R2CYwL/uhq0Q/CcEKwimU5r7KvJ6a9s43eMoCRSNp76H6N15TWYh9MJK//EotF5WaFhufnp0MSGEm6eXeLu16oy1Xe95BlybVxW21R5ycI01qUKTCSkJZ+qXRboM7Lkb7OFmLf6By43kpR5YRi8Bel7d3YdmNJLuQQIpHiJDwAYuSNtfE39JgfDf1W591F6e9Cdgy329xE62ZZ7aKYZliqlNWkSApNZPJYPN1fNoNPLyQLyGH0Tb5Z/V4OLjfnGXdS4KMtwP0gW+T7YBjaddtHHdfphYrG07aATcOhf7pR+PSwKN63/XcZbEUB7nPAqwHiiMHjeGFkmt2mgitcIHdo/piUAA5z5jDVb6SPmhAW+x/mG2NdtzjSTVF0tH0T9aIUfiBU5r5ZmsAsE+IVynpnpTrh+ANaUqZFLYFQ7LYBNvLkdIFVmsa8hgpMWs/sDBZYVrZLiRHNhpg8nIKVul42tMRYEvG4tUjNVcCWxCsEGIrH+zdJZGhPVmR7t5cyjIaSpLTZK0Xql9N1S4L4g5LPx8eXOUKresQvIrsoLHnngjN65BAxJodu+rMDnYn+b2G7R2cmuKOGAh0AC2YUWNHurlibMwhi4iFKK8WYJJKoeJPBpwhe8NjjHQuzEMvDwd1do0vUwFtGqb5xkQSqgUxoqLXw2rjTnVkZS6AvpI8JMJ2OYEaTInev+uPKVMhsiTHiR7pHUBpu5zc9WfWLCJjeBkL2gsk4J/Ggk2A7O0g//CZyURkmgawDY0oe5R/PnJlYFqmS587ZzfwLX69u3xUqeiGd0IJd2w9AcBe/M57ibAd+qA/xQDYmoApRL1ywSRORU5EZTQn/zibodsH5e31ysav0KMeN/NS9boTn4tvXQj4RxA9QVNqXjTZHS5qScsNOWXSwJuyve5noHCNtlylFyrCa4HeMtgT4M0oCxXFY4wWcFx/7ywnXVak595pwEe5VR0GQXI2s58cT0KWROwIBAQx4qEnsnLS6gEhfn5T7EyXOkt4q754tynqx0znPl0mMbsAY4f9fRW6Jjn/xTqLC7R6v4JdMB5GaQdEa3D+75TAnVJ6UvmL0SDoKrVCMhe4fM7E40NAjEbhVDNF9w7tqi7GFaqub7HYGJ7CJHS0nyL2eWZ8MkDOmq+VOtIBrFC9XR/qvsWhgr8lcnW5vFuBBY0rQyY+L/pd8YwCtzHKHEzcpZ1hhHQ09GMNP0XrXApXCufLaL7d2KJ6SLdEOu6CK5DKDFwRvA7LlPGhicyl02pgWL530d1ZncYeDZShMU6+Srqoy8lqK1j046p4h/9Ymh9lNuHMt/+aMk+Qza9uWk4032sDD6bj9RIZJZ831CP4TQbvUyH9bBexWFbIUaFm5NiK7aVfGMZUfMBzSfZVz0enZ5lLVEbpAs
"headscale_config": "ENC[AES256_GCM,data:el6qhwmXGGKlD5sT+Occutld6GU0HR5kJ91Am7NZk3IcKQwromilTGg1ah2JnDyQDga56K5DBI/TgJ3TPmJpK72U5WxggtEjIS2jY8WGsNhKLLpzaimny7geoMgyoQJM+Ed9qf8EXkH+/7qajXS7Tfg0SM6OhHaVX6E8yLylWOD3zY5XibxBOmxQUHVI6JB4wd3cqL0HFHVIAVxhik3CSp/YMfIrtW2LB5TIpC7KhpSWB7FcVKZL0ZVjJSzzymisanUJ7WS0JczRTtecdl/wCo0Pc3djHWeK8HkAt1zs7NiwUP7eqLylgyZ5o6QeHah/w21j0EGMwzP1aJh2w4MHbSf4Oj/UFtlkRZ6FGzYdpfTaWbFRR6FLLr/ALcGoK5dRbUs4k2+a0Bbd8IXvLnOcGVwZzDtUzxqPSNCSe+R/riR8j0ZT98EdLwQirTBaX88/F9v2H7A216hnGIu72MYqEPtF5U88D52Ee46A6gqqzEFXrLiOjLGia2DPFLEuAk2PWDbsa1xEUJfcxl2d9HydpNgi7hqKBW/u4mHuz8K41s2S1AO3vEW6APfCswdECHB3SkfwAR7T5U74ZxcedYVa2OukLpT+Wx4jp+zG91OJBkNjFej7+YkYYVVDDvwaO5T3V3rXtEjR9YDhqBQELjFH+of6+2GOPCy8Am4CAPHyzfDfdN8b2E1LCI6u8d2W2h7OKP9+Cs3hdLCl0UKjTn2NbigQ3xno2r7NWAgET3Pr+/j8HF7bIumk1hHNCMJao8cupFYUeAL9D1I9w7gQgIpfaj+SrFr2nYzy+c42dPwNbK9sbjOj0daiCBzNOcTBT2GtRlmJiHFYXxSN3eGSOCB8BDCiYmDpQaKlrYiydz/LF7WuLL+/NkjyHqv5Kcx3ZfBioRso5WMZ96Gi+ZDVBVpevUYqOPs4Tzdk5be2eAmSQPT3mKl3zxa0pcqEKfbHTnMhAsbe+AQDdzD9mMJHiBjiPEGHIRNb+R6kjApYPA939SCDTmYoHt7KGhlOL8nGISaIHo+dbyJzKz5WY096GBDMzwRj5knqbj+IDK1zZk7dkbP1MFn+1BV3N43zmYZesxM+msBtVaK2d/OBvjNVPck4PL/nf75xA+UFgGd8rMx0JrytAnoRkrkDmVNvwke/znVauZSVNcBNqXqkXI9L9qoUYr7P2756pfILhzxubOqXiHWI7Ty/BmmWdtBdJO73EaCzDabk8oWMXH6pncjzbU4NpIaH17XQ9nsv95tO7KCU2paevslOYXlORgR50d8SIbZtTOlXIJFw+qNsnjx1olpx4ZqMMrx8m5KoXWi02I9ZL9H3Yuz0ZQ8yVBgvX7fT4Dk9GSv8Yai6pJcUUMgRXES7lPpJwl92231XUgq/w0Qxu2360Vs2Qv1qKyIu/L62JKrRsUwzTkOWRodXLWwzwM732D413rLufwfG74xNECVH6z6zcHd9KvOmki/SM+vYLFg9QbQgpZW682gurSNx2GKt/mJyt0txkw0yLN72maMXuj/yrPP3Ff0xNvDO4ugJQyegGnA8eRX/qtZzVLY7ogkXXSnwzvkvM52yyY8d991Y0kzpKO6CuOm6ovdMr3quIGL4d3qBpUKi2zY3G6sWbC3Km48HPkuYGOwz6h6DwaoFWS4OAfLOotFTSFq34eJd0St9pSbZKw7QTrEHL53dTenNrt4FdKc1WDSBRZLWYLvBUjiI3BWdWwAchOPznh/oWZMm7GIBGme71PpcjTHaaqEXw13XzBXzgUi85tH/2j1WsdOjzR2rsCx/QgMd/lIMIp/MT7sgB9mwXN1rRTJN3c8WsXSkFX37D0XQHRm1kSMWZde94/BftLaRwIAsKLvcXbpVDfmxE32MDteitYw1BzUSj66e9AsvCydvCklYRAUQ2CVI/6LqvF15ja4SdKUH2w2LYxB6VM5Ng82+n8X5xo79SXNxrFYzVhOdE4A3S7i39GsT0ofMaG6clmAxFWTcRIySDToyBSJ+8ZLSXWB42PNVnCrbzKJRpuDOKZpW9qmuA9jPDNNAWHtNme7F/j2c6yKZqoW0UldLPFiQZBFHl+4h+X3wbci6KXJ0/9gwOlbk2+74j9Pd+yOWc1RrL6mpnrN/ApYVQaS8pGQ7dM8NZHCHbw2NZ1qN+YWeeAFF/OkjykLqDugQ80cu6qvhDMV1C3wAPPylPEU3KDUcjTvBblVimn5cwDMXuM5KXjzzLVvDs8+HWmasniZ2XkE+vrxanU+PcLivD6CZt3J5QtNtK88xCWlDDNK8SBqi9lLY4GtdEMe5yXVXUfx70tRqUa24Zo+bzoIa0DC4z5p5yXJkiqKpE4Ikn/Vo++RAf5ci33a2ETk9Dg1L3Hdrf6sXegAspvE98eSobP3jw/KmbaRH+ijkbqg5Segaa56c4RnY10q2UMek2W+JqzOjITa5uLE8F80+gjCejGxfOKNjNwvYamY1E8UolsMZXap2mjUMbHG/Cq0e8sFXuaTpjc3jV3cS1wQicYGYz4pYVkyzlwaSv4CpheXpXMYQrZdWxw5nXBndGLFScKCZ8HK5YotmKpuo+6Y4hnv4NkPIH8XK/gWfK2SVIBYZAnpBZ5J0qeQ6n/0tNtKr6wrpKXax7zeeRJqifjlv6vlSaBXdzU18W9Rw3H3GzPbdAalK7WuAjlG2Qo/UprwWQy2d7q9pJ2yP8T6AM2mmQ5+mbYu6hZM3DPiR0BcQEXbNhhiqz4oUER+OadMM4cWJaTpedc8eUDAcTnlzWp3pkT+G0UikrdCXq7JeQ3wA3naB0A/AXj/CRrk7OSSEQ5Yvi2JRyvkt9V7ttcFilra7xNSaHmwjgc0TpDVG4gZnzQi/7vZuPD74Th+VXFF7I9AblS2dXdEeAK9nPPLCBwdQk471XQBJ1A+vSvXy6yd7OVyWBpH+pIYBTo7ufCI7rR8hQxpuVuc73y430K6Z6vVHkHwIEBIBj1360dFAkSrCim0zu5MDTdXmNEX5/k9kD7sSjDM5t5oFMCI1Oqsrxgx/KN64F+tERXXOiWMA3MpDuInilsUbFqFnbJQy61FcMF54dcYwTi7ha8LWefdqJDuGTjQ/NWxxF/VvVTKpnjqOL/cxslyW+m7yROxiFk2q5HI7j64egID0yDHJznFAGIVCUVPCRHKbMMTHJIqM6VpcOcbleMxWY2v97buTZPzFqQCka0dk9254JbzU86kfuxZw/WJUl1ZrZFrcBQ/YgpuQRAins6WycXTsyB/k8kqlYiyCpMc5G0eFjJ9v8IIlSoGcnHzEEE3xxK0HE7ynkC1MTFSmLKDX+ZyHKUF55FnAEE3NVP2GQ0G/6ZCrz0nwmp5JtLD4WuHYFkXwggi3EY8F4FUhV43qWRhIv/awOyxuyJqgLHOk2i2iO2BHUmjJFUbc3yk3P93yJ6jstpmeO6+ExDwTicaPKlmhSE3cYRX3P7F7agcqrdLH2D7712GuUVYvC5qlWYOHTVdLUIsuwMjNrtGF8xmsH757Jlchbr/wexDqniXLe+Lhz8NiBmHUr1910SiqAf/KTXLhb9+tR92HaY2U18DIQBtWZ0ssB12R9zcYw8jukYhxMmXvSBmpQrcs34oxhglDwH3UmU3qtH7Y0NsPRl5EcdDUD+p5fL8Uz2ubdEGpnBqpbkr+AR3GLL1+/xtV3NLLaxCI4Wy2fNCFm1GFzSFoNxmWvw5jyJLFbKHKN7u5OMIErm7/ioLIgEkzn++al3ZIrEMCnqVlWiAtyyxSkVl5G6CeEnGkgHHvtU4OlGGHpOuCAYZFm3M479NWxTc/cVuaC2wF9WHw8UOf2yODUnkukUQQ1powHceTldBDLTOyi26ZFVFSQO4ryX+/hu4ifknfba57CxPtNn9dI5gItCLpfVgPOzrnK0Ra+2iQ7tKjnPSZwmhKErIoHN/Tsat7NsdwORQT0aBMLIPjfEmclCk058wrx6Q257eYFRGHaZu3OAsvYNnsdBPsj3f4Y6YFT7ZenjzC5nWap4vbmZsEwEjD5ViRnWTSp5UMwredhxVwq7INljq8Y6me2eIHkdNQLLvqoIu3Xp0
"homepage_credentials": "ENC[AES256_GCM,data:ODb+rLt4thqLh69zpiki31Wd/LEE257D1yDId5sc8m6HTLUp1FIRRfZf5Dwrfd6XDsCfn4Q4AYPay2s82CUNShrCxL4hcSusLrNpfaa6vN8wgme2bnLEF3EBk2d95kCcCryoAuf5F4yKDwxlJlAWNiidicWHFSLoEOhJMzhU5qnb1X5ioILWi0xpPnjkuKf1Qy62zKf6BNFw6yZZ5nUUWy413pfIk1wQrNvfQUULUjwppO7wqnbM6jr1vNPv1QORYi7VpNld7NMR+SIgbd1qwRGRGRB1Ij2SLZo5Dx/3WTjVPN2J/VH8DXPwL9AanqHuLeIqT+dRAF08S1hhCYIT/b/MndUNvUQRHGEniOhT1xWrjDuSzHgUsOajWTWQzrvjCbZou6x9bLD6h74KhHJIuPE98QbWG5iIJoYCXKJ7jyvR5n8A1mamvZcmG6bAsiqEPJD7Mb/aqSCuPAvaHm5BpuhY0zeQPF/5TgC4MdvTE9b61tasOdvLBG3PLYxaV7gNy1qA4bhxNvqWv6hbqsSn8gkqToyjWFUWivM0w4tAlTre7hs7R8Qwhw1VKlcS9YltU5ZRjqPiarQb3S4LkCWkYx9makZ6NDnGuPTT9aq+1t+WSxsteQp+DpnIwV65ExJog12aymxMcGd9QYhl4oVWgJ354MiZ37TVKVcSobuB/Hn+esgS5NISfwvvRBadGxw+LXVkGdfHzRcCRrmQtmoBgPFfdtjv6ieOy04BOpklcHHwFHaaGimy1N5td5hSUlicEK8k58XwUZt6PElg9KHkiP9M6eirV5MjFfoWM4jy4jvX6zTRa3WajQijfAdcIUsaBnuPN/nuGiVE/XzkOcwk74IZ4rkW5rubNFGZODPhNrNp6seG20HrvHsLitSPlRd6MNExx93H8yGaksnlq3VgT1rvD2bv/cMSKuMhEsS0lGeI/nYRhoSwc/egLMi6Gn20g2JvoKdM2m+Uqm4PSPnlcAPc46Dgipm0/vsHSFzbLQhdZnKQlG2QDfPeXGAfqoe9MNKauRTzuihMxUP7yjewKrPNkgFlOjOPI8gpqyYl9IDDek9hhEyR3mrxNOFJe5NmMrNkWRGWZp7rxtMU0I2gETItD17NG/qRN6EXirISuDK31v0XR57iBbc/r9oNRZ0+8YxJI8UT9bZ02KMUh6TDQnhrX40nwZFPb9gIArut5pD6xXghgQ4OBJd7gJx3lsIlTKHUdAUZFG79cz/d2j4tysbYD6E0vlehC9YP9xtMTx74dzcMFS4dsqG5qvOfaSnf3mDxQvlF3js0gjOWyKcbCcUAyFpHgt+JQi4cXZaXbonCrlNATqVroq3zO3KqhxQOP5mKwyyDaW/Cg/eSDGjTqjMXhA1ZscH+C+9L7yYtNwZf3Vm54D3B0Gj2rd+EQZ3TqmfqHlazjw+KrYDsaMBAvcgyPcn7PUbInY1OAMUGEPb4bPjztgbNbaqftfW4Gf4A1sRbYkqCT5YMV9GZhhwJUmwYb3mcuv1CGGnRqJgaMoxW2Lx9fd2tfaGL50bprWuNTdkyKPiuRCe6W5kWRzpCZiGbfc735Bt31RbhD2VCv5QtVIYiP0qD6saEmEOmtzkq21NnT+o7hnkex65FqQp5GzO4DKInniGE8lA3/02K+1V64kA21scYHaWbjuo7OqgKc73JjXzMrwrZh3oMBta+PzTls2tEaC/SCKKoiSsZ4h2b7sfJ283zby90iBToAKNXg+qoRKcg3xSUTceYoO83A5AVHZBMiumenam9fygroDuwT7XV5JDBYF7MYv3DWsirqyHaQEmoyzpMR1yWmO/NNg+UwHrufiBWmuWvdAd7YkDMiWLasrThv/f1NdUKtSVhvrVpWiTQYsSrgLIXDbnildpg1Rqsp15GX69dHZaJPyDRh/ETIp7GdNL1cVK1cJV6SlrV4fYRfXBTXEY8uD94JrcW81nYgdtREm8fAIdiEVRtKiq4BbBHP+FgILeo7JrreIvs8atcXm6yiOCL+Y9BzbMZv2/UMqCkp2q+yut6B55O+8ZD6JAtRk1b6XqulagRXmmdrYj09BHQZ2miIHAnis5UYj4blTxt9rOBcGQpiLhKi3FR0SrQvDA9qU2ylwlUNgaELtX709+rb+KNXiYZWjJf8kh1q91SRkWtMQfeMJlVuQNec9aMkSr4WisHHux2GVLztJtcagd3jusj9zeVLHdukS8HK7VqLUrbiil3TAqGbvjVbiqLuuoFVPhdPdipJ6r3oRZonahHOaqhUK4+BccgR4A+oGc8hdyZwJvjHD3I6bQtVB3CQXfzEkN4vhIZS4CRgnBz2Qo6aLTaQW6vz5leCUcOHopXb5Pd2+5TOIks911EtkVfvHQgZxqSkFr/S6kJkDpfKWHcQS2hG8C8hQPF+Hy+co8Iz+Nmbmmc4pzx8QLVGApS7ZltM+PewtD13MFx2mtCNgRPegwL1/f345aF1WIV2ek8VSwjfmV40ewcve0dT9SdmVucPJO11cm6geOlyE0Pf6ip/GjXmfFsFOo6JJGsX7u3HV1PYMw94HOwbe8+83ZIHaQwfRAe6vKjPO2O14KOZpcSA4UjzfoPumyHIoB908GcaO5rVj6ouZnl3LscgjwfC8nBoVejCeG0JdW5iQpMiRsEJUIuvd4w+A2VaqQ+OkgDexPeEvdUEsp01wO+Sbwt7SwVvMofLpkagZ7FQdA3rvXFwNVUsF0D9GrGXiaGGvfQBZ3eYE1EQdC7huGQ8Rtu+wVo/GxDlU9zWLvuBw==,iv:wUTYLdqxZ88u/gDW4ICf3gzd7uyXISUr2WJEDsoLlcQ=,tag:cNcd2PlF9SDsb9fkV2lrrg==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:s+PKu6VcgleFHCQC55aDaOGhKsHCFuIFOPrhIrofbTjMwFyij7Ml9CUcwA==,iv:/bF+If3dzUnpQFW9ZxwQMGgPfpjBVUY9svmBeQK2m2s=,tag:7vyNAHtfgp9fdnXVHN6wkw==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:EghP+VQEoi3ECMjcflMx8KdF1oOxtZhKQv1AsxCG3Er0NJQgiejXRWxc0Mh1Rs7EY39fFxQQKyoqLTfgUHsTsgT9DKAjnc/0Cn4lD5BLcGBEadIiAaWyKA56CfyIatDQRDyFM+At9AenWt68KbeN/+2c9upeI6harnVOgzx1RbHogUWyfivc8kH2FvdAI6X8APzICRch/tGW+sQa85QtMTpL00BGbzv7k2Xckw0=,iv:glnYBwPzcsb/wa2XoKTP+cNYHtQA60e1Q4ZoaUlpL8g=,tag:YtMTaTYaqjc8ScccPuzJlw==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:Nd6ZyV5ZV3oWyY1gW3L4XQjyTDqLY+u6Sognq1P2N/CFKaPVZe8aXr1fdWyNzXZCtqxmiEEz0HJEu1G5mJWwqWT4Ywjm74kUSU95DWy1fn66hCuKHSec2fhjMTVSVoHbMMUNa3vM2ew/M9F8yMCjDQy2v5z76/++jn5RcrlqMmbGBFhBqiVWpooMhIVzNx47jxCLGHFSf3qaHg7r57CCcXT7zM+8Iap0AzpM0msL3/ppjfCb5a950gbH+Dje+KSqLike0MuOHsq6hHaglE6UdZeh1FWnoUkAh8YP+/0kw1Xpts3TccVSjL4EN0WAYGIGC8HU6p2X730S9gHAFyiiRQIWVBbCCkdJFy7KRBZj42G+5M1XcWEA/g/jwScTilOhbQf+1yk1gaoau/iOt2JKRf1Ag/t0tFKbnjLnz1IZdD3rfWOGr0dPYf384APILbzsj6sO+grDSmYFtce3JiCpOvAiSfE71OrsdLGkoNoOe1aiSI++etk9GhNWo9oV2MDUr7xo5Y6RCEAmpONgwODZyrJ4BY0XJj3wIyZ4psJkTF1yixVJAN/nIDe8FKrrMYKRVwJVm4VaGJQ+GT/PhEDzzg+MhtFSUw6FWMsPNHXY4SYb5ALgrwJgh1s/rmYnY0yhEsYDW3V1UmGj4PiH9116LD1wiCrfZCfawP3GA1g52JnVS8vYtkM1ara3yG/5t7HqMBchXA0aOUQ1pnko5IiEIEnmeoijHCjNRfpLoDSYvkr4GgIO1rvdXdM4HYca4UPGd1yrxJkOA3AU0i/7ROTDUx/RUWfoTqsxxDBY+uSFDP+hQtsy9XaT4q9iVRpzUTQ+TAvBuHDsVxJzRq2tbbFVBXrfbL5nn3s7niCRyk4zbvfwW30h/PGCvIj2OCN5Mg+m6aVjtFOVS3J3hIpM4X5/,iv:jgVqSo9cN/1j8oH0VGkDdSYI+k4Zq5Ke/evjTm+8CJw=,tag:VKTfzsLjQ3vN3NaBdlAytw==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:ZFEZiyHO0LSh4z3Ez6s6xDbkeLjdCJL16E87elAFI1KIX05m2bLUHuGt0kUo6eOOppYWbRwDXXlyz9/pNl6VN8aM4sdY1YBae2U8pULRMHiJsXwspv4lvBx3OobQnK08DekpjQW2coOqwLEaw5okZgElYX0WlsMQddAMTIp6nUTAqPppPEm3u8YAMnTgL+zrSV4BgET4fUC0P5FJ8EH7xqXCcHXhXP9uci7toP0cBI62sUVh7lNb2sio9YpN4ceNhWSWz4pbRNYrejsgDHKfMQci5TTkO4yU+075CMDItDQYfaYrlR3UEr8xDSkFbDW6rsgie2S9VmPpvPEOE94J+ZNwS+MY1WY/OL6TqDpYC92uCeKBvBwtAOQGnnwdcqgq2Yvxe3J+GEX1NZZ8WsNDzvLUu335mCjiXqvH3QDBNubJa4wo9ns6SfVpPElBYFKZA6hG+NXlbkPqOPp0zwY1X5iK892N/yYPbWcbcYbZKVMb+kd7qBXFZxqzOJFuKa5DvBu+N6t4QcWGp4wdw5QiIrKuufVFo60TsBV29UyytyXA4lxmoyGJmUkyICnbHA3Ic+ExkW9s7bIORc4UyXzXQk4kJvXa,iv:mQCOxUXzpcdswrzxmv4w4nANxuSR7jzhL1F8xPWVmBQ=,tag:M/sJPR37noUvZCG3vZr3vQ==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:L9cXWiLpFUbWR/v3GhaKTZAsL7ByNs34ZfGxkX+ehwljebIyM7Wb85m8drFM5zlIVmqW3ah+i7DnUiCjHIxsHjZI+QWS1oo3aRhu31qYPlN62G9Dw4jU4ZYKK+uTNGzoRFyokWTi4qPDaa9N3zOR1iyPw6LiCWMnehU6AwYpbbhsgZ/qaz4B9h5pLvR7BptV8DvYGlsGApjG6JrL2pSVnrcwprT+qm3mcg5F/xmdnXwV14mgz2jm0aZZZnPBhyBBhF9x7pnXQP/v7kz+i9bU7DETkxTQC2RYnoJjNhHFSd8EvOLxlP6lKgD2WJCVc6HnTm2Mn5fxk0NT3GCDcFW4hsiEhmclI4CwuTmltGpdxMg8ywPFsP3HpdhDlVyxfWM1zUx1g2judVAkSAPY1IWkMdjAOoJXkHadA8A+M5TVAKC9FNeuA9tdqTIFHA2AMvszHXZRTTEAnB6QUeySuWOPzgB5qtzSYNGGX/N85NCm6c6vRb3RmWjm3PTSB4GGbxHgDJTXZaBqzCKct7xS8JEVfpk9ZvV+rMPvAgwaYTx5GYfHzdtKPCCHGniCF/NaaKN+1AXBAG7v9Wi+47J4Fn7EL4CvyjlD2aGC185O4G7FmscO0+yJ8Rdy6i/Sc/n2+kjD+Ow9SUWQ1sDHMsHhIiLRwVMAkiDmAM2Lpc0IH9ydIxQoq9dlFWPAJK9CqpoeC+dsxUZVbUBqdpR9ZUKL0A0Sgnk5Ra+acjh4lY69eekkoVmcQTU6lHBiem5LDbi+8CDWGKgf4pxvB9WJiRDLYwD6+5QJS8DtCdOTAVBUuDC9wy60UJuP3AvwgAqYO5DXRInB7a1waNMrUJ/ujeQ9BKW1NltALZJS+LBuPbCayXT0GAt3ZyeUeyVEZ7h4Ch3ms19RzRjCNe6YfGd3lVfHW6o0saj4inSbnMZvoBCpNjXi1ELduILD8PX3H8KuTitjLzG87jjT18+sxLEjogpivTXRBA7xi5np4PhXtSXl4YZ5bhUolLFVZlwPv5EmDs4+9RGlj8aTDPp81//SeJKtjMd8VqDdzAWPQQdaVVLfzM0szl853x0siaYh+rjvzZm8sLuI7AHWB5hyiXVuEXy4vD4q2Nrxk8ctkqVyJura4HPDZhBJ4EI0GXWg0n0ZdXpupjT9VaStfQ/iSKVzRlnTO1WNQ/noxv9+iPv3hN8JfAVVq56wMe89XoB9M/J9/KpYUCrCbdleZbM71CUhMSgav6SXjyrEhpmKfEedajH2Wnr5LjF6dHGCN9ACidRCqi9hnfgl02r5tgLP1xx4TWbRWvZ2F5qvn2NUlbH7SZJ/cwrqMFSP+UBwMd6ZfxEczuAuqfZypYGs7QhDxzeYsldahfjOofxiJMahcuDnmqW7KB2j/ok069TuZ5/9NJi7JpAqXMiQn3WM/u1O5D2FoJEP6YJ+WGwm0EVgLnlcMD3Us7riCnUbsXolH+D+pvqIHDojONxHONOuPlpyNzQJggubTc5wRfv/NvS5vRUugwEinDuLUWlm5tZiEx7k8glw9SBKXVLFb/kbGlEwaPjj0cWxnXgBlB427kS7dsusuTCrAS4V5lZVwJkHv9UvNnbTtDnoaruXysc8uRPDQG69Hbyo7/Qymmivii8zRr/OQ1u44udXz+zZslqCvD8PhVflmGeV2miIED1PFw26VnyVUyTGCGGsg6tDSUAV33mftTzyWD9gI284+iCaxoahF/fLlCwuHuEhW5xFFSxTzZj3KkPf/QMkBo+OnIkZuEhdoxNjFyo+3+Po46oA24TCod3hOA4IYMn13FSy6s9RmTWQzV+7Qs3OY0/WBO+WFw9cTlpuVkl99iNPksy/4b0nnCxlECk+TFuaZdqo7jRLMdUrkZlGxofa6NAvCFhcu8c7g3K4olKzQZIma2GFYEF0COWwzlR5AjZJn+yojWDMYR+hatLoJxCeC6p+hCEeIxaYNJwmJB0PLsZgTA4/tBY2gFmByuz9YAIFkUL+hPZPqma+BrEFWEC0bD4288MIu9LGHIQUVH52K8RDZz/8SaVRKtc2hqDDkNpAnrMXIMehDqy6DhbMYDDEGhwtPUyTfN8TBC+ftfajYBu0edGIZz/EROmKKX3qXxF/cbBGPeJsbuJVM6skuax7JLYgYccCNW66bj2m+5WNesT65RbbVdzj40u9MVUglYJfjQLZsQN59IZhT84bqs0C+gMzubJzH9Jc+MwSoIayr/Azyq6MENVtNWxSbSiiGRX7PtGqbGB31wVdxq2IChsgOhlYReKj3aOEqXEACg==,iv:2yqPZ65tEGyR9zryi5UmjnpLk1Dik2IMLFIDT1Sy3Cw=,tag:MEtZ8SGeRkXDkh+gN/7dSw==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:nZz+Aceo7L3jNplqgQw=,iv:z33GX6zkATDZUxoHbdzJ+DmpctQmZvUvFJiIH246I+A=,tag:k21DBOjoxugLWVC+wRNTAQ==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:fdkdMKtyEFE3dcWXlizuAdsjjyZ04vU5Tb9GYMQDa9CJW2JxcTzBb1fgluv49hm3nKSQq09T3bQgZKVpP68EbA1SOXpisB7Vppc2wIe/ki6A+6ejS4tZS3+SYjL9lretl/7q,iv:1snOFxPXXqpmVmeD1/wogpC+eI/F65M8YuO/pKwwa10=,tag:I9By0WwDpOVlR+I9+M4GCg==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:g654CH2N,iv:R0UqHCsb/Z8pq7qslk/eNHBSQ5nxx0+2hY5QIhOb56A=,tag:GJ5PLncVkn6ZPCTZ0TQiWw==,type:str]",
"pve_password": "ENC[AES256_GCM,data:TMFLeUu76wOu+REtLKh4B89LDzTbp9q1KbxI5g==,iv:gvoGXfv19mou/PSWyXdbZ8QMpkzuThgjqn/C1xWUMwM=,tag:0p5zJo/oPTL3JXl76sYiYg==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:Ku4sa4fwnUsayFS95TI=,iv:ohL6mqFjGc6YURx3q8tyrKpsWxpbPHwd8GzFbJa+BxA=,tag:eTUuZ/LUczGknV6UbypQkA==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:hqpE6XGLubwK441gVsc1FiMu5338iVA=,iv:PkJXYQfDRwjVn7stciEHo2BuB/n+AUbvPVF3XXg1Z/g=,tag:N795m3YuNSaVQakl3p9QaQ==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:v2faLuA=,iv:9DtriR3Hwv+YhRtLlQkYfd3E7XLAQ+hKY9TjHE6l9Mk=,tag:c0pOy2/w/82cQgcS43brog==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:VLYGJg64rIf3WhR0lAnI8YALrCx/2A==,iv:CO/Nen1IvqMbantIJ/p9qEiwLFnshHSrZDXERYhu+ug=,tag:8jtH9Kix3TjlWWgao61Ppg==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:foKA8ed+XDSTu2cFZAXjrtoMbm5AGZ8rvL3ZsqujWqujM69qoCumIH58MyfkdWIiCD4nX0VWVeM9IilvVetagUhp,iv:pp/upp3fPOGPsEkjZ3iLya3K7Ux9rLHmmcMRCmZp4jg=,tag:MkypDTFXo+Z5aS4CxHJEWA==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:RE76lB/qlzVBf+Da4b0BaNjyvQ3l7nS7AH1BblXBSMtPUBM8haZ8KIKOfkvSwzcMUkGbh46yxsKQkqmRqhPkCcgRR+yrFuVrqgPy7LstSInqSjYJd/jorKxtbBz5xvfTn1DQSnuI0/+T+49ZA7xriP8aOxxhpm4Ch3M5zVYzUcHhUt9QhzEdyKAQ159AP3MwT4wmeljf3LbO5DaNV1nRSfCzWiOJCKJjP8ijiMu/GMS45/WDNKAc8B1xg4h08yKbGP/dULx9gMWsyzjKeQ9dU4/fUbSaDRjZkUqV/Vxz1THiApvJvQBB0o4bv7m0aXkjeNxVFmDRoo/t3IDlLwYY58cdiXahB2ev+w+yZBQ26qCEo9Iiyft+fvjU/pPMxgaP1mN0sm4rUUxpFUuiN50EsKsvZPF+VfvFiYsjYLemju+4M0CBKceovtgvYMj7D/ROcVhBHVLe77qXxVnfIvuzK/giZA7ekLI9etOqJfBFIjECWBbsSLBqyxroGy29rVda1I5yMqilRSMHeZ8t+r0rV6E8P1DQzbR/NS8P,iv:jE5p28rTm5WhknOvpLKnfOh+rQVKNC148YFDvtq/Hc4=,tag:cqMtPvNj1nCIekzU8ItCzg==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:XTudxnYEZ6B1JQ4blmDP+ZqOKVo=,iv:VCiakrdvurRSWRY9772F40q70TtcN+V1tNTJ4EcY2qs=,tag:9ikvZF/XKz3eKQsI1r+A2Q==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:pc6i4izXowmmKqrrgaX2wt3NNEEBPnasY8a/49h2O3RDRSWrtuPctg==,iv:XWQ2IM18SF3iYonjjhsrvdHqOwu0blJo9vzn9/PkTxQ=,tag:10V/IBf7nvBgz5NUhJpMSg==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:DSzVPw89VvVd54Ac,iv:6dnyimLOuQOOmIt1dYRHrBP9Phnvn2D6UAl7y0zYx4Q=,tag:ak0EpDG9YsrffqXR+m7sBw==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:VKNs5OK0LUCJC1P2/W1X4fyDwHrWm0oBUjcrWnbVVN8KjCsjbudWokNT/jQDq0kmLvkSaZXSndGI6/j/FA5lXTtF2b5b+3jUTXA3XORHs+XYOlcyPk+9oktPsRBniZTp1jkQCt1ssFTYwl1GtAPDDlEZSkw/V6psq3nBZeWlAloKT57T9fwnRueAX/vhL9X3FB5s01UhlCoas7PYSxoO0Fa1zOKkrSk5nP4EChnIAnYqLZceav1+8MEBXbK5l2GPUUGEFA2RcB3UeMRGQAal+BVHcpcD9a5ZL3Wzwn9KJlNEfDnXauxECCBKapCboF1AO81hJlQWyU4BbZ4ym713hsnU8UVCzMR8upApH+JEsQttr4gL2SYEvEvKT+VlHlQ9jA3quyJnDuXHrBMTkh12EVlygM9efzwfZiL/tqwOaP+LlOaqlPou9dFBaVJq18Tqsb6G2uTUCHDliLyby1stBBdcDlNI/soBScl5d+YMqqBYX3gO0joxsgS8wBefAA5QKbxVj16tDJ06ATHHO3R1ZYq4IxvkMmhliAcQxw==,iv:9N5ycQ1YQxcrMj2zS02gaPT/ZYwHyq3h1KHsmmRtiDc=,tag:lbJtdHWZR8oooaA8dO288g==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:EN67SkpWgWj8QV0IsNNc/2eVnP2o+EBxOSt6nqSvVSOI9A3y3sLt+ssDejjIPJi2uE8wq9E//tphG3Q15roEIcvoUvIjG+q8kqJhnB8BXI+1YjaDmG7f+3nTUhFEr6AP9Hq1XK6Frvne2kxzEq6XNU7vHE902wQi2rtBe/3gnuSOM0/WwY8gnbwhsJOh+9AzKIFsSwWhwmoe5lixZIrTL89pUz/104FG8p0sUxdBl+QHejIAPeleQMTmvq6GWhUKWRP8qjUuhdpJ3ral74N+vZUY/xzVtCg7M64T/dwXszW/KaGFKld3u6JyM5DZmZW/RhUGQj0cz5zxBauCsAkEstdjQ/CEqU0cxxMx/0HCzWdbGrYNjFIthUhOlEbAo46GxRPxCmg6IP2uNK/6NqSuCW6FCu7t0Ee/4ITWlbimdEC2qVHIZ9fOoWHgaZRYSk+nBKLqa/o3fDVcs3O8vSNMpYfJSw9az7MUjYtTyZdvNPJU9qYIXYmbSZ54BjwOXJjYrdV7Kn9eFDa/4zSREKb5sTcjuLhriGZsp4XN58k/wgrwzkMm5f4d1yxMJDRg9qV7y49NNEHQf8/eC1NqVWeduxqcy43taIEGl4lWADpm+lrxcKdouxqUlYXHez8FKcy+oiH0KHx4S5EXdtmupdidbppc+LOn8up7mD0tfwghtxuuJYIgK/Gvb6MphuEZj+jV2bwfkyovsdElxhWMcg3HPM8O2h0+I1JMq6k1Ps5Q+uRr02brMlrNVKS8udoE7cyM9gkMBqnQZKja5KHG1IvlutHPUgurw3RPV9Es8GaC484wvpDLam+0CjLr4PPN6xf0TgmGWqo/QEREbfMk/dU7+M1Rqz2NCpCCpaYGpfYBFhW60ZFlYcL7Ldp++lQRq4Y2AseINE7CSjV1mJNIX9cCQYXdbf76lJpPS00mYti8ZWuNZO+SkqSCUENEEhwaY/uW2W02vPAYM34sX9Bv0izmq8UoIoNdsZHEdyjEhpddzQVMsw2w1RauuKDeY845XcooCKSMUBDrs5CYimqu7v/iiqFSceRRlruYI7nTqa96NjsFVYvul9JxHjBYEQAi4Ar5YDnpaB9KdKQhBQJgLT9tdTo2Lx7jeF69acGAxuKoxdNq6W436sF5pFempjAAughJ55K8rtsuZSuvm8Oq790hhTPhBrQrrf/GzI1qaXkLwKU+n5VuBFkMIX5kihcVnKEBTiaeSuI5kGvzpSIhCozc2ApovqgBMY3tH8NaluJ4bfcvaBFQqw569PxCJKjPUyZqx0K2cqdUUK1W4+2V8352E+i3JT7qqQPCI0HLeUbtgyOG/i4PpF6HFYdvFwpyaeju13sSTCYdhNdfPKYeTiWzlkMbLv3m8s5sxW9dxlAvD3/JA0XHvKZFzdsNTTwj+En5AUZ26+dRfBgjhzkwtwQ6zwOBmZTiK8LkwxN8r0cIF2oXHj8KMHFnBnLOBmB3j5W6nWQIA21KDKOQZCkla85NrGabcGT4x22cHOoW8AkWyKISfgOAT+KJIb/EYGGfPOUk9s9REve6zGivWr1H2O0wyOBvqILrGiToQhJb/gurgYGn3z5AL9TuxY93yfHKMMVun6xmmd6G9uCGyxQYyFTCvHD8AGByGcVz5ciJJ+Vm9TAzurctvlPeldPj2PNe7o2gaGlYL0yWyfIO3RQUNerPCeMjdj//ifnP6YhvixZ9THonzRkeAuq1DVoQ2WxHuGML4PGlDbNdN9Is53MvOngeFlzs3g0rxG8+uOuLQRo9O6Evp1BLXxpqndnEUjDRAUFGaG0Q5g2YzEQcZJ9XFG3dQ8QLrNE26dyy5XqKArgPiQKFPUUBJEATLl6iEfTVuaJB1YyeXeycCJTa3l9oXTXd9yfGrsEy4nCrui37BqWZiI5wm5UXBIS8Snyho57rBM5VgfyC0MWT6bYwOqIDIDCWSPMgON8ixLID51/YE2QeXY7gblwLET3TRLBR7PzFEb5QEtXFtIMNIqqAC1b6wloHrNveUjgVxTRvGuzYBUXepp5sHoW9r33+0Efhpz0OglX4MDBnGUqGTZ2KpQlO4ejDkaOKZ5kD7zouLxji6/ty1h+PKSKbIMaxo4MgDGEEwns5mR5U82fengwRIxLpJkxw55nlPIuq33Wqp3FQwDLEblZJ0W//5KUSTAqOLRsNYTr1K0T7IcNFcCW6ZtSxNgwD5I2P9OZQpykoEqtVQx0WkH5TkEjjLk5USwWjBpcUowNjojANRfF4zMCJVFHDV5QqSjGb0SV4o+MUz5z5ysXC4nA21aLPngkCnBTGk7CCQm48wQotNg4IEhmSYSDcY0smVWfJ6q3lg/hZR0JjqKHdKwxOIdryztJVyo6L23WKhShI+EUPdbxITM9iT6/ukwTjJ8n2FA2vXmqJizibGHUeo3dqdEjfKehbqB5Y7Q2a7M/U8ElVL3m+9DePoQFwAmlWOu16DuYJ1A3kJtwLl04qnasRm0xcJZSOUHk9nKe0tBptRIMC7JI6Es2NsMbtLAJiQxJ/u5d6kmJKxvT/hixrwDKvHbGMNsIzRgZYqO3WMXvn8OAQH/TZ7qqlxMDXB7KPQ7cWU+MsElc8GJ7/NBugn1xa7bW1ikkx5xvR4FeOMwuUX2cGLIMkYL8LFbTdmmV2tTR0p8EqYHFfQc+HVdnxQTgTFlPZQkbcNq6bSPs0o6VOFiw/9FnDlIgd7tbIxSKzRXg3hn++fD207flIKHtAQYsEUznhBsaiVwK7CDGNmiE+cw4WpthWI0JzTwnctJopxUqFCzTLLVXrJ32B0q+PGES8BsayN6MPArzfhDO0ZLTKeGF89XO/Cf6Fd+1EoizXC8+6ZIMMY24elh3gV8NZgrOaHx9fpIAi/YRM3Op3WArp7s2iIg1Y8xoOjm66ZaTPsciWJSVhVBZf3CXJR79seChwDhEQfFcwRxIKU647fQfoZBMvxMQGIXvCLP8PGKpouW3pkwG2t8ppK3iozqsxkcJ5/cIloNNfWSVn618wGOhOxCcmR2omTQOaAD5OJztV64uqav85DaMl/t20d0FziXMMS1OufSQVRaCeQamQydUVjYB6TZs2kAwgTcKVqeJoE6eTpl5MfoQFb5VPE7avff1VpsyHLTLdqp9fekJq1UfD5oRTSWrrwyWH6k59RF1aQorFKSqhPajxUum46hpYGOJ5EPMMNaeFjMjVYnpHG0+pnEQE7wA2XaHtlSCn34Z+8PY2Bohgjgovr+FF8AnSVVitDEJ1olKsMy+/m+DoOHK5J+A1f5ud6NZ0xbtQbkfy2bPbXk1akYUKEzirPLkZQm2UozTe7EUQhgzumTSpwLnibw0y7OWlKsxO/PC2axk+/EIEjZKtdffmBPZd8GnJ0nM9JtSeGRpSc8JMTjiFRrj88o7cg3axboRqkpYzSvuth7voq/Mp178dM2s05UNdA2HBxCyP2yzE3ClDC1A1At/4A69xx+muKxwqRw==,iv:0ADiyKHlTTMJjVz2rPl+/HcJc408TvM2YBJ0taNXKAo=,tag:FWtAxseSdZc9qQQfva1pZQ==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:wNw25axhpFLo/DhX/cMZKr0A0YndOCmpcDVtTLg43o1KlUC8AR+BlcBbFdg=,iv:zjzjbzYrEeWE89DsLWnH8epcJwcj0UDP8ILOCnPCpkg=,tag:8dmLb1/GgLFUYsPvXpJTXg==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:vnP6Xn6eJClzHrcKcG7iOBtzInrQfv4hOWJ8e4OdpLmsmzc41SFszxZVN84mPFU=,iv:ff9jinkf/K10eXmnvC8XaA4QKOINSM2dIJ6Drvnye2s=,tag:cFrJh4fj9H3KZPTXgfQgwg==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:nTAEQjs7r6LTWGT6Pu30XmFx/PYDrf3E8Lndq/GW9QxLKTN7kcTgkoWLJg==,iv:bvgIoaZzuXdht9uN+lMh1xWArvzBl7sum3iAV+KZhCg=,tag:mwKyFlPwtiivR/mRpSfuMQ==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:tN0Ff3R2q5CE0ac7wXqeqNd3YP8ww/oTMBRmW9ci2FgJbe4kSDeXbPwqquQkz8ReiiJv6cgt11bKOLJOBYdWu3A=,iv:OgO7DjMHWY5CFtlmoWMpJuqjekInd0lck4v88XMR6Pw=,tag:uT0JEXrFTkHttsC0dqHf8