viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/stacks
History
Viktor Barzin 3aba29e7a3 remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 
Vault is now the sole source of truth for secrets. SOPS pipeline
removed entirely — auth via `vault login -method=oidc`.

Part A: SOPS removal
- vault/main.tf: delete 990 lines (93 vars + 43 KV write resources),
  add self-read data source for OIDC creds from secret/vault
- terragrunt.hcl: remove SOPS var loading, vault_root_token, check_secrets hook
- scripts/tg: remove SOPS decryption, keep -auto-approve logic
- .woodpecker/default.yml: replace SOPS with Vault K8s auth via curl
- Delete secrets.sops.json, .sops.yaml

Part B: External Secrets Operator
- New stack stacks/external-secrets/ with Helm chart + 2 ClusterSecretStores
  (vault-kv for KV v2, vault-database for DB engine)

Part C: Database secrets engine (in vault/main.tf)
- MySQL + PostgreSQL connections with static role rotation (24h)
- 6 MySQL roles (speedtest, wrongmove, codimd, nextcloud, shlink, grafana)
- 6 PostgreSQL roles (trading, health, linkwarden, affine, woodpecker, claude_memory)

Part D: Kubernetes secrets engine (in vault/main.tf)
- RBAC for Vault SA to manage K8s tokens
- Roles: dashboard-admin, ci-deployer, openclaw, local-admin
- New scripts/vault-kubeconfig helper for dynamic kubeconfig

K8s auth method with scoped policies for CI, ESO, OpenClaw, Woodpecker sync.
2026-03-15 16:37:38 +00:00
..
actualbudget remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
affine add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
audiobookshelf add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
blog add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
calibre fix cluster health: resolve 21/23 failures from healthcheck 2026-03-15 02:33:46 +00:00
changedetection add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
city-guesser add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
claude-memory claude-memory: pin image to :17, fixes URL-decode crash on sync endpoint 2026-03-15 15:32:50 +00:00
coturn add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
cyberchef add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
dashy add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
dawarich add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
descheduler migrate all secrets from SOPS to Vault KV 2026-03-14 17:15:48 +00:00
diun add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
ebook2audiobook migrate all secrets from SOPS to Vault KV 2026-03-14 17:15:48 +00:00
echo add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
excalidraw add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
external-secrets remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
f1-stream add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
forgejo add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
freedify remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
freshrss add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
frigate right-size cluster memory: reduce overprovisioned, fix under-provisioned services 2026-03-15 15:30:18 +00:00
grampsweb add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
hackmd fix: increase memory for OOMKilled services 2026-03-15 10:26:11 +00:00
health add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
homepage add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
immich fix immich TF drift from Kyverno ndots injection, right-size nvidia GPU operator 2026-03-15 15:36:19 +00:00
infra add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
isponsorblocktv add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
jsoncrack migrate all secrets from SOPS to Vault KV 2026-03-14 17:15:48 +00:00
k8s-dashboard migrate all secrets from SOPS to Vault KV 2026-03-14 17:15:48 +00:00
kms add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
linkwarden remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
matrix Migrate Matrix Synapse from SQLite to PostgreSQL 2026-03-13 23:21:59 +00:00
meshcentral add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
n8n fix: increase memory for OOMKilled services 2026-03-15 10:26:11 +00:00
navidrome add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
netbox add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
networking-toolbox add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
nextcloud remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
novelapp add AUTH_SECRET and ALLOWED_ORIGIN env vars to novelapp deployment 2026-03-15 00:33:38 +00:00
ntfy add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
ollama add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
onlyoffice right-size cluster memory: reduce overprovisioned, fix under-provisioned services 2026-03-15 15:30:18 +00:00
openclaw remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
osm_routing add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
owntracks add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
paperless-ngx add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
platform remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
plotting-book add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
poison-fountain right-size memory: set requests=limits based on actual usage 2026-03-14 21:01:24 +00:00
privatebin add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
real-estate-crawler fix cluster health: resolve 21/23 failures from healthcheck 2026-03-15 02:33:46 +00:00
reloader [ci skip] phase 5+6: update CI pipelines for SOPS, add sensitive=true to secret vars 2026-03-07 14:30:36 +00:00
resume add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
rybbit fix: openclaw policy violation + reduce memory requests for capacity 2026-03-15 10:37:58 +00:00
send add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
servarr remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
shadowsocks add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
speedtest remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
stirling-pdf fix: openclaw policy violation + reduce memory requests for capacity 2026-03-15 10:37:58 +00:00
tandoor add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
terminal Add terminal stack - reverse proxy to ttyd behind authentik 2026-03-10 23:46:01 +00:00
tor-proxy add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
trading-bot right-size memory: set requests=limits based on actual usage 2026-03-14 21:01:24 +00:00
travel_blog add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
tuya-bridge add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
url right-size cluster memory: reduce overprovisioned, fix under-provisioned services 2026-03-15 15:30:18 +00:00
vault remove SOPS pipeline, deploy ESO + Vault DB/K8s engines 2026-03-15 16:37:38 +00:00
wealthfolio add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
webhook_handler add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
whisper add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00
woodpecker migrate all secrets from SOPS to Vault KV 2026-03-14 17:15:48 +00:00
ytdlp add vaultwarden daily backup CronJob to NFS 2026-03-15 00:03:59 +00:00