From 72720efa21cd0966f38163b29830e2b819dd0ea1 Mon Sep 17 00:00:00 2001
From: dtoro <d.toro.v@pm.me>
Date: Mon, 6 Jul 2026 14:01:29 +0200
Subject: [PATCH] Rotate oikos-console-deploy webhook secret
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The value written to apps' /etc/oikos-console-deploy/secret didn't
match what Gitea webhook 14 had configured, causing every deploy
attempt to 403 with a signature mismatch — likely drift introduced by
the earlier two-step PATCH sequence (secret set in one call,
branch_filter/active restored in a second call without re-including
the config object). Rotated cleanly this time: fresh secret set on
Gitea and re-encrypted here in one pass, single atomic PATCH covering
config+events+branch_filter+active together.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 secrets/oikos-console-deploy-secret.yaml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/secrets/oikos-console-deploy-secret.yaml b/secrets/oikos-console-deploy-secret.yaml
index 4e9695c..59f6bfa 100644
--- a/secrets/oikos-console-deploy-secret.yaml
+++ b/secrets/oikos-console-deploy-secret.yaml
@@ -1,16 +1,16 @@
-webhook_secret: ENC[AES256_GCM,data:xo9I443vTtLvQesuyEOmfduLbljaVSQeWf6B7d9Vjp6HoP92BJiogsrPXQ==,iv:HI6Q7OzS0dNjJVXfmxNbetjxOE5nAWQoaXSki0fiItE=,tag:bfnR5RmVmVd0ahRXIRV1yg==,type:str]
+webhook_secret: ENC[AES256_GCM,data:+/+IOmg+PC1IvItSOEl9PJZ53HhTBC1Qg6NGTQEW5K1mC/7YE1CQEpAr0w==,iv:rv9+eE1OhkudGtBB6VELcHWeDIQz6IvH3nl6H1y8nks=,tag:vzkMN8lfL3Sw1a/OA28i3w==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdzl3Z0dwU09aWjVBcHcx
-            ZE4rWHJ0aXhueXZmZ2NhSWlSaHdzUnRYR3hZClRVZVY4WDBTOHFnM251L2M5R1dp
-            T0ZQWmQrK09Uck5laksrVTZuckRqVU0KLS0tIGxKZ2ZUa09jdklWT2JPWW1KTVZr
-            cGFiZHk3YWtxLzFCS011cHpjdE1JTXMKCJXHZn7akExja+Xy9SeHjFoc1h/ctuQP
-            s1CUPsnZXPwOkxWSyqx+YEeilxwWlGgmWT4EZXAz/JcSRPyq8u+flg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNnhBVnpJaUFNcWZYZW5C
+            Sml0SkI1SVFVQ0hsSDkzMXBWNlZmQmRmRjNBCjZqNWRUQk45elp3VFRjUEpqVHFs
+            cDNBVmM0aEtJZGplT0EwU01RNGNxZkUKLS0tIFFJMXh6N2Q3Ymg4UXdoTExFalVp
+            dmpPWXlKT0tuUnhkc0pEUWFuS3l3OXcKCaSTvIPguiHnxPquk9AiT/zKBRNWvgxK
+            L4Iawa12jTsRSIM6Z+T8ow2eCz0P+dtrUmxc40WXmKR9OI9mPpZQOg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
-    lastmodified: "2026-07-06T11:14:22Z"
-    mac: ENC[AES256_GCM,data:J4KRkno5xwfs1za0PqGR7MKSuve9tTv5zBIb02nvD+pXTBuW5CzhnQM4YPTtq8NhSngEGJbVA0o5iK5aG3ezXFyG/m3JzACooN/3XHh3zvEvm/ZuubiV+mVhJYNv/+3/nK+jCeIJNrpmw8opAEE2+sy2cKryNUV1jRlw1GGFE2k=,iv:7PDWchlXYpDde3WsBiZ7UbO+XtMfeqPQO6JDf+/QXLU=,tag:HhfSVbDqtU31I5qLG/dMMQ==,type:str]
+    lastmodified: "2026-07-06T12:00:57Z"
+    mac: ENC[AES256_GCM,data:wGYgH6R6jReR2DUSyBQbs3xxF6tvD/conjODOri85ups9hMqxZUXGsxBBbshjwIZrs1LDOoDqq4tYtWcnLPa6awbx0gZdTe6AJji2ApFDf9Ah1MkysvHio7Qr7GdyxrJbdt80bfP/tF740m9iovv2eEUNJosQOnCz6NQmwd2nZQ=,iv:caYOD2gm596LrJjnFVG8UpD8x9TQaa2ixXreoYKUc3U=,tag:GYx6NpG/lWcuANhtlY3uLA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1