A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"data_json": "ENC[AES256_GCM,data:OC4BSNjGpQF0Im582g8pSxnK4UFYDN6o4flhC9xlVlcP7HHeh+APaEawfJw7FcAPr8w1tDl4cskg9Vv5a99eXpkjQlfvGzkyK8iIgmKHcSSAWNzSZgxSEsjvpXpDEDWkSeIywqDUz4ehUkDttP2ev6xanp/LesLJgJrg9sU7UQVX/lEvarF3gbVFwX9TqPptXGUiZfKcVBE4kSvnwq8EZPUEhTAUjATdXPnld5Wf7pTMCFCkPUnKxd+FUUx91R96KlC7g0lGka9aechfs5vvRH6dskoxtx3n1V8qxG0kCsw4hj8CNGQZEDLzMtgPyT9EjnhKJ1+8FApc7rLWH712J7+vU/RhGOt8MNq3zKCyqP1aWKZKmT2sHiNqk/MzHKD3eeEJk2JSHMBx4j4ohrsdwxFLwNMGXCYqYPeVngJ45UmV8MwoSHpodDGuFo0cjqtz3GP2lE/A1DGCkH9z0tSxzXl02y5vRUBKKBZpHEXYTBUE9OKxAV8Ev09ephfuXTullFSw00oMo/i4qogI4pGikFHhTd+wz1PjMBzZqSBbSSkW0PpuGgiv5Jz7QflwAR9qQU0BdYvLXbRmXiMA2eNORtyFLo9iAe0fs9Q9H6iBbYnMwzTgXA62QhPMBGhmRFW25JMIBZuPSXXOHP4ob1AgaferKVzn/1j8MmV7g+aX9v3X6kxYIBTwr03R+UqqIRb6/huixM8UkycdHIBhrVkQbAwUJwFWw1XH/edttn/hevyrHx1BuLakYJsOD8k8YH7QRUTqhkDS6m5QL5tz8xTqNGYhaQZVU/WrFxQshyBj+IFHA9l46NbPmnSLs1R1dNWktGKpAS5Bl05sieLDQeYVW/R3vAyyRNvTbcFV+ZOBTyPhdi2JsWIfWp33G0z8KKB+ugxv0sOhZO5L5yEtBAAqHwUHr3eWfF2OwgByfgiEWK+3To30vWEjR3QBINKG9JXpz84ULF9aJnIyfDjQHFcuHcFnPbm4ZeE6SJ6FKlDwAAz5WU1x1Y+kfkjj3junG6iU75178rMk5AHh9qUknTaLETt7uMusx3XVrR76KK+Qze9USv8v+JZ7AqTeVCdE1KjpD9504Ti0n5qPCTQmqCc05MEnG9oSkc6WKH9/1H7rFlo0LMCEC+sN6l0WHarNAxKi16of6YFuRVbDm+qxOkmMEwfuKHCgA0YD7KGg9xtVI9YAD0GLrSCh7eJ29bIShFvIXdbWKZkpoix0Tx03TV1iMIulmiP1Yvl0NE3hcxqh0lEiqkAex8xvJzNWFU5EBG9zjA+vSdp+65gs0rl7Qm3NEo8fls9RTHATEhW2nfkumd1qL7arhvQu0X19zCCo8F5WenubhngcUtB15U3kPVeb+M3WwkrctX6TXdonOvZdniHaGmq8VtmxCFxRHIel0ON3+F/pbogUsuUTE/5ra9W7CHaN98kxMUexjTzEBArg7vTdmKLvjdCjG0SDNxQrnckOVJHeYd8JYvQk/WPcNAMg23xmDZqPICGXbJB5z8TVVp9H64W3yYGAXzOowT4KwuGov6TFsilfEo7Dxe4zvjGNLFxqguHcbgg0y67UOw27Vba7PjyCCr6YT6mYFh5OkeqUSECKSfQVDB5idWBdctfLu5HfdDZ7mfH8YTGBdP8xdg0G+ZbhFZIwt3s6GyN8YMppAcVbN39CP1HsniPgUgU1CZb/morP9yt14QAPX7bAc1MHUoUc1958Fk7npgR8RNtExkLulotEn+/Aoh+Km+fjN9FQnEKxVMrCaEi6gNw9Tt7V0CS0yE/i/Z6cOM9iccMfNzpZ1h0ojUOL+W0QDt8zSfPfr3xrPLQ7US7OcaAULDpISHzY/XiMB2P7BJPXsBDJbWIa3HvNnx09vjCcqIV5hxxSR3bSBBgykrksvTIFsiGNVTd+J2Ng6jfN9/wOApZaAWDDLcyYyfnce9001RMdFaZhD4Vx0mgyfMFdxHL6OZpj3yVFWj/7yryITu0FlE9tL7wUmrMA3DBBSQPYY8HlD+uAuWx9bBhm7fmAaCgOcDfk+SqccLqXYr+jCdoaVfC8YyNNbGqgFm4CQoR65i//USEPEeVThullhW2bapWJI/aImsN0D+HGGVfOvZkZ2/iWR4Y4RCXxUjwH+DNUb9KtSwtUhJNnvzEGWAYQlRN2X0jO/YHbllc6KZmvuPOqlXKozF+apuV7jit4Vm9i/L8c9TbH0N4fGKdj9Cwm1/6VwtvEqAI+oc/HgPr7n06hKkKIoIddOV7m+gX6Bk4z+T4o9Xk794JZ9xGizWLZbLXmjT4P8g1MlnZFQ+p+JNzViXuiwJ2aHxbsW9A5ijLK4+71DOfu05OBG+3Gsa5QXq+cOstGhg2IaWXGCusyYuU/PNA9gi2HlsHHtoxQRZTCKYSMPToN07/ahtwKmJZlqSgRKN/Vlt8SYPPuZFA3ttHYWvnqNgcwDLnDjG7Cv748td2rdS0OKUiXCPZV+DwXLvVYIFTGlhzs/2fPq+fKOEjwvh1AiMQKDdTEiqmz/zt8BZeAezliajmuc3au3YCPvDvtlECClneRZFkwSIsSKwhxq1+DDyFFqMiIRdWdk+YIVmvv/C7SqHNM2YJ7amWIDL8lHGWEAWgJBDOVWgvGEs6Ksf8Fv7l3Cl66fMdc+5KrC5cbqMKMU2wcen87YEEGP8Cs1nLQLePcLg8UcQ56lWmkjmC5FJ1ezGocauWmMNlSTYj4Ai8ypa5Z8oShIEvwG98Nfw9l+0GCxM9QD12ZMRNSsn17brgwvP7a2qn5ELxqFUJPdxjuzHYLAjgDr3STkcZdI7yKoMXhiliY86Tc8xYeShNxa9+WiTl3XGwytrwlQ9ynk0X1dsKJWGkhRNIz+ffFw9/SEg+xfH0EEzJbJwF9AHK2FLy6s0fVmsMuAgm+0HHRdCoMlhIibOVBVeSL0DJB++iiPgJf/3tshYpdwm544WPQAfnp/OAV/yMiY5B+C7Mxv4D7HkWr7ub2ipqMQ1PWRn0NYsiNh4S4eu61zWYRivRfxPgOCbxDAo4XSsMaySJpPN/HsfhYZsRGJq3oEB4oxHM9wWFOcKiPvJQsW8RoDeFHLsOvsSrUUnJV4/XHw8biYxfUb+u0+Pu4dkaJAzx/ygw59gdBNJN8yrN2pYuXKGq+MkT2Sag5QQo2VOG2BwNTfCKHRTo0jIYdtzOypUMt4d4cCyjX78bjZXhmHBb0l8wfJyRIDVSZ9ApsFbJQ/9/co1pPLlioQ4eIgBIHdzwGCb3/wJON3CmjUvUXGzupy97gAxnk2rfor5MAkx9T9lRVUsOWNe0K7tC+0rf8GrYLHb2RMpPer4jD8/pdS+IOsC/GfWimM/CuTRN5fRHb+zEVcv3D+pXhJEQxIkEo7+C0DdhWbGJem8wvYEeJW6pAp4krp2wCH0dI5dYnMU/6lW76LBlHZRlgUkL6Em9ncL9bR+5/uG1j555LGf/Ujg5b6UJhVxb/kfHAfsBFHy9T+n/X9R9tTUAZM2kqOKqV4ZhhDDI7Cyc2+oITDsvx0HVA21rxybvGKHpuUswvjxFJrgmuTtLMuSkiSGVtf7gQVrfyc8U3D9OYVv+2R5MHrSQ9aTw6L+tMSNnN6+qIM4KknEG6ZcNzmy2e8ie+1sxwLKHR2D7CgdMTNXcTfPP0x8GAbe7TF3ypYpuamg5WsRm1xkTIedCS5cP+N5aNLDiXWJD7KDzSFvMZd/b5sVcm17yjJPaeoCzZznpWt8YoPVVTLs/7ZQhV6Eg4ILaVDnNjXEiJ78qsMi3aUmEZF14YKldmgZzvJtZJkC1rCPS0yR5B2m0KcVleluLeOGuY4pBLWwYLLPALHEHqjmoV5n44Weuh9fUm3KgnyNKc4o/KRsjL9kHrDeAigBoDbbbx+L85dyW/ksFaUJ0+fXrAyX2aoy6B7jM8a61Qhd9+PNk3jzeQckZD+PLgFXTYolMnh0bK/Fn/nBI+pMXhldbeDOMd0KOyOejFWy62UApb0/J0kZSa3oxNATRMi7Urn7cctBOo0qaidwWRPqDflksn2PX48N/NVle28vrFu8lcjG1u1au9tcrFdx+
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"destroyed": "ENC[AES256_GCM,data:eJAxJKA=,iv:71SgvvOW0vF2Okthkoj+537zNK4sXTlFHJkOPbb5ZPY=,tag:zRE/hcE4UKrr8kQMSpJjvw==,type:bool]",
"id": "ENC[AES256_GCM,data:Fg1eguU5XfAOs19RErk7WP2GY+A=,iv:YurgcGXSPyPjgSl+34p/kz2UNxSNq6kqnb4SpltEbEM=,tag:RRVLNqAw43/RCfV+vDf45A==,type:str]",
"mount": "ENC[AES256_GCM,data:mMIq6d66,iv:bgvH72sibopIPkyhqQuJFWFeIlgu7NDhvjiW9kgBPEA=,tag:ESq2eb4oqES9NGdzNHDmGA==,type:str]",
"name": "ENC[AES256_GCM,data:Z2Vr4tB9Nbg=,iv:VnRL6sItgAvvwju7FpSoOyO+M0d07pNvd/C27u3UJhw=,tag:GRWo9BrfV7BGCC2jo5J6+A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:pwFviA1sh/rFaggl0u2DTw65Pwo=,iv:t4QmJr1+loZkRquHtENGdNNULyr8N8Z+DKEAdyyYv+0=,tag:WbDR/5/Pl+ZxLyufiUuyaQ==,type:str]",
"version": "ENC[AES256_GCM,data:ww==,iv:EyNOIEOSUUr/Kw/UgJ03eKPkiBEm+I174FSAH2RRKnI=,tag:vHtzBSdyNR3hj9vFSzNhcg==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:8mWSMQ==,iv:ulH0PXJi57ItP+J2NFPqwz8hO0/ayq1sZ2Qfg1SAXbE=,tag:wg61YvzIhI/lUOoeL5vgpg==,type:str]",
"type": "ENC[AES256_GCM,data:INYCgrIrKkLeqPzkoXcUUGOG,iv:P02/dYO/5U7LAG/UOdQSwNM1PE2GTKXmQxmjJ9vTnq4=,tag:IrILfzgNmy43N0IyTqErGw==,type:str]",
"name": "ENC[AES256_GCM,data:lynigH4qUw==,iv:TchbDGIIMXXMHEsH3ub6zmUo0DDNMf29+fENbABoh+M=,tag:vqq076AHmG0NVav/ILpwCQ==,type:str]",
"provider": "ENC[AES256_GCM,data:P8SC3l2rZhtkFEm6dunmCfhbNPU7+fSLEDK2OUFiaDLlxvkSvE0kEol0tRM17XN3gQ==,iv:KTJNW/BWurz6nKo2ZQvPQcXQXrak1DYHCxr0qELyEIg=,tag:aEg0vkoRSnKeFvPL93rhZA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:fg==,iv:6BBUxxg3+7ULd+KmettzCcvgPn9inoGXSj3ucKc2I/I=,tag:mn31sUAjvHvUz0bRyivn1g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"created_time": "ENC[AES256_GCM,data:ky0r08x9Emg8b2aSTjZ5LxjKN4Jdk9GSjtgmsv2W,iv:7qo5D1uHvrQWNPlCqQxPG/L6GQN7MMR97TZ8iy3rIG0=,tag:dhsjmlGviduZwBcx586hyg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"custom_metadata": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"agent_secret": "ENC[AES256_GCM,data:PyaEtQ4NxFgRGSxJkPT3qy5zammGqcz/nmpkS0xb5GPu1dnXWFj8a8wD2Ge7xaJBGk0iU+krMUK46YjDVKV54w==,iv:nFOjtXaKe38y+hIyWPAwES5oAosbM4RW7XoZNaaER9Y=,tag:mF8Ne7C4rHZAir6mGiHnBg==,type:str]",
"db_password": "ENC[AES256_GCM,data:EHpGPGW9csgVz92vn9QZMS4tjwfmJAjZNWZHLYK4S38=,iv:sUT0b7xZbi66wB7er8kYl12a/ojfnsmkgFkCJYnwz+0=,tag:CzO9wCKFTvrSVsinZ15y4w==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:v3Q6pkb5TdgYzSwKZRWbRh4pCQ962AoyuMU=,iv:OchewMDw4hJkH4llfhMEEbj7Gs7DWj5QDCvzWdiOuW0=,tag:ftkRgJD+TuEQTwGL6yWMbQ==,type:str]",
"forgejo_client_id": "ENC[AES256_GCM,data:7hTQ1luabP2pnL8g7hzC+Qeqi2a8MXPAJgZpCUqeypBYZ64Y,iv:csAgptLw5FP7YqhcQTTg6XM30naR2dvtmSNPEwFCXso=,tag:tsYHG+StHWzJVNAnUqZqmw==,type:str]",
"forgejo_client_secret": "ENC[AES256_GCM,data:loM3GY4eXuaQ/H7awihoA3sWY0E5roL3QUpqicci1xTPliwxTctGD5WHBEaVFTXkbgl4ePbIUiM=,iv:EUxQfhUqqZZKFD8fF9idBN0RW+Oh/K+rEednMOMvT6E=,tag:sX0EV227eRXDDDpigExhNw==,type:str]",
"github_client_id": "ENC[AES256_GCM,data:wyBNpv7hbGZicQDArbqGXLS8kVI=,iv:EH+YClHiBx7RoquYRUE+yrxhlibA5fDyBwB9ETXWtmA=,tag:bWmF8KUch1mr5ax6viFp6A==,type:str]",
"github_client_secret": "ENC[AES256_GCM,data:qn9diDZDrqwrhocmTUBUX8t6YYrSfO6ElJ4MpeOgPnVrvIfWg92qcQ==,iv:CvBF+yErLdxISJKlBsHeYAUj49sxKwXWDXoqS4hD2HI=,tag:lMfeVMnSPFRMPZOukPNYnw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"data_json": "ENC[AES256_GCM,data:KJvRzCm13Z1eWMwGRKkhTi8QF3k02ZMLrSN5J94HjbivcSNKoQND6psearqJ/Oy93mCNjGEVEeycK5SQRUhp6GNrKivm4+DndeSw0VCcUKfLwCdFegECKq3cG7K/JjtBtWKa+RKT4xpGfMcXBwxXeEaIWRFKc8IWlMLapmd53vapwLSqagqySwOwUK0Ri1+INgvYz4ewrJuCzKYOiMDWZcoLHaKBR8UDnTztQWZ6uhEgITvgRdy4P+qvk6FMbkPxTX0fuKPP14HgLvDpak6u4LqgcDqIwn7dG3dDCrCOMmLyiOcnoZwtsIVzYJxrZTWlgyNPttLKBMv3SivKK1mMt3NezbrT1y/zQMCYdZGOpsljn+kbccgKnAind2fH599conQ7bzdG3w6XXwVbcrjA+WbZzDWGGVLeazsf4Xb3TaggRh6Hn+qi83BLWGG5HKXz0N49TnhS+TM2/8/ZF9LNVNKNI2tdrWKhru3goUIerCP+IytSQKkUkfa2bNl2bsQ4eXSF7SY9KJP/+XJFJtjMb2ncH+xk4WgdGrwcYCN4sMLtDCaOpBJGZjAwv42AIvApEw==,iv:ZOgyqsr/3kxpon+bBAFApTZLUf9QpjQGHvORLfaLIS4=,tag:NBaAFq+cb8pWbVI4+JnTXA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"deletion_time": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"destroyed": "ENC[AES256_GCM,data:vDU0toY=,iv:uoDd6sAF6047nWzQ6T2A1Y2R49x67tJhJpFTNfHVIKs=,tag:M2J0f2OfF/Il5RTr47gPCQ==,type:bool]",
"id": "ENC[AES256_GCM,data:E5di81Ayzo908VlHAs00l0fyYgp46A==,iv:3anRH47na2M/czfXIAo5WjyFYpRzs9bbmXvVhBdliEo=,tag:6ShTTmQlb9Z40n/3e+RUSw==,type:str]",
"mount": "ENC[AES256_GCM,data:lIAV93cM,iv:Xv2mZww76jX7DaWBlxb9bZWOPJrq76fSSVoQTHxhEJk=,tag:VyAgePHgh8ogFTfhbvKTyw==,type:str]",
"name": "ENC[AES256_GCM,data:3JC3UqGWCaOyOQ==,iv:EUjUrWTOzFQ6ovnsoV1HvuDH3gx5GoAwJawPg1pb8cE=,tag:vyfLFhpWGjWMeWhteC8wgQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"namespace": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:yhKLHcjqqb6KyCEGAA9TMS0Lego7SA==,iv:fzoLz9OtxFvAQA4ONw06Baqxfz4cOsbjk/toxaimC1M=,tag:aQulC8EAw7ub93BPTb6QDw==,type:str]",
"version": "ENC[AES256_GCM,data:pw==,iv:TL6m43lx00DDH/DYq72dL85nEssL2Uri/yn1YzbCeRc=,tag:/5Gr0pMh6EzePEq6lv9nbg==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": []
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:/EGB8k3Pww==,iv:MBv6pisrsq6cfyZnW2AXwHKtDKBWI3EnwQuBAEgpPCA=,tag:dBMdIwzDJ9a6G9+jkDK2BQ==,type:str]",
"type": "ENC[AES256_GCM,data:zNIoHjfrcXZEpdH/,iv:McYvTmyUtMJnsNXkuxndJhzNfp/0wXlUKyYibK0oXYo=,tag:ydh6kQquNkqtLe2p4GHowQ==,type:str]",
"name": "ENC[AES256_GCM,data:3xAA6O+Edoi2jQ==,iv:pCaVHnbh3Jg6uW43sXWuvRd8k7WVKsB99cDsotakh/w=,tag:ctiG6ypcBRPSIRtsStBICg==,type:str]",
"provider": "ENC[AES256_GCM,data:6hfDHEexuUqwblkQ66NjeqxllHOOjAC1CLtbWJ/R4LjoCzwtFQhjv6Uf8fXAxdzw,iv:zdx34uY2RiY+RP+kWKlOKqsc8d1jP0vXD1fpb5yTB2Q=,tag:H6sxoQfSnj/mk9yKlrkKDQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:qw==,iv:YYBLyWdPlO6xC0sfMOew6GVuw5DOoCKFMSAnzBW7yTk=,tag:U+5u+YVAvwuZJ8qp2O3c7Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"atomic": "ENC[AES256_GCM,data:uMU088Q=,iv:qG2+wuHu5cSwtCfOpB/r1moDCPOWC79/1G69W1Kj0/o=,tag:7P+B3oNm3oX3GMx9I/s38Q==,type:bool]",
"chart": "ENC[AES256_GCM,data:yrrpc1KiSZwftQ==,iv:bh+p0tTzqBgixD+aPGyxE9fFajjZ6ucZv1bGI2qBMaY=,tag:PUNmQJGl7K8xZMyamODn5g==,type:str]",
"cleanup_on_fail": "ENC[AES256_GCM,data:E5rGEgU=,iv:4JtvnwxKfLCX5yQzspj/beC+uJE8oMetO6d9EnpoF/I=,tag:HlSOLyrqrf0TV2vNKPFqDA==,type:bool]",
"create_namespace": "ENC[AES256_GCM,data:YQutYN4=,iv:VHTesCrEVoLSedGn9lzOplJu5L+lO0fKbccVMgtGB40=,tag:/0OSVnlGB+o/2MgTnuf/bA==,type:bool]",
"dependency_update": "ENC[AES256_GCM,data:TvXWSi8=,iv:BZ+QS7oeNKBlgd6WooM+aR1ufRA6J6tZKuJrfKTtj7Y=,tag:FDcxs6pEUqIJ1fMXKuk/Dg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"description": null,
"devel": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"disable_crd_hooks": "ENC[AES256_GCM,data:dFEklXk=,iv:bidYRpedfBA7H8psJ5HVGRv2ffnUqPSaLb2aGYLKERw=,tag:6csx00YT0PqWqPl4ecQm+A==,type:bool]",
"disable_openapi_validation": "ENC[AES256_GCM,data:r/Fdj/4=,iv:XdzQkle+YrW7DAqRpVHnWjpG4xSlPC1jQczS5yCujEY=,tag:vLUhe1GwnRODE7YluoHKag==,type:bool]",
"disable_webhooks": "ENC[AES256_GCM,data:v3xuUV4=,iv:i3eUnTefMLNCahj0mCBrfVl3H9BFuaZECWnhLMM/jOU=,tag:yQuWXfGZZ9eAZjiAvUz/1g==,type:bool]",
"force_update": "ENC[AES256_GCM,data:jR3ZryQ=,iv:AWfpSJGKAqlBoFZXpoHAkfCoE4n3Enouldeo86Y46BM=,tag:thxsbNawt1Y3sjBg4CUwAw==,type:bool]",
"id": "ENC[AES256_GCM,data:OVonJlNLYdcR2A==,iv:HBF8EfsD4SCbc+8GDs6wFxjApFXtxOHDD0IaovyPNvw=,tag:gl7kBGFfgy3rkEO/nrtW0w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"keyring": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lint": "ENC[AES256_GCM,data:mFZiJAg=,iv:kmDTQHxEBYfxRFstAC3GtQ9UOYd1WI3H6HrUpqyYFUY=,tag:yHzTMBUZGQaOi3kjTPMw4Q==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"manifest": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"max_history": "ENC[AES256_GCM,data:qg==,iv:/b3DmICVL8DMsCyIsW+/Af1wuhc2Y42bG5eCV3SeN54=,tag:YosqsabqLLVc8HpQelluHQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"app_version": "ENC[AES256_GCM,data:gOsZVwmC,iv:8ZgeJqnDV2rw0VVIFsJlKSH4ljSbN1Uiy07KfQzXQNM=,tag:+uyeM6ZAyVNzcDw+nHIHMg==,type:str]",
"chart": "ENC[AES256_GCM,data:x4ln+bl6nWxYRw==,iv:5OFHtELoF12pQvMbUk0SHNypflJdkVRGflUdLDq3YIg=,tag:wJHHVpkp2KxGqCACzHzCqA==,type:str]",
"first_deployed": "ENC[AES256_GCM,data:GC+WpMh+zsDrVg==,iv:AcxisUdYAcsD+uLKFfyNJ5Ow9hFgegevA6UVNeQMoGQ=,tag:iEPoOTUAGA22kuT01b9ngw==,type:float]",
"last_deployed": "ENC[AES256_GCM,data:Ky6JBQxz7C0K9w==,iv:ZYQovadIfWjJ0fT9IXVUCgMX1k30oNYHJA2z45VHpy0=,tag:kMRqhsC4H+Nn9KjHApBRUA==,type:float]",
"name": "ENC[AES256_GCM,data:8W7r5E7B1iOg9g==,iv:7NYz44FPEfeFS0OKUxKg3s3n94H7wk3O4Sr1YaX+1kM=,tag:VoDE2ErPhpjKNPT6NIkCeQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:xA6SeY4zdHkMeA==,iv:hSIp3M/CY/imMcEC6ykkdqIvvPYlq8RpK7SssDPzCsE=,tag:4NdjzNlP57OTgnF/RCKq5Q==,type:str]",
"notes": "ENC[AES256_GCM,data:Y6bvs81w8LLvK3eqbuy1h5N7FK7GVSv4oka2n8141GN7AHXDRBwEAGZ3H29TM9Uo8S+IO/d7XzqChbJRxiLOhcRLl6u9TGVbYXK7hyLsOAfTeCB5OpfshtcE0q82cmsWUZF1OOAz8rlG3jJANpbfMPGjK2lZkKL+U/n0HrJKD/KRceG6gXvIOWkuDzpKnaC9K8EdTuHt8+rBB8l1x1UxNOO8FZ6faN/dlltCG+QwoDuEpZqf+bhNnQqy0yEbi+bKGo8G2E17JhWZdRST/NtKS6KKqXvjFJbGvUFDRA13f0C7xtnKZpAW8RPY14zzy9r+NnWrRC9xS42Q6MWmw3v0OtlUuj3Sfp91+g3TyUoqOTwhiTfxxs7B78tpW8NK4KcU3gJtpi0fzzoXOK6MhEXeMSCgTuQLaZBsthHI3LRjZbUA4qarFO6wuymk9HMPv2uyxEleyQG1V6xxoOJlPjdLJ7R4VClbcLCeKSfK+uL/zGwjvCGpGCmgjWXulNNMbm/06IBCF8Ijvq55QyE3W52wmccpsOHcaTEZmUe3kCsanQqGGOxp6DQRFrXFlURMXxli1cF1wqHEvBnSItOb98ogqcAL80HP20/dMWw2rtxN1r+fkSw36c/4fT9soOFBJNYC72akUAL1suA0M+X3IlvjQKxIaODm,iv:IlWksV2vZ9nUrEoZCMTD/yL0yljfoiFZev1MtsiolZA=,tag:uKYJJ2kCwv4oMhSW1AcwEg==,type:str]",
"revision": "ENC[AES256_GCM,data:ug==,iv:HBKZCYu26K70t9d+6+0y31ILNTSMA5rnX+L6wCGjVdo=,tag:Hzo+mR+1vVLYFeJc34LX0Q==,type:float]",
"values": "ENC[AES256_GCM,data:BPnWBe2O1WyOi+/qwxarwQ7kA+rjx1bI/pEXy+UqerxcuDz6uSmfifDnaDhn2QclhoUbygHKbDuHHIsuWYig5Sqpk9XpufVUKt2hwQVJ/T92bl7kxYJszfrNSBFX8uShgUkx+dQsgBMSu58vzBhBntTRaYYexF16dldoOrBBT7Qgyt3BYz1E8/7QbANGUuQATU96s+QI++bDS8EZUXHVx8V3qmqpyhkCWCfRvzyfSnOaYpQWKsfhmKXMVNIdpps4xnlejP2y31BeF5+ucjtoe9uZgudrfqVRrS7m0iBbLbPPkHLirUXJT44qoYNCx7pwaYyZx9fFEx4D7l2YPSbKEyO6VARByP694rNxUnoVHCF3lHq1tubOy23i6mlaZZ+Bs8VtbEux0kdlrtkbqte7c+WuMfhra824HXAbD2sB0I2CXVqLOrOtIfQ2GdnmBxWoArSQr5x9cFatXeo7EOkhWYZN60elFYun8TD5ZuQweb5Ut+PiHt+sS3MyJr0aiCOMopdGVxzVSrz2alAY0x/vCGazmeKHaKIN7+so637/tKCjXhF7xlsPRcPJzqNrLJrQwWrLaGGJ0LRT9DEQtC4SHXiP+5SsDSRcKvrw3m+QKWgctcexTtGCr8o8pa/f2JVxuHpiPN4IRW3df/Y05xSgPEdaI6nHgdEoWWoUN9oB0wulOcp/8FoD6DlRGB8MJytbMkLyj/dBjTbfGpoWI/eLiIDSuYepZB+8GgUu22lbY677rHjGLJElIRQSWsKlnHFvdzfm+jpkU7jt59IaX2Kj23Uem6NUkXAJaEn4pMNkLuRqDXI3k8lDhQP9MzRMXYIiB9EPD1CAKlN/sAlfkQDrgcrA3UfjFQCaI4hIuHcH8CyxembDXmA9iirKhW77+kJjdeh3wg8zgiLElYmfAEHe24wwNKoDPOhB/hkq8GDTk5yWbjYS1LduX1R1TcyknR1f6ppZpa/WeWJOi/0HqC3x4Tzud5gU5g4N83z8pVzhx+/u2epv59+o87nZwgFINwH/cAr9hD6Ls36vmAVsEoyOxVWvgzJt7E1GUIDWJbfqIAS7ajcMlv8oMRIS2MssXTnEzc9p/16UIbf6B0dnfw4aQUZGWngtC32OYQjJCIkO9torlX7CeyEIjuV94lsO3KcuIFovoDeAI7ETOcAoUcqdqRaAuuMYiD70tGT5wO5kONJL1WDskRFtP9yUlU61Z8e6K+5q/D0GqtsEAnH36PzG4B1nUgXpevzaRFTopaxTFSZzeJTaIkaMcsShiV2VmO5iguJYXdigK9UP1bSAi+EVvtRyABFABQEHMckQu7NX0QiKzpTeSdeee/+K1/Bwi/PItJLAD8c8JqGtc9G4bSJF3BxjgGe2yuB3uullgzIypAaCxlob1vKKpX/WGrG3UmUDapEAjqTZJCiAyHnrYgz87EXUOCIi+sZl3ukWm6ru7qXTgbpkFV9YvJ8IdBB50mUY7i8Pv0RFFS5a2NFbKKR5c34tH9DuDMiwepBGhOVkqmmDbcStLc3edHf6TYhAT3siUDeUTQuHUoR6SHFatJdWpG2AHXk6vKrOKehkyYEGpfZ5YVEcTyWdxYj9qzKqCCqs+JYXdoqV21hzEhOq3xDl8cNl1k4X9hJOmW70+m7A1CujH24HQ+aicoLHrRSFRhg6Asf6HHipEDcGXeVgjAnGnBTBOYjwvCDX7lXv6lrUxpjYRnCSYmA4ncqUU+8DjuRylnnhdHTys7z6E4Agpn+28FBzyCjDAOjjkDx3zTj71hUmrkdtszRAHeGaZd8+e//YIW9uU1mWPpsV9XfdUXZeEx/2RaYwb5mxFwdzt8EDku+aPceD5tMzeT2FG/7dz3CmRw2opsv6qcIvjgMs2wJvqI8jG1p2InxKk6R/RRT+Y+kUCYjhgsoo6i1FCl4HRZRzqG5Elxw4YEscQXwrQ84/kjCknykl77362X6wmf5TIQW3X/+qD9fEerySWz03JkowpiaEScSlEE5hLXOj/zaQpHkjUCWPxzw1xjMls94/vCOU6qv1P+Lo2ZymmvHooDackOM5MAaC8aZFAW9VcO5g2gfAnTcM7cATiTIT5HSvciastH0k94kTQTAQKkR8zSu4gPrk8004hIV7MtCDL0MroUf9DlY97aNk6N2ygxojXU62PolqFGtGx4VNO1Uwi5F0ECzfjyg8LxUxXR4vBiLAXjLkf9PYHYnKuHb9eYOpJ+2zsHRnpCunwYCG9q8k69nteNTWJqxsTsNdHdPdSfox2Hpn2cFN3Z1DUB/JleZEIoIux8d/Akl2k8a68aCkFUmfA53UTvrrVmnSnsOlBBhzxl0SaW+PRXuvE/4ADHHL+ngDNzThDn0ZpT5p0eYFxjao95RzBddffqYTp7GTBvSC+TWnHKPqIZRzkWHPGwCZak3JxqHSFsURgFa0wTY9zgxvAFuCE3P72tpzoZg0BKP/sR2OVD6a99Br,iv:YVD2fNt10Uy0BsJ6lBWsEaSBj+cvIPVWXQYoFPhuxA0=,tag:Jr81wb8MP0d6UHQZp0wVFw==,type:str]",
"version": "ENC[AES256_GCM,data:jZ5AClE=,iv:kkRIT7vEnhlMAgzg96TawprzpSy9VEVJ7FpC2/Ij09Q=,tag:tjgWa9Pen7hyWXZjbT+LlA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:jQC87GOz1OvcrA==,iv:jEzPc/7Zf93rheEcErGALyWjBIED3mPp2zV14Hf9v4s=,tag:7YTRdzVoDhPhiImZPULPew==,type:str]",
"namespace": "ENC[AES256_GCM,data:Rc7sk4ctZkX0xw==,iv:Fs6/6lHcgF+HH/AkhiMro85LmwlYidWvpKIWZpz7+EQ=,tag:Fh/qrDgrQXJSPwuvcust1w==,type:str]",
"pass_credentials": "ENC[AES256_GCM,data:OKsBUyw=,iv:/Qa+naqca0FtqXYy69w3MsHzFDEjXRk9HyfMoB2OCmw=,tag:a+QljlrVGqZi2HHO1BDdgQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"postrender": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"recreate_pods": "ENC[AES256_GCM,data:RoHtlL8=,iv:SlCLRJcqQwl1O1YSoXvOYPtEbzH7+tEg1LyoanUloXs=,tag:5CVdQR5urghDjbleaWsWRg==,type:bool]",
"render_subchart_notes": "ENC[AES256_GCM,data:GJVq+Q==,iv:V1qrjp4LL64OrPoE7xdHqGukvrTCfazTNyA0YYzZnfg=,tag:4eo4KcaOm0bOfhTlpzaE3w==,type:bool]",
"replace": "ENC[AES256_GCM,data:z6TO3Ko=,iv:thyMSdxacWbYj8SKZPqf/QihUQZO+FHBD9GscpMwLoE=,tag:f9l/FtbMD80EkzW1Bt6i6Q==,type:bool]",
"repository": "ENC[AES256_GCM,data:ZvR6RYpRMtvWcrKqARJT2XByOp07fVlUzsmDn9ducVk=,iv:puCIWyivwSPP91GVzGgMq17OVeIFNLUCTEjBRT1r2Lg=,tag:Y1kxu6WGfgjg9zMcdf+xwQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"repository_ca_file": null,
"repository_cert_file": null,
"repository_key_file": null,
"repository_password": null,
"repository_username": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reset_values": "ENC[AES256_GCM,data:fFhC4P0=,iv:0zvsPXmxyT+U0xLdiSDkldxQ6JEvSzbYul5pcdLAUyc=,tag:JrcI5inZFiie0RuH8GP9Rg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"resources": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"reuse_values": "ENC[AES256_GCM,data:98WpZow=,iv:iYmarp8zk4dJJaRvjjD3uxZN2eOABr0cxW6IhzC+jUY=,tag:DGKqOYJ/QEuFl/ekqcZtAg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"set": null,
"set_list": null,
"set_sensitive": null,
"set_wo": null,
"set_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"skip_crds": "ENC[AES256_GCM,data:9UvmGdw=,iv:PnXIyF2MvR3G/8Rb/HGvbm0RmGI7pECSUx/SQTHsbiA=,tag:uKRVlDN8GYal/7LvGVWAcQ==,type:bool]",
"status": "ENC[AES256_GCM,data:mcvBG3R/Zfs=,iv:qMGLdK1caKOwQwQWkiu+p9A6m8fJYFDn9b7tE4IIZag=,tag:XTfHKNvDL3+VUfvbsONxEA==,type:str]",
"take_ownership": "ENC[AES256_GCM,data:q8ueOrQ=,iv:E85AeJLNkKoZIhORIDnDRvEGy+gCXSXTWSJ8JVD5HhY=,tag:SAKj6qxuX7BApq79+DHQig==,type:bool]",
"timeout": "ENC[AES256_GCM,data:vKI0,iv:C6KwWK/ZnB2DD/nuIWrZYPjpsBSDsQK4Z8bT0CR6174=,tag:yPpb1SgtVQQj1EXY+nP5hA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"upgrade_install": "ENC[AES256_GCM,data:cdolk8w=,iv:h0I455MeflMip6KvPGt+TIb961949+EQvxKGrNAji8Y=,tag:pURuTikN3+7pZ3hh6G8cFQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"values": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:0YWOeKxBxyp0V67nAkES2A1Kg6PkJdueydCseXqmymtgf2+wWeMBAiqbdEZRUhtk17moWZP96oV72l1z8tlIpn3CJ/KwQZS21puXEVMuH6N3HXv29qgMfUHwnQ+0GGwAPFQug78CUxbeRxl5BammcIp4Blx5JrG6DOw2l1clIBp/oK3uwH0uZTkGaAtB09Xl3aLqfbORCxWxDQHRRN23HCMqXzEO+0tsaFBwlZHQl/HvVshUIMIJ1/sDWPj3SBK3PvUBfCpVnXfADLxlxACpAjzYmJ9wBBWGevN7vGSEqHHYpV1W9owLWvSGzSj1GQvKQetS2XeDYXL1+kQhAl70DHNm5X/e5fHJnfpJ+0Xm09971GMqYWWvfDrx1LK3X6H6m+2p31nD81vchUWI9j8HZqR4r25lsNYBYN5JyADD6wb5W4+gQTzv98lvq0tXjZcUuUkijtP35hj3z01RDq5FW5qOf3E+KSeO3UIMmeyDZrO/yOGWf/q0GdNZTKmplRZggXbH0qh3ee1zUDnp7SxH2n1f8HJGps9NMoiOpG1Lc3trebyQIMuP47txoqOceA6lTbGM/whrkEJPTq1TAItzJhxZnjuMgx0k2FkrSR3CKs1+djjQNBSD5Nd13QO4bsozfzbAhYHaz7/rFDmJUaUq3RPuQElHeV9O/IBrIH4tGqrs4d0LQS0V55EBbdxY2Kc7ivf2YwLkjyxqu+1J7MYbpDwT8dAk0KpqgauEUn0+jyadnSV6KXDA87Iri5nJlkoIx6t3Vo4ew7fB4c0RHFF/DOcISpoNhP+z2aulqwzJGrGzVdPPf1lqZwHxJjoJ63BayYGJgeWR8YT10K3OFzPHIFK5PIqG0Dx4vxeomwEGyN76AgybX9rldEHWQS8WNq28Z7Q35qv2BduoCk4l8McpwiyEYrGNpZRUoN89eVIncm78e3YQjeCiMwWMlU6ur3IlBcdUc43RxLWuFlzZGUb7vFS2cSKThgt6KJYSpZBsasqCK+vFyxng5QTWdvDAbwv9wzZtpmxLR5qCIxgg0EHSaI9PIXgpJMV3lc+4mUpOpp28j5XnjvJMX8fzOD9qhDR884A1kAwznQiIr6V4UcPV4EnJkAjW6Z6UJW/2vr8zzMa3EqU8esqBUn/zXywypvqoHl8lAcxDSnzr4w6xbF+hCycjSBuPf9U/jud8rKewj/wPkxuLa8lVzrKCcId4qbLXxo8Dqh0ioqWmTqPDbTdl6dsVZ4jvI5WnilRoLeLsfRhJBL2FrL7XAQIoGqrSDAeNgK9rWKWKpQOW7gDKY8dcQq1sp4kjWFRe3/QmHb5EwOSj1tZN0iDlW58bI+QfOP4pWlHJJ0vQWV/ePN4XUzxaI0sxm1q0mtZwf1MLO7+Hjz65mI/htwF7WwmTyBzIHZocGcfbyBsx2prS++MtksV+47PGiarBjDAwIEPNk/PjpOkpN7xIpcwqD+XEloG2xYm2AvsydePR34QFR1dhM/cck31nuFPnfL5eAF5cFFYnlsR53j/Veyv6+/PCKXkQcOGmc04QmDw52Z1/AlDE+nLlKKVFUNJQESpUZabqgwlO9woeJcWDZjUXTNIN3pHKZjGbLQkkGjIiVcXQ7WRDFyzZoxcKCVI/y2Tp+hWz+r26xbcmAeeAluq+X9+vOa0qzRIjTJLV2DcJ47e4UBta5aMMWIkVFCqqxUD5LnYv0527RIYD1/UvpJ3ujnB9yzxYorQ7NzpMVOHOcYvu1HGEwH7Hm+0tspAvHeEqoYMC/eR7n9WAV1e4bQuPNq5jqlaDNQX1m2zQjDmrfkZXjSUqaaVk8OyAZcC8+atN60UIqgqncU+0yPJzK/vgbwx6gU8o0hnFekf+Myk4y2FCwg2JC/fV/Gub9JIFB9mLquNwp6MUGt0Yjr0qdNIbWARUDS3pMrx9hps/qvhFWZlXNnbCTRXGS9o2ISI8spClOPA8054vAj29v82rRv/pVxXcic26syH98T0KKBxbaMyqxT0IJK8SuBF0C3q53OiA+x1qKA0gmhBNeAlunQq4585COizEaOZZZJodR1/AwyKQexXbfrQ0RBTkPEw51tE0on2SDUSub5GeQc6ZZJ25CsJ7vrJG6RBq1v0peDFL6DmH6Zz5DyGv6fvflDEFgrOsxUjfjK6CQCE+gPU/y5JJxIaczaX/XxY741AZtA8kJU1KfjmuGIefGIFDArbsFTBQNIFRsJfjz+nHqyYUb37XeS8tGWcIn1yt9ab2sTQ4UbPPsjYylK7ALO/SnJCKpaU788iL/0U9fvKkFePP8OpXbwUIB6dZ6udIt1mgwOMXzKne6kWkA7UWqM0LSQkuHuaEXH9Icq7kQQ+7PKOk05rtyD+qfyPucfqPpWtJoKGxUbtic4WFtfd1vXMqjbuSZDAgpnWMZFgHznKDy+TmekVQfEARwDiJn5K25lXJxfQyswZDNqTgPUKpHQaRPNyn+1sctw3HugEmQszmpm1/5M4g8dKmwarHkFAC+1eLu00l3dwJ3ljcwbLt7fJP/YWHKGNAG2SuSBqKaAVdgsUJcZW547fltPdeykObqInVy6pn45YhxHw/+gUIBgvSivid63W7Fxhf/Acz5cMp7E3O775M8zCmVoiKHnHwnsoSsp1ACBOjKr0VCh0a9jj06NUG0oPmXUnShhrN43zrve70VU/Dnep35xMkN6DvwK3/aRjN77e8I4PZlDf4+FvQ7Hv/tI4/HoM=,iv:pyr+ZQlVTv5nqKjyPLxt0VC779/9GjQOApiyVrRlqDQ=,tag:PQChXHNjoD15kADHAUeuiQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"verify": "ENC[AES256_GCM,data:36GwIEs=,iv:+0AwJBKdwS7ZRkX78FwD4dM2IQB01gqhI5JRIcTv4ak=,tag:/CsqE2UC90qRAwgLflMLSQ==,type:bool]",
