From f2c97d2f36484cd96365593ec1990115b9ce774c Mon Sep 17 00:00:00 2001 From: dtoro Date: Sun, 16 Aug 2026 11:29:47 +0200 Subject: [PATCH] archive: remove secrets-sops-backup DR fallback Infisical is the sole source of truth for secrets; SOPS DR backup is no longer needed. Docs (README, rotation.md) already moved to docs/secrets/ in prior commit. --- archive/secrets-sops-backup/MOVED.md | 10 -- archive/secrets-sops-backup/README.md | 63 ----------- archive/secrets-sops-backup/gitea-pat.yaml | 80 -------------- archive/secrets-sops-backup/hello.yaml | 76 ------------- .../hermes-house-users.yaml | 50 --------- .../netbird-authentik-oidc.yaml | 66 ------------ archive/secrets-sops-backup/netbird-pat.yaml | 36 ------- .../oikos-approval-hmac.yaml | 25 ----- .../oikos-console-deploy-secret.yaml | 16 --- .../openrouter-api-key.yaml | 48 --------- archive/secrets-sops-backup/rotation.md | 100 ------------------ .../turn-shared-secret.yaml | 66 ------------ .../secrets-sops-backup/yuvomi-api-token.yaml | 48 --------- 13 files changed, 684 deletions(-) delete mode 100644 archive/secrets-sops-backup/MOVED.md delete mode 100644 archive/secrets-sops-backup/README.md delete mode 100644 archive/secrets-sops-backup/gitea-pat.yaml delete mode 100644 archive/secrets-sops-backup/hello.yaml delete mode 100644 archive/secrets-sops-backup/hermes-house-users.yaml delete mode 100644 archive/secrets-sops-backup/netbird-authentik-oidc.yaml delete mode 100644 archive/secrets-sops-backup/netbird-pat.yaml delete mode 100644 archive/secrets-sops-backup/oikos-approval-hmac.yaml delete mode 100644 archive/secrets-sops-backup/oikos-console-deploy-secret.yaml delete mode 100644 archive/secrets-sops-backup/openrouter-api-key.yaml delete mode 100644 archive/secrets-sops-backup/rotation.md delete mode 100644 archive/secrets-sops-backup/turn-shared-secret.yaml delete mode 100644 archive/secrets-sops-backup/yuvomi-api-token.yaml diff --git a/archive/secrets-sops-backup/MOVED.md b/archive/secrets-sops-backup/MOVED.md deleted file mode 100644 index 3af51f99..00000000 --- a/archive/secrets-sops-backup/MOVED.md +++ /dev/null @@ -1,10 +0,0 @@ -# Docs moved to `docs/secrets/` - -The secret management procedures and rotation runbook have been moved to -[`docs/secrets/`](../../docs/secrets/): - -- [README.md](../../docs/secrets/README.md) — SOPS/Infisical conventions -- [rotation.md](../../docs/secrets/rotation.md) — rotation