viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix DB password rotation desync in 5 stacks

Browse source 
Vault DB engine rotates passwords weekly but 5 stacks baked passwords
at Terraform plan time, causing stale credentials until next apply.

- real-estate-crawler: add vault-database ESO, use secret_key_ref in 3 deployments
- nextcloud: switch Helm chart to existingSecret for DB password
- grafana: add vault-database ESO, use envFromSecrets in Helm values
- woodpecker: use extraSecretNamesForEnvFrom, remove plan-time data source chain
- affine: add vault-database ESO, use secret_key_ref in deployment + init container
This commit is contained in:
Viktor Barzin 2026-03-17 07:39:29 +00:00 • committed by Viktor Barzin
parent 6656743968
commit 94717dcd32
10 changed files with 166 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

4
stacks/nextcloud/chart_values.yaml
View file

@ -61,8 +61,10 @@ externalDatabase:
type: mysql
host: ${mysql_host}
user: nextcloud
password: ${db_password}
database: nextcloud
existingSecret:
secretName: nextcloud-db-creds
passwordKey: DB_PASSWORD
persistence:
enabled: true