"version": "ENC[AES256_GCM,data:1M/1Z88=,iv:tVTWPEOUUoDeogqRndRGZUilRFy9GUPzFI/0Q1H2nmw=,tag:ZrYLYV8XkyKnKMkSI5FFwA==,type:str]",
"wait": "ENC[AES256_GCM,data:q1csnw==,iv:8VROcv23kJIONQwtofyRU1axfWYZF8mJIBodGF+Wk9U=,tag:6xcVbsrDFvvOSpveLYw5ig==,type:bool]",
"wait_for_jobs": "ENC[AES256_GCM,data:H+png0Y=,iv:JwA2jaGKnDMSmJO+kc80aP31N29RFfwe63cRmD7oWLI=,tag:P35ilNgpGwWuTEbP2CSm5Q==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:CYhROtGvlDE=,iv:BWd+O4qPIptc0uDnsW//IXzQTdcKJlJAqNw2T6ca8OU=,tag:CT40EmGIvLyg1aZRZBYzuA==,type:str]",
"value": "ENC[AES256_GCM,data:UP1zD36g,iv:aYw2jHjbLJ9xuGD/v6yxTlyJ3SPBCqOw9qi0vVZOD88=,tag:OkrsUo8PiKqQCa8gLi5G3A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:4JS+pKQ=,iv:fNnTGMrUxws/9zX//lB3VJ2FU1pR5mDD1a+YwsSKjvA=,tag:3tNMtiM8HlUha+b6WUqpbg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:yw==,iv:SnV0IOMr19tzvLhA3FZSuapFaJ6pW+GX6Hm+MmupsK0=,tag:L9T8PhtkkBUqFM3+oDiiUg==,type:float]",
"type": "ENC[AES256_GCM,data:fC2+WlzF,iv:Qe9KLFzLaRKPzKezvI9x6NG5hY88ta2C0TwteXe5/IU=,tag:8EefYVqu6rFSLfZ5N/4IWw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:bQNdeWVoPDES3PhgVJv0mUHMGH59ViRgN9RPST/1+w==,iv:L/co7KVzYvl9fR2rw1GvqjgsBFijpsXN468AEz/jhYI=,tag:k4IPIL8QNuiYkZQCKsafhw==,type:str]",
"ENC[AES256_GCM,data:fBRDjCb6TZVCOCi0mUG/uLhaMCLXzDufsX4V85IPOfA=,iv:xOAIFq2zAJESEVw3L0ik0b6WglU1ATerYcn53ulNTd0=,tag:2fMpwK9GfsqalWgHWM0iJg==,type:str]",
"ENC[AES256_GCM,data:coX1LwgDPz6fAidI4xTTG4+waMn6Nhk0Szg5tdaoAA==,iv:X0KNuj1fq5GeJ15sMP0H78Xvr6q+uY63XcU245dkYIU=,tag:HRkFWzF+mjnRjOdiQgd4EQ==,type:str]",
"ENC[AES256_GCM,data:joOmfxIoy4/fndSv98xyBi0mqWahiw==,iv:Hwl5zIoMO11zJkonwaQyKsqGM+mImCwYzJ/R8xE2S/M=,tag:taPutsqK2wuUOkabo064+A==,type:str]",
"ENC[AES256_GCM,data:VD/WlAjiugkBshK6R1/stQ18Q+t2e6yybew9DRNxcL8Gfr1TaQM=,iv:tp4l72QZIUgC5NDW777BjZtqN95UZ26ih90T1XwrbQE=,tag:MHn+oDL69kDRizJjgHip8A==,type:str]",
"ENC[AES256_GCM,data:v/+oRqVxugO/BjnXwZN8A5YMAoJKdVimSQCaDJcq9Q==,iv:gdAr92sz0j43DYxHda/DX7Vzh79/4STuOQC01ZM9LIE=,tag:R3k81MOzm+3jjy1f7Jx2hg==,type:str]",
"ENC[AES256_GCM,data:3gwNImQ7pgHpTtMcvmJdbXSlpBbCP3V3bxzEYnampf0OM6GAB7hgX6FvWWDaKx4sKqRc,iv:+pwIU1CxDyMEC2mrlSIYVhAfrm9EuuLXW1whEQssoAw=,tag:xqRp/k6sRBKBoLZeWauIwg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:uG74QfBpWQ==,iv:xEr4LMYqar50XNfIdNfy+kc1wqRW602tHjmoGoss4ec=,tag:yJnJAUJ0eaKEF7iMrlZENw==,type:str]",
"type": "ENC[AES256_GCM,data:tYfdL4cZ+bsy2BjD3+gZqfXYJUwtoFzf3KsPvdDDqQ==,iv:f1x69GZio4sG5smk6lWVvqfwD7zLYIcUb5Abfpm3Vt0=,tag:AqLLlmCkoCnSxTCIpIk45Q==,type:str]",
"name": "ENC[AES256_GCM,data:wNxI9EFN19Qj7g==,iv:6cwt8kbmz2kUOQU45aty3SkGWpKKpDYAjRggIvYYfig=,tag:dsvYbgWYO0WvzT18ufa3pA==,type:str]",
"provider": "ENC[AES256_GCM,data:smLwI7NAxx3x+Hu77smzYGl6GPX96Tn8HCdjIAp9sZs4RvybARixImIv+R0Cv0kZvtxpQF9p,iv:n43IofgAQOxReSKtk5EMllt4e+j9plotnoiouG/R9ag=,tag:gjC3NdmGh+C6ZewF/czcHw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:TQ==,iv:ktLB/4+YEOsWkcR5BgJKN63o9qCVQf5zVz+iIDvkNCo=,tag:6kJZk2BoxXZc1fKUWhgQhQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:e+RTnS1eP/F8RA==,iv:gLduZXrZxMIqZ+3jF7zESUJu42vSpT1BKu9RHFq53QY=,tag:J2+tHtkQXOSFX/aJJk56iQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:jg==,iv:JA/hWOH4sf+m+hpOIQwMDLCISSDP5OYGB1IEuZ0Zosc=,tag:qI9i7fmK0mHQ82dRUE+mkA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:GpFpUCnHLZt6tA==,iv:w3VrWRTonl2D8RHu2f+k+Yrdn+ClJ8GdbYdP9RiUC38=,tag:MUhsV8bnRmm2s9wl3c4QzQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:z1YPg77hfLHy,iv:p2TmZ/JN/I/IHm6ZyVcPPWf5dQGz25U7ouo7cju/zdQ=,tag:3cyNV7RqpkZvxKfLPeHRxw==,type:str]",
"uid": "ENC[AES256_GCM,data:CzhjzTVEIww6ybxTs2ENXgXErE9DNsMvDmlWZ40LZxCo7Fhb,iv:yfaAbHicV7SaYXWlbsjuZfjwiel677gPTgP5R/HgnGY=,tag:CpVhcZXWqE+5UnHoUWRwug==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"role_ref": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:EK5B0fGDUWmiZdWrOVYjOjFiqA8hi+IcuQ==,iv:c6l/eIkNZ4reos4SK5wE5eRk7lHqCvdPJ+6i1iHQRx4=,tag:wJBG5N7lOu/lznUv/Y75Ow==,type:str]",
"kind": "ENC[AES256_GCM,data:1zYG38+KJfR9/0s=,iv:XI0s+TnUHOtPRgJH3SH62dxTi6suZl4dlbyPmCrzgtU=,tag:Bf3NxJ1BI53wWDcMfDyT6g==,type:str]",
"name": "ENC[AES256_GCM,data:rhdm2SZ40xG6KgwP0g==,iv:rMNoLfIBpyZD/9nJJC/Axh/nc6ccB4aWE5hwgpH6acs=,tag:6D7EOknCVi0xEvGKuMxfkA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"subject": [
{
"api_group": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:ymOztUgJIaKAe8myPes=,iv:+97lRMrXtbc846p63XpciNW3aWCGK+eMbYO96Bdvw/w=,tag:rOi+TI7Y+eVr+4E9ri606g==,type:str]",
"name": "ENC[AES256_GCM,data:Del5PDXLw2RG+8NI0h+MaA==,iv:P2IfYJBmC8WPJRKaeQRpnUOCmagAweyWu75FQGUet2o=,tag:vO7qoPFpWe8Oo7qyf1tubg==,type:str]",
"namespace": "ENC[AES256_GCM,data:GiO/JRgSZ/lXKQ==,iv:NdYTvhzGCXTGXeQya6J7MOFGfYeeexkNFvlvnTJSjQU=,tag:RXwv/sjOPUltIil1MMJLOw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:95EzPw5NJjY=,iv:1pUKYDUbOm2fH94STudqW4Wyd6VbxgjVO1ltS8r+dho=,tag:DMT1WkUjkvl4cYBZZTfRpg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:X1TgrHjhI3nGC3LIxB+Atx5/JFEL81Ye1bFnu+wxHg==,iv:0w/lDVYu7OAWZkqZjJPX/fH4AUxjZ5ryP5LcnuQDuZA=,tag:zfQovCB2c8T+TsbW+UcTmQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:ATOyjbxGug==,iv:ImOlUuEsx+f2GRy9HRnUe6AcLNIeuuiXtfoycILH6qA=,tag:PmYfP2B7gbF0YFvpASfLAQ==,type:str]",
"type": "ENC[AES256_GCM,data:seQ37r5I3Rn548xZgMyaiXqa5f2Npmu0SgX/kjwR+Q==,iv:vBB8CkhhQmngw9dhW3BhAe4C9gKcLK/JuZOroEWOBgM=,tag:HJ4IK/H8hmBWzQqzZaEpGA==,type:str]",
"name": "ENC[AES256_GCM,data:Q20Klz/IbvGbfrK6diqH1LpT,iv:QMz4zlKO+qvzkABiaTpFoI1IgrucJbBCGZ4d8MT/7Ww=,tag:m6zxyzIF+FyRZE+WBJAyIw==,type:str]",
"provider": "ENC[AES256_GCM,data:nacJbCPhpTmQTUk/QtXF3LDI9iqSqpbGwCBcdOO/cn7+zGWaLqcD6Ij8JxbMqrwCmcdCO8LH,iv:7sVXl46aF0kBA3C6o8sydp40v3232EIYCvPo+OkeWtI=,tag:Hf0lfg7TjzWmt9iscI7s8A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Vw==,iv:qSBolmRALRzO0SClDja4cG0rDi9J3uC7myw0WSR38hY=,tag:ORncQZ/fSWtqtYk4S9iRwQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:8Ophnsqxnt6GrbK0JvYQVMNV,iv:2MSUQybleEkONhFx6ZhhF9t9ghzjHF8GwKsi1x93+Uk=,tag:8H3Z4DgsDCn4plpJCyd2yw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Ag==,iv:RxtYo7jVLmVfZxcxdUSL0xJpVVRsM6eNMRXk7GW08YM=,tag:hR6dU+OxZkpzDVpHkKkM+g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:K0Uaq7zhHG1HabSl5u/8EhXv,iv:URWMBrb8Z90hISqDuCzUDXy8t64dP8gNdYNwdWCVRyc=,tag:Q78co/VzkPT1QyGz/R+PNA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:5xXzft+PukTo,iv:0cp4j9gyblGheex8w8Fn9BXBofRSrfp1nJ3SD8TuUbw=,tag:YLlqY2CTG8gGX4WSGIrSGA==,type:str]",
"uid": "ENC[AES256_GCM,data:Rz/0gRxXFWkJ6f1tSy786p/mpk/QQsAP9jadr6ZbvQy1Kj1k,iv:kDBqkOtDS3GwK2WoFV7K/17PaulGAItIux1ymzy5ImQ=,tag:P7oJc6BYZfYuLGHJRlgjIg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"role_ref": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"api_group": "ENC[AES256_GCM,data:VcoL79/kUBQFKTcezm4Atbk+JuyMPY/IOQ==,iv:CiMOG4ccsIaXo+5Xx9FeYBZO4GkmqNppVnv2/653Z1w=,tag:WbPSt0Rq5IW5JiXtlDCYUw==,type:str]",
"kind": "ENC[AES256_GCM,data:7fEVwJQVQYSsyMQ=,iv:PF4z21CW5qs6LdQh/h4y72Wb2Is0F+9BxdxtOgkqOwA=,tag:5Ku0gcF1Dx/moQV8ghA8Vw==,type:str]",
"name": "ENC[AES256_GCM,data:zu6I5H70fyXzNg8b5g==,iv:3bNB47IlHosYSYQoXO6rP3ZX2ER96D8BVwvFwWNz9xE=,tag:SAnNeBjBp70LCADtJkrqhQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"subject": [
{
"api_group": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:6CiT2qlI7K4DEI0t/P0=,iv:tTNmuidxysZETxagTe9oKeZ/PHx5VWcq7LCCmdXl+78=,tag:XuZncSuCDRKX5nls8lr8Ng==,type:str]",
"name": "ENC[AES256_GCM,data:INwV16Z60Q==,iv:TxFmNtwutefaVx+1bfP1N4LQ+OvRIJPphxUEobaSzTE=,tag:WxEYuC+29rrUYDtBIZe+Hg==,type:str]",
"namespace": "ENC[AES256_GCM,data:xWj/a/1mGt0ZIw==,iv:/9NSdE6CcnnXHx1SoTnDWoVz2PKOWnI+xAL/v9ZvkAs=,tag:8rXtBuilWFQEZ8PcGT/YRg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:nVsYUBapads=,iv:RKelV8O9bQOJOLAcXH23WuQ5keXWpq10UChXFCldzK4=,tag:crzll+xSFPRFZW0WOx/FRg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:XcM/dIPEb9ysHlCf9W+h7YVf/AhoOHQb6OoJNP87dw==,iv:Ht7YCr5b2/IKgtwK/uI7YixW2Gid8FDQHKRYfPaBCzs=,tag:fFRXfEL3rvkwlZMqU2bD/Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:64ev2f+aJg==,iv:b/GRWMnQ76piEm3hYALBjPYqx46YNiZpboitj6UFcI0=,tag:VRfhwHK1Bt58I1X0lFTI+A==,type:str]",
"type": "ENC[AES256_GCM,data:wrTKaiZuSEhm4yyk+FJwOo4vQrZY,iv:x7lqtSIciZ7T5Jd4558oUc+OQ26W3GXSQdb0CpFZWo8=,tag:xlfGY9z38QEzb46Le1zkAg==,type:str]",
"name": "ENC[AES256_GCM,data:YBrsb99TlL9yMINXZw==,iv:SAqVfkU5hVmj896F0aH1J5MCLERZKLmWNpMC0Zqgvmo=,tag:oReBn/cSNgiB2vLTAReezA==,type:str]",
"provider": "ENC[AES256_GCM,data:/6OdKLwSG0vOuCFjXrP67Ii9rM+CMjXac0EP3R25NMxSxpI7M5FHA+ugkzS53DmX+bgA+FqG,iv:vOdzthfgFwzd+hR6D00T5zPnetdXhohNHsiTYkGIS+4=,tag:Fn9nhSp0eY24iVnhOaK1Pw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:6Q==,iv:dk8KrEdP0XOmWdbpUy4W45NeVtEks26rVaOzMSDUdL4=,tag:l9DYAaRVyDD0jKNXV4Dahg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": {},
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:5G/71CXfWvDM1Z5VKqlMHR478xDk7QAQ8mof4bkaGS8vIVbUWEzuXtnjUQOwIMJt4l58Q9FbJnHpt/5eN/BkB53MFBNbhPoblcMBwXWci6QfkugGUxrndTyJ62/Tef/lrE9QIlOj6Pujhd9U5InzApl1SfYtYLwQUtDFhybp1iawlF5TpVDbk1cX+ZHIE7zqx19uEUdXd2aQi0Ryf8mfNN6U0CkyAsi3sshmNcCJVct4XyqWHquanw7YNoRk489xILw2XCOmkKQ=,iv:YTpyKiz0/QEsw2AGE1O9/xgnb/k08JorfcjK3gu3d0U=,tag:gPRkJiXpZOfj31z7S2XlVA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:NhcvdSGsFwrp9iGjakUH7HYnvcYmEPLh,iv:cmSKLSTIk2snV7IbOhzEsNrGM2WqLQO91+ypLEf/ieo=,tag:3d21bs2yYQRpIURxgEcDRg==,type:str]",
"immutable": "ENC[AES256_GCM,data:6rY1Qyk=,iv:CSx8r2inF8jDCFHZuwoVWXp6uytwYiNEVCSUB7MjYxU=,tag:YLUWWqvx9yXlpRTMlogArw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:sQ==,iv:k/dwb7RKYvq6u+2QsVkj/Sj7TZCtdOmDh84T1FLBVyc=,tag:EkoLTudgMncCW9nvVyx6aA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Zlt54LdRpF0ukPFLoA==,iv:Vh3lpPweUh0Cqy77N15uIpGqM+rkYDKP7rvVrWNzrlw=,tag:BS/OFcoF+pHV8XshxnqSNQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:ubZHd5bxEvgrfA==,iv:8kDdX1ZsM3ZPHoecd6N4wr5sZX09TYLo+WYuXOei+I4=,tag:3I5iseDGAdfak36dqzF8ag==,type:str]",
"resource_version": "ENC[AES256_GCM,data:iC93+PaJXFLc,iv:9X0h/F2AGiC3lUCrQakilKD92ZTIrV6VyhnNTn0S9NM=,tag:dlxO2U9p48hdEG63XB4jwA==,type:str]",
"uid": "ENC[AES256_GCM,data:uyd8GeOKQrifxlUAGRJlbX9eIfHA4ibZBEPuzcAcFN/gIsQm,iv:UkGym/8rjzzVKMnSQ93SjETW9GB2ojdBDkTpAuNZASc=,tag:NVd+PGzlUc2nVfED0igASA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:Gj9LlrVsVrU=,iv:PsLk3XH+z43aFwEHqFchiadS75hh9TnVlGdQ8bAla+Q=,tag:Eg3thxn7ZvyNCeNDGcBWYQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:/AUXjkMeBndRDvashvel19IorI7JnasIXRdvcoWbqA==,iv:IG+aS0FnBjqC8Kzp0Uav/ySZMeUpvuKBCrSjXtcSEFE=,tag:tGV4orppV7CnwoYVamrVwQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:yrWpIcLQZA==,iv:Jh2XB1AdjdWzsn5ih1jt4C6x87Zd0pqEUkb09leDYOE=,tag:GMOBtLrkcvV77IgQKIBT0A==,type:str]",
"type": "ENC[AES256_GCM,data:AfB08B8/ejxN92PI+iUQ0Vk49czr,iv:13M8ujMeN22J+E9L/z0joHgB42f9mNsdyVMhCxqwL+w=,tag:LfryuCinvFzCpOkxlZlgUw==,type:str]",
"name": "ENC[AES256_GCM,data:2sv8qhSL8h37RXyyF8ZZv7aO9dqA,iv:XxvtqaJLIJyAKVmSLW7lS09TVRYVAxofBzH5dsGOMCI=,tag:8r7U4d5T3CUHHaFL/03IuQ==,type:str]",
"provider": "ENC[AES256_GCM,data:csWOwoM/uzc8dNgE9TQ5u7rv1pqY5ORMNYH1J3Dvb+XG6HJpPExEBMoNedNa/YlFjsH2ErBh,iv:fEfedLApKsrUTgVHtR0EVlCnygtKNy97D8l3Bk5j1nw=,tag:x/4hIudJFpW3hYJ7EHdRFg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:bg==,iv:pWlxQ/xk2aiM8OQ6M0g6q2PjxnbbBe8GxHoW5pXfS44=,tag:1QZ2VQWh+OhuDEovV/Zgig==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": {},
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"sync.sh": "ENC[AES256_GCM,data:up/jzADisLkdfK/brZggccViorAfNH+9/TupEmhxskvYOlfMWG2rgfMWh3y5N8xMosvGIMoy3hfY/qCEv2PMh4nnbQq4sjOsHq/+0o+iLTSMUMU3Y6Wu5jcaICUabVmqGZtRvoqANrhKLgjoMYMRkkZmK2qnI7gVv9+uTSyeTLQxKYFHyg5kUNGxH01Bs1+wLWdzeUTXxKuoGbeK1oVpLVe+tYzbhpPv22fNqGxyuVkK4KryL6XkLTWsYv6SAjd/t4H28yYXsE7t5dXQ69YgI3l/3q8tpos0RONRdAAI8dLj3Pno/uiikJUM1NmHX5j4GmhVwAxLh1RNCYOxwrajTRYENqiJ4dbkzL7WS/IGwW4njfWYo6cTonDZyrRvkrpPyCMdSVosQmnaetVtcT8yItJlQZV8/cqqZP5RURMjlr4UFN9N+OCBIzWHVicMbiEqDo+fGdrtnGYIaPXT9Roy7i56eMyyfj+7rZV2B9EmYV5a17yWfRHC9M/fAVdKR655VR1JBn7P4E8zSpzTOirXrK1x/6yn6KGGCk3QpnwL23dy8v34Wj0/5vJOPw9gNyyLcnThpDPAQ1iN9YcKKvD22I0FmOfRFBqe7hMN/YOTdUy7JlGRTk4Nj5zAeFC1GHM6/cd0/e27kJ+InWB6/k4w4wD8JOppgp0mUS+YaPVWxLmjY98xyAETtpjA34kGFH3vcaWpMTrWXcyG5E6r9LoX2lMPZKOEAomf8IwzgAXYchv7aWgLPpSgX8USUIPggQyLJVSuuDQeaAIDysjDJH1s22qmetm5Jry8Gei7qHhHBqwocXKsIL05a/ex5tqgWcIGx0KKIHKZTpJybrlmmc1XL2s+4XQJTOov0jrChw6+Q7Ui4u/S60C0sbsIhZkDShFviDjzGT0Fmj+IlAbQ+MuH2wcUCN64B6jB+isIwIpbkFEygn6ghdY9KlN+U/S1zJfLetF49APZBfJm/PKcP0+QGxgoRfiGxiCopoFKg35aA1jZsJPDTpz55DVyrFJugWZVn9oyg2xsNKTBprKdUCiwfiLaWfhXk4WC2KsEE9mM3XppADEC72gTS0PFqvL75rRHcxxS/vJk0PcRUNY3v0SMMw9mAhHAfO3EasPjACu2AP/IhtcAyiCPrVHm7WgJlzgNCr9op22wRIHipDK9pUGMnpdSZkkT1dMbomRU+us8IzdrxFRZjzVb/u7bEZ+QYRchL2jSnAxnji3JFSQ2DF/04BulPCSJF7MIfSkMUf82q9rXmi3/1/KDxYW50/Xp06ykuDSGkhbaBK9NNwb4CTpTXnpGCtGImtnY3sJCN5BAj0kJypUmXoYXMlagJ4BAiE8phFKycfDqIkxPfTx7VwLynLBRKWCWWfO2QqQT3hvBubbqgtkdEHWOYJBOZC1Q6nLrOBXgSJuXkIdJiv9x6JOnf9lyhM5q+BsxPnQU/7SIcA05BwE5fGy0xxMBjirLdwT2ysM82siq5geV3N5rfW5QoeAsnyqNHkzCIgwF0lj16tTi54gw+7LMWFG8YBrykEuLNKu68jHNuaRyHnhqIe5TOvqVuD/LguDmqJfr5632Ce7m9EuK3TkSpflDQMglb63EdlQS+fgUZOjp3/BrujpD0dh6EK7gQVFrq6RMgRadf8kpi9LdqzaQhVom1j5ckjTobYh3U86/NCQkkMgioCo1saaZmbnkFd/P5KSqKfxDmJ/5EFqKyIY55WPM9PCFwVWDllEyPzuKDG0tyFKuPLOaPt3RjqT7PDpspfTcEjTHuSNxRSJ4ipcNfcYf+HSBh92gYI4xYQSyW9pPrr6J/eKTHI6Vef9PrxzXLx+GE9TMlKaaDTZfwMJaE4CmUjerLQxppGrGX7HflURIkHhKY/5EDZO5z9QPiMrk5H8LGkDBGiI5b6laCiHnjcqQXL1JeRo9FDHzmbPys4AyG0MfBkIeMHNAwm6DXkbyst1Q+DVP4DNYMUNRs8pDu2FNba7enScTxEhLyBbWCXq7X9e2viuPlP2TkuB0v0uMZ4d2l6qGVk+lx0wM50U+4Tb/ZFw+J7IIEUNm5e01PEc5vwA4M2FCKdwFMryAVzipfIfrBLWNizIOv1xIjDVUJt4Q2Wy9oCcW44NfIN3TiTAlvLYZN5tbc7g+hTnyaUUrIExbAex4SfXOMYmUsedHWvk+EqX5a5jkN1KeZ7hAqqxtot0ScyMKhnr+e4BeatvwULyST9Ze9I08WBM0iq1ri16iLWBa+9Uk8xPtzIbLpgEckkzJoaMhy3VEEAMA3UGLKZEMtQ1rKkqj0YKHW96XQZKV+fUW8/Oua3oaeAzGcHxhkT3l+xQUF5sHmVVGaLUfzsb7+fWh1Q72xVTwjcg+5BhzEdZAF+5oyn0Ud01WhYl2XXsfxarUBvvRWCdvo1VlwXMfxIgPh9fxxBSZ1k4hrBQmKqREI8bH2Ovfqba2G1bpAuAkLAzBxhVVT/9C6TXOhy+DugMUXySsvg77MHp21MfjIHV7fC0DZl9ZJuC0lF+IGwnWbzZGPA==,iv:U9CKinFROanmnN0vVyxkLxJxabpnFd8myBVL2hGgxc0=,tag:wBW9T42hZviNl6chNASK2A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:H/1mTZ9RulPg3jaOWSsioLXh7UGvLptyMjA0A4fIQCs=,iv:3ws+4C1sDCZ1FOs75YiiWPCSopU3AIuPOCNXDZacqu0=,tag:UPC0Hgk4zjy5DzE+k82btg==,type:str]",
"immutable": "ENC[AES256_GCM,data:j5mMsas=,iv:rw1pCoXEWxyIXwKN3lJkVwMMcWUdM9D1UPYkFwvI6nI=,tag:mUvGE4A0l79klKZlW1TPyg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:GQ==,iv:j4uhpeh6BgHDnNQ/nNtmfZdq6NZnFZKeO2oAoMJ9Mq8=,tag:Ib5BKVno4hehe6LFTgO1zA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:7fXGpsjDOs2Jmd6gx23HXeMPeZx1,iv:EBV9USjYSPTnIRhccCi6iRdW6D5L7EAt4w7lFurjlAc=,tag:mzsRym9m57o0euoMMUCM1g==,type:str]",
"namespace": "ENC[AES256_GCM,data:n605yn9ShKnUmw==,iv:GqOIukdf2N1gJdOj5K2oLzrHzxTDVpxgytc1oJH52g8=,tag:ja4MV/mIWna/Sqh+6AWNSw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:Lcl19Yxvz7s9,iv:anu3bcS5SIsay4Fytt6kABYvqoFKhSrNJeFqzIb0pX4=,tag:QWZcOR9TCS5icCgnoUUV+Q==,type:str]",
"uid": "ENC[AES256_GCM,data:AMH9adEzHNNVMCt8OxEln828SQGbsukW/ZN0f+WojdroQ/6q,iv:fhTdA2QzCuQDSKl1jz33XqWJuD4PmTdwIeJtNu9i04U=,tag:EHGHdM8HJiyD7qvexUg4QQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:DToS+RQ8jWo=,iv:T2UR37PzDTjZ/qadX7ISwgRLXRJyom64/KVFLo6WVt0=,tag:JclneTDt4IGEif/juvri2Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:t7+njhWcLkJhsFh4+0fLrTeBnoP6Ul3nPW74Txxikw==,iv:lLEc/WVoah/ZT5NQv3t6Mbftl0RAV1vhkCGqEH5QF2E=,tag:82i3XPD8AJIJnRAV021Dyw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:FRRfDFoqpA==,iv:hauYpoUG7prWrwBZUnBephk9EHg//sOfABqfPXC35fM=,tag:D/tKQ0f5q4SmmQedm+HlJQ==,type:str]",
"type": "ENC[AES256_GCM,data:9/v2N2EVM+RWVHxbDxkSYb3z5pqbDA==,iv:5W+Lec3Puin+jsVfPSvXHXbJeC6Iezc9tqE+EPfKAe4=,tag:7MfuwG0VA7Tr+n7K9HB5ig==,type:str]",
"name": "ENC[AES256_GCM,data:XmCxkjfW51+ajBuIC5GIujw=,iv:8kdpA3v8T7/m5djy+5k+ZQY3dXusW5jujyxSstWXgik=,tag:CPaRSBynX77Xwm1d0upW0Q==,type:str]",
"provider": "ENC[AES256_GCM,data:GDwx59MdGXxpL8jXb7yshVb/A8HaSO4YIWFqfr0rkSejYjvwnwhkutHSL3VYVKyMRgJ1jVgv,iv:h3IvGXJDbLjJ518wfI2E/z3O54qShieIw4iL7HPyAU4=,tag:qLW6+9k0UJSqGW7bih8E6g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:vg==,iv:oZBtkE1ZXT/DEtWbFL/qRxdBtJK9yWvjwrz+fptqwYY=,tag:JxbG/80lpSlxF6kN6Wr1ig==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:Bn9JqUvlrzofcqu/IOH0uV5rKeE12mZFRhDBYtvXr4k=,iv:SQ+PptB2TB/ple51F2foaei3BVqfQ/skneBnyp+eN+s=,tag:2u0gSHotc1TStUD7vjtCIw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Nw==,iv:qRs2Gt7zMtAmM1mb4UmzGeSKMYYPPk2dt2MZsKOdMRw=,tag:aqTp4C/bjtTidT5h/yJR0g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:bXi7ICMXfQ/ADE3E9J8isXIzhpoP,iv:2Jemo3zhDYxY0jPgsohlTBNs6hi8hkOkTx1RdGIlKk0=,tag:ri3dnNPfQegbt5i/VEWzig==,type:str]",
"namespace": "ENC[AES256_GCM,data:Ic9E3715qzGBMA==,iv:GrnR+ZVFbRrczwWSeIq497aPVCewxxsxzBShURLjuFY=,tag:aUS8ivSWPDKQRlMcuLScIQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:0Uz/J8Z1AFuU,iv:9dJAVqvzntqvMJYqoxll5ZeS+ohUAf+ROsMrtKzs93I=,tag:fcWu81ZSnVA1I0fT3NMLDg==,type:str]",
"uid": "ENC[AES256_GCM,data:aYSYlEo3Vjd+Se6Xa/ECvy7EnoQi4BAyxNp4Nj4YzFzaT7Pf,iv:nKz0U/ya5FZ/V8Gy3CUqvgOgAoMXAfD9gcCpdYN9OFk=,tag:gqTqR7aMvO5qQQuPbVQA2Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"concurrency_policy": "ENC[AES256_GCM,data:NGSkR1rF,iv:ZGmNFjZ4wUDEScU/XY50NCvK4UGET8QMUjG1r3A8DvQ=,tag:u8K7TpX02zI8CXeWx/MNXQ==,type:str]",
"failed_jobs_history_limit": "ENC[AES256_GCM,data:pw==,iv:1x73JxckBlyRrdwtiyUswsDpNAE0De3BZqvIV3PnWFQ=,tag:NQvaZX2ym/itje2vuT1dog==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"job_template": [
{
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:pQ==,iv:IFYBJLDNOaGYllv9CYygMmo2SmlsDES6KvNmh/81Yus=,tag:BSQ9iYZQ2eJppjvrNXa9MQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
"name": "",
"namespace": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:/A==,iv:1RKdCaAa0kn5L4lneJw+uTgmim+QBSNZrjuxpwkK2M8=,tag:ZG2nMIvdJdzW2Cce0AhbvA==,type:float]",
"backoff_limit": "ENC[AES256_GCM,data:+Q==,iv:Tpfb1YjVPtYdRipcN8gV+Gngbpawi0UEMchMvF3ghNQ=,tag:FSlKo2qqYPiaMomZKFiUCA==,type:float]",
"backoff_limit_per_index": "ENC[AES256_GCM,data:VQ==,iv:sYPAjaFGLKPbMtapZea+dJ34A1BOn9ah5uWVTuAJOok=,tag:VuYoyFNM/QILeaxKx4UO3Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"completion_mode": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"completions": "ENC[AES256_GCM,data:KA==,iv:NoPG4Lii3yGDNHUZrl5JGYUjGKpVNm5v8VcJIBlQEec=,tag:567Kc/S6+NG7uIxrjtM8UA==,type:float]",
"manual_selector": "ENC[AES256_GCM,data:psD3Ya0=,iv:iwVZkQFdXvfEjlXqqnTfRQCDqKbZlBktvPHU3ta/iuk=,tag:4pdg31ctINeJpps3hPxFFQ==,type:bool]",
"max_failed_indexes": "ENC[AES256_GCM,data:Kg==,iv:E0IJdgEKcaNVKjrUDchbsmPUHFPRdj04ipQY39oyCeA=,tag:M/+aSOr3nEiU+eT8xSsbgw==,type:float]",
"parallelism": "ENC[AES256_GCM,data:dQ==,iv:Qy06zBgo6aAOTB5QW0Z1DT1rd96qpmv1iz/77gB2rTM=,tag:EaVx358lWolNG3IOXALJjA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pod_failure_policy": [],
"selector": [],
"template": [
{
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:ew==,iv:dtsi1Gve128ZKDPFu9ZEHk33MYgd6s8dLY8bz5VpwBw=,tag:zPjZ1Bcw8sMY2GAkbXvkSw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
"name": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:mg==,iv:wiWJkxe8iBY+EmwqjLuLiCtTWy3TUxp+RwjdDWYZbrE=,tag:ladmlQqX+sm9T+LIWzFNpw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"affinity": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:HlVs5g==,iv:ZWW5rK6saBwYWRsYsqUYWnaUkC5ftPROhoowa/Hwq8Q=,tag:pQ59AbSj3SNr1HjMZzIJKA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"container": [
{
"args": [],
"command": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Y6gK6go+uQ==,iv:eMbLL1G9G41y9PBSef/xFrp5sSQ9LDOjCCBMKnxbjUo=,tag:+opkhGopKOCHV2ez1O9s8A==,type:str]",
"ENC[AES256_GCM,data:qfY=,iv:XvVoh0sPwTzrAuV4FwXyXg6XQvLDx0i81L5m4boCRik=,tag:clkZTGXvUlOIKd+ivpwMSA==,type:str]",
"ENC[AES256_GCM,data:gRSaTnEP7vZNfL7ewJ3xJ7XiyHKNGt3brkvs7cUIOgGh23rYcUqqfIQ27TVdedT0cmCnoTBL,iv:gACwfprTC9mn6uWW2Zm+2lMudh41zSFhs4gfk3T2kbE=,tag:25sHkWzfgPjUP10CsDl+ww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"env": [],