runbook - -The encrypted `.yaml` files here are kept as DR fallback only. Do not update -them — use Infisical for live secret management. \ No newline at end of file diff --git a/archive/secrets-sops-backup/README.md b/archive/secrets-sops-backup/README.md deleted file mode 100644 index af534a60..00000000 --- a/archive/secrets-sops-backup/README.md +++ /dev/null @@ -1,63 +0,0 @@ -# secrets/ - -SOPS-encrypted YAML files. The plaintext lives only in transit and in the -operator's head — committed files are always ciphertext. - -## Conventions - -- One file per logical grouping (e.g. `gitea-tokens.yaml`, `webhook-hmacs.yaml`, - `api-keys.yaml`). -- Recipients are declared in `../.sops.yaml` by path-regex, not per-file. -- The plaintext schema inside each file is free-form YAML; the consumer code - decides what it expects (e.g. `gitea-tokens.yaml` contains - `{"": "ghp_xxx"}`). - -## How to add a secret - -```bash -# 1. Decide which clients should be able to decrypt it; edit ../.sops.yaml to -# list their age public keys for the new path_regex. -# 2. Create the plaintext, encrypt in place: -sops -e --in-place secrets/my-thing.yaml -# 3. Commit + push. The 5-min sync propagates to every recipient. -``` - -## How to consume a secret - -```bash -# On any client that's a recipient: -homelab secret my-thing # prints plaintext -# Or programmatically: -sops -d /opt/homelab-context/secrets/my-thing.yaml -``` - -The `mcp` tool `list_my_secrets(caller_pubkey)` returns the names of secrets -the caller can decrypt. The MCP server never reads plaintext — decryption -stays client-side. - -## Granting / revoking access - -To grant a new recipient: edit `../.sops.yaml` to add their age pubkey, then -re-key every affected file: - -```bash -sops updatekeys -y secrets/my-thing.yaml -``` - -To revoke: remove the recipient from `../.sops.yaml` and `sops updatekeys` — -but remember this only protects future ciphertext. Past plaintext the client -already decrypted is gone from your control. Rotate the underlying credential -if compromise is suspected. - -`homelab client remove ` does the recipient removal + `updatekeys` for -you, and prints the rotation checklist as a follow-up. - -## hello.yaml — bootstrap decrypt test - -`secrets/hello.yaml` is encrypted to every enrolled client. Used by Phase 3a -verification to confirm the end-to-end decrypt path works on a freshly- -bootstrapped machine. Content