"env_from": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"image": "ENC[AES256_GCM,data:Dko/YxRA,iv:YCUOJDWaAffvFZTAZiPCjniV+ITM8nbJE8ZVhaw2Ew8=,tag:YzdcqjANFZy64vup4LPOBQ==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:4axIsS3n,iv:ra72BRLZH9i2t/NVOjr9hhHrJPUYlox/qEUER9bJ0Lg=,tag:pM+IvBuJ0i5tGn1m46gh+A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"lifecycle": [],
"liveness_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:k4UIEA==,iv:cY7TshH3ZTikNw5g91mTuKBC8NzG7oM7YoLqfYHbvUA=,tag:HVA85ciR4f+NXl2n1d76Iw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [],
"readiness_probe": [],
"resources": [
{
"limits": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"memory": "ENC[AES256_GCM,data:cqh4bQ==,iv:jWALouzMsUSgpzLst+AOlz4kDyfEM7AGPqLDeINawK4=,tag:1PTitlWEdc5mjh/oXKpiVg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"requests": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"cpu": "ENC[AES256_GCM,data:dhvn,iv:RcyMOlXoikTQUPj/YNyD8Dm+0qsQMGZ98NUPO6lYIz4=,tag:pe5ic1mbWGQYjCPMHRVj6g==,type:str]",
"memory": "ENC[AES256_GCM,data:KuK10Q==,iv:8iZTCPBQM/KOwbI0vEs+sXsis+iioN6N5ZehZLm5L6s=,tag:1zwb3asVqV4kCjBismQkYw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"stdin": "ENC[AES256_GCM,data:fzIjwDk=,iv:cbhMsjkF+INd0iaVSF1Sz1epCwu0+Utmr365aonQX28=,tag:pLulvz9jTU29x+EJBWzF4Q==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:AORnMVQ=,iv:IIoT7wKBRESvav7c0BFhEG20iI0lamPzCzecOVZFWzs=,tag:OYbPOLBRE3ij09rXT03SbQ==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:2/rn25ehJAZR2gsBrtcZ2Km+tZQ=,iv:2gqIxlcddQTjFhKr9wwS80TkK7OA+1Uv47nsQqFNPs8=,tag:DXJVH9q7ZEMXIURlEUba5Q==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:lXlTIw==,iv:tGXjklyqgyyH0bPXLYc5L5egHuQ2fSKEG6eYl/whe1I=,tag:DVQ1kv2Eh9wSUdOw1b58cg==,type:str]",
"tty": "ENC[AES256_GCM,data:FaLuJWA=,iv:2j60vw4vPVPB8z66XYGbmDsbzzr6EZAIlpsXkfDTwGA=,tag:2fSt0pohi3Tds0EV7at9RQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mount_path": "ENC[AES256_GCM,data:ZRvp/rE5qC0=,iv:lZRaDAx/CPqVz7w5CVV0GyOL3DrUPZHuF7MA1Inf/xI=,tag:vx4bT9fhIujb2+PxDEK8Ng==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:mMAAGg==,iv:uu75FPgLZQ1oFAbxUtKoI5fEu6eiE+Z+9KBuZv99NaI=,tag:eEHzM5tnP8UnRORyJWmcKQ==,type:str]",
"name": "ENC[AES256_GCM,data:SYxMa+u5n3Z6OWM=,iv:AJD7iB5G4Kl7qbsrBmAvSEbrrMO1P3sEYgi3qozM1x8=,tag:frPHumjt+A9KEFd71j1DYg==,type:str]",
"read_only": "ENC[AES256_GCM,data:JRMSJEA=,iv:fU89dn0qtJmIbSp6akaB5dFT5yF8fM/XKiV82IGJCH8=,tag:4KmVwlxqe7lR39BlWI8wJA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sub_path": "",
"sub_path_expr": ""
}
],
"working_dir": ""
}
],
"dns_config": [
{
"nameservers": [],
"option": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:EAlRst8=,iv:oR9jZkCD8SBZWQdSW4iI0NKNi6FrIpAaQ5SWOlu1lWQ=,tag:CW1e0ZaEDOljhDVQG9iKkQ==,type:str]",
"value": "ENC[AES256_GCM,data:hQ==,iv:dv7mJVMWFXP+Mw9GjyxsphpQJkFIMr5+d+mJ4oKaDno=,tag:g9XuQVnvSewUyWaWqLCWNg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"searches": []
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"dns_policy": "ENC[AES256_GCM,data:hehF13D85yIVbuKI,iv:sFqIsBxa4dr5iJ6o8Kfp4lBZuIQs/E7W+x53I1E4P8Q=,tag:urtXgRv6fLjVFqLdRxRY6g==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:OUXQOA==,iv:EMpx34eB/ttxU1spPghCWm6DNRETR2/KOYjVYrA9yeE=,tag:tdPVID2zp0igkBJQLO/GHg==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_aliases": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_ipc": "ENC[AES256_GCM,data:76IREkE=,iv:waVm0dbfcSnCUHAXM5MSx5Pxh8ERJJr9ZZU2w3bj/F4=,tag:A4Hblla2ukP3SzxcQp3Elg==,type:bool]",
"host_network": "ENC[AES256_GCM,data:4a86ycg=,iv:mfLcpBxq3bw6fvEiTOrKHXfNWKZnaeqMZHcpIkDKMoQ=,tag:EGwn3co8jiv7uvis6uBpmQ==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:+6g2s2g=,iv:l+AfknIFug/cwXV4ZnEqLctEgSDCSFs/BT0v8zq82rg=,tag:eTe47xaUU41nUeBZm6cO5Q==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": {},
"os": [],
"priority_class_name": "",
"readiness_gate": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"restart_policy": "ENC[AES256_GCM,data:9xG90Q36ueTL,iv:9bPqTpzA8E47rS92T2vq9fZSO6toAI4Qlm+dSP9jrs8=,tag:W3PgvHqnOZbJlwvhdefJwA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"runtime_class_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"scheduler_name": "ENC[AES256_GCM,data:pKUnmKxmHRBQOm6oRlAO6pU=,iv:T5jfnpPshgAl2HK1bI8qAexHu2bZYgd3GSQDFBAfYBs=,tag:L9yvYwqAz2z4HPELEuT4hA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"security_context": [],
"service_account_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:MVM5Hmg=,iv:My+uRtIU0ZzWwfXMEkgJI5bHZ9wzDwA4K/eetYZLm7s=,tag:3dDAdLXhTli0q2G0dmPENA==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subdomain": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:KS8=,iv:nLit/G9d+BPLL2tJum2vadGyWXAEfbp4WEmhoS4c1Oc=,tag:izDtXnepBjiQaFlg+2CK5Q==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"default_mode": "ENC[AES256_GCM,data:3DWXbw==,iv:PAEF5Qg3Ev/njaQEQKTWSv9Qp6kYekIey9K6oYKQvKU=,tag:9JnQic/WLPieqb0PqBk4zQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"items": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:KhgWsEGEqaiOWc2Ep7bv6pGhZ1Fd,iv:29Umap2QqywpVd8vELhvA70UFlp+PgMxlWWPaFFcMiE=,tag:desnFS/xGAEFLMvE91vpkw==,type:str]",
"optional": "ENC[AES256_GCM,data:YCFl8Sc=,iv:iKSs6iu80f3IFbyPmU4y+DI/KDD7t8dlzYpBi1h9PLU=,tag:9feMQY2QFra//BdxfumACA==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Zi7iKY+EGJJItaw=,iv:frv0Z4thg+Ooaaur+IOBrnREwQ0PZJUQ22lG8UnhSzY=,tag:rAhposEoXp0xSEOjRopvpg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"nfs": [],
"persistent_volume_claim": [],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
}
]
}
]
}
],
"ttl_seconds_after_finished": ""
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schedule": "ENC[AES256_GCM,data:eb4SWfNOev6LdYY=,iv:qzjz6sCa4epCtdgbt4hhjfZ7zrLFnnPwySdJWQlJUWo=,tag:acIECmY0f+Qt6y9d3B8hEQ==,type:str]",
"starting_deadline_seconds": "ENC[AES256_GCM,data:Kw==,iv:nrwmp4QhErBMKgxuWp1evoi5QAVcQRevJdCGmhevD84=,tag:l15HOop0SEDWQYJ6UwGEyA==,type:float]",
"successful_jobs_history_limit": "ENC[AES256_GCM,data:cQ==,iv:8wzp9hR6H7s4qrT+4S14hUDL0NbkhRAKDmjDzwBwftc=,tag:kqfOhRoOZoQo4ooPror4Xg==,type:float]",
"suspend": "ENC[AES256_GCM,data:jiTBCCs=,iv:eoA3bSR5kikLuIzvzcBs3zNCOK3k7WHRA7wQfaCMNNk=,tag:zO9gtmect4SgvdpbqjXvVQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"timezone": ""
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:J5Zma3X4K0mqtcuCwwbi4mTtJQ0l7auPfV4xsIZhqlP0yBM6luKQ1ffkeQQ+Ha6zSIn3D/JguNNG4vX6uPpdyEScNJuPGjHG+rZoP6qLIC9KmN69,iv:619PVjQkVXxNQfHLdWWKV/Ncdx7z9sIsuQ9+yezEl64=,tag:3+2N8NnQ0JoK6HxqglJ7Uw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:ES/juWSdQywxZUgnGRw+EMGxtGKm26H1Aq6MokD4ct3e10BtQYedqVrV6A==,iv:r7hsR4SYkLCZq1T+bjopR32wq5NcZQx7Z0TVHsLFWps=,tag:KNSqFBaKtWBDE4r5TYB4bw==,type:str]",
"ENC[AES256_GCM,data:xRCIks8+5Vog4p9sswTXtw1/PxpFhBB9GGQMH0Yy4w==,iv:uOvfQDh/xvyuTE5qLigB0p3qDkwcochKG/M5ZLy9SjU=,tag:v3J/jKyUIJd9QORfpDkUWg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:1oAo8dIbCw==,iv:Yj1/EH+GARPIiJAvzjesBSxZSoz4R12SmsocamoIl48=,tag:v1Rima66/SLob0yViUYiXA==,type:str]",
"type": "ENC[AES256_GCM,data:dvP+PSjPB4dP/JfbRCw=,iv:bo+vxG5KiTSdVy7OED48uMS5ku6c1I7xSrSIVrWfKdU=,tag:8vUKkh6N30J9LL9T0QKimg==,type:str]",
"name": "ENC[AES256_GCM,data:awMBGJLbLA==,iv:iRIdZNYdmwaZRM/1h9fni/Qgsa3YUyq0KCcAltvbO3M=,tag:tTcdgz/AGqkaQWecHVvnig==,type:str]",
"provider": "ENC[AES256_GCM,data:yeJjuptQ98WscPJSOc7Qp+1AHnpHQhWMhSo4zc7p39NSgtELu+yvVFrwueWZWXW/22yczmqN,iv:RpdsXlqzYkuCGgpXvqm/dLo1RwvJWb7JsiCBPE7Aq9Y=,tag:bKsZDY2l50lyKQwmakjsZw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Uw==,iv:XCul0jsH8kIwNcFyfjh4MuGU3Wc0fuM0xBW0ckoMFK4=,tag:dI677o6EctK6u9hmP8TSsQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:sZedf1KNFktfnei+niM4jZJ7kX779iyQzCynFQQ=,iv:+nL73QPnY5VWGTD7mRk67ACGFmju1MumjdW2hgTQsZE=,tag:iXpFdn5As54PBkjlRSZESw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": null,
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Rg==,iv:slEEWsabizQin6sxuAvpVaSeJ/r7qmdOKVIW2i8c9tc=,tag:nWM0fhm04lRGOI569xXZNw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:AE9P+7QiOjUCT9t5dzsZ5h3l,iv:jJLsFo1ZMn0UsqwcGoRzLckr7UZ6X+VzmxwDCKvGWX8=,tag:NWREKXVRN6/IBNDLwq2JDg==,type:str]",
"namespace": "ENC[AES256_GCM,data:wSNxfVezLg6ANA==,iv:BFU/0c+8jG5nUWg0HwfDPxlpvKKgVck+G9mFWYELAzo=,tag:3dqzivHfDHPQrToYMeB3jg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:rw==,iv:gQLwJyNm4ovWXxiegJB6WeKOVJUVd3afNB1ZHFrCWgY=,tag:TTr5SGvXZYrUL42S8X3RHA==,type:float]",
"backoff_limit": "ENC[AES256_GCM,data:zg==,iv:vjjx52NZcAKZ6ZJUe95FBVl5IofR61y3Bbhd4Pcjmrc=,tag:HAPvXdFjG2qRK86ZbhNzIw==,type:float]",
"backoff_limit_per_index": "ENC[AES256_GCM,data:6w==,iv:MriD52wtwBMK6p75M7LO1NHgE+bKb+BspANsaelHedo=,tag:+BX0Eg71n4OsmdN4KZb3Dg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"completion_mode": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"completions": "ENC[AES256_GCM,data:PQ==,iv:VH9UOFTh5OaO0W5YtZfNgmsYKb8BkHBWv5xuRG1KNjo=,tag:eiPo6/YMejcwr0oLcnC7Yg==,type:float]",
"manual_selector": "ENC[AES256_GCM,data:8ZeHFMc=,iv:/bsvZKarREX4CzzObKoksRy/bWfhKmiwJpNG8QHoPzQ=,tag:WqZLSkt4XiMmgwc6XIgAHA==,type:bool]",
"max_failed_indexes": "ENC[AES256_GCM,data:wQ==,iv:6r0TUjdBkr8udyYRDPTtp1jZcPzdBjg5TMNmkjgjAzs=,tag:xLbNkESs5pL5ntvtijNMgg==,type:float]",
"parallelism": "ENC[AES256_GCM,data:qg==,iv:dRmpy1ZTnwUtVphEtg0a19ZxqmPWPRiVPoPpFWTXrNs=,tag:8vbqG3P6Q8D+GlbCzmimGA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pod_failure_policy": [],
"selector": [],
"template": [
{
"metadata": [
{
"annotations": null,
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:wg==,iv:lNJ4T3zyzn1YumFcX+J0ALpr9XDau9kwAumgi1n6qNQ=,tag:O3x3WHGastOteRD1sWjYUg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": null,
"name": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:CA==,iv:TYZJovUUIKNqSjzHBTFIWjLA93UGRPMS+DIZMv4BZdk=,tag:6kqKj53xkGX+LpylHoKNZg==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"affinity": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:v+OiKQ==,iv:9l/qmUK3+i8UUL4IIIU4g4sgUmjkyi+4t94D4naTYYQ=,tag:JYAr6M8u5QJWxRzrrkS0vQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"container": [
{
"args": null,
"command": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:fHU=,iv:5XFv5ycUCaZdNCguQ2aG6ILpG0CEO7lGmzWJGN7OkfE=,tag:AfP0lQR3gC5iooOYkhkcqA==,type:str]",
"ENC[AES256_GCM,data:YoI=,iv:nWPmVzj8GQ+t9FCBjkfS2XTXxW1g+e641nawlTefJu8=,tag:cp20530jIvec6X1714NJ4A==,type:str]",
"ENC[AES256_GCM,data:3FC9Luv2kEWds5KFFcClTFYjDWJ2E6Dm5TskhoGkKymIplj+AI1kq4rK7Pd9uOddm3g6se++/VT9ajKMAf3TaSLUVVAz7YrbUP9VlpBHVGWuTy0e7SpyIz3iJxVTtON/qbloBLBeD2OLxHymNO+s+ZUvN4gAb39Ow/nhz/7BoRd7VGXX05wPkfp+LA795jYUBFYmu706Od068xtQ/3GCiBFaolvnSTcPk0DlCtQgW4ruKBeQW6dcJyRgBU8y2NPBNXp0UwpMI6z4hL2jQS3/0mlSYvJeGaXeMr5ohCC216t5HYgoDmh+bGXYbxxBQTiVnxpTgf15QHBqDYH+vaqPU5c5TeLRlBi5jyv8ISpsBD2lkCkMh/QN08/mbdmm3kD/e7Ii/9xtfyRtKnDuTUUoeImr2NiV4eDsOwtEqF1z8Y7+EHHtN7bGD5xe+muB7x6+XOacU01mdGHuT0ZPlM8p6H7p38IAzRIowmuyJz5G3JLdlIpQF2hhecFKemXAWTOib3cXb3fL0/U679XLbLTS4gl3elbkxSan1kQ7LDGmqm1659lx32i2g9+qDgkO8TV/N5T/jQYmTm4qDWUeCedOzhbTjSpWC7L6LRaEp/MzdBXVWMar0hs3tzmDNMu201YLof4OS2+sZWqMMTDP6wGQnwaHj/fvf4vEjqMkhnpPUDu4HSh5HHxrnBd7A2bFrvlJ/mUX5NpFJ9FD0uL1J/dqxmLibpSSj/aWjkLX84PR6+AzqMq5x+9rhcqfu9Jr/hQvYsBM/5CrSsEUuW6RzNRvej0ir4XY7R+ySTZZP6AaBg6GL2fwoaVFhhYH7tfppzdrFQCU4/pNGovZELqxh5FdKCecGkmBgnowWt6Ntlhmo44n18oVAk2mE37eBd2+IoNfSMM+K3iYxDK3RhDGeQG4ATNeyv1Fo6fVhdvJVQWJuMc5lVcCrvuVa8wqf0+J1e8FN7k/ML640XA16cPkdwVnBRVqYyQ5K+W/kgI=,iv:A62v6WJ/CwSxhzFxtJhSPGL+tKSLEv0dm6qF+R5OCo0=,tag:Hopys26HkDTxKkAW5i1Vtg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"env": [],
"env_from": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"image": "ENC[AES256_GCM,data:qH2ysEPSBB9T54JDsbsMTGCf,iv:UVEyCBtoK4QsqeEV0wa0b5w3QbfHN3foeo9wtIIBv2Y=,tag:uNYbbj5Z3JnU7+fx2bn18g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"image_pull_policy": "",
"lifecycle": [],
"liveness_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:cv/fc/6Q+Q==,iv:SgKl3edkD1UhP0yYHOczPSuAiFjDhfSfvhY6tSA0rvI=,tag:209/PVff0b7dcQHZedSGHQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [],
"readiness_probe": [],
"resources": [],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"stdin": "ENC[AES256_GCM,data:u7Sm3zU=,iv:4x8HqGjKPV3AuglZHB9bVlCeY0yDFMjjbXmYbsmNsIw=,tag:KW/jZeNdguL3G2jkdVNEuA==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:TTxdnKQ=,iv:s+hZERz52ZwGd31WqLaiw1mtzewEjjZ4mp4YkR0tdjE=,tag:zOihOdY6bXbZLiZbWFwAwg==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:56Too0POE0iCACSFLiHJm/AYn2g=,iv:dh4h+34Re2vM3dCLpN+aI2LRNaX6UYqoIHir/7Kwnhk=,tag:EndFAWk+noFCqN+gxOPBgg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"termination_message_policy": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tty": "ENC[AES256_GCM,data:bbx4BKA=,iv:kk39XiUWSlHtBHDWYz3UZDTMUvp549XgbpuAtN7zopA=,tag:BWP3ThCjjbLJNWxy+30dFQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_device": [],
"volume_mount": [],
"working_dir": ""
}
],
"dns_config": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"dns_policy": "ENC[AES256_GCM,data:X0JvqAX8CYOH1Jf+,iv:lXxHUiXXiBOyLBUD5CtPnBHEOsgZqpAESrR5BpC4XEI=,tag:YdMiMZEAlwqEowrM5A4IqA==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:KHLfXQ==,iv:A4QQtriVNfCXE2KuDnFKcTJo3WAm0dWiLnMwti2rM9U=,tag:z13FRru0J7LFE0oomQyjWw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"host_aliases": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host_ipc": "ENC[AES256_GCM,data:Q9TyYCE=,iv:gILSDUCSkAzpAoRooTK5LBHNV3rFca2ffPeuyoVWefM=,tag:ZC6RuhH64PRJDS8lWWxlmw==,type:bool]",
"host_network": "ENC[AES256_GCM,data:nGzb24g=,iv:9oMWT7MnrgKAPzx0pxfIQSCMiV5i0MzH5ov0MJOJp/I=,tag:iRpfFOa5u30AtPsp/lj14w==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:0hFRAeU=,iv:OthhUyuZ6hCWck4UC1j950r9Y2+fbnKmLdU5jG9mLE0=,tag:ewgHRrORoEE/x8t2vyvCxw==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": null,
"os": [],
"priority_class_name": "",
"readiness_gate": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"restart_policy": "ENC[AES256_GCM,data:1M1Y1+0=,iv:1iKYXrtiG4k34DTZQrQOofgWMj0G6zFIe67Rio4US1k=,tag:Q7YEqRX0/PR/mu4Xt+EQjg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"runtime_class_name": "",
"scheduler_name": "",
"security_context": [],
"service_account_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:rFL/JYo=,iv:JCKrQrEz7V5gik2bvJAfN6K4M+s0JhG0YO2qkhyek/c=,tag:DqHxjoRdRrCCX0Y9C65JJQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"subdomain": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:e7o=,iv:JQ3KMAFwe43CIY32KOMA+60cCopiZSQ8HBilQjId5Ak=,tag:Izu787coRzeRVxO1HbfVow==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": []
}
]
}
],
"ttl_seconds_after_finished": ""
}
],
"timeouts": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"create": "ENC[AES256_GCM,data:jlg=,iv:OL1IweFvMYv6d5w+oUZ7amNaa0NjfL2jBYPDWTMXjjA=,tag:WT/6G3nM+KsC8i4YjzWH5Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"delete": null,
"update": null
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_completion": "ENC[AES256_GCM,data:ODMd1A==,iv:3vX0o0NzS+Iw34ELkWMiW6TEIn2xSilyZLZTpJLzIo0=,tag:UivQEym4r7Pya1LSZOR+VQ==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:VZtgSDbzyg4=,iv:IJ5HEdDEvl49VEsrTTebqSfOV4/cW7o0gdSq74mF79c=,tag:/FoYB/6hm6zX2blK4yG2ew==,type:str]",
"value": "ENC[AES256_GCM,data:jXlefw==,iv:FNNOe5MRUCrAwCuVZBvVVQ+yo8ZtFXdsV0pF22/UTis=,tag:xfTxWePu4bMcIpi0vY3aOQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:QJW0Duo=,iv:3ditJY089wm0fuXOwHV279q+HOvXAnfCFNUbEHA9Cq8=,tag:6wI5Ii9bgw02DoAvRnC3uA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:cQ==,iv:A6WlQOA4pxfNIkmKkldNNvq+6MESz+WhT+vLqKTmd1o=,tag:a8jilSmSWglkUBJhPF4SUg==,type:float]",
"type": "ENC[AES256_GCM,data:jHF5+piw,iv:Bj30sbCUfRC+lruDl9F89fLTpED1G06IvDtnrMfjbFU=,tag:zPj2U7Z7VR3cCpf1aPQnow==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:6zeJ9yhFA/s=,iv:G4NgPVect6jTvoaK+JptoAXLadP8awv5Hl8ikaSfhXs=,tag:w7UUTO5amCvyvu37c7fAOA==,type:str]",
"value": "ENC[AES256_GCM,data:Wr6fYBy9zJU=,iv:IX/pgKdh2lhKMFm+BZ8JLJOrjRLhJZhK3lnbzqnCllQ=,tag:gfY7ABpHZCKxwuyRoa0wbA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:EAPXB0s=,iv:uwVJJGWvCO0Od4Ngm358/Kuxv+hYuVLonVQJp0OMI3g=,tag:SDF3n01uvRu8SCtGcxkf6w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:uQ==,iv:0CnOwQrpL7PQ3Jja8+NIo7bxOa3kppEr9RMLj36EK68=,tag:CJfAQXR3K7OPh+3Mzypztg==,type:float]",
"type": "ENC[AES256_GCM,data:ANIG1H9X,iv:fBNmo3IOOhHVyrmzK6VEWEkGhaxTRjxYielBDSaTr/c=,tag:7Q7/nO5iCAXLwwKO6QBtYQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:zAmYcercAoU=,iv:m8iMfTlUYdjdjNGaJFTbOT858WeyNddHrbS2jK+N490=,tag:wf2DiVn8YLGUqYvD+GhPZg==,type:str]",
"value": "ENC[AES256_GCM,data:ESEkJw==,iv:o0Wb4F1zKJsOrd0fOZnf5ae5guu/C/8h0kfrXwSDSeY=,tag:EBh+FiSwCaofF+pmaBpprQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:GA+Yg7A=,iv:DMP6tL+f0bq+o+Y41UuOlHRPEXri+S50sO1LSzKTEKE=,tag:Rbw/8noZMEalghgQpAQJww==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:gA==,iv:kp/j/3D3gz3z1N/rgLzEVjJqXANwE5dmlEpoJO4dI08=,tag:7VnDOOm881ImfQrE3N7jRg==,type:float]",
"type": "ENC[AES256_GCM,data:bGV2M5+K,iv:7Vq+75oY5z19rk36BeEWaJ9LkDvLw55O128fXVOYTRM=,tag:iPFE9PTh1ycm2Cbw+hJTaA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:Mzzk6Hjb+gg=,iv:TQgvL3ck/9bJqlGgLE+ZmPGDPYPKm8h2JQa6xL6hDAw=,tag:RUFc6vMEvqu75eNscnqFNw==,type:str]",
"value": "ENC[AES256_GCM,data:9CcwNdg48OM+,iv:w8HF4YSURX722ENpytc8K+UkVPtfBoga0mFEk5KHptw=,tag:VyTuMgFiVCkI6ijZHs7Y5Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:Y/Il3Ks=,iv:YO5SGv5sy2qVRyrrmGKfPmAdhaLe8TfC/t8AQtleivE=,tag:MXMZjqW3j0qX9R5sEYYg2A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:PA==,iv:LiF80TXt9MgvujSIb5s7ZZ6NfApuR5qTvf5qJcqiRnc=,tag:KxCR5bj1VYFb9FRnqRxDIg==,type:float]",
"type": "ENC[AES256_GCM,data:lTmke2Sc,iv:1GvY2THDyglAkKDy0ENEb0eYsAZQVwbp3QUQI2IJ10s=,tag:/I01EG8R13TiH9UZjSnsDQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:n9BIJ35OB6A=,iv:PJkKO4P0zcihMpPzp2m38A59xuk71Pc0obt71KUn/Gg=,tag:7Fo7cP5Fk1r9XJce+j1RqA==,type:str]",
"value": "ENC[AES256_GCM,data:q6RXD3vgtQ==,iv:y3iGCbgew9gofabqhJHmh/BtG5JA5BehhL9Ty9tXo+Y=,tag:GjPWlPSY8bczgsRK8MaFdw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:hzz0tAY=,iv:o7w7Hwo97iAga8dsD4THCpDQsMhqPpankYt1bThxlm8=,tag:KuQ2XvclYi+QWjOzZYi5pw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:5Q==,iv:pykNE2xKAKleqQ4OcHfbIJYvXJWMvRYRVxfhbM/EaUs=,tag:TRygcVrzTJ7n6YI6Ky33Cw==,type:float]",
"type": "ENC[AES256_GCM,data:0nHUsRV0,iv:LPtVfHIjdYn+/7zIOMqZ1TX9ajCAKVAJpBTYWcErkDA=,tag:hoo4cwtWW5uFRmpATfGMnQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:b58LB4gy/Bd49IEqInhOeSd/D7DsJ4lzBID2IfS+r8PXH9YBaZB22IKewzPweEXm+Fft4BpjgzYnFjfL3PVr+oWd1ESibws9kW1bLON1TucYlxIM7LD+/V1L7S6Jz+PKdaQmkw206bSoMNi/1twgrGYbCtMLCelhvHvU9M6shTw/EkqX7vi4LWBpuYbe/ec/RB0XdgoBt8Dtqa4nVC6XdgqB2UAOGQYLwrCotA==,iv:XBnUNLW8c0Z/KFCRMQSMegZkz+qhRvP0tnF9zrnmS10=,tag:jYzu83wP8bnvvtnHaoJRrA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:FfdE6oY94dAyK/R3zkOPCs7aVaghRqXSbtKVRo6E0A==,iv:rLyVqsPTbvg1GHjdlOq/EmZRQF62rUSrJq08EKELDTU=,tag:2YBi84PR5IQAAyAC/+N0AQ==,type:str]",
"ENC[AES256_GCM,data:BrRbZ/J2jaBNlyr/NY1P/jiPasBDGARtsSguyXOP0g==,iv:vxhbfaIv/tIbw3ekkiCI9nuNL4djnUsdiyfFFf8GjOs=,tag:06dwvjiNu9JaxFJUCO8bmg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:hcMNbYJqxA==,iv:fYRt8Zt49L0fR9Oc0q9UWibQ6UDxUZyIFY9SOOvxn6Y=,tag:1GTULbukrml6ea9eg4FdFA==,type:str]",
"type": "ENC[AES256_GCM,data:sw4/jlPyEUpXjIwy6blDCzJYcw==,iv:k0ko5FNVTxID7r+YKyvhgbKWuQbx0I1upPpM9zyS7Fo=,tag:o+7DAmuQzQYjVHEef49Cpw==,type:str]",
"name": "ENC[AES256_GCM,data:5uHnpSKFzOh/nWoIFsoHX/vz,iv:dek9AhoTESMOUtg9GDvMGXFucjiIxogMK0FjTzSs3m0=,tag:6fVcB29lXCJuD0ZG17wBmA==,type:str]",
"provider": "ENC[AES256_GCM,data:r7lpwLr12NFENTCbBsxm6liRWmT1zx1twR0o/3cXj/OaTzj9OPCoLvd7DEB8/R++9fCwy/yP,iv:jA/8Z0/bX2s/a7fps5WPY/HDf2znTyKdGYoJ4z4VM2s=,tag:XXMgumLh14cN3Z7cAcffzw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:cg==,iv:CU8hXlGvBKG65LiLanyjiW3i5JjUcXcys8ryHvUFGEA=,tag:B5H7cc+tH+0QALOga0thnA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"computed_fields": null,
"field_manager": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"force_conflicts": "ENC[AES256_GCM,data:/PtsWg==,iv:6wDJTOWpvQ7klHBuaUtRhlQzu8XmLNjBhE0LAdKV0cA=,tag:Gji4WSL6M/jed5Jzo8uPoQ==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": null
}
],
"manifest": {
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:KRhC0INeRa0+XcdcjQ2FeO23e06DOaD8BAZJ,iv:RLeBxGfpt9HJzCgG1i7+/xlLfHUjcvWuEiBmzDXDNDc=,tag:nFzGJXMDW2ISthajjv7PAg==,type:str]",
"kind": "ENC[AES256_GCM,data:vfV6WQmc5NRY7yX1z4M=,iv:ym1nr8UEHBfVTcNjRtEDnYph8vWvjWNbytofhCz9mrY=,tag:NQuIZ2c6DsMlFvZ3MqU7Rg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:1USbe9sI7zLwzQm8/VBES8yXqw==,iv:28UIGDHztbTtxmTLvA1xihxPynoypdbvqhDkc/EXwl0=,tag:HgTe8egz+YmW1w3EbS8yaA==,type:str]",
"namespace": "ENC[AES256_GCM,data:gJIB5G2bCJHYTg==,iv:nRruOOR8Pg399t2YBbsCb5O6Sz0QX4Ke65+z+zgJICs=,tag:NZtxzp4lISOUQ2cfDbwvQw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"spec": {
"data": [
{
"remoteRef": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:UfNqzhnSD/lRxeha+GaBdTWWdzhaVx4LRsI=,iv:F7Twbk3usa9XBO+iBHQKPvwbow/EWVKBw0eeWPEq8qE=,tag:03FwJACr7DrUkdFnOC6duA==,type:str]",
"property": "ENC[AES256_GCM,data:JvAx2E1S7/g=,iv:RqH4xXSNjuQBvnyxMGb8IWUniGW89bvjSNGoehMWpWI=,tag:RPki1HsRFC4ku9ZoWsq+XA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secretKey": "ENC[AES256_GCM,data:01oGUYy0EE8=,iv:QYaPOqi3wXyvtfHqdzg6X6wBqOPAn3f9z6lY05SGKM4=,tag:LuP3HDa/TMVUQO/kX7FOpQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:xDPs,iv:Ee5VyRL8nI4Zs30nuGHdzwPkGUEcDmO1reC7wnFPtmw=,tag:usALnWHE8RTZThhbCHzRCg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:x0XLeR9jENwtdltV8o/ixEf6,iv:b2KI7W7xaAaSyDpT7R4yB7b73/seozrkJhGEdqSnndI=,tag:kRthmimRMqdjV9j9xV/OHQ==,type:str]",
"name": "ENC[AES256_GCM,data:wrUHIWwPHZSRBay9p8g=,iv:UoZiUeKae0aWAOW5ZEgHKgBy7Sif6CNJHaT8CKw6iGE=,tag:Lq+GatnuKjz2kgHhw5jYjg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"target": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:kMSGzVQjqLKASH8u9UYqqnGl0g==,iv:oeUiwQOhJbw3SPTMNPWIuGBN9v0Qv4KPZNbbSm12W7Q=,tag:zxP1Ll/EKbIomllHxxr+3w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": {
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"WOODPECKER_DATABASE_DATASOURCE": "ENC[AES256_GCM,data:/sZhs7bScg+TYcdp0X7/0Z+Jy9085eq/ZtL1GJfwprB33HVa7AEeoIxldSRfDc+hR/2TmiHPWzZN9Gigd2aEqfUBNGaqkQKTegqFIjKsTrz48IGv9KmmAThRx1DGCVib9A3tgK/vDnA=,iv:97SxxPXb+GtRLuIoAZu5SwjMLzfmM7okRozJrxXsSeI=,tag:vI3hEhItVcPyvr1tgYhGRQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
}
}
},
"type": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:f5/u5MMw,iv:BroGbCN3VCuiZiwVI4MnA8rfxq4rPxXvW8KAKbbtlDg=,tag:VPzez6AwuTON/YdKGA3K+A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:IzDwqsj9,iv:4AQASj+g8Hb1k4DKWis/Ep7fuPZhFYVVZhu8gj/YJ1E=,tag:wvUWghqdKslBSxPRbK0d8g==,type:str]",
"kind": "ENC[AES256_GCM,data:acO+Li2/,iv:/yc3vvZpxlvUHfjzJ/icSEEbH839lwb17vsFjEK+QVM=,tag:v2EkHTh/6L1LpPwVetzZoQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:CAP7JtKE,iv:biECe/vTyH38X+qKWzgKDf/pTb+4/Y4g3Mgxk8EDMUE=,tag:wDxM3yk/f6Z8rUWD+vbpGQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:1+Hwkjw+,iv:2O/iXqwuPtjgbOdkhk8/bRnbnXB+byab49qbvikfv1Y=,tag:BLCWrj7A4GmeYP2ZPHkNwA==,type:str]",
"namespace": "ENC[AES256_GCM,data:Zc01V7BQ,iv:Vzjo7c1B1fy15YBZVhaY8VcgPqI94vwjB8tl+E+YBY0=,tag:JbaOfzBHLcOvR65TVcNZdw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:JtNk5uWx,iv:SXZeuu8zyujanKSpHn8GRMG6pvOaKaqIdeEtOztDZLk=,tag:QHCgV6qCMaXv0fiDllj2WQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:6x7iEDU=,iv:gIaMcnN7jvssRtYDSShj3STKGQqYe0BSQJfjxjPIZIg=,tag:1FHrgWQjkCCcmjKHg790Ow==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:26qn23Mh,iv:RdmmJyEyrXf/nxE/UZkzNb2PCjjcp6U/VI7KRR8lK+8=,tag:axXBnWU+kgtcn6zrezec/g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"remoteRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:eKMB0AD0,iv:9fVGOlpbFgr6PVmEo7uBDeq74c1XFF9u3ZPS61SWVHU=,tag:jaC4mexIXtygyl37cjRGPg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:MUOwPgPq,iv:1PYDbv1gkFpYCY269d+l6trSasJrWblOs6rVv0PFd5w=,tag:4neJ1Do4PSqd/U96lFQTuw==,type:str]",
"property": "ENC[AES256_GCM,data:lBlVzm69,iv:hUjL+v3sQMDRUfU7O9YdlFT6i3GTIJk11lq6SvIsr9o=,tag:BIHNwAVQk2uxNyGEyhiXsg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secretKey": "ENC[AES256_GCM,data:R8T77w7f,iv:S0hpqYIv3uw8d/IhMcjTnEyL7tYo1O2mNfMzoN1TE0U=,tag:3zCo9qRDVmTmcHrJ6UX16w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:2xdbmEqa,iv:oXexTWvb/IWZBIuziIScLCKZCuqKIF/ZkN6yEy93mjw=,tag:YmFiJh6hkZkiuKQ7NK0xRQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:IYyyNCrj,iv:mOVabl3l6hPuSSdZe5p+QUU3M7Sv6a8hPIu8tdQZA8A=,tag:JaZpnwf9HNur74YPONxugw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:ymCTr76k,iv:7xTHLlwMasdgyWyB8G2cjTTTH30HBD8HMplchKeaMAo=,tag:Ujt1rUadw4VRSpiNXRQd0A==,type:str]",
"name": "ENC[AES256_GCM,data:GwIHsokp,iv:7Y2bZ1D6qFH7iqPnj5yv2RRC+OMFZMKySFY3Au2JKw0=,tag:TfT1OtxkZ2rJK8398bC9XQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"target": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:GBI2oWcr,iv:Tk8TVo1Ce4byLfDeDGX4yfCTIHjHS7I4H96XVfLIayM=,tag:c1SSTCwfbBcSA6Idhkw9Ng==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:lyhFfV32,iv:0Ylpr7cYyzF9tnXNdp1tiE/ygVEmf5g4afKcH+uo3fo=,tag:a6jDRllID6GEWoLGKI30uw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:4oE09Q7j,iv:/Um7LVEdhG/iT4wMhteG0i0FMh3ZPH574NZMJ+i8Ivk=,tag:uaM1CFOARCpSEuD5Wzz/Ew==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:K7FJ+4BG,iv:DQIiLGTIIItbI5Vo1lQjJS0tGRr9p8tTmXoqa9wRMws=,tag:UI4j8huzuBB+smnUkgiskQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"WOODPECKER_DATABASE_DATASOURCE": "ENC[AES256_GCM,data:t3bpDyBy,iv:dwSojX5fspRfkkCDbdDZtvsEMUciLJXVymnt/ZJ/55k=,tag:pX7E6Vf+RWsAtI2AGKR9AA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
}
]
}
]
},
"object": {
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:feRT1pXqxEGaBRhrErBIthjrrFNy7XLOGJjK,iv:hKaHm3oXmOyWh6n1Ir/j8XqZjF3RVcRN7xdrmUAhHQU=,tag:qqVR6ThL6FjI9Fgu5XJiug==,type:str]",
"kind": "ENC[AES256_GCM,data:j7cmf6ng5lQCDHnPqLY=,iv:rM3AkvU/ZPhmrsiMSBO/ZRttY5c/P5eeR2WIpe+/4P0=,tag:bqtAAmIT/IrWKQA7lf1lLg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"force-sync": "ENC[AES256_GCM,data:ufc6UlvEH7SvHw==,iv:Ram6Lty8VuMyRxQi+g9M+HeCJW9TGNTmTSJVH21EVCI=,tag:ngmhwdlQ4rBto1fJH9VqIQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"creationTimestamp": null,
"deletionGracePeriodSeconds": null,
"deletionTimestamp": null,
"finalizers": null,
"generateName": null,
"generation": null,
"labels": null,
"managedFields": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:LWCcboRyO6fYwCBjugFZgqW1FQ==,iv:o6b+l55giknmk++rPygEZBxQsvG/uSWgjgL7zmqoeMY=,tag:8icBH8qHBn9QgNbVZ4Uxvg==,type:str]",
"namespace": "ENC[AES256_GCM,data:Z7K+iDz/XJRxMA==,iv:Hz5aonmiC5wRetxwwgijC+/Qr6mtI56o1XGo8KocGds=,tag:50Ae+3zLaqjGjzcakmfbmA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": null,
"resourceVersion": null,
"selfLink": null,
"uid": null
},
"spec": {
"data": [
{
"remoteRef": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:F03RBn+uEQ==,iv:FHLZTqE0C9ziYlbL5yPtX1J7/EjdeIXSmZDWQlrc4rk=,tag:DROJkaUTh2ACNrBbNyTq4A==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:gUqNDQ==,iv:ny9LFdRIA9I/T9AsbW0zH91QX+QR7im91FBeMD32E74=,tag:VgzY0ufTZk+hmrGbM7jVoQ==,type:str]",
"key": "ENC[AES256_GCM,data:VnOVZCs8VeOfLS8vHaT/2/7C00nkZ3RGQtA=,iv:UiuB7wx5AymUPF0Td2kozWWDo4exTUiYSTmfF0qO0eE=,tag:MjeepyuI5szcOWOkmbN18A==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:ECkyQA==,iv:9j9ApOyZ40wFFOTrrK5FErrA4hTGK9eHeMc9TjBrgvU=,tag:/3GYBrieQ3rEO9dlnyN68w==,type:str]",
"property": "ENC[AES256_GCM,data:+MIIhBbS2fo=,iv:AtJEkshm0957XCUscTx73t6sz3vegn66a8P/wSw9E4k=,tag:G2rkqSSsm/OHPHtSpiFljg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"version": null
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secretKey": "ENC[AES256_GCM,data:nsgyKBZzUdU=,iv:wJuvoJTMB5EmVhXAHOiEYFZcWRsbhktMPGErKtMwmBY=,tag:737Y5gflrPA7o8LueeKfAg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceRef": {
"generatorRef": {
"apiVersion": null,
"kind": null,
"name": null
},
"storeRef": {
"kind": null,
"name": null
}
}
}
],
"dataFrom": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:ojt6,iv:K+BZ+gPDOnpBgaRR7dME3R6+G0VtsCyh29cARU/0PVE=,tag:KM8nW9Bq9GTgNYq5az0q+w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:xqh3l0UZK70a/IkeKBUn78pi,iv:hiVK+fTlNOOAMDL2B7lSYJ90NCtrGEpQa+3E7aQt4bo=,tag:yNi9JJ4Mj8FiSDA1/z4xVA==,type:str]",
"name": "ENC[AES256_GCM,data:Ze+KWi/4BLHa9eKknWY=,iv:QDXQckANXUyO84+e7NTrSXtjCM58sli8zJ9EfnEc8F4=,tag:AOAC3wTTfTy5lU/1+fZTmA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"target": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"creationPolicy": "ENC[AES256_GCM,data:NNLiGiY=,iv:H0s7Mg8S6/d7AIyEreuNFS1kMfn+tci7vd4/C7u6KfU=,tag:Lplo1AhS5wfBCsSwF1GVTA==,type:str]",
"deletionPolicy": "ENC[AES256_GCM,data:LK4T2yc5,iv:Rhj0p4YGtbvxq0MGvzU5wlTblchWOCMrZk9NrYKkrCk=,tag:i8bl38YlG4HPiUFsIHvUDQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"immutable": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:87e0aULoF5u1/MPaMiogP0IpLQ==,iv:iY4asLNkk5kUMkuACGdmDx/TxSovkiuzKs/GhrvyKcc=,tag:Wbav4hlkOzNcMq3VPIItsA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": {
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"WOODPECKER_DATABASE_DATASOURCE": "ENC[AES256_GCM,data:TeGJEy/EiYUOHSws5KGRhebvAIBc0DW707w67gHZGZuHrWcSNYyVYGoI2Hpr2+pYW0gevuYiBhIUQ3mWh4T1na2XDsAF89ijOWRmk4t2KAM45bVIvjd9BODU+8D7DorjIjkl70+iCeA=,iv:AaR9kLhq+4gj0tF/Wp15AxNvnGTbhcddO1RLyvKtxJA=,tag:FIK+yyoKaAOHJewRVUi1YA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"engineVersion": "ENC[AES256_GCM,data:Fu0=,iv:dZ8nWQUMnouwYkVgZyI4BwqIb5KvneLYCvizZ5auuec=,tag:P4h2Kgga2LP+peTnpNisMQ==,type:str]",
"mergePolicy": "ENC[AES256_GCM,data:iyTpWD+4hw==,iv:lzuv32oAMRKMAOOyKVLOkOGSPm364GGbRhZEnoC6oXE=,tag:T9ETEx+lCx/OO4i+hO+TLA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
"annotations": null,
"labels": null
},
"templateFrom": null,
"type": null
}
}
}
},
"type": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:75nVE0E6,iv:6/g0X25HbQOvp5FlxWPIOCACKIrHFur5WQ2fagKnakw=,tag:QIZTr5+Tlr/nhPbwuvNFfw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:hAvmPqxM,iv:IYcHXBuZP10QarnMSty6f5VDpmyTvAFo+LiIEJGjI/8=,tag:XEXrYBMUSPJqbyRB0lyz6A==,type:str]",
"kind": "ENC[AES256_GCM,data:eyCM6KRI,iv:yvrGwa/gsqbcy10QnN0GXQv04LBFreUW26bFK/WPb44=,tag:+h2G0IAD1l7gNiQki0xDHg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:PH1Y0Go9,iv:4Zur4HG6vVN9z9KLQTTgy7KdWJyqcfMULuKEt6GD6gc=,tag:DS1e12i/1Fw+IxCD7owaLg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:fVAq,iv:R0MpLMDfRVmc8VTKb6FGu5/PAOOEO/he70nWmzGb4Fo=,tag:ayssWsc5fJN6U1rTsoAY3A==,type:str]",
"ENC[AES256_GCM,data:cv1PswbA,iv:jqAk/1d5z9Z/Y8eRFbZmnafwH9Ct82/X6ww8u/XzS4M=,tag:RHHYHi4oaxReCsmGg59iRw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"creationTimestamp": "ENC[AES256_GCM,data:E6eMHnF3,iv:6WeJrxckYKTdPSrnKu3RWPtsFdTilK43Q6mhe8F3ARA=,tag:YyzvEfiREf7VwK06IN1zpA==,type:str]",
"deletionGracePeriodSeconds": "ENC[AES256_GCM,data:QEL9BoaH,iv:T9uDBrR2xi5EzzLLOCZDcAjWN8/HJNcmC9nUMlbiRSE=,tag:3j7vGLCTEk3qLstGwm8kIg==,type:str]",
"deletionTimestamp": "ENC[AES256_GCM,data:PsN3nh/X,iv:5B9/BrImMLHPckoH2st4QuijkbmsE4R0PVK7cVFdOp4=,tag:YQFtma5sTs+BKnoaRIeJtw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"finalizers": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:T0z8cw==,iv:nJRFhPUqJT6lCXQSHJcLXT5C2MViTLT30EynddD4H7Y=,tag:TahDG7D7CT5rx2ET/XIDFA==,type:str]",
"ENC[AES256_GCM,data:oA+XZRX9,iv:BGtg1Fu5W/BG+YhkqLovEh5ep1JFK6izDu/6cjDnwsg=,tag:RQGSgbKE/IRlrc0iPw6/IQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generateName": "ENC[AES256_GCM,data:J7neKpBp,iv:yCj+saGa4PE1MHe3GLbyOhFLOWATgKH1icf1HF9OEDY=,tag:Cu4X9hKsgstAUdgmHtAIlQ==,type:str]",
"generation": "ENC[AES256_GCM,data:OTeUMURg,iv:QKxx8wtQB23gQki2ygxOLND/ZXUCW5eijJZU1tckj6w=,tag:h0OZ3kkQ0q8wFuhc4aSFmA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:DRng,iv:w+z2JyEiGIXtIPLEvJ6Q4uGOsPfObbZjcKWhn+xiSyw=,tag:RZjRarVTKCTXExkIu/7W1w==,type:str]",
"ENC[AES256_GCM,data:QSLX8Iux,iv:77hNuV8AyE0mdRsWp6Z/I1seasLJuEmI8r+kruzREtA=,tag:Mmo9R8jMD2CgxQwGaBZmQg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"managedFields": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:tstqt+o=,iv:R9GsBObmMbm80p0mrTkcf3OYKDWLykeGC3MnlxMAQ1I=,tag:ac3uTK8SgXBHKI3I8T1viQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:pJrGF8vL,iv:zbom7VswqzjgPFmkf/X3St2EadcDj9DOQTwfwy5J1SA=,tag:DftQOobzH0VioB8OYTpiWQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:j/0GWrgN,iv:e6N2NI1Y2dA6bOrV5vFLETa+HuVHP0PK/hcmRGU1LW8=,tag:41SWqCsG2bhp8JnY7HCfvg==,type:str]",
"fieldsType": "ENC[AES256_GCM,data:iNZ5SAg9,iv:48bLxekuvxBoo/pyMldqf27V3mNoL8OG1K2z/XECXNk=,tag:yHRe1n3ABdZbXrltJMdNzA==,type:str]",
"fieldsV1": "ENC[AES256_GCM,data:BJgYwblSuQ==,iv:vXFf/KsqiD2CCH5hy6RwhRUEGNlUADzC9bpsmCJwU04=,tag:fmLIBI0r8tMfvy3YNYkavg==,type:str]",
"manager": "ENC[AES256_GCM,data:CMSRZw21,iv:n1l7u5o1cApEhdF7RPZJxmxiO8coyGGAUjdH2KOsv4w=,tag:ODKna2LjqgJ8y02eC1PaJA==,type:str]",
"operation": "ENC[AES256_GCM,data:KlX/SmSS,iv:BnAocd+X6cnttDiIT4ecz+zf6P0LBIvzXf44kWHbWCU=,tag:ib1xcp4TFtD/g6urvgm6EQ==,type:str]",
"subresource": "ENC[AES256_GCM,data:kk6GBYfN,iv:544yKA9hMOsIaogwBdocHP7DZ/84540QZEc3B9le24I=,tag:yJI/zUCb+0o4UOeCsNPFVw==,type:str]",
"time": "ENC[AES256_GCM,data:ZNJ/4EJt,iv:7nykJIvwBlPiNrQ3wmuWvlcC11Z5F9fltwjZfm4X7QU=,tag:vYptWvACDoQPXIYIF9EtCg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:R73nTS0l,iv:LY25a9nzpUyfGiIym35mcOR1i3mtGO5kFYwpuij0b78=,tag:jfRdq/iOUoAYTzPyy2N2Gg==,type:str]",
"namespace": "ENC[AES256_GCM,data:/kCvAiIb,iv:p0yyJv6kE76Zi2y47d4Tt3gXFjegmQDKJLmMOyoQ0Jw=,tag:TLCqdNghPd5p65AbZVIzVA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:LuvCMw==,iv:rhygPDDksBVCEXh5Og22lRuo9Serr8xD5dodskTepNw=,tag:5ZizJTaTrPuZIefJ9TW9ZQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:uz9auypY,iv:+YybzPVCw3pAii+97XNCghNIkxK4+b/59pbuSNQ/Oso=,tag:vjQtsF3IZtarIdjakCrWnA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:QE2h6bP/,iv:vK16OvItizeEja4R6EBKKlzrbrVNtkvGlQ5rMY3O/dU=,tag:ijn1qL9ICtqJc66UKGF/IA==,type:str]",
"blockOwnerDeletion": "ENC[AES256_GCM,data:x/nnYg==,iv:E7WVyxpgrwsLmUFFUchd9yEVzLnXkq1l7CPUrlvGMiY=,tag:tRviDqq43CQBJ0O2OVRQ5Q==,type:str]",
"controller": "ENC[AES256_GCM,data:gXrbBw==,iv:u2cVbRA3NSAZACrZh/Lyf31EGWmOwqmdxqAIIvgPOxI=,tag:eq5tORCtysGV280aRhFfYg==,type:str]",
"kind": "ENC[AES256_GCM,data:Tz7sUVy1,iv:8fU/Vzq0xHVcWTHKVqdcv8JRgSWNQD6EKksm6iOyFP0=,tag:KfcnwEfKV3mzJr+Da7bGqg==,type:str]",
"name": "ENC[AES256_GCM,data:NXQ2FNYg,iv:ref0XmeoVz63VmWqRC/h9L+p6wjwBJhUfQpbpP5T5Ag=,tag:qnJObcA1DgRo+BdaiPpzdw==,type:str]",
"uid": "ENC[AES256_GCM,data:3LoEZ97H,iv:Ea5XF8B1aSIRqNZOYXI8KPumG68xyYTXUGsVqsrPFpA=,tag:CABaxpPZU+c0nJpmrt3aXw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"resourceVersion": "ENC[AES256_GCM,data:TM4Z90Y4,iv:EqTbqssxi9dMgUojl+2I3Ud+UaXMtxMlHP9WsURJB2M=,tag:mQqpLZdVtuvKBqf9ptGkQg==,type:str]",
"selfLink": "ENC[AES256_GCM,data:OOTdlAO4,iv:wEGw4iZa8Flh7n95pRODLV/JuwUorPV0JFO3FYTV9CM=,tag:xwyRAH8fLWkkpUhTZst11Q==,type:str]",
"uid": "ENC[AES256_GCM,data:9cEKJxnm,iv:3hdRDaINVQw9ye30FW5TCdn86WKZG7xIYCkY2DYIbCA=,tag:6N7w0hWlqGL64SKLuzwjrg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:qqmkxxnt,iv:uBAru5oT3FUpcjqA6YHDjo1rMJUNSVZViKLXfiQhUfk=,tag:+CYntGbyen3qjwkMdl0gQg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:lRy/pQ==,iv:AlR4d0Wvk7bOjVTnyeejfp4fPkqjRy8v8aZMtNr0g8Y=,tag:QyA9kh4gnbwkUPzeFIVHMQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:DtZnx9BA,iv:ldDS23Ea0B8xhK2zV2H4vUKDjbPKAvv+8n3qNV0871U=,tag:gv/a0fTeu43m2AKlWRCplQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"remoteRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:owJL98uP,iv:GYrP5CxDd9X3uFSdFb+JfWEkSP0JZhH2BMT+/NOcsms=,tag:yZJtd972EwN+y4kOj3J+uw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:iLslvrMa,iv:ypJ44O24DBcVAtZ5tsJIP8gAu8CyB8ufZKEoZ524KSc=,tag:8mxvPs/o6nh7m+MOEToWZQ==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:JW2pGofU,iv:gW9AhqVrO+vKyf0K/Fmsq447eiLkX1daI42CcAslMno=,tag:6odAVoFAKFM66jzVu6quvA==,type:str]",
"key": "ENC[AES256_GCM,data:9Q7aVwaa,iv:TJ2iy/nXcSGeX7kf+qfKb8oiIgWerfShPdnZdAr8jls=,tag:AV1JWv1H85oSIWusW244Eg==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:INpaKqyj,iv:D6WJH8BacGEo/B/7H8A3Nz/nWUYaWxTbZCfQXZHiK6s=,tag:O/DITMrYkVZ3Yc4fl73IHQ==,type:str]",
"property": "ENC[AES256_GCM,data:HRHBS7cW,iv:UBVMkWaRyQJ9VMu6KGw7XTzyvkD7JWON0WMd4nEA8LA=,tag:DZPmJY7WM8/q12q7Ug+Fdw==,type:str]",
"version": "ENC[AES256_GCM,data:p+B4Wjja,iv:HrV9Ug6EB9CLyMKpFtZIP7i4M9ICGb3lOiE647LXIVQ=,tag:0iQDevLviYfIYQWAEvMC4g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secretKey": "ENC[AES256_GCM,data:zLJTJrqe,iv:t7vuCDU6Amm0rKipc/PeqPEIt7YFKz7Gi/T71Kh3Bx4=,tag:3vsPfZQ9s2lLe9RygQvR0w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:uI+XjVEG,iv:wriVJulzjAJeCUKNX1jXZX4NDbKrJhsczPE3ouJT7FA=,tag:TgMzyyJEdOvPhLRjzIspQA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"generatorRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:l9sAS/8N,iv:E/n9/FX9VI8joYedBFyX61dkOj8d00Rcf5Zq6a0TcVw=,tag:yCNuOl3rcYJPLzZft9tg6w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:cnmukRcf,iv:aD031juR0QTWNmvC4v3+8uPcvmiYCsWEXvReY7eOlpI=,tag:i6x7JEOtUAx2o8HQF8z28g==,type:str]",
"kind": "ENC[AES256_GCM,data:iraPwm7O,iv:QESDV1osfwLSoKIbok7FEfr4LIdGTrpJRjZeuTc+fP0=,tag:mHv5LYUUCA4TUoNi6+PNGQ==,type:str]",
"name": "ENC[AES256_GCM,data:DDjqrEjS,iv:6qbcZzxvo0bfLmNfOugfDwC33Y3BX/oKuigPg/ORyJo=,tag:AG4s0OR+V8iX9XvxMYPZWA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"storeRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:JrqyQUMt,iv:NNI+vSs+ylVsSZTnh78YDNue/Pn/iWDXBO6wPlBXy/w=,tag:LTSxrlFIBEzyaxUTnY4ypw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:r4qeSucw,iv:CSxpnlDdmGysdTt3+FGtLI9+i2BgNG8fTrBWN1fGOlo=,tag:Sk/cZEGXiKZVrojtreUj+w==,type:str]",
"name": "ENC[AES256_GCM,data:5FOBfBE3,iv:pCaPxoPs9IO45NC7lKdLH+bES81XKni/UcQcnXOIsGY=,tag:SUpBXhM2dCTnpcO0IEGMPg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
],
"dataFrom": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:BlqZCA==,iv:tdXuu3XUpwvoh2p8aHHJCLLTWgJ9B+perq0FQ6rUKck=,tag:IjVXBQSSHveRUslu0+TOsA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:XrvQN3/f,iv:S/f267QE9RuPqknX6j1IvEwtYnPN+Cmo8nT0G0FOCQ8=,tag:sTpOsq82VSjB3m7oG30clA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"extract": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:fPuhIjeg,iv:RNI6pplSGr9LichNvF3RYEF22sI842GtXQdoAt1YfT0=,tag:CUvKWxGRO5vsXcAi8TNQUA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:tw4hPfSe,iv:47WSp3SjmLjP5zedf847AifAFvDllvNGumWmeRzPO34=,tag:5KQsarPspEWO+d4oRbFihA==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:BpoMkFw0,iv:P+rCFGXD/t94n06kKB/XaHHylZJf5CKzpFFnu1epYTw=,tag:oO7zYjusO5QtDogmGnyPqQ==,type:str]",
"key": "ENC[AES256_GCM,data:OJ0m/ban,iv:3sTnFqJ4Djqw2ya5ibsbO/0+GdJuh2RabQ/3/EVpivE=,tag:KZQ3/3PoQSdDflmF+A9PWA==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:DMT8j/Kw,iv:E99YS7rSk1jAqYaKBPf79PEDHDUWtsC1shXLatxLSPM=,tag:eQfR/9n2fcNFXNlqY0lEhg==,type:str]",
"property": "ENC[AES256_GCM,data:9lDPJHWu,iv:xuyu1sDVHDewTrxxCHp4TVHlb25athUAxmjM5m2VdWM=,tag:yBMsQxQAmfa3mz0HlaUZyQ==,type:str]",
"version": "ENC[AES256_GCM,data:8pw462NR,iv:z7C8/m+kmr4B0kxQd1wLE5sUofCNyxPAU281ScfArW0=,tag:hlOrqeXUDsdHn2yXxJUsUg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"find": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:GzKA+syF,iv:uqSGdHthhIA3aoFBACBVJLAxiSriJ50vBv/d6M0HZCw=,tag:MK8av5R4PMpGok4GQ4C/2A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:SDI+NMzP,iv:h+VEsGmywiIKQctGy8qFcXnIWpwrc9FPXZ+LW7W0Cfg=,tag:0ekb5n5DROYSo6O36HwIjQ==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:Cm4Mz7EI,iv:EGL6N+/L8Zz2zokhQlgoRna6AF6hxulXoGTkGPd3GAA=,tag:ZaKqqq+FieFB5uBtjWAvKw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:y6SsmsHh,iv:7AbBipzHM+EzTBNbLs9sTaBnsvmH1rnjsd9OfctMaHo=,tag:pzIUd8ubjDmrcOfgbwcqpw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"regexp": "ENC[AES256_GCM,data:i/rzRQFc,iv:OOlIHIaTM7p4iujD2+vYjV/r80g8GZF/vNRF6s+zrTY=,tag:6rXiKYSnUETU7cRl1/9sOA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:T3UG5v/Q,iv:mCP+SUs4HJz+aX0E1bOZ4s2LAdT1IN60ZvXgrF36n04=,tag:urnIzfKSrWQTa9DBRYcS1Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tags": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:YdRq,iv:LNER9Tf+BVdfuLbSoFZWHGRcZ6qpRaKd7uNcggnb7dI=,tag:qbyomTkJd7phRmgLiBMf5g==,type:str]",
"ENC[AES256_GCM,data:OLGkhSvL,iv:XDN1nyy7LZV5OqoBYBHPzRkLwYNM+XqZ4zO5Rhyd6UA=,tag:1LvzP7OHG+XYM8an3PCoAQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"rewrite": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:NvEvRw==,iv:J+Iw80Ec3ebT66CRbesnaFCFyoocwov90FOcN0zk8h8=,tag:AOmTromqDr4rpzoWlh8L7Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:I5dhsj3D,iv:TYdlyfFpbtIef8mAWwjj+EEt/TGqv4hApp4MnR7dyUo=,tag:tIi2N052HM0wE5OKc6Enyg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"regexp": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:oJs8Lcmv,iv:3V0WneaYafSnyTICl4tFMG1//tq1d3zdbqxSjLeV9t4=,tag:yjMRK+cpvJsnIYziridJrw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"source": "ENC[AES256_GCM,data:s5LnBxiZ,iv:xTdx2YiWzmyvCW988vDn15JaQfEREtcguZcMWKtACJ8=,tag:qBJlPxlStwinfzFTMipdwA==,type:str]",
"target": "ENC[AES256_GCM,data:FQ6n1IuI,iv:I2jVZLPdnmTm+NHz30SApn+RUNiTSBH8hWD7JAxmbqM=,tag:TtdO0Fv3Yj4wOmJ5NnC3gQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"transform": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:bnpiykJc,iv:pX4ZiQGhQhDDZuIQyF0Shkda3WReUZEStd5mk0R2Y7E=,tag:xV/ixnbhXr+dS5ydaNkbDg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"template": "ENC[AES256_GCM,data:zWQveB6Z,iv:Zc1AUgMZguYmsQOJrdNjYL7RDaJ0FAuuVORalCH4/Co=,tag:g3gSy2pcXTxQNsTF8ebTwQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
],
"sourceRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:scRgNhl6,iv:9DwMKe5AmDmfV6WK1Ga5X6vuILRDzF2L6d9gsEtmeXs=,tag:ci2IHQIdXQWxD1FrcKmicQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"generatorRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Nednpwds,iv:NWUkl3H2175mqBOgoWaEG0VnmXdqI8IpVikEQcO942Y=,tag:FLkw8YlaOYyrVSd6Chqc/A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:ScRs93GI,iv:F3aqP3gTkPaX8wG/nvUXkRnsocvUEfvhTayGO7lp+oQ=,tag:27HhJFNAaXJAkgScEiF0fg==,type:str]",
"kind": "ENC[AES256_GCM,data:/4KqF7Nw,iv:OHTbCwzrjiiBGEcRjAclITY0/pzqg6+LFElJwHbDh68=,tag:s8y8nKFKPU8NRF7rTqKdsQ==,type:str]",
"name": "ENC[AES256_GCM,data:wN7jrKwK,iv:H71LJq+qfvPQBdxiMrmIATH4FM0/lVTnDN2mp+qiuXk=,tag:YbMIZtt35nmjmH5EQeRHsg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"storeRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:AxqKs5sC,iv:Yad9JhgH1o7Mu5wAOYpZaK8//F8kj991JZnPNHzeuvI=,tag:cG0oWppIF3CTocUb2VNq1g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:YOwB0I79,iv:PUqQe2tJFfNHIqPOjVbtgNneN7WkdKGJZ/U7N45XNJo=,tag:dZ5dd9EodMitIjpB7WlIAw==,type:str]",
"name": "ENC[AES256_GCM,data:GhLSTOdK,iv:mx0AN1Z+ArCGNHoO95it1zB1ZwN4iPWU5BRl5sEuDN8=,tag:HvW8dOkL5OvnS++epuLe8Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:2IT0sTnv,iv:LMIai3jo0B/QVGa48LnR8EZip/Jmykz+uNHwtkLOPwU=,tag:fG6iyLIZAj2EC5tJXMuXYg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:NHp7whoA,iv:3Ww23TUPqnZNm/1cx8iCRbSwW21jnaRfQKuCzgBsm08=,tag:T8LMTw37+g2ZepHhN+wgqQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:oFWbm5Uq,iv:5ZzT+QlGsGMy24Vd6xHJhFFuA/XluEpUC2BcEAx7IWQ=,tag:uh/KQ0ACUF+bn7HL1fyy2w==,type:str]",
"name": "ENC[AES256_GCM,data:hojYFhge,iv:e3AVIFj0mthi6H/hCP7dhGo3GQT8a4mn5riJtxuEgRg=,tag:OHCVC/XDSlTypC0/wDkJBA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"target": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:LuSlSLDt,iv:W3xTuC+roQ1mHbdNHUDMDxVVHmEjT4lRrONOVsStEiM=,tag:FbBfEf8cYWPvSNw5wFuHMA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"creationPolicy": "ENC[AES256_GCM,data:w6X7a7t9,iv:UYQb22ZTgqkL5j2tNC1+ACcuD4sJlijEJLINvcfTBSY=,tag:n0s9Jtg9Ds6bILJF2yMDeQ==,type:str]",
"deletionPolicy": "ENC[AES256_GCM,data:D/ypMBvN,iv:ElieHGT+e8HZc9vjRwGdMmk5kRkWZJXd4W2oml9lICw=,tag:UbNkKvHqIz5wwQdFPKF2HQ==,type:str]",
"immutable": "ENC[AES256_GCM,data:y+DZUA==,iv:j+G0KesCusc49la2qPw2/1yXg/LemaZIrU51bA0Fk2Q=,tag:8WG6o1cP4gEPaPxSxdNzyA==,type:str]",
"name": "ENC[AES256_GCM,data:ymol0jQO,iv:cb9Sl3l2bPldhyUDgyPr/Fq0ivN5g4SaP4+2plyPB8s=,tag:/Svhz4dPQG6jrlmHVfz09Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:1Vfrc83H,iv:SqST2BXUtYyNaMtuq3RAV9hGOp+k+Xm5X+/YrstKH7w=,tag:INoKqSq1vRhEIRJJDkOBww==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:xTF8,iv:7vLVhi7o4zX7YBv+EO8UbeHjaqMjzayHoJCtwU7ZzFQ=,tag:HzgYhXAS0DyNdFl3PQhZ9g==,type:str]",
"ENC[AES256_GCM,data:99S4rBj+,iv:S3NreEf9oiEGNzOs2M88AT7wyNUv5ONHk9yKu234V1o=,tag:NXfHypLmWh3hapG7viVARw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"engineVersion": "ENC[AES256_GCM,data:LgbRu6Xn,iv:Rr2BrdnMV+e1oq9oi4AtXiNblMjKDu4qGYEbwlaQLzc=,tag:6UiLFLTjLgIzydgmRD1nag==,type:str]",
"mergePolicy": "ENC[AES256_GCM,data:+moOAiRu,iv:gUnMGRssfC0phBPUi48prc+L4zzifQcDfk+8F8fhHqE=,tag:NHXVyZPJX5nn3zM4ql/u4g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:P//sLTDk,iv:jsqkaWACApYHAUEQKkMnBzOtWdyfUgbpeTtPE83L+kU=,tag:rgTbvC5KBB6CrpAjHt1URA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:tW04,iv:Thl0O1in8K7Ja2uM04YDxLn7YP9M7w6hU5pF31w4qHk=,tag:3RPm8s2Lo8GxKA8CpreFzA==,type:str]",
"ENC[AES256_GCM,data:Kh11zN93,iv:5a/jCmzL+tzddMcGA1zW7xr8SKPYAD0Q6EKBRltr7K8=,tag:VjXhZscDEbw33t15ReT53Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"labels": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:14sB,iv:HHyq+O83DcHobfTiOuaWN1oXs/X33QZNioMgQ5JactY=,tag:LSbnKwAkKv+K3IRvaqWKvQ==,type:str]",
"ENC[AES256_GCM,data:5Js+WxQJ,iv:qCslRcPBv2wfG7WdGj9FR3NNEemhqIVZ5SAeLJ+47So=,tag:gH6lRuCg3rirKMfgFZmGgw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"templateFrom": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:1GCavA==,iv:iigHEMxQvcrzTxknQfq+5gxZd9MED/QkjFRk7w+r5Po=,tag:LcOU+1Dy9uH787f7lEZ5tQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:sFXxlB2c,iv:tqpSGsRPLLtUieaDUCnCCjyJgyad6rIOAqwxfJklAYI=,tag:/TftY00m3PMutDFyWEh8lg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"configMap": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:PykFmON4,iv:yhOpofsE95a6/6kgMcIsAU4AEaUNqagm6DQqhy6BZPA=,tag:9t6hSCf+zn7AfjsLjJy87w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"items": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:wpYtOw==,iv:SG1WykC2mUklfTn1HMLorxA7ZqtKDeprJLFmTb/j9GE=,tag:+OAETtDb6EmXsy9G5g/S8g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:sThXCMRO,iv:t+qgq00nPb564DOP/N/tdWkvdvRu9ERPmbe1ZOUuLI0=,tag:uX9kEzN2UYVIZ6gLbSnwnA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:igJPt1Ag,iv:jVF6+6Ap9a0YH7xXtCA06zfLrwt9BHINGcPldI118I0=,tag:akvEqHE51mCTP9/gk7XgZQ==,type:str]",
"templateAs": "ENC[AES256_GCM,data:FUTfjwjO,iv:diHIyZoh8JUpA4ejGvafieIgG8Yd/mdE1DA1RzeaA5o=,tag:gf/vz9EtTDerwIZGXoDplw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:veAsrt8q,iv:vKDRUqXLDhHyZ03LC0HgSeiKABZtdzOaU6uq0C2dytM=,tag:slzBUPGfowdqYWbBFk/ZaQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"literal": "ENC[AES256_GCM,data:KRV6LS7t,iv:kI/KKL3s8bVza5v43jiwDPaI4MzpDsF2hChiLZ18WQQ=,tag:gwt246H6QBQyvNDxKJzGsg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secret": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:y1FZs+zq,iv:yJmihImqmYDllQXAmw+kzYSvfvGwwzhhhahe4K6u38c=,tag:GA6Jw4B9SUuDcLUOzOoWmw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"items": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:8ECIRg==,iv:LNYXxRTDIZkidXCtlJF7/MWq+ZbACBQ6x4Hy5g0rUJ0=,tag:qMJbx+ExV8SvVwr2ZNckGg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:0JZByRev,iv:X4HWxlExMh3hgk7o1A9VKZZkwBEstsPwmDSWxlWzMd8=,tag:SRBqopsQu/vTKNwfa03Hug==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:ncCOYtjy,iv:d3nZHhOwJc4D25BF6koLC1r1enpLRh9hpBzgxPYVC98=,tag:2+rtZ6hGKNALQhcrYlj0Rg==,type:str]",
"templateAs": "ENC[AES256_GCM,data:PQi4xDi2,iv:N2xVhArJPG/fNzNcvvYCB75pTqCtBjE8A2t8pk/NZgc=,tag:IW36ekfsPY6O5O3neyMQqA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:aTwnz68a,iv:t0SH9lfsshZQXOmCkOWQk724yBUpU0yI0F7TjvVpKHQ=,tag:e4K6E6BKXpJ7FPKQ7RaKAw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"target": "ENC[AES256_GCM,data:36vHAmDM,iv:ZuGn7IKEBGN3n3EBkP5rAtbCStObb/pZpAc8d691Eps=,tag:4TyN2Q4rwZ2xv/EkehxBWw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:fBJCEQW5,iv:wPnbaiJD6SxY1l2/HrHnFnUbJ1sa7do9q2gkEY3Po0o=,tag:36xECBt6QMvOWTs//+j20g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
}
]
},
"timeouts": [],
"wait": [],
"wait_for": null
},
"sensitive_attributes": [],
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:U61/9w+8xCS+BD6AEqb5XkJbslaxkGJvoKbUzbacZw==,iv:qBVnfJIRibqz1/5btoHroxGAc9Yvrc93aKr2ipOP85Q=,tag:tfH1ms8dYuET+AwF5pHaRA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:5z+qLkXU5Q==,iv:wHxgD6rxdkngYWCXyTC5KjSHxWE0NoO7FtLuUSdWTMQ=,tag:DFr93k4VAWmCWnhe2T+PgQ==,type:str]",
"type": "ENC[AES256_GCM,data:bmSOvxrX1qir2wPslOQRngZZGg==,iv:mMWDfEuLeBYwAct3G3YGJGRWqvqcKsm8iPG/DKDzfVM=,tag:UH17iy93fa0MOq2Xl8HmJA==,type:str]",
"name": "ENC[AES256_GCM,data:pvSPvj+i1hU6Sd7yK+h2,iv:IaLVpDblpDpZ/zwuVgaRc8J0UJ6zc6JWA9pI4vAF3eU=,tag:BKOQTi4h9km8bnkBeTdAXg==,type:str]",
"provider": "ENC[AES256_GCM,data:D2ag+8TJcaVOv5E2qQuElTw4kOYoDxeHRpviv3oq18HAMe0w82S376KBSz6YiJ9ETejPk5Ho,iv:yMuHQHTDPv4ycHGdV+e+izjpt+tsGKrWgmskJaXB0r8=,tag:L7ZABn4JwMr64K3HWnC4GA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:/Q==,iv:BCYWvfMk4W6kN5mDy0P2sXXaSwsLd80rFA/uST8ExU8=,tag:hObIfbQy9U4xbEX8sjRGdA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"computed_fields": null,
"field_manager": [],
"manifest": {
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:IZkGXcTeRB5meVQn0e+vFAHujlzgJpYX01wk,iv:4GaPvxYzckld5W9Z4xPyjDb5V+eML9mrykQ1T5f+Z/U=,tag:9XeC9mqHxNYQQw2AX62X0Q==,type:str]",
"kind": "ENC[AES256_GCM,data:X17uj4M4IbJN/RFM48U=,iv:c+YH+PLyUgaFGoZ+tq1/VSQc10c5yspSXBUBzjPNDxU=,tag:CHMwdZqmU6GFUbVY6oDaWQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:mGrWWF+ljAQRzWLLcvYvGIcG,iv:UU2V4qkriNVlbIg8MQwlu79PVtUNIhelJ/dtiICk+N4=,tag:S3EGSPfSncdSco4MqUSksw==,type:str]",
"namespace": "ENC[AES256_GCM,data:ZYu2SeERhJtXYg==,iv:Eh8WAWUAXqgg6tzdyc/Ek6YAKGx2lRCpSESYfQrCKn0=,tag:wYZ7jhAp5fldqckHsVGS0A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"spec": {
"dataFrom": [
{
"extract": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:S4a2dYAioypX6Q==,iv:fKf7QERCfXLOieIkeZ/bbKbBmwa5zWN8cDpWjL9j09w=,tag:pxiZAMPo0MuR0ArzoHJi5g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:Zgnh,iv:/3ClbjpbXb9p+GA3LX8AijH6LAaW66vBWCOFnpV2IjY=,tag:VXUd6Te4IE/Ezd/jPvrLgw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:PQZfqTZdbP5rGqNCMSOGTq/b,iv:3RZ3svILfGdIYbtBEDs75IjF7aVHvt6mJ06xcXdYAzc=,tag:YhJiBYjlIOqsHfycfoSNxg==,type:str]",
"name": "ENC[AES256_GCM,data:BQLUxr7STDY=,iv:rI1w9i9NwqhmBJeNDrJsY5u6eOk34vUoQrLqgLFu1zQ=,tag:AcSj9VDa14xG3zDIzI5JiQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"target": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:vFsdLPwvIFPi/TL4E0I8+S0S,iv:NATuZfd2BZ8ilH9hgOYxYUL0v4qfPuLdhH5msB/kw7s=,tag:2u6puRSY+6LwYydeYYteMw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
}
},
"type": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:ZC2fuMoZ,iv:ckfeEpTSfytWwO63qPM2Lv7Gvmb6SGN4wYAGAlSIf04=,tag:o/F8j+oj3C/6QNrRO0OqPg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:lTBuXoG2,iv:WdUqPvR7Rrb8NMYzxw4pE1Pi+Vp3OQnMAw/1ID6CChM=,tag:VAOTE8HtZFP/ewZ1v5jdzQ==,type:str]",
"kind": "ENC[AES256_GCM,data:TRaNgei1,iv:xakpumvxsutNHdzTsXDpckLBG2rPGqh9Xw6eHoi6MbU=,tag:bSWHjs1rg2altpH6d4tRMg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:C6Kg+6xH,iv:p8XC7dr3RJl+8sWlajoVsKl2Ycbph+meo0u5mtlA/Xw=,tag:6q77EWBA7C1rZ9/xAnzXyQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:GxwS3/K+,iv:gMmn2+AGsONZM9nakASTTiR0YCs7r8h66ub3km0f3a8=,tag:wTF1KBdT8HSu3Xn7sjgYyA==,type:str]",
"namespace": "ENC[AES256_GCM,data:CequqTfC,iv:lhTiVGd4rbiODMVRV+0fvgE0QKP08WYZ9i9b8rZvcIA=,tag:xAvt/LjC92RwiomstWNf5Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:V0j7k8F3,iv:71GJlwsmTHbDclTs6sY0SLSPe5hj6mShuQSDPozeEfc=,tag:k3dJ8lDDxQala4CNOBexCA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"dataFrom": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:CHtXf4g=,iv:qAXtecbGOknJ6rq0l5lYskwSC47FCG1n2CTxJ69jGko=,tag:PRBBjrRryJgW5RTMtRw2Tw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:PIYF4+wI,iv:vQn8ElaDDO6IyGLoydLPLpr9LxLIhrxEOlh9XD1Z4gE=,tag:Lb6TePR27OdPCJ4t0vFJfA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"extract": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:0k8lf1zk,iv:cxPW3wD7xO2hyoDf0EX5bKJx7Wrv+K542jAX26zEsw0=,tag:ATHqI8RotEMYktjJ7Tgc+w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:KeYlRGU/,iv:8OSLe586d1ePDlJH4TSxhm7a3gynXnygzClhKau0HUE=,tag:2Kjqdysjj87SZ9xRqyzmWQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:Ag/Lw27l,iv:Hq1fSvxGGcqAHLuLSjP6O0c7I3p6ZibXMuRAOPW3acg=,tag:b1QLYItWZXscwvgqZYbLpw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:OR859ohw,iv:4gKjLYhPNi/q2nhHywx0Fr2v7Yu+/rgpqOyLOOAC8w8=,tag:n31X9jk38/igxcSLDb5FRA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:3+stEWxo,iv:Fy25Rk5bBo/kedC4gUkUWdbhy1BdvHKYDAHFce+LDJI=,tag:zrok2+0sf12oM5/Tv3Xo8Q==,type:str]",
"name": "ENC[AES256_GCM,data:qifAtebP,iv:+xeuTBRFPQVXzjAvfLBuR5Ptj6LEWpV3ptri4DCMz0U=,tag:A6JBMQRInBZP25LthGbeBg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"target": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Bb/5ccEb,iv:Q41uojVPL8FcbEnEZUUWdgsLS18KoFBeZl56XwmHK0M=,tag:5FDKXuO27PmExcq6mz7a3Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:npkyq639,iv:ewQr1QT3tQUKxytUyw8A3z2UXc5CLAPP5tYVg6cKvW8=,tag:KidHVPeLYL+xoLYs6OfP7w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
},
"object": {
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:I/qoFaUpkcbyB2MuhcQMEIUG9hhABE0cx8p8,iv:UwMtGq9NaLQfAv2IsO7pjKqxh3TVQ800riybImbFglI=,tag:8hUp1GkjwIcTPQA9FkyXlg==,type:str]",
"kind": "ENC[AES256_GCM,data:iQ/zCt+K7LN9gT9+6/o=,iv:x/vkDzwqv5YgCSFbVmpDPBPG9vHU+3LZq4Mq2FbEIPo=,tag:5usB5RxbLBuULoSQPTkuJg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": {
"annotations": null,
"creationTimestamp": null,
"deletionGracePeriodSeconds": null,
"deletionTimestamp": null,
"finalizers": null,
"generateName": null,
"generation": null,
"labels": null,
"managedFields": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:t/RLkedyJop9mjmNigIihRL3,iv:NiTHfpHhW0bshwU15GqN+PsGi10fH1ZvIrOCkClPQlA=,tag:iSW7Dds6bwc05+1cL2B96A==,type:str]",
"namespace": "ENC[AES256_GCM,data:CtkjuGZV+e/mNA==,iv:CPMzsG1+w9M8BI76Wt/kcnpREp6oc+esl++QSj1o4bQ=,tag:MLPwPqGXyh0MTzvxrcmoUA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": null,
"resourceVersion": null,
"selfLink": null,
"uid": null
},
"spec": {
"data": null,
"dataFrom": [
{
"extract": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:Bych8xObgg==,iv:YO96zhLgVQjagV9GoOHE8XUC093xCHu1064cQUU85GE=,tag:SYMney/ErTbbREcvkUR5Nw==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:XmlBDA==,iv:C/0AJeLayj5bafA+gTc5PnXF1T6ayCkTemHlvnhsVpw=,tag:92E34vToe6sKS0HnGTSSng==,type:str]",
"key": "ENC[AES256_GCM,data:sfLMHP7AdozvRw==,iv:NGUGIh+T9SQ+9YpFJVPmVWcmo79Ehub7zfE93XGzYm0=,tag:RFtvIuDmyd1V2GyKRxlhyw==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:N2D55w==,iv:JNEgh1iOD/hce2YhXIZLYnWyNtC4E9CH83P4yXvq3H0=,tag:lwsq8JIdJaWyt58Xp6TIIQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"property": null,
"version": null
},
"find": {
"conversionStrategy": null,
"decodingStrategy": null,
"name": {
"regexp": null
},
"path": null,
"tags": null
},
"rewrite": null,
"sourceRef": {
"generatorRef": {
"apiVersion": null,
"kind": null,
"name": null
},
"storeRef": {
"kind": null,
"name": null
}
}
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:w1jX,iv:+x6folNxFAr3ES0QTj2pEDcxYEgZOZSIjTFrw6h+pow=,tag:qcDQdJB4G6Eltta3YbFurg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:sb8JSkBWBjMtyWjsqZb3zmF0,iv:z2R1mvJWF1CJtm+Vy7Ia8zLx+GyIDg6kL1UC2nr1Vlo=,tag:9rDRuAeq/InMnyW9qCT0pQ==,type:str]",
"name": "ENC[AES256_GCM,data:ioVGlF6n8kE=,iv:9oxRldgf9MZb1/OxAZWJ/g4s7rCT3RrIovHcBgdqOAI=,tag:KakVMs/3acYzviGW+bG/tA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"target": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"creationPolicy": "ENC[AES256_GCM,data:zP0mrBE=,iv:q1Kaq7aJLoDzxfCDYcMnZyE/xQrx25roL1KiVHX+ykU=,tag:wAZmQ/OLTpILxAehN8tJpw==,type:str]",
"deletionPolicy": "ENC[AES256_GCM,data:LwJJAN/M,iv:vRVa617HWMPY5MEcGuCMTJydZrnepGcIniL6Oksmvwg=,tag:U0UotNe6ECOlNGPSmBTrOw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"immutable": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:DCI2AZt5M5p++VhS4LFVsEuL,iv:ju7B6XivFAF6ofAwm9LMJsAyU/tuxYIy/1pziPtKxaE=,tag:Cz7EtK9eKYP//heeWWLuhQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": {
"data": null,
"engineVersion": null,
"mergePolicy": null,
"metadata": {
"annotations": null,
"labels": null
},
"templateFrom": null,
"type": null
}
}
}
},
"type": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:g1Er+pg1,iv:tw0Y5xOzaYG5XYeyp57S+e3BFVitnuMURZbhEZTtpc4=,tag:jMguCo+rEVP/Q/lwRoVoAg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:cahrC9em,iv:tYpX+WgAsx2siYBgVus1CLG2FUwqH58bjIdOewG4SWk=,tag:yURlWAcsz0BRKizfOKRLAw==,type:str]",
"kind": "ENC[AES256_GCM,data:fLmDHsPX,iv:pjVQrOptR3d2LErLmh6KbS4Mf/PqAU7gyna8ugnU4MQ=,tag:OBfpP9Pbu7mPeWAmrDTANg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Bvh0YH7z,iv:D8m4abVU55ICkZCds322JF38PWbKtok8LjH+f0+Xl/E=,tag:LtJXyUdd7kQdGgGn3+lhig==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:zi2E,iv:A7xNf56gfmcFzhSV4d2ia1TyzVvsrix7ZO187bkSE9k=,tag:63dCGgnXIOPjDk5RQGpI6Q==,type:str]",
"ENC[AES256_GCM,data:kWU/pLJZ,iv:Ky3dMHg3hZHqpjLePPqOpKsRHgM3dZS/4O6oLlljTV8=,tag:91NbGhdRugeVXB0L36pKFg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"creationTimestamp": "ENC[AES256_GCM,data:N0tks0dI,iv:NaMccP+bkKkZ35bMTJnnNnib5j5+algwO8EkUZBJuv4=,tag:IaG4xlnYCFbDzOf9cqJz6Q==,type:str]",
"deletionGracePeriodSeconds": "ENC[AES256_GCM,data:K8RT9u0F,iv:qVnUVy36PNHA6SEiKpZamy5a+7YAfhl8jn6LGA2OTv8=,tag:yNTrnFOWaV2FUFPcZboCqQ==,type:str]",
"deletionTimestamp": "ENC[AES256_GCM,data:K0mQZ0YI,iv:TOn091KGwkpugDy8Sx4ICBsbc3SdgKHpfvX/PiSwlI4=,tag:835ja3r215BMzxmPR8ZZCg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"finalizers": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:TV+gfQ==,iv:1VTSm5S10bqV+86YtHDPUXW0QWA8brBbkMe7Gd6clFM=,tag:+PIzUtI+EO+UaOEcfb5npw==,type:str]",
"ENC[AES256_GCM,data:G0AZus9i,iv:hg4CikGNZxsNfZIVXVeBcdB+Ob7Mg3iop8kHpTdbfRM=,tag:ZSGQKGUnS9wWqz4mo7MjyQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generateName": "ENC[AES256_GCM,data:7wuPgnwV,iv:sf+U1HzRD0PVywo3aY6s7MbmrfR5TfIWhBQHwhCkWjg=,tag:EXoImouWyvjSb5XwfOEKUg==,type:str]",
"generation": "ENC[AES256_GCM,data:qW65oyTX,iv:lwI3uygvSRyY916wN8r41XkQaxDMrPV+upnNH76j2d8=,tag:qZLs32K9Ox3F4nRe/4UaLQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:cb36,iv:C0P4uYyLC0ffAo1TEHRxJb3+5M87SeYyWeKhQYoksFU=,tag:UUTvJ4B7E2WlhPHIlPBFYA==,type:str]",
"ENC[AES256_GCM,data:WRkpqEGb,iv:3KKZpHqmbspaKLuXVYL03XuCRGF4UDUQbX1c+kUq7l0=,tag:AqFjIDx0vvJTHTkc4CxZnA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"managedFields": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:JDK11tA=,iv:sPul+HLEDhziRP05fv0EXDbZAAXGBaH0hIhiSl3hN+A=,tag:XBA1Awk9qq8DcuK4+F77Mw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:AvWE+Gat,iv:gI7vQwIfEQoa7Fm0WHeILh+eyVHTJWbT5fyRSHskgWs=,tag:fY7Zu/AokgMTaLW1+VBBeQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:7zJJd5ZA,iv:ZLh4hFIOFoLFNQclaVd7N9jdMUgztKQq7d9+7Sv1Ino=,tag:svzWJb/+ILmGJ0i56dONiw==,type:str]",
"fieldsType": "ENC[AES256_GCM,data:rzPQEmEx,iv:7iwBpRocYr99IjiR/LiuSKM6ikXYAjhhqZoL9sUZj5Y=,tag:sM9esGf7mfEQHxxagHCZxA==,type:str]",
"fieldsV1": "ENC[AES256_GCM,data:cFOhaEh93w==,iv:3yC4wN72jiH12t2pIHFHGhE0USCc+OtAUqAMeAAZC28=,tag:A1tg8etlhM/y2WyxtwW+GQ==,type:str]",
"manager": "ENC[AES256_GCM,data:rQz9KITt,iv:EPqwqGdU0o5grUdT+2jj17aIeaepbtgfXwt0ejRPm4U=,tag:yo7JWJivH7a5hrANW/AN9A==,type:str]",
"operation": "ENC[AES256_GCM,data:iSDCxBMh,iv:GJK8txGEgAOu+gQLYdXi1RdVqJAnRxhhwYFUgzKaL+k=,tag:HSHd8b65p6JZjO8DZCFBJg==,type:str]",
"subresource": "ENC[AES256_GCM,data:dnzn6OlN,iv:mZzu1vnQ6MS1dmtxiEEp5nxCmd718dvJ/floQWkGS94=,tag:kSvMnP0VcDv0M8/E5qDh4w==,type:str]",
"time": "ENC[AES256_GCM,data:Qe3CfuWt,iv:/AY8waz4mvP22ZNDz/wYnSP9gK+qWVVRL/CP+r+1h0A=,tag:ZIhhdULKEhJ6sVr8ytuy6w==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:tYJe2hr4,iv:RvXDGsB9mF4pS9eDiTll6LgFaEGt0uVRZeBWRNDs9ao=,tag:A0l3YkqjQn90xkKs1l2uyw==,type:str]",
"namespace": "ENC[AES256_GCM,data:zBPiGA/v,iv:XJ929aP1ImalA3ziwCKqC0a5Sj4S+881rWbjHNTj7nQ=,tag:qvSJwQls2LDtDXsghKqYHQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"ownerReferences": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:GygAhw==,iv:zWjLy+yX8lmYAGe+2gtosJbm3S3lncRU+R2C4bkX7XI=,tag:nm1w3IN3EOsv54WmQCaO+Q==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:HWpbXsF/,iv:VYl20+dUZ5nX0ivhULMB/qZCmwUyauIQ/8BbcroDsQI=,tag:8DVnehKKU1vjF60UV8HX/g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:XgPs23va,iv:BNbeY+Zu6D3a5G1k5JMj/7w0N65+LKiVr/b9kyHfab0=,tag:C6oqBQJv95e+oPv9kPmIxQ==,type:str]",
"blockOwnerDeletion": "ENC[AES256_GCM,data:oVaN+Q==,iv:0+3gbgse6rdFdYryeSC7sMkowRvi87GlB+CZxtPDo2k=,tag:oiHbiMH0iGKDDdiCINQEfQ==,type:str]",
"controller": "ENC[AES256_GCM,data:sCcmMg==,iv:BzoTvBuefXPSS4feM038nHdgL1k9urPE/vQddIi4Vn8=,tag:5XvJLPvBXWScAwMuqc6AKw==,type:str]",
"kind": "ENC[AES256_GCM,data:Ol+A71dY,iv:U7MPUVwSTHt6lazWXaRs/TLI9d41eG0tbdK8xC9QfuY=,tag:omjSmCnDq6DAa6wuswgcxA==,type:str]",
"name": "ENC[AES256_GCM,data:6B5VviuC,iv:JNPJmLlBwQf/lRLUNT8eTUlh8NUob/IUeAsEvpoCKoU=,tag:GUaxHWoqTsptKH9nAba/pg==,type:str]",
"uid": "ENC[AES256_GCM,data:mPelZXTw,iv:NBBDhXMx/chB360px8ZHgmIMTfz/NV3gP/jmO6+xX6E=,tag:C9kS4xI+ZZ0ovsqva2mb9A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"resourceVersion": "ENC[AES256_GCM,data:NoFY32Sp,iv:fyA+DQAQJuIJZCSyncGA70Ll/q1Bu8q3ewGvC8/NLS0=,tag:BsEH5S2PcKoxFU2Z1NGH3A==,type:str]",
"selfLink": "ENC[AES256_GCM,data:EC/akk20,iv:iSSuaoRqQdeF40GvPbv+1ikm37KVllQXikiqTi8EuP8=,tag:mp29kvW0dVUBaWrM7xRN7g==,type:str]",
"uid": "ENC[AES256_GCM,data:OoUsfrC5,iv:Cqad54rDi08ate5tVytyYIzVdletYKtfESmOWaJc+20=,tag:dR0HbbYwu1VmFV7XmaQIRw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:uR9FB5wu,iv:xoTbKxApyspbkf8/BxNxCFU2NPRVfiEwwxvy2BEeAJQ=,tag:SqFh9lZ+Ix8CfULO6jQBeQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:ZkGpoA==,iv:E8SFW4aWWqyuPVbMxI57COp2yatbogVIgDuVlp3WxhU=,tag:8z4Lqbwm2G5jCXUV7grNaw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:q4kJkAS1,iv:dkirGvxTjpcKjFdsfXmbzaqTY28AOUDRRZ8eDQf5KQk=,tag:201j2gJdfF1IcG88VL99QQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"remoteRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Bbbsx/c2,iv:3ocTu5njqxeIj2MgDROq2aSYdo/nS08Mnv7VazDASjE=,tag:r5msavQHwEtZAQ7+szayIw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:sJnW+pi/,iv:GLlmru+oHgY/Gt0MrEKsToN3T0qYDCpG1EIO5JpSfqI=,tag:h4mManeHcKAvpINPY6F6lQ==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:qb5zVyLb,iv:8wufXHVEZLEx82D5mzyCrt25rljvkIA7pEnIeZUMmTk=,tag:pA+Vtjy9Bt1jXT7/VLnqmg==,type:str]",
"key": "ENC[AES256_GCM,data:18BhCuSx,iv:CbQDSJN/LDH6q4Z4ura7sfMy+S5DvUk6w77znwraYdo=,tag:hFWWqft4Obbrjx73RnL3CQ==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:3UYdroMY,iv:rdb+UgqhuEcvH7wfCq3x7m4eFX5vwmTRtjwYm7sh1Do=,tag:6nC8vsAmSpUtTZZZQuA/1w==,type:str]",
"property": "ENC[AES256_GCM,data:apDowk4j,iv:YLZYCBAQlPLnH/SjPAeZqmGnPmE2mbCp0U3mmWfYt3Q=,tag:ouTF3mrc5IbTl9wVrFc0Rg==,type:str]",
"version": "ENC[AES256_GCM,data:kN0cxML1,iv:GjCeC1xeNJvi0u+Xg621lsjieagmk92F0YkU59gW3BI=,tag:afxIT3Mcg6QhCH0PgBz1tw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secretKey": "ENC[AES256_GCM,data:EuQy0t+p,iv:aQReGp5/dw7ez+D/hfQJnO+1YDzF0I2r3lC+WOfrpq0=,tag:FY8TAN3Qmdy2rTAejEZK4A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"sourceRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:2fPAMVsg,iv:EIz8tsFib4put+AkYWdNWChbYlmGxyTcHDrtLJAsJP8=,tag:W+6OKxmDmrS2Vjrahk9AzA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"generatorRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Xyha5wk/,iv:p9C2lhESVlpKCZRuIEEzj6agUz/+a7Di8+GdlbieC+8=,tag:u6E8bX9mwHqPMuNkqn4YYQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:/UK+yGsN,iv:R9WrGIKcfM5tM9Gmv3Hlxnc8u/p90r8YVYXENrxD1mY=,tag:PNzJoVDu2vQ0KLvVOS41DA==,type:str]",
"kind": "ENC[AES256_GCM,data:NCeagyX+,iv:c1/xJMYu4dqFUPY0owSs3457VJ3k//qTi+ZT2vgUOPc=,tag:iMP3ORcRF74xbo/c/12cCA==,type:str]",
"name": "ENC[AES256_GCM,data:IEGkQP9z,iv:XMxC7omOi+zkNNys+LnwV1SGmNRayVOeQJ++VURPwDA=,tag:NDz0jKGutkK9Xx3mCiTVyQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"storeRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:LwIcfqGt,iv:m7H7VjyRwHPDnFQMyWlODKLjK587ZpVkXhrjtwgU67I=,tag:dLzi36TnuBq+buOtNapX6A==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:gRE/FU8A,iv:YU6jEXHlsqFrxgkZvTdcw4sO9KhxcQwk4wRic78KWEA=,tag:x69hZX7vCqs/03jV98VueA==,type:str]",
"name": "ENC[AES256_GCM,data:8bfT0M0w,iv:TCeh3MMDmouK8QVRQnIXaAw+6LCdOu2IUuCYokownqk=,tag:czFJLy+rncXvQa5lcGqPjQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
],
"dataFrom": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:VBa3eg==,iv:03aVj1GALtP0e/p1H/UFFCwxkbMooS/Jx1D3L4dcIug=,tag:9noWvI9mnSw8UBpyDG+TsQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:hGyi3nJP,iv:le9XdhNeLXTJCFgnGNsrkGCkdu8fx6buCay3C99qf9Q=,tag:wpNy03lnv1Wc8wRv5j2kRA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"extract": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:sb7Tiizr,iv:XfSsJ4h2gu8wROipFxwy0SPG9z+rfsLoE8w4esKaYbo=,tag:ozFdwuOQOrrC61Hgdvo1ag==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:qum1Mu+S,iv:LCDZG1aA40+aelRnzTmRwIVKLfIg+2xTvxVNHJ3IYYA=,tag:7Y9Ivwjv5Ccw22xUnKxBhw==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:dLnuPKvk,iv:ZEwqK43Rj8qUej/kaN/Nvy+zPtJjO/9f6CDjJLjCBqA=,tag:RUs2z2JkGEaEjcn6STbHaw==,type:str]",
"key": "ENC[AES256_GCM,data:zRwkXECv,iv:a4TEqS1jxF+ApEZbuFNVYASpGxZv3o3qla1Uy5e61Lg=,tag:q3R/Z6RvNhe1X8HmjnqPeQ==,type:str]",
"metadataPolicy": "ENC[AES256_GCM,data:5nPsolSg,iv:vyb6hcgoV2Pmfz3xgxjLps6wJhnfQga2VbN1iGtMnqQ=,tag:iaooqU2G7ZC+OXDtxBzuHw==,type:str]",
"property": "ENC[AES256_GCM,data:5asr1zN7,iv:WhFR4GYfjgQCK6JbU+XQ9y/65JnaGktgzGUW2qju85o=,tag:BtzoeMXTNTH4DI9kwHmdOg==,type:str]",
"version": "ENC[AES256_GCM,data:P+Kz42Xm,iv:GgFqhYVhtci7L9IvYsY/nMXVYCCDlOx+/YCWYlBQAV0=,tag:tQecpEF8ZkaJrRMnSGkGdw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"find": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:ei8wtHTm,iv:kYxLzQkWUsXuZCdJzB6aNXcqAeulHyj0+8X6rvMgtC4=,tag:vFTnOo2cDzD4FOE/mx1K7g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"conversionStrategy": "ENC[AES256_GCM,data:yGLZYOFy,iv:3fdF/z5i/8l5WLpGBBlwFyHSIDDodepXddCwkNE4kqA=,tag:B396NiirvGhTIi2Jfm2ttg==,type:str]",
"decodingStrategy": "ENC[AES256_GCM,data:TXXNaUCP,iv:eK7axUpJH8heoB9O69quz8djwsjqKqXiIvXxSJSH0yo=,tag:B/wsoZ4AnEvzi7ZhvVpCaA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"name": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:ZytiI0of,iv:0JTbA9Gn4lQocURsDFSZ5ji9uG4Uh4dkEBOvw6ipres=,tag:jrulMVmu8fh10G5dO/7Szg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"regexp": "ENC[AES256_GCM,data:/TIST3WJ,iv:4dsekl1RsYLs0WH3AtqE/0PE6cgytvGExfRBViCyGuE=,tag:4j+2+rPRhpLO4O0Cr7OF8Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:Ce6VVwiQ,iv:TXsXV7BHZwjC/Uz9aI3ZN+7Xzs1isrv5IRXouYSssdU=,tag:SH08n9/5PV0U4YLqYY9bFQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"tags": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:imyx,iv:yP5sw+WVEZzM2IQtKtxvrz1S27Aog7PPt2QJI64X0OI=,tag:4Pw9AzZXliXYTevdS8NsZw==,type:str]",
"ENC[AES256_GCM,data:9HIabysl,iv:fTTIjjV4jvBydZLYQ+CI6VkWAM5rFUw3kwT40lpGRHk=,tag:Eywmo88cXlcsHuXGeKczHw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"rewrite": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:Oye6Zw==,iv:DHYjeIGq8AXrsc2kQ5jDaGP+KBmrPN5axaDvN0kaswQ=,tag:PexVJ/3mwtPLSOpda5jpog==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:y0XMbf8X,iv:Wcuec+g2FJodLEg6rV1CuTitKy0g2VRJXg4YOhTpW7A=,tag:o3aqFWCuvGlFitucGGosbA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"regexp": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:hS1Zmndy,iv:EzbsEIDoWQSySN+BD+Hxkxd2L9fMTM02wPG68vt4hgk=,tag:YMb4iJcK5m829/MXDe5YLA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"source": "ENC[AES256_GCM,data:ze5sID+3,iv:NMfx64kr/zUKcGNWgn8KatEN5TtiGLbVHJaBQSWUu/M=,tag:SbvBl2/39iAnxGL31n65+A==,type:str]",
"target": "ENC[AES256_GCM,data:+i3ipEN+,iv:L4DZwsmQ1tqiK9NLcnIx3GNIruAgtnouS/5fGloGCIk=,tag:0bzsoC4lKxxX9a3TwOXudw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"transform": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:yDBCP5o7,iv:PhgJj5BRgjoqEpepMEHdJjIWpyeAVLs9a+gtJX0FaRc=,tag:ulG/gf/AWpxvQbbplo5KpQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"template": "ENC[AES256_GCM,data:1Q0gw6VB,iv:6LQT5w4nWxXnOylEHBXldqDxLCmY5Y3RZQXX12NhXAw=,tag:6bbBizE55vf2uzesSDvFTw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
],
"sourceRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:GRBVMYcv,iv:Ch8oyazxyqhCJ7xWu1w5B4cephcESF896xkxAk1VDu8=,tag:/8X6HaYj43UJDizTH5PzyQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"generatorRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:5DIY7tlQ,iv:kEnU3bXe1BhvywKc+hXru7hoyQmVEo7tKdBmrI+pu04=,tag:NTmByA8ixFdUzJvJPBylwg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"apiVersion": "ENC[AES256_GCM,data:BksD6utk,iv:H606P3osStrznPTsUh3oUBCXUH8RDDfdOE7QZ5DwBcw=,tag:c9crROBmZCt/3CN5bCfIoA==,type:str]",
"kind": "ENC[AES256_GCM,data:vfN9atHk,iv:shxniVIw0dZ9ZAL7Zog+AnlgcIllYDOctxdpmC+M4pI=,tag:yr056ZQdJAz7rRLqHt4E8A==,type:str]",
"name": "ENC[AES256_GCM,data:k02DwcJa,iv:coBXoKASUOnu80SwcRU+KbXGk8wM0Nc0ZU7Y/tH/E1U=,tag:4hKtO4hQgM2vcERy2sHJ/g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"storeRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:ab/Hr+xH,iv:TxAafhAwqBBUz4KwPkzMbrj/1/2CnlR93PCBRh3RO+M=,tag:S4f1m6VLfFvaC1pi3Tb+Eg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:yeUOIp8F,iv:DDiG9ae8BfTpnNM8wioQTg8Dtf/Xpa8ujGOkNSa3eg8=,tag:oSlxchUw/6e7ZOFuAV+1VQ==,type:str]",
"name": "ENC[AES256_GCM,data:YL1ZNY4a,iv:Sdf9fCC9040Y5jBWvOuEBgOlCfxupdDrXO5TLLGqG2Y=,tag:jIPiMwIfeRudBlWIWF1ETQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"refreshInterval": "ENC[AES256_GCM,data:UE341g8u,iv:AbyvuINkMCvO/WxrMtd7TJUA0CtMCCxH5lATavZGRTc=,tag:C4iEJnIk8B0srpI108FioA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secretStoreRef": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:7cZkD2qr,iv:70y9sEEjfJ75FP7nK0QSFKHhJ1hGsxXbsORllkLD6VY=,tag:RWo/9DaE3S3nL3l1aGh2yA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"kind": "ENC[AES256_GCM,data:oAh1Y7BN,iv:I/nAkVB2XPrQSE6Q2wuT1Dq5idb9N3mrbxN/0X/DWgk=,tag:Dz/pfAUXpueHRB8CWsn34A==,type:str]",
"name": "ENC[AES256_GCM,data:Dlf+qZ0L,iv:7hQdvde9Ur6emVxvtrrt7eISqDT6/Msg4LScu5ZDX9o=,tag:ulcH5SNcfUqpp+9AuU8vAw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"target": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:O9K11VK1,iv:XZwwkt4egrDiDvW7Hh9pfSEAMfbp/c1D6ch6TR+Lw6U=,tag:7U4avrqpL2BQs1FNMpt/1g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"creationPolicy": "ENC[AES256_GCM,data:KETvzfEN,iv:z/EtC7B59TCGQKxci0Xiqo5EoCfAG6dJW0n/G9RqMh4=,tag:wEjnEx7a6j4ux8p3iZIJTQ==,type:str]",
"deletionPolicy": "ENC[AES256_GCM,data:GlWa1h7m,iv:g9z8JHjyJXpUm6O+/8fQN327q0CchNkFx0bsWaATd+8=,tag:kUg3GFmCiQIay8iLlDjvCA==,type:str]",
"immutable": "ENC[AES256_GCM,data:l3r61Q==,iv:u7Cmyr7L938XLWOwjQSWk43eNB1siy//yk5XbttkNME=,tag:xcaDLy2VIorFcwwoscW49Q==,type:str]",
"name": "ENC[AES256_GCM,data:VnH+2FFK,iv:e5EU07ZpLaRqBgGFg/sPyjADhZ9MpXENigPdT7PvAwk=,tag:GATD6ScniVoq2RCssFdwuQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"template": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:98sV1tTd,iv:h+FOO7K0SBUrFgFcCujzhYaIicCpUf4aWRGeoaCBDQ4=,tag:07NRG2IgF/GEWq3wB9GWhg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"data": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:6taR,iv:gtzatExbiBq0CW5AQeiX6Mu3AMMBcrCTTGocDXiWTQ8=,tag:5nPpSk1JHY2t2amtcW0xvA==,type:str]",
"ENC[AES256_GCM,data:mo56e400,iv:2dz3GSyNZoevVajXZN/K0Nem/DNykpH34Xz+YtdzrJk=,tag:q3aUmemBO0IrOuQFJIgrMA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"engineVersion": "ENC[AES256_GCM,data:TCnN+uI7,iv:Nc74N+YeqTNLv7YMkrluTxxUgUuacG+DvjxWQshROWA=,tag:40nPwto2kuhhb1D4p/z/pg==,type:str]",
"mergePolicy": "ENC[AES256_GCM,data:6FY0yrCi,iv:TYlElQr/cfUbEvGditcctN6kdBoJgJRCFEDDdeNqCTo=,tag:yYF2ttuUWdMBNXQHYQ4mcQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:VzOhC1O5,iv:nOvqAA2HVth9ZWfx2lGmA7+8MP4LwoEEPPvFZ/oekuo=,tag:UWOmYNy8yOB8nVhM9OKLcQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"annotations": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:RXwL,iv:jeJaGI0PXFV0AllcCnPPvOlLdl1ImRgPfv0z0+jVCsQ=,tag:fnt4Xnh1g3D3sDyAcX96ig==,type:str]",
"ENC[AES256_GCM,data:VPQFnVsb,iv:EbDECAZjIUEmQEz1Gi/Dwa92NmCtYy/O+oAmGsVnRMo=,tag:ZQj+5jAgXsahJprLiutxig==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"labels": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:jciZ,iv:Ha4B4kEDlsQSG3Ry837DgmrAnR5S/it55wnC1f2g/nQ=,tag:BDQhY47AJBzGCGbm1ZI3GA==,type:str]",
"ENC[AES256_GCM,data:RZZmL4Bv,iv:Lpley92TUVDacqcVILH2UGRz8saFDEfEGSaqHN0cYxA=,tag:RyJsBLHHSCk1gwE+l3inYQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
],
"templateFrom": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:aCYenw==,iv:bBgvydbBY7dXh5UKX+COKTQkMyvMDzWJ8ZRo43gnaSo=,tag:ExhuTecPHNM7qmeIp2Y2rg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:XoNwPfPa,iv:YlBXPVov8TG3Q7B/RpkWQn517ohsoA6DVSqQtCcZWqM=,tag:F7lm1txITAWSXzgc3Z1oyQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"configMap": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:iDM9wKKN,iv:3KUvtd+6by8xtN10/yKEoCGrfgI6NWO/4TPqRQpUtHo=,tag:kFUXzccMhRTpNlvypFpR0w==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"items": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:dI0QsA==,iv:MGHvI3mxysVwGxP2umU9/HiawWrDomfqfe/KAmHTfJU=,tag:e+LACzrPuTFaPuIcDFHcjQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:TJ0KGrMx,iv:dVh9/KaGWI2Qj8jDKL5M3CqlSsGoyvWMRllcFMflc94=,tag:QK2h/BJYaablFCgUBg8psA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:hlXJOqJ6,iv:WYjPgKl72ZkBveD3UPghy/T8YX6zbJjK0lEZdj46+9Y=,tag:sLb1o9n2ynln1oJBjgpErw==,type:str]",
"templateAs": "ENC[AES256_GCM,data:1Rr0jTff,iv:hB7qhdceY8G64A/uLTEEo5WgvUrs+inocdwT9OiVArY=,tag:b08UdmpbyJWyZKxImh185Q==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:L/MXhN3q,iv:RlOMel4E+g5arrNtGiHVdlfweT4KugZQ6hqHMTUort8=,tag:sXtKkwDz+2VMOPs4HubA1A==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"literal": "ENC[AES256_GCM,data:1uCaprk1,iv:q8L0l7peL06+P8MXoLyARCd6bhm6wXW5ULSN5mrzN2s=,tag:oEIu8ryDS5rvbrCGffOfKw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"secret": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:IwtjDxCO,iv:44QJYFOE/7ExIEifEcABrM2AGEBVwfjAX3t8Fep1jGw=,tag:4rETGmbrlF2KFRU9r1shng==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
"items": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:eVfICQ==,iv:njowVS6mQ2v0FDutQK5e7ANQihKCCkYAsjd3Db4LEDA=,tag:IXB2DrhdK0kXkNl7XM+wow==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
[
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:lIGrrzTj,iv:HtrdQpAsdqSGTBQUtllX9xWySDw9Nt+UyrH+yuK+LPg=,tag:SyMmUlUaKNeHJj6DE9gQPg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key": "ENC[AES256_GCM,data:x+QizujE,iv:Jfl7w4nIYwgcbcYKsvJZ0N0+HLIVPjhd7kKbXj2pDVk=,tag:xoM4z+exn9oUE2u4bATcHw==,type:str]",
"templateAs": "ENC[AES256_GCM,data:NRu02dxw,iv:gIsEEf9EnUQ+4skvAuLXVm6KY0Xn9XPuskj7RCxCx8w=,tag:+hDmBSTO4Lr7Di4Vg/ksPw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:AQpwv9zm,iv:bMp8G/bfA0Qo7cKUb+l1ykjbVtNyzUewB6tKw5JxB3M=,tag:2+bKPzVso3NKsD9tQfDmLQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"target": "ENC[AES256_GCM,data:JagEmTAF,iv:7t5I5+aPjDhNZOwgzDmM7265s70E+2VAFqPp22gZDB0=,tag:/it+mfWgX4he8Povez2/9g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:q9EZJyBh,iv:SPoGM+ml37ggcLk0eErvfBgpNn4CpvKQakpvv61NaBg=,tag:uN8+B3bmpY8sr50Cnw8fTA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
]
}
]
},
"timeouts": [],
"wait": [],
"wait_for": null
},
"sensitive_attributes": [],
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:aDGntTPV0b8g3wIFYtGnKKd1yd6ata8ym0Q31Jrmmw==,iv:Z/WBsXgG3wB5uWOq0Hsa0WLriSMZ7OxyPNrX0wog/lM=,tag:xf/HqVvzlW7aUkPqWVrYGQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:uHkC1Cs56g==,iv:6YhqTubMUGuoXfKPRHaubr1NnVKeiy1qW27XVhq8LiA=,tag:pSrPhbErIDJUeJOU7CR2VA==,type:str]",
"type": "ENC[AES256_GCM,data:ExcdiUMu1U+z+vXQg+KxVqO28SQ=,iv:oXxWPZfgptB+AhCL1itQtPphhhZQBRVy2UtI7KmP0Js=,tag:ZJ3WyF1/V73gRxk3pvGyIg==,type:str]",
"name": "ENC[AES256_GCM,data:46HOKzaJl+AJQg==,iv:cjJUrAJheilRu0bqLdZg31SmHh8+FKFRGZ4K0oVRZeA=,tag:N79thcsY6vO+JW8hYc3yuw==,type:str]",
"provider": "ENC[AES256_GCM,data:UNxa+nZc59ri74+IXg0hLbrevDN6xprI1d+5yruLMqcjWHiqRGz2ZiEYjmL87UMC4B1rINDw,iv:zFGxtz+nO4+HKrsxnaFn82zEKXtHPO8fk2VyP7bMcg0=,tag:TOmcQhei0vZF4Bn6yWWKGA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Iw==,iv:zRRrF1SI/89iiTloZd6VnH6TYPhK4AUHpFx/i7Az9mk=,tag:BJd4BYxdG99qPqpWoYg2KQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:Az/OHmGmVCCHXA==,iv:N1A7BEkQYTCOfz6ERy1rhk8TatkCvCmhs7su8rUe2cg=,tag:0klgYDclt9FsS8LsuPPyUw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:9Q==,iv:erdxSus1bOEbNqE3sdO+eidBycVw9FpiOKkjLjTZ8YU=,tag:ULViyR1MBM4gUymYa0YOjQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"goldilocks.fairwinds.com/vpa-update-mode": "ENC[AES256_GCM,data:wDRK,iv:5dmKsAt9koEQ332wVM5GO14cK2e/huOeeF/wsj+OpY4=,tag:CDIBHWXk4IcSyrqjsfNJ0g==,type:str]",
"resource-governance/custom-quota": "ENC[AES256_GCM,data:rmsVrA==,iv:TcGvMa+/8zOkX8N1hUGCRmMJKIKZhIYmyKWWYr9VZWQ=,tag:Kdg8kqc//cHD9L3UQp32yQ==,type:str]",
"tier": "ENC[AES256_GCM,data:qTO78TAf,iv:4O0bTUiapiA5i8/OlUa9aYpXLsD9t8GOJKB4bvbmtg0=,tag:1zgB1GI3LEQyOrsnpda+wA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:g/ApGySt4f7N/A==,iv:QW3IrjJwbf+WU5JaDuZ72C4Tm1OBGWVatxaLtQ2j6Ek=,tag:vAauKGYE+JCWG+W5pEo2iA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:kmwgw6E1hhHZ,iv:v025D+CZSXQujDn+T/9t1qnflYOpxtDL6TpV11nBQ4c=,tag:CtboZ3hBeq9xg1Wcf50J8Q==,type:str]",
"uid": "ENC[AES256_GCM,data:ShYIjK4HkjH8NLusY5Fzfampl8WiV0QIX7ejH3Q7ui6puOsQ,iv:DPaxUA0QLJJ33tfreZV8tYUlyKSudmhqPZkKvffu4vs=,tag:yFWFdic+cWBqYGr0Crpbww==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:YAuyqUc=,iv:ffx4ngMXCK3njFUvVvC7Cncu/d7JaabyuLb/JTFXbRo=,tag:WPK6a6zvsundP8Sq07MH1Q==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:zrf9LzHU03PfAmU4ljbC+QaE5I9qE8uAOLn97HPWeQflS+WcfD5i5L3gcfZ0L1IAsRqfa0Nyvzca2A3p0L7TOMx6zJtPJ0dBiE9Kz8gmpbOS2PTdl7ioJA==,iv:aSDc736qobdA51uKvYHgDQIkdldDjqezCAigastvPsM=,tag:hWAtZBkFmoLrL5PJK0UcZw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:5dm5UADvtg==,iv:BnrxwQ8rGoYLzz7XWf5MRADvFNbnQq3n0M7q8OiQ3qc=,tag:BTVJN9n/9l7S669g7NybBQ==,type:str]",
"type": "ENC[AES256_GCM,data:FlpQIzHXlozXZvRIze1LollS1pcgvpbVTiY0OQ==,iv:QPBY0Z06YqFJ0AA/BxtqWddXLL1FPwBI372NPYYXbc8=,tag:BpB7lt6sfJESMJbUePeRjw==,type:str]",
"name": "ENC[AES256_GCM,data:1V0BzXQMy0iu7gLX+FB5cZu9ZGLmfw==,iv:1TVUkZ0gMJFnUXA/3dxh8rB6GPh4Fx2XZXjYXhaeqO8=,tag:KNFG96RrO5zJjoCwYIpdDg==,type:str]",
"provider": "ENC[AES256_GCM,data:P/IakuP2W0hx5Bw34MREDedHCvavZfEkckRiY5r+zXqKNZRhiSXc25X6GuQYkHtPeNMVxm/D,iv:g61IgKO6Cwk2tys3CjN+EkZ8eyqhMYXCPRYSiIT6VHE=,tag:Cj6l4Mn1rYYnXIw67s7ZFA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:1w==,iv:6Kw2HEOZ7zA830dkeglT8Q2o8btjSMAu0HM2d0IdMmA=,tag:pkFU4trup5+4c/jxwmicxw==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:fEuf/SHxm0J8lm8k9Xrt7mq7QNX+7Q==,iv:ntJwFIrjfLVRe8sX+ImaD8tq3jxm9oKbWCOgZ4EjC98=,tag:J4OTzrhPZjrxWPDLLhZltA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:kw==,iv:KoY+8da9XdMbk2D2Yu81x8c5/9IMV8BALeGn61TSErU=,tag:lj2dObvWbs5HQ4Vc9ApdvA==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:Ru+fr2wlHYXJljdTBxOvoEYPjGu36A==,iv:Op2/+9jSLewTxcGZmZ1w+393Sw/IjLRmIUU1vY2FbrI=,tag:ODqsm2UBE7cZ19tD7cb5dA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:j1YgtscIVvcN,iv:HDRqxc3I/1B6QUcEiDelYAAYmu+dHjgqHIZNfjVF0p0=,tag:/YVBTfsdBNy6qdYsV1Z6/Q==,type:str]",
"uid": "ENC[AES256_GCM,data:0bFWeDV8U9xoCXO3SFrsGupjG2mydq69LRlFlkJBEvDIuPMa,iv:Pb1HhAhl20lmI3kY/i3wGmnvpj36Fb8LGasahJVE08Y=,tag:DTt5wIXu+wSkJfOj7KVdGA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"access_modes": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:5gdODQXIPkq3oQA1CA==,iv:2hdkvz411c1tF1RFthFsu2UrR1rB8JY6FkILDAFmKsg=,tag:9ZaOXGCe5GriZRt4EW/XLw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
"capacity": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"storage": "ENC[AES256_GCM,data:xnOcYQ==,iv:yvCCl1jZAkaicQk7vj8CzLlaUwiaiBFhCcNSbQwX93Y=,tag:Ylk16xI72Wmrbl4cFgiiAg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"claim_ref": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:suIVBP6iQ2Wx/eI+1fzkmXnIRuzcTClp,iv:pHQCbmcF8afnPhJVGOdgedR/k3kPnniHMIcXRXEfjiM=,tag:uGjrTgr4V6Lz1QLnowMwqA==,type:str]",
"namespace": "ENC[AES256_GCM,data:q86nJX0FhuJMOA==,iv:Rj12oa1+MWYvoQnhecrMMdHvpJaDnCo7F9Ezb3/mXwE=,tag:fQ5VsakWlstUXWJpAJpHdw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"mount_options": [],
"node_affinity": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"persistent_volume_reclaim_policy": "ENC[AES256_GCM,data:7tz/1Fz7,iv:2aj7F7wW28PYycA445UQcnRVNW3nYwNDUtzb9JhKPes=,tag:zAxP/FZXHNA1QptxS/6KWA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"persistent_volume_source": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"csi": [
{
"controller_expand_secret_ref": [],
"controller_publish_secret_ref": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"driver": "ENC[AES256_GCM,data:lLSzTFqB0FWmo9GkYIs=,iv:9bIllkwh7PlH3V+m70+fTXJW8PRbn74D3mX4R9w9vwo=,tag:MZLF8NyGzuCjzga37W4kEw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"fs_type": "",
"node_publish_secret_ref": [],
"node_stage_secret_ref": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"read_only": "ENC[AES256_GCM,data:slYayS0=,iv:j4pvQUYAAFVQA4f1RjtTXQSh1idJL/H3LyZJBuKI7DI=,tag:J14+C5AjO9VelCf1xDnv2w==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"volume_attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"server": "ENC[AES256_GCM,data:05oci0RQi9qUow==,iv:ac1PQTJQIG3EDYzesr9SHb0I4UevNUhGdX2aRAKBJ6A=,tag:EJ3beQDI5JlOCL4NpdE+3w==,type:str]",
"share": "ENC[AES256_GCM,data:C6dhh+1yIqf/+uuKiP8NlecaUU4=,iv:gjMzWqhSQDFTrh+kJun3BfF3AS2mKRzyO6kOr8BZ81o=,tag:3uaRgdddaPJfAN9psNAoUQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"volume_handle": "ENC[AES256_GCM,data:HkVH33TQ9RV/qc0vwvJVTY/nYzoHDA==,iv:IAOaCwUW0NpoUyknvJw8BTsyI9hfSEUbV25Bv20J12E=,tag:3xUUKvDDEZfsLsaPdlm0VA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
"nfs": [],
"photon_persistent_disk": [],
"quobyte": [],
"rbd": [],
"vsphere_volume": []
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"storage_class_name": "ENC[AES256_GCM,data:V/yyVxDblMOxL30=,iv:T5uNcV31rHPG3d1lfA9RRzyKqzm5ArrPoW7GZ/FkjzY=,tag:XntmxKcKDBrum1pIkmzv7g==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:zP1xfBkquZsgjw==,iv:6r3t0gNZnNVNdDKOE4SA3iBe/hqjFP+WNcdO2G7rOO4=,tag:3mwa9hSeE4ovfY5rOyDAVg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:+Dronp6SeJ+tRnWaXG67ben3xb4/4ynoPrAqC/rveBvcysMYtaaSI8Qah/fWPN0+bb5/zhuWkrK0AYWThI0lkmqiLxosRo2DA+M3sEGKunEP+0hf76C5CA==,iv:IszhV3gJEpdFTPz9XcJkXqzS3fpbKQL8BMuTcudD6a4=,tag:cLsWXnCdCjT21Xt4LzbEYA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:494jDZ+JBb/O7faLNNp1g54KJGasZvrTm3A+r8RyWg==,iv:eZp8RyfAAn4UGLFLTOLefg+g6i6zMQ2aFi3mYR9Uv0E=,tag:e9ksLGqKwY8DxbVVGT2Qmg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"mode": "ENC[AES256_GCM,data:A6sxKZBh1w==,iv:tpDuqa80CmSGGOLEnfwv5gkRILNEm6sEV2TEZvZqs58=,tag:F/7pEDMV2W2QMB6j7i5A/Q==,type:str]",
"type": "ENC[AES256_GCM,data:zO0fF3DAm0BK8Ue3k1n9SKl9QUmS8B7YZQ==,iv:VM2wcmil7yUA9Bp523vxQ2kwApMfR2VnP6BU7HNPUUk=,tag:M8j8CsH8OhimB/bNEonmLw==,type:str]",
"name": "ENC[AES256_GCM,data:BQ3PcSnhDvjaow==,iv:WBBanXV/T7zd/aS8Cg2v+It4h70fiYrKlx0SDEjafjM=,tag:ImVJWPgCmNBw4UNzYUIH1A==,type:str]",
"provider": "ENC[AES256_GCM,data:NVW7wNASEn8DOjjyp8BFJ00O5l2rDr20ftsMWR2I90DC/AdPCKs+2H6obDlKm10LioHaH2UQ,iv:p60NC2itcKRBRhTWziviPBXnvphCGn5CLfB6F3CwpX8=,tag:aPacK6Y9CnQXEr4+un2qgw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Pw==,iv:JbuMDnUMGWjKPucdlTq9qe1Urf4+x92NlnpbX6ipC5E=,tag:xjwgBiqZNIshr+OHW7o5ew==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:uJHdgZaLSXQPN83CbxZDE0iG//q1,iv:AQMRr10hmP9a9gvVGJkLqnAkb4X6bQOPJqdxSH3SPlI=,tag:2pVrYmnuoSOYZnFXI511Hg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:8Q==,iv:HU6OqMRTwbOArOUItelJanPGrgCK0v14kFp3rKDUJMc=,tag:OawTDJNGKAnIYziO/bLTKQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:qAAyS20/KwDodg==,iv:2Mxcd2YlvkQzkI/AbdrjV8/5qqCePiWVlb/TnDUU8Nc=,tag:jcjThVQDqpRspv3X34/baw==,type:str]",
"namespace": "ENC[AES256_GCM,data:CSZ7+oTrgQ2iSQ==,iv:8OYPKkZVvE2aycYJTqMTXnseRcWackgjeegnto/KyDc=,tag:44fX6p67MriC8B4xXwlNZQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:MVNkAOr81mz4,iv:2kWhdYMfdqJjj48HJMs8P0FJHpKfEm7T9QNWU+JiIt8=,tag:iGeDcsJ9HZSsHaV7IHU9ig==,type:str]",
"uid": "ENC[AES256_GCM,data:INEdx7oxGJOia3wDFb0/hT9P9M06YH7Ofz03UpI2NwPhL+bn,iv:9ydV62No+lawaDke1hZV2EAtpJj32TKMLtofEqkdOUI=,tag:E9bRv3BU1pbicQpcLBQURw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"hard": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"limits.memory": "ENC[AES256_GCM,data:O8kWJg==,iv:l0fz98yZRaKJLKw+/UDjuBhnUERZQ9GjmDPV1F7V7l4=,tag:W2FSc5WlnFGbcoutsH0Kvg==,type:str]",
"pods": "ENC[AES256_GCM,data:ix4=,iv:oehegrF24kwLOL6OtlRdQTdYxlelh4Y0RBzzuFs76Iw=,tag:StoJwJxAuAfyiPnEKd6DLw==,type:str]",
"requests.cpu": "ENC[AES256_GCM,data:BR0=,iv:qoItP1yjc+JePlbzkkumBsdkcx5DhbS1uEc7xz0ANe8=,tag:+ha6eN5v3/roEZmHKt6jJQ==,type:str]",
"requests.memory": "ENC[AES256_GCM,data:3QObIA==,iv:UxcyXPelv9fFjqF2w4qezYjv2NPUKQydDkIimfft148=,tag:JQZB4hnqr6p0Y9CpMmsdjQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"scope_selector": [],
"scopes": []
}
],
"timeouts": null
},
"sensitive_attributes": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:yMRhrD2eDB2E9dD4QhTDxYQkRi2GkfK6zzSS7KzntXDthm7HgT2joHEDpA7HyB3M4PiqRczxz94p4aAtfpEgRoDpwKRwevzVX60V1KWdPkePxtdVDT5ziVaSJZHtKCECCRF5CfmSqnZKsGWO1dGrGg==,iv:dj7PV62L09Wt8CPGCa0sH1mPjPN41RP/bICz4Y5h8aI=,tag:0e6hYm7bs5dPaGHp591iTg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:46IYQMTX56BlKeicoDs1B+FkUksNtTs30m62FciaCg==,iv:DA7+QppLZp0EpILWbrOfRNNqRH9BHp18bON4lqLBBs0=,tag:fREXiqUsB2tpy1zTUqGbkA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:o+QIEnrV6vEYf8G2eyA=,iv:WgCgJu9erQQjr+EnkZhUTyOVQ3aN5lTI9HoSSEUor2g=,tag:fIEiP9EXI6hyoaSbNgjhDQ==,type:str]",
"mode": "ENC[AES256_GCM,data:itZxYnCpKA==,iv:+yVIeaMS3wl7mZDtR1YcKIYVvJqdPB/+D9tsdybCHUU=,tag:Qf4D2P5f5REQXzcMmj0LWw==,type:str]",
"type": "ENC[AES256_GCM,data:PMZ6yetPF1OWalnGbPdSaDXYeqkb,iv:t+4YnzpaKk72r0TSo1CsDWDRbLb1eobzNSbM/UNB+Lw=,tag:Bd1Q2jVxCAsydgA80vr3EQ==,type:str]",
"name": "ENC[AES256_GCM,data:u7QzPfTk0dXhHxPGfUia,iv:fmU5FFKEyxCpAVnSlXHxc7D+QgDnzluTzVwoJ4DC86I=,tag:6OPgqMZ5O8OUyrIQQQzmPw==,type:str]",
"provider": "ENC[AES256_GCM,data:LxnsJb6+qtnG0dfR7+SJktaslskp7jp+Zd/RhAoK6+8e7W2Y2uu4rl+ryDseAYjB0fluYVU4,iv:/f5qczGGbsSLlgykym1F3IFRk/vaukjnBjzL8B3sHC4=,tag:sc7at1B3aV/XMO4xD9v4Iw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:Cw==,iv:vRH0PFyEFn14qWDn6p47j0KFPLh/sZXxDaPrtzWNq2k=,tag:J8MhjGeknD/XmvZeE9OyWQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:w252ytv1uZVFJ9nOYw==,iv:y9BRTwRgomi96aJi+M6uvIagsTZGM/cfX9vW7t7J+Z0=,tag:ENO41YSqXl/ZvbzNfsPunw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"gethomepage.dev/description": "ENC[AES256_GCM,data:cnjN3mNGvnznbrlYTjNH,iv:iQumkoK3Ik+irN9EnKtqeC/56LaMBWK04AL6Zmq/xOw=,tag:o4+l4qIHeDF40kR4CHhe6A==,type:str]",
"gethomepage.dev/enabled": "ENC[AES256_GCM,data:o+vimw==,iv:XrOojyeCLr7z0gevBuSwGLdPpgKYaiVY5mw14EKyhwk=,tag:1rjONyG4R8AsmJheohumdg==,type:str]",
"gethomepage.dev/group": "ENC[AES256_GCM,data:5i3BhyUKE/Q28zA+/U9lPw==,iv:890zx4d5hjCbz3HhCsaWuwLSClWv7ayEr+7dsu0NUiM=,tag:7Or2HyNRfPhrhTwOPRR0RQ==,type:str]",
"gethomepage.dev/icon": "ENC[AES256_GCM,data:XFZOfr4nZLnxrl5cadVjX1A=,iv:L2SNxoC/BHjtIjH01LC1Kca47g11gBOpYj1i+EWrdvk=,tag:xq89KtTryw/eeforU1HyOg==,type:str]",
"gethomepage.dev/name": "ENC[AES256_GCM,data:JbitggAiDsRPCPpmpQ==,iv:VrnXEI5jm37zZFXjgWmGRr1y01Y1ikG1CdNMYOHE/Ls=,tag:RVSg/F4wDLwZ5PSFxCh3RA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"gethomepage.dev/pod-selector": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:INNetL49P4YS,iv:er8KTRb5VdXcDCuXbSGdET+Xj+3rRvr9b6hZGZpYpcY=,tag:xjJ3Msw2HFWFT9I8iY62ug==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:86V3oNlqxuCLHDmHai5GEXFoJw2ZYwwvuY9hRUV61E6RdAyFIfTUVBO1sShcKW1CmI/P9vfNk7eEeVoECtmKVGEn6Q2pqgnXX+Az9hP8RHwhoxvYv3M/S085KpeYvIK5zPrVzHvGdA0iDzcouzUtFbK0uK4kk+wYAdGnF3ySMDrw3qpLYVH1JaYI3gLWsk8PiZGnOlgnvnUHV8xURzbGSMD/dXnXtp9vQNYLR0WvaIFsLVEPOHh2HTiEcIRcjIcxl5HCWzic6zPHLRFRr3r8BjNBC6aR76SnZ0exQy0vBmJp8dhn5LukYtCFfEJaHBv9EqnFDO9AFirgxoN0s9Fxkwwytqog4xJgPLptm844fMIx0M7EYrlnZON7SA==,iv:EzHdewgIzJ4MY6ypd58OHDz3gVQKXGSqhLzXYuECiQs=,tag:vztsTYUoOG3qGQl90vXLmg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:Jg==,iv:pwdOieWyavezgTn7gpdnm3+S1Tw8QiujBWENDqoUcZE=,tag:DV5Q2D8g5wzX2+tkHbhqQQ==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:uSg=,iv:e12n6dgWMafRNYqEJEbb0kIcZbptZD9JRSGRN2CRhQA=,tag:L1Z2/cF08R1D9N8H8Z5S/A==,type:str]",
"namespace": "ENC[AES256_GCM,data:qq3TK22k1T0y+A==,iv:b+b0Skt3XoI7gdJc5vtTE7wfn0ng6jjiOTl9XmBwzTA=,tag:1VwLbioK/Fu5cTUmEb4PQw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:NLGbTLqNbzY8,iv:Rot8D4w+Z8C2fZKb049Vlbec3E+fSEfZYkGIDZc0L1o=,tag:rugShEL6Va7AN7HEWDSYEw==,type:str]",
"uid": "ENC[AES256_GCM,data:R9Fc+P169CYeKhu8fDy91jSXh0wK4Ox4+u+7H8SzSFZNe/7O,iv:XKgzFV57gxPiWS71//EfEDaRtPlTK/Y1RzFV645KZB0=,tag:Ik6wINgp6bR76Knv+s0KVg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"spec": [
{
"default_backend": [],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:sLQvCj/xyw==,iv:lhaiV+6qm939vtIsRq8iBsqHuQixqh2YBIAnVyvxiuM=,tag:doWLm0Anb7uu70iyIQeVsQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"rule": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"host": "ENC[AES256_GCM,data:RBSJLHhrcs6t7oXEnpCbCGtC,iv:YBdEXuJuFmIrI/N5ZSZRGxbDIFrKR+7V44EEipPfcmg=,tag:kTnzWa/Gzc9irIViFwd1rA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:xgh1UFSpCuFfccRbOYIw9NE=,iv:FfUgZIsFWoHOQ3wlIy4J90B/GTBsPMYJA7NTgxUj3Ho=,tag:VtIfkqbrJoXu7hs0+W9vmQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"port": [
{
"name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"number": "ENC[AES256_GCM,data:UnM=,iv:qbU/DLtPmbzFwfGPNcmIZPNl/mcpa3VJ+HVXM/ODyEQ=,tag:BGzUJC3nNegH2ivg22422w==,type:float]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"path": "ENC[AES256_GCM,data:Zg==,iv:mcIfDfRTsBaPGHRspCkaJN9Z00qsUqeIWrbzzbJ9/WM=,tag:eJmyWOcTO/F9FHs9kDVqRw==,type:str]",
"path_type": "ENC[AES256_GCM,data:H2OjqSEgmqjnWe69DjzGas2NkGP4sQ==,iv:LIqcoeyXbqM7KI0GiFeB8au1nPEYDU1qIHwVjXEFJfE=,tag:xzxj5OTvqss/Kf4mI1OflQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:qr4H57L3ynGwzPIiqOtnm4Tj,iv:iU5DzlpJLFuBWU1J9kekuEqL3hHhISkTAAB6g3D5up0=,tag:+yPeA8Fhz/fD5HQI1d1DJw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"secret_name": "ENC[AES256_GCM,data:GuhRZHjFEdDglg==,iv:LciWWgHH39ZgwJV4+EpLR7+rYiUaF/JWT27k5tyspg0=,tag:0MBQ5ExYMC8agqVbavSPcA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ip": "ENC[AES256_GCM,data:kjq1Togd/wyoboA=,iv:XspFhEmJFuJkm2BUoMtHiaidgoDHGDcm9BbfJvJKQCU=,tag:66FMF9oaFqejN0NnpXFNSQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:mZewTFxLVcI=,iv:SQ6+SgpT+ev6eipVN0ex6lTvzWxSqQNjWnX0pGHAOO8=,tag:I2QJewKa3mmRp4cz1AeKkw==,type:str]",
"value": "ENC[AES256_GCM,data:/OEUmw==,iv:NkbZbrv5Xh70XN9s2ge4EBQxbnlDxV5v9DwAFe3hE18=,tag:Tj1mp74L1i7RX80pQqAgcQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:nVWWbR4=,iv:NV1DH7kBLQb7tqmhT+EOdf4SnURfw0QiG28zKEyl3Uc=,tag:St4dgABfYnTOufYHT3z5Jw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:Yg==,iv:f/HTZ5ACzYvmp7epXOXIsb6IwNzadDm6t0sgvZJFNQU=,tag:OTFipcVZsdNAf7SUXibalA==,type:float]",
"type": "ENC[AES256_GCM,data:fuyR3yaG,iv:OKsLUA+BBehrwbMfIysuvRTdLE6Unn/KncLwxJzV/v4=,tag:gP6NLp17g9QdsoY7cyWPmQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:nhI3ntDtrE0=,iv:UICEKoJImwriWrQJy50w3TbuyRiBCNW8bd/LCFyWIfY=,tag:4Ufw4OJlJm13Nu1Okfzn7Q==,type:str]",
"value": "ENC[AES256_GCM,data:Bs23,iv:TyOs0FRTpnykhye+waiOUrt9g7HB6WEDtxYx2ksruXs=,tag:D1MhElXfsZ59/Bt100iNRw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:ZCbCWms=,iv:pyElj/chJCYYoQShrccKpsMlPblnzUWG60Mnrwv3HrA=,tag:9w4NOwtTkIaWFnAW4IT+6g==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:Ng==,iv:81YtMKprZqZbSqmzqn49LoyzhCSxeA5pMQ9wlF0z1HA=,tag:S4GApRyJmvK3a7img0Y4OA==,type:float]",
"type": "ENC[AES256_GCM,data:RS+jOAIT,iv:6iEIqVQb2U6im0oWNC7zBeiwb2bBo4daxUphuDH3ELU=,tag:Bp6vk7FP7OshIWQFOnNDoQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:ODwK1Bn0zGg=,iv:Cm2LHHeRAdWpChJceV4KrmeAn1TktLRfU+eqwzf/Mvc=,tag:DbccvodnwEGaNSRgqKpeKQ==,type:str]",
"value": "ENC[AES256_GCM,data:ep6vWpfcFRw4/NY=,iv:zhFDzxA+QgOvkFePubK2sC2kH3sCgyEXA7mJk+tvJBE=,tag:RPNuklZMXEpICtB39wU1uA==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:+44MWDRKjItaApblI6iEpl19AFX90X8DdDmWPQJNivBJ0rIhoq2i+WASY450IWn9+qQxoIKtnVQX4Fkk7Kw1drg7+ma5jGuFq7rD+MGV/faA0h+h0Vn49q4WTiDlGGmMTxvYGebNQdMqm8blJ86gSyTTasvviqXv,iv:uazHlAa6byBwXh+YC20UYuPHARHphilofP7UL+vrDaw=,tag:fO5hbtu3kvMPMHCgx/wNdg==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:jb0P6njk9Cn18fPFVNdhg6OY7OGsiGiqBkDI5IMvrg==,iv:fTjlK/fjZdu7lmUu0bAotW7oY5R9y5tBdhPuZphiqAM=,tag:WB5meOOs9TGBwuc+Ijivcg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"module": "ENC[AES256_GCM,data:wF8dlm5JFXfxZBwa5Lolz9o=,iv:809lvbnOH7luv4VRS+i56irRj6kmzWeNvwI74qeqiek=,tag:ERXQtEFWmVj+24niB14S/A==,type:str]",
"mode": "ENC[AES256_GCM,data:sfZjoWXsuQ==,iv:opPRWeL4+t6kXpoedqMcM9nZYHw6Yi3lLg/N2j29ksg=,tag:dbOKTvgMT1HSYtlC1vW31g==,type:str]",
"type": "ENC[AES256_GCM,data:vMOfsO6WASX8SuwL+ELduLQ=,iv:hy5fWJDnn++OK05KCQlO3uLXtFHbQ0KS7ioRRr+8Qxw=,tag:NHXc/3temMVFufHyN08Gbg==,type:str]",
"name": "ENC[AES256_GCM,data:t9VXLI7iDG+CTw==,iv:s14KFgFK6zskV/Q+0UbVGSCZ2vXUsDagFig6ZcmEoug=,tag:4Xini2QqXLyC6XoJmozLZw==,type:str]",
"provider": "ENC[AES256_GCM,data:asFiTaZMR8YeEZ+/eFMa6zvff6oB8A+t5YPKitSgS3mxauhqMNIhWkhMOkD1Dr+8lv6dwgll,iv:rj/NftQ4S7Unb+mrdNc6QKkubNvSKZ1fUA+E63QWAu4=,tag:MNS6uufRX43aa/9KEP9gYA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"instances": [
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"schema_version": "ENC[AES256_GCM,data:OQ==,iv:/8EHWhu+Csn07LmUXKsHlG38Q2XU0YGDw3TJCvdLERY=,tag:ElgzRqbJkKEOFTQ2ABnJ8g==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"tls.crt": "ENC[AES256_GCM,data:fgpAZU6ceagvzpkpAzdA7odEmDB/SeA/zoVvJ45rkfHCezdMQ8VgFRgdlTzoOIixZXPMmgTYT0U1hqvTjSQVGfGZRE+wpfcZNzUHq7bsh0Na/J2Jg6gCYd8LE3i9xaxEZazrMI+NRrQ2Mo+jIGUlbmJjQBOKyVwWItR/CoHg+OvsFiIpu3NoUqDvAHpROnzHFEZlc6pHFBWI6aWOHJL2oPD+OpV46LOBYWeYj1sO5E/blVj1hdlZXCOXyC1khtHYmqvpQlFaFQqS9Qkg9y2NUhV8iyfxS8nySgGVZp1mAPSdacg7X6vnccEQfAcPT5f6ob5XVY2nAarg9mOIiSZq32/Z5UKyH6ta3YVdY1cokXedcDh98cZJhwKZgACo1tTzHcaE1hgQC2ZMjQWzFihvKEgVdmYCBnAxItijUiH2WtZoaR0Ygl65V0t2mAQe1AAoEKH07DUKNQiki/S9s2aXuGRGGLWh9UKuyT/wCWbABpkvRroC0w7q39JabtZ5HfEfSft/lFSq3pPZTJezu7SvBdPQ1furF+lCWW69jMwjxe05skskI2beHQu8BOz03NHdzL+jwXIrKLGKmHWEykWbF0PGgtTJsXHtQLGvV5V/jjS/mjDN8xiBx0T11+w/UYKjDWHL7wzLnR+WzBcytFaimn93C/CcqOaTrVMJyBwwha+fo3o3oC2mjgLCn08NR1AZQ9VnbwP8/tgQNIqNOMMjnlbifXlSg3rxnhhNKQC0Htd3Y07pzbC5q5nnB9oAXcEj1sVkSRdH3I4DhCGfSaTwDfnc4w3HseYGKGuRMxqnaPXjG8uXWTtei6c/Q0HN8Bydax0PUKWYOjG1/0EH9CmnFRRyYDyZQVGpH3g5Ts6om5rdGSGAYjHZtg5Lnz6JUqZ+5NpboFvQCnlCAzw9w20fEjMS4obp+POJAMoR4lrcMGlWuNItTN3x1jxWxGVh5TEgI1fSB+xs5vf1Z0kyNlO3e6pnx2TAqi0IORLo8sc7z5aZIn7oVCqzZPzLAlpMQ/O+4QJJ0xTsSBqEh+/o91aNV/GVl4Qe8xtsBdcLz7ScdqtU+ewWiZfkRLBvKVG0zst7aF03Lo9M8x2C3fKC43zxeHyd8HkqBi8ril3i4J2c8t9oEfL2h4DuzeqJyMTwLbelm8ICg9W50lVl91ffVTLgHZk87wCaWe6KfCUFxxbLbL8KlYJ146VHzSi/d1a0VvyxFOoAmPO72NTreBTJoIy72081XCzUu9iC0ElMpXjt2WuyxASE+6hqq9QdM5je9fxgjFWo6U1AeXVth282wzIvLYj6XA/dJlWSTwQWN+sGiITgxkacEOP7CFIQt7DuLCYwhkNLYvsFI3JBpTvMuA4iDiv5jQUs232bNy++o6JE6XGhJR92hZeoVKcqqGvYyJJViynLxHMO2zQS2stSqWDSy675Ap4bl6tLE/x0aKGvNTO2hdM5T76UozLPRPLAB8pPEoEQe1GOLtbt7BwAiGoM64KIQ+mgnhvP5SfNc5tDxoEeB/Sc/chz+dvM/MYNa7LeJYBmD8uDf7efDpAQ6MNG5P/J2vAUVXeGsU+hlK+YTsHbHG2RczkJYbKuwjRn3AEg82SoJ92PQn7Ud7IG/GzFooEtqg/gFNsIta8Xch5mzK0SrTkAFgX4zpXTDLdnOyebKKY05drFfgMF+g0lasp1w/7c2yyR1/lMhfEbOrPih4TKgwzHcvRkSF8ask7hts1Sdglg49kvaIi5lozeB1bfXjA+meSkmGamy/Af577twP/rseRJUdVJKU5JwUW+uNdbMIyipoNjhRx89XrnBDbja8R6+IJv5MLtiDzBzIFPsz1m/NucVaWDm/Lm7hqjrGKR4gnwEANUTRAB7UHMZ+apnlSLKl/pDoOmeBydrhJdg86AG4jQImex8iBFXfoHUu2l1CADQgtup58x7surwonlRNzsIZmOuTX5686P5WyJrJkXLPgsxPOj6fV6f8GNrU9NKiM/h7uWoPCJTTFNSzj6IklBehRslgPdnNrVeSEmsELL5rIRIibl/TOzhO6UUvUePhLW8T8PnXwxKqkbO1bpsJYhq0AcpKSPIavLefCDr5/rIHncyzfEV9tcetuTncFQUaT1FN8YxRPWAh9T0w8RpOvwsbQUPP7TeuKrNl2NZ8VX0ZEZH8Cf8l5xfUbh/4MM7mSPBWAgW3l51dZrmvm7uSpRJJrMS3TVJSG7DwrLwfmyj1h1NURWS32eIzuqy847n39hMd+qJaYnp29XCtSjPyd35KBjLOR1/bO7zUUlUQK2AhItt/s2Oto9wHPINF4fLLLlNOnBPHjLrLi1b9wcXwVgBic+lHriu6QiK8oHUyyL8TVolZvc657AruqIippvTEsCywz/4PmM22hmqPe4ZGFG7IcARjPeyP6GSeA0CDyinq4GXl5Qsf3fUyt1g9kMQVtGJXUeE+9MdheQ8iml0BZw0e4JLsnNJ5+RqBjqWVbW3P4Cj1Oq8mDtSez900xFTwRcWlmiMm+66vJh82RGe3Hz2pmoez6z84u4xJi8VleZC+giYFQmy8Ls6BLc1wELxoNMLxVT6NJTv8JoOKXNbxepEQMPNNF6GozRRajKlpw0OsRSQ0zkJ8NxQm98xMBW0uG2yVM9RdJN9OUT4rumZosxNWPmAMxlh1ftAWfyYELJGj3lCjf9fpiSwWWJ2KoPvlxCiv9HsIm8SuZMpk3a8t00HO5flbTXhQKnYPO6riumyGYdrj4kUIcSxZJJJZx6sJKolTxbBm29hGIz+HeHf98S4hTe9fSPG1rzIrpMyMnX7J1LIrYiyWfN8RLeQZ7n188SB6ef6OImcRJOHOEB2cUHEErCo25MN2+Kv02scKo2H6fwDiSHF+nExqdk5blpqylm6RujgN7mZgY/ceemJvJok6LHWP9mrC0yhtdKgGxRdMIEUGs1sOfHNTqmqfirwBU6EI9wTqyqns8VNFMd25KNYt/O2PjW/RGqWPDEzRgIq6X1a3SyZR0rcxEkFfL5zriywFLXQUihPiZNQ/wjQ+g598tTofVm2y8Z1ml6BMdk1QeQj7mJ1JjcZJO7cW6O29RKY1AwC/UMPye58n1CVYzqL+kwr6JHrO/lRARmKKsbcChOxW/x4g4NvkL7Tq0UXxP+RLMCaeTp4ORSk4GDnz7S+JNaUtq3dc+N6aANA0fHxY/FMsPfWaotQV2vZTO1tt4DwAMrOFR8l28NSSbgLf7IuME1oxk4tL1J+cXzwgGzk1x8vWKw8UBU6hmDM4wAkz+8JDq9b6VyGKA+n+CUGDR7oXo92+jd+AQixQ58g8hPhLyMsLaqtaERS+RyqPuUhbcSCkJyEGRSg8RG6IkRgAfSIi2N+4Q7HRqbahSZGp9tjuQfWD0Ptw6n1n8tvVIzTxVUqLDWsAGY8ENbn5TV8ObanKIEd0ej0MLY7MOUVJ6p8KRbsr8SCBN6D26kQvFHr5f0Q7YSf42vVY5Dc5mXZnQhBVeH/p4SLqDsoRUXOFVCOxAHdHCHEpvECHK8a4TVov/L0PSyzFYFmiFemiZDOY9cLfc3p27gvd9YfzT1Tx8HxLY+duMct92adOBx3HIN1oQEr4Gm+GEZOYCUhkZaCWKPtjMJIxAYwlAfSdUu/hytUzWS63mg8zo2mrhHz4B+3qw9LhjN5s1DfpC8/RSWL6iuntIOmrkGTn9HHcUjLApoKBHLk0qsg9ILVSVNeBCNx8Cw6FolGdh3RLLvAfTgVfUKk+S8vHJm/XWB49e44uH2LrgbvEYE7eyp/blOrE35rk5CDSfVdCIX4wUXKAcGt7fX0wzfjB/T4URfUsWT8ijOrDpc,iv:u9WL4gQQDlICG6pohgR1O259fx4sY0mCEH51cI+U8vs=,tag:SZFPbfveRjDoccRwjk5nZA==,type:str]",
"tls.key": "ENC[AES256_GCM,data:ucUk6fHKphpjz5ZC37VhelSmc63ptZXdQnv0dMoLHcbWUugMM2Is3yLR5M44hhp6KY6YPqouLzu9uHAUq5RkdPJseNIDidultHCVecIDYzeJSPQYNSq6KFTuu2aN3/r/2IZK9eFO3N2NKla7sgdyb6U+qPzwyRUZ6d5zOFSPjVIR7n7M5uESkVlm6YXfygOECmWywltFh5tyzWTYBCvMYnbZre07J1xHXPxsQya6jO2Qdscu/N+yyJaP3awv5afNhzzuCeGDbzhVLh4jRQ54fEHajJL+TNlIVXllVRW8pcThNV+dp5PNIYDa44wJHhwWfQ==,iv:arYXQaR3kn+d+6AY85Zf/NRbN9KOc4ULW9zFjljMw/c=,tag:s2VBfc86SF4On27kK3TBdg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"data_wo": null,
"data_wo_revision": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"id": "ENC[AES256_GCM,data:k50ChMjx6PyirOqKwGfwEMcS6MEg,iv:kr5Q6ZNzD0S7q0U/ITXh9EGntJuGA+JI9TM3wbInWlc=,tag:y42BYNenRSaAwbgA1wbiUw==,type:str]",
"immutable": "ENC[AES256_GCM,data:ocXgmIQ=,iv:wbMtPronbFt9R4pRBvJhdHO32qyAX5MxZU1lMU/qmls=,tag:Mhz1yteawU3durLWfQgIww==,type:bool]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"generation": "ENC[AES256_GCM,data:IQ==,iv:teHQYKEMmHHgBJt8vcI+0bP4jhGVoU5OmXQKfbfUsSw=,tag:ZFhmZ4gcBPO2KXj0oDr7Ww==,type:float]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"labels": {},
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"name": "ENC[AES256_GCM,data:akeTeJHpUef3LQ==,iv:q7KafE597jKZDTv/5otF2XOM+QO+be0+h+qtYrwF98w=,tag:8PBW3DKZ7dZLLE88X5mSpQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:6LCuoDv+Ul8FIg==,iv:pF2tlaEuCDeXUCn3wtiCB8Urfciwslz8BCj6kg/cJ/k=,tag:KZN7B5iwHheTk7zJkbYh6A==,type:str]",
"resource_version": "ENC[AES256_GCM,data:K9t6VwoF6U8U,iv:kpYudhJmYTrN5AAZ/UnI6zF2SWKsTkcGnwfWmHs/1V0=,tag:cyb7SANrvkwP5knjM9k1nw==,type:str]",
"uid": "ENC[AES256_GCM,data:LpbWSCZ+CrcrOiCBD1NgnnideqCC8HSjlx1Y+WWgPaUgy4d4,iv:k9DlVK0hsKyUr7H9My4YQOZny5C1aOVvsAKY+5HFdgw=,tag:aGe4jJd9mUZnoFhM9NgWLg==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
"timeouts": null,
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:DASNhIgpKoKXuGuWh1vdI6I=,iv:oBOgSl8nCeor5mDpJxWJWEwtYFdSKuBSmghycs8I0iA=,tag:qNaQDxMjmzzHl8MvbnhI2g==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:xm2CRA==,iv:KmKazr0teZvNYB683MG/h+oploDKUlu3Am9hUI/aMSg=,tag:0uf8W1dnBPYG1XN2Gmj9Iw==,type:bool]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
"sensitive_attributes": [
[
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:yRjnb1oeIWE=,iv:rhcV+1ZsZU8YZuVF1DSkS0h043bUBejHwGHL6VinNUE=,tag:EnM4tQ914niE3EoJOXVcgQ==,type:str]",
"value": "ENC[AES256_GCM,data:LYzOsgE61+o=,iv:u9PJkI0GT+lSpv6D96Y5w6HTAjGMGw/9a7Lf7KpYKdA=,tag:q5s9OzeMCmAoQAp1/mijsw==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:7+cpzqE=,iv:iLHwnEhBg5bVipMzPUKhX7uiQQTLPRVuS4VAe/gXy2o=,tag:rzkWrWcP3jj1pz+w07+tPw==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"value": {
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"value": "ENC[AES256_GCM,data:xw==,iv:rJpDl06uyr65UlEl6gQHtaMsVF/PvwLRbI/AsxJMYxc=,tag:dvNVYJUAiTEU3nh8VqF2NQ==,type:float]",
"type": "ENC[AES256_GCM,data:EMx77Gor,iv:WakcsRvH3TxXE/6LQ5uu1azVP/P6eVXJfWdF5/ObgUQ=,tag:G8vBDv8a/IHGiNaCMMb/yQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
},
{
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"type": "ENC[AES256_GCM,data:vJMD+rSdQpE=,iv:4bpbYUQNjJwA6EfZDcSIHEKNYrzKl58liw3PkLuDjo4=,tag:9zxRx2E+yPMf4whUUjvyvA==,type:str]",
"value": "ENC[AES256_GCM,data:ogbbqQ==,iv:HUn2uhW4UgpAuaOmh+N+Vrduq+vQ0NJDyetjUhAgGiE=,tag:feMs4iyfDmfSSKxqY2kPcQ==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
]
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"private": "ENC[AES256_GCM,data:nPWLGtCx/aLOxyxS2cKDlf9/MueCSZ0V2M3nIMHAmFrSiEfDLhoqX1INT++LQoKy0L0gJThOyKR/8SPGOGUSWxCJOBFSknnUeSi72L/RIdqZ9Tvz,iv:2lC6J9bT04ToIRUpTRgO7Tzpl6+zsgDE0zdQ4i7PC8M=,tag:yJerW7B2qk3+Wyj6TUu6MA==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"dependencies": [
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"ENC[AES256_GCM,data:gsYyhQPe9JU/8hoHP4xVFjAdVRF5fSZlWZCE3ezsdA==,iv:+HoAZ58THE3buRr2R+WJshNQaxEDxv0Antuxv79LbzE=,tag:Zoggw3fBIqa5RgzGIz373g==,type:str]"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
]
}
]
}
],
"check_results": null,
"sops": {
"kms": null,
"gcp_kms": null,
"azure_kv": null,
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"key_name": "sops-state-woodpecker",
"created_at": "2026-03-17T23:05:57Z",
"enc": "vault:v1:oHkicM3bqBQOh09Kj2GSwGn3XEgiYcze8eD+6c1GsgJTNZEJqpwWOjPBM/v3pErF/msiTahYE99NZ2Ft"
state: add Vault Transit as primary SOPS backend, age as fallback - .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
}
],
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtSC84UGZsV3BMT3d3Z2R6\nM1lWTzJldEtsY1FsWjFrMFQ2QXpFSnhXd2lvCmF5UUdNYU9kZFJMcGNCbVN4WlVX\nRm41NFlveDVleHphekV5TTVYQ3E5Y2MKLS0tIGYyRWhsVDY4eDRmUE4zSlNxZ2JE\naiszKzdHcms2ZCtJWlFZSjBEUWY5Q28K98zTczY2Q/lmZVH1LBAsV0n/134lEYAM\nAaLsXpUsWYQcpQNhiwkRSZXK0zkWldeThm+EPUnQq3y7i3BGbHE3jA==\n-----END AGE ENCRYPTED FILE-----\n"
state: add devvm as SOPS recipient Add devvm age public key to .sops.yaml and re-encrypt all 101 state files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWb0RyQ3FqN3NUK3hVRVhF\nLzlONEUrbzEwcm5ieDFUZW5ZOXVnczlJVDJzClc0K0JSTXE3aVlxb2t4TmxiVUdn\nRFhJcEhWMGs2QzY0Tlh6aTRuMzd6M0EKLS0tIG9iN045d25xcDEweHphektwS1F3\nK3cvSDQydjJqNkZwSEwrMi9STmo3SWcKjTobP16apfwryXGO7+//axJBYcusK9c1\nz6+xeDkohPPJYaQyRQEH/X4JBYvgKJHdolyvt9J7qsiDbIj/rUyz8A==\n-----END AGE ENCRYPTED FILE-----\n"
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
}
],
state: per-stack Transit keys for namespace-owner access control - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
"lastmodified": "2026-03-17T23:05:58Z",
"mac": "ENC[AES256_GCM,data:WWKGVk/Ed2H8Hnd6VokhRMr+CRhxWBG5eTLFGucWE2XSEIcK3KLHi4LK9JSuatD2jYV58LpFl3ktXhPc5SdRMShGIRyTBI9YiuhUj7Wc0+y9PWHCLt28hhlFhZol6ltIUmzwGuYrj5z2Bl18o5NNPUQCsBFuT74c+0Mpm/Strtg=,iv:p/eZ+ZIZpP7+L6xFf0YhRPX3D4jKpOgCpDYVCRL7F+g=,tag:rn0Hd2NnVaXLHjRzdZqUbQ==,type:str]",
state: add SOPS-encrypted terraform state to git - SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted) - scripts/state-sync: encrypt/decrypt/commit wrapper - scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy - terragrunt.hcl: -backup=- prevents backup file accumulation - .gitignore: track .tfstate.enc, ignore plaintext .tfstate - Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
"pgp": null,
"unencrypted_suffix": "_unencrypted",
"version": "3.9.4"
}
}
Reference in a new issue Copy permalink