is intentionally trivial: - -```yaml -greeting: hello from the homelab -``` diff --git a/archive/secrets-sops-backup/gitea-pat.yaml b/archive/secrets-sops-backup/gitea-pat.yaml deleted file mode 100644 index 6da5b05a..00000000 --- a/archive/secrets-sops-backup/gitea-pat.yaml +++ /dev/null @@ -1,80 +0,0 @@ -user: ENC[AES256_GCM,data:e6Dj7CE=,iv:Bf4tvdWQr0vdF3PShG2cRTryxqRC5rN6UdGd1qwFg7g=,tag:22rrPMAF97C2GUhRGgutOw==,type:str] -token: ENC[AES256_GCM,data:98bMZO2t0qgOO/rTYmyDBZdRTHu8iPgUsctS4dc0B2BCML6tBxBNhA==,iv:oXehq2FJy1pQxzK8M3LqDtjpoFbdfAPvYcKhygwf51A=,tag:RMYdimBwxw247OARznBu3g==,type:str] -scopes: - - ENC[AES256_GCM,data:S3nz8buLTp1PCHpf8F3Y,iv:IkHU+QwIlsxrNrGEu3tRS0zlnuCyp9Fs8ILxUaZrabw=,tag:Ufd+MVYXAAtbSbfvRi3jCg==,type:str] - - ENC[AES256_GCM,data:/UG/8LQD21l/Ca0wfEodKw==,iv:f3tW1ZNLLkzE5Oy8acQ6GfyDvzEH3++kp8duBOI8+Is=,tag:IgfhvEaX9EGyPHhr6FSAjQ==,type:str] -note: ENC[AES256_GCM,data:vRDjHXh5fYlhwJ4LyS/hcqMGdS+Z/D1W2oH6NaJak/XRUr+nFVQqcXSH/zUgqEBWNrMv6j8n2Ouxex/q2mr+p3Ds1jfThJTobX/MFqMkxvxk0TmB7ucui7CDa4mcVgSo3wyhcaba2o3erObByZ3o2uay3mmqzAUdo/wy2bCgQTkTG9/xqVSf3EYuR1j/A+SAzSvpsOORMNUjC5NRP1DUL+3hZkPXsfkXuy7sV6T2vF+oOrbEI0WxR8o4/JcF1B/4ezFAJ+f+nukCMz6eSCwur/wHffbcYa8mtD6BIRuV1pTd/Zob8arhe2ir19MB0fR27E3UkcCwyCkQ+QWuGzisvciCPtwR4JidH7xOpPW+4AK3vqEjmpEeMSWlyxbZadQFuSi8f3bPH+8eB2h/UFvT0BU6xw==,iv:r2dUnKyUWhyafIeDIjHOdqh+PNFzGtVZfcHc2TAhvvI=,tag:Cmg6esU4mQ8/9UbIQQL/gw==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIa05CSXpkcUsvbFYxcnNM - b2o1ejFFRVdUaVhzYURPRm5oTnBxUXgwYWtVCjY4L3hvcy9NMHpDM1Q0WGJMZ3Mv - aXhVek5uWkIrdEI3cFl2N2NUUjc2ckkKLS0tIFpSRDZqeE5VM3ZsNGdYTHRWcUQw - QkhSSVZkVm05TEp1RmFNdXFydVhpQXMKgpF5MlP8wkOLkbCxozmtG+axD32rs/SA - Oc1Eo/ggRT54EGCFoMPITnzsC0ELqZOnOjpZi2FU/Vh1pEhBXCOwJA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxeXFyQW8zb09QRm94M1da - ejBkbCtzMkQyaVF3RkxscWk1cDBiQW5SdmxrCjRCa1UvZ2VhQ3Rqb3pXcjN2d2dS - VlROVHh0ZnRWbGVhdDYvY0ZDWUUxNE0KLS0tIE9zT2VvZ2ZjWnBNYWxTaWtFVjkv - S3VIdUgydit1Wk9kMnd0ZDB5NE1iaVEKLvVToIX8zc6lXi0Ro59copkeCl19Nv3H - obbUoW6v7tVnM/Khiw0DhHzzhLbgLFfSm/e6h/8o4Wok8CSHvp35iQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlMy9nek80M3k2cTNPQlRG - WE42aGtsWllkaHZjOFg2b3ROdmZuWUNLQXhBCmNZZC9mSXNkU2xLUnp3MDNVZ1hn - YTA5TzRHNHJMN0xqMDhhZGxxSytpZDQKLS0tIHVwdHNRczZaLzRrK3QyLy9qU0E2 - anExUUFlRzdiY3dFbU5VMW83K2I0a1kKFaQVQH6mjh7I4r9UNk1Uvw2hyYnwLGSJ - Z9PxVOucYfODHoWMq1jWcW2vQQO5G8dWtE3S97yoqNVteAf8nmH4xw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDaHZmTzkrTjhETkttOWho - azcxb0lTNVd3aW5iZzBxUkNZQjE4T1EvblYwCnBSdFN3WFhBYWRFeTlSQk1MbkQx - bm9ORkJRbHhJLzJva1pvSDF0SU5pZlUKLS0tIEZLSmxBdmE0RHQ1Qk05MnBnUVlL - aWtDcTZHZ1BWWmtLNHEveEE2K3F0eVUKO5Yi/DEmFL5wJDL3XVFlRfWTjPTNVFKz - G6NPwO5qeC0kFCOZWtKU8+6f0m3tw2ZsNylntnCZbRScbshR9QhVEg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSkEvNm1NZFgxRlJaeVZu - TCs0L3c0UEpTWmlDRnV3QnkxUWYxTnFIZjJnCnlOMm5lOS9MbmJwekNoczZsZFFa - R3JKYWZoNjNLTnhscXp2UGVrOHBsUkUKLS0tIEx1K1lYODBuczllRkl5U0JTTGpC - RC9Mc2NyTUhPekJnY0VWSDVpZzlhVjgK1bFDQaqJf0Nz+IjTPPMgi5DxbW/ln5Po - SABlg3INzGh2pyAgOroBEKr0Dl2dU23/hX4uixP2YxkJRkbamU3+6w== - -----END AGE ENCRYPTED FILE----- - - recipient: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQUE3RHhGS01SYzMrZ0lK - elR4UEQvT0w1anVjeHNKN1JERGxwcUoxc0c0CmNLVEFVMWFDdGNlM3VLcDFueDNa - SW10cWhlWk5KMWtYMnFXTmJYbFQ1RU0KLS0tIGNHVWloaEtIeEVoREMvT3lqT3dS - ejZwcVhWS1NmNVByRGY0ekM4V2lKQUEKOWxj1HmtSPoungbzek2Z0okRS59A2QwY - /zXoEXgIskP9Rjr4zf29cE4RYSYW2UVU4aeE9fVA3Y+NrylGi5I3ng== - -----END AGE ENCRYPTED FILE----- - - recipient: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzYWQ4RHpNWEpKNWpMRGll - blpTUWpmV1lOZ3lKdUwwL2o4TzNMY3lnV0NjCmRUNEQ2OU93QXdhRURveXY1bE5S - alAwNzVGRVZtaXg0TU9xclJZMGNvSlUKLS0tIEM1SmY3TUhkN0FRb1JUMDFKVndN - a0dIZlZ5ODZBMGtEZmxiTFRNUEdKQ1EKXYAaezVE0H1viKEo49D60i/zqHv8xZsg - 8c4oVRGVW3wLzb4Dd4O2MvLpNpy1yRgd1pN+qUB/Pft2G3IwWWw3BA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-20T16:24:18Z" - mac: ENC[AES256_GCM,data:d3qcjEqpPIFeut634ImvISJLdit0MQWcdFYomrsqriqJ0NUKdyq3XCk85+vvPvDWikB4WEApk6HMXssSY8mhDci95q5Ssmr+JRAhLebMZjs9yXUf9A7vXpNFswmdldu3CKBiDrhm2GE08qUfsCkcf3jjihEqsfHhxMuWSd5fZpU=,iv:VZgvZ3bBArRChgRX38U6/43XoX5aTnts7Kd4S9spBPk=,tag:/5oOw5yvulvFT6KXv2zj0g==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/archive/secrets-sops-backup/hello.yaml b/archive/secrets-sops-backup/hello.yaml deleted file mode 100644 index 1cdf1474..00000000 --- a/archive/secrets-sops-backup/hello.yaml +++ /dev/null @@ -1,76 +0,0 @@ -greeting: ENC[AES256_GCM,data:eNMtZcpv04PHl/lGBZGBp7xAcO/5Sw==,iv:A4jtwePX0p/eDTP5+ztfV6gege9RwdPfLBY2N+DPfx0=,tag:MU8HpvLt/PUrNMw7BNUVIg==,type:str] -phase: ENC[AES256_GCM,data:oIeo+kmkwaMDQrf10iY2PqOXJnq+hCIwOROQ86xgpkU7EJEeJKFssrNgbvQPHhIRZUZblQg9ZPamiZixQbYSTOXQSTWWu2FOnu6XFb24wCay,iv:TYKqoHcN+V324/roNopYhkwRpmv3cPrTFcmni5TajYQ=,tag:g8DXqEyORbQZ9B7PaFWgOQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUFNydDVhMEpvMVNyMTk5 - N3ZiTGZibmNhWDBMajlOQW5BVGllQ0lWcnlVCmJsQVZ1Z0c0WTNIYWFYbFk2R2lZ - RkUyR0M1Tjg0SUxhY0RrU1FnYlNrbFUKLS0tIFdSWlllREpVUnVOVTh6dTRxenhk - WndBSEdid1hlRUZmMTl0a3d5N2lRbncKIkcQC2JTSxGES+DOzLCT3G8KrrIO2nUK - jjovwCLP1XxoTwXfv85nMPNwsJkCddg5sh/FXGTDglSBHfZ94RFeYQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZEptakpiYnRoaDNhek9E - c1NKSVNsZDBlbWhabTJ4NkM4RmNNTXVTS1ZNCmJ1RHUzNlZ3aGdsUHZCaXNEeTBM - TTIzNHY0Nk1sOGRCQkVyRlc5Y0s1VHcKLS0tIGx3NDJDRmZiYzdTTUc1clRkamtm - b2gxTGpZbEdVUS9oMVUxODkrVERqUncKTsngnt9pySyKqxhBOlDFbtqaO72Bq3Z4 - CNVVigYh73xWK8CHVU+nj0QG+VFnRr8FJhRxpxJw/ZfFpHvpSKSxtg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5eDY2V2U1YkJhc1ZwSVRM - d1NnQ1ZvUHpVbG5tWkoxT2N2M3ZRYml4NlJJCnJDVmV5bzdvTS9FZGlxY3pheDBu - VFRWZ3pCdUFFV1R1dUtTSmMzcHdrUlkKLS0tIGRHcThteTlOUUMxOXZSS2tlVVpt - ZGl0VkJpSlVxQ2pzaEdmQnpmY254L3cKQ51TCwCzDpN8T5qsozW2ScSiBvvERLg6 - p2128rIityffiCCUoOCUt8gHdqDBBivruVnofINlp7fN7m3xss6NcQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNbHBLU1pJRXlIWFN0MzAr - bnZUd3NoYXVsMmxKNkR0ODBlcFlDRkdTUm1zCks4Q042Y2dCTVV5OEJTS2REQm41 - b3M4RVM5Vk8zSEIyYTF4aDdJWDNKbHMKLS0tIGE1Tzcrb1VTUExieFRxNDJPSFFa - SkI2NTMxdUhraWduSHpLMmh3SDdZaGsKzjZvj1Y9UlEoGZp6FJoOxW6r7sX7g7Jj - FpK4QiUhiKztNeUIdx7abte2rKSFqyjLdq45SKdqi4Bg1iiuqh6Umw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNEhuY2Rrb2hzWTVFQlZM - VHJURUJxQSt2dVhqbTVZNVBBWVg3ekpBeFJ3Cnd6bmNEL0RTNjc3UXEvOFA2ZVhF - dThNNkd5R3c5L2JKRTA1NDhNRXYxU2MKLS0tIFFnVU9TK1JHQnhRRy9CNWpzZjdy - OFZYb3E4YlB5VlcvRVA0TFM0bFFLeTgKSFvNi+X2CI2zvWBdcctv26ocG07Xvtw1 - mstp3VQUhwMYe63YVl/liU/JnBSC9EN0Q0/8WdsVUycm2HEIRBnIUg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1Z3FRVzZWUU1UN0JUMGdw - T05yaU05Q2wzc0xpTGNkSThOY2U2YkNSQnl3CllYbUlwN3FxSHpaM2Ewa04vR09j - RlF5a25NSW8wc1ZteEpyR2NJdWl0ZWMKLS0tIFBQQmJEYWpNaTlTMXdqdFh0OCt1 - eDF0U3oxdXdQdFpNMjBBRGNFZnY5ZWcKvYjG2p6/MEd7VV5/K7tnNTqZC3R1BsVd - oAHqKo4+mcqyRaS0UYoSfiDo6XyTUXNk8n3zRGMlKuSaTqGVpv/PMA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPU3BuZ2ZERWJDZU0vdHVi - cmxwTFc2WXE1SjhBdmhnSUJIZVRrb1FHRnpzCkdiOHdFZ3NCVjM0SVN4cVZ3MkJn - NzFiV0tFMzJPUDB1Y21mSDZGOGVzOUkKLS0tIDFUVEpUd0NETy94KzlCSU5UTG5G - K1Blb2EySlhnQnFxUm1zNXNOMDRES28KXeFuHSpm3VrdVdzK1cMiFQQEzvjko/Xq - Bsfu3mZ7fNlHW5szZtAFsyxPyvaELCPGprKmQFzUn68GFtphJxmXww== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-20T14:39:14Z" - mac: ENC[AES256_GCM,data:CAoIW1sJkIbNoXMaVlXwfHdREzATNqDKpSN5ecaSiRARThB0/tcLNbkazXKyV1Rx5b+b3s+yCpBzwmNnH6ytaCzG5pKPcnfd6YJq7C5rm/EQHyaVGrPdBsSfqiz4yBXKClej//v3+qkD5Ls2PMppv5KmqigOKNQC/ot3ht2c7lM=,iv:eOmDDclksr9f9CDu6dJprSFwlWuoggzVFjyfqWf5Uhg=,tag:IU3sMlIi92ohM86zOIJdAg==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/archive/secrets-sops-backup/hermes-house-users.yaml b/archive/secrets-sops-backup/hermes-house-users.yaml deleted file mode 100644 index 81241ad0..00000000 --- a/archive/secrets-sops-backup/hermes-house-users.yaml +++ /dev/null @@ -1,50 +0,0 @@ -members: - "+491726924525": ENC[AES256_GCM,data:RA==,iv:FLOi3HmBPFtS8BAqPR9Epihs868OwAWs1t2LGjg9kGU=,tag:bf8PGNipOeepfnzHUE5KMA==,type:str] - "+4917622791635": ENC[AES256_GCM,data:Mw==,iv:onlvwM9nlAlXnL6f+BTRZlOi4+C6pryyiay421GY9WA=,tag:KiYrTcRlBNbB5mYYlb7GHg==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmYW9VS2FLb1BTVTk2OFZZ - Wnd1U2tnanR5N2d6SmNqdFYrekpzZTRMRGpZCjZhREcrY29qc2pFZUhnQnc3U1dE - aU5Kd1Robkk4OVd2M0ZkalBWMlQzR0EKLS0tIDJOTjkwR2htaDhDR0hqN0R4cCtB - dldLSHBOVjZxNVFZVUtkZm1INkdvM1kK2iaqr75MZ+4QlWaNOjH1X11zHbi4Ahy0 - ely7Fakx6wSoQtl803q6UyNJyIqCOavJKoLQw48FhAl2yGmv9KsvrQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4eXFvMjZXVWkvZnNLSGhS - eWJ3Q0M0QzlnYnJ2dTVhZGRtZ3Y4Ylh5NHc0CkVTRnNLa0NzK2czcjFSSmgxQ081 - ZVo2MzR4S2ZlY1AxZC8rWTJ4d25vekUKLS0tIEFnK2gvTVBUWk5jOW1NaUtXTmRL - U1FCaHZjaTUwZ1RGVlZkZ0JzT1NOek0KceYGFDlpcpAQte0yqebyuQBxr00/Rurh - McQ607wCQWbGKkwkHCDi1VGqqokvbU7MRT9iOBLLBlxEF+KS9UiYuA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6aXRkd3d4ZTV0RmltR1JN - bFg4VU0vMDVuR0cxc2I0b0NRRUQyQlE0RHk4CnpPaUpGMEh0Unk4d3BDeE84Q0px - RnZnUHRQa3BJQUpGWUFZd2dLczhmc3MKLS0tIE9NOUNacDM5dktuWWZ2WWRxajZu - Uk5Gb216dmdvUkJzYkoyWE5yQ044eWMKSGR5dDya0gyBWDMB+NSudXK38VQYP88y - M6lyeZUAJ3cFydjyE1PjyllBehX9tYh/rh9RS67y/zRSmkXH5e7eAg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkM2I2MkV6NlhydURwYk8w - ajB1cEtiQjlLYkRGbDZXTHkzTWxuNW53NTJVCmJuMzJZSlNtU1BxVFNpOWpSVWp3 - TmxOeTRhRmZlanp4QmVmRjRSOElHL3cKLS0tIHp1MzZQUlUxNXFlS1B6TWhQdzhE - ekFibGF3ZE95K2FjZmZmVGkzek54R1UK7Au0Op4P+JZjHIiJJ5effjxjeAJItXw1 - Wrq8Z6D9NZTAZ2TBUGpdqIZcZhBiOuqxdNV88ZHOu8sjT1SLwm17GQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-06-28T14:50:45Z" - mac: ENC[AES256_GCM,data:7gWwrXY9q7zpiDZgFidEMa4VbxJ0uM7HdG6Ea8P4fbISgRnOx+aoAwznEQ+K/fIBsa1qtiR82lIxsNr6b44W4jmFF3+rPAm9DMs6ImX1KIVCW3GVptM9fMqOxnCI7RGMKKwWYxkvfE2lwl5EsBljqqlsuxDfX26etfqukIhbOIY=,iv:6iI7Q8wFKguICPtFvZWshok7BkEUUITp5XcSYt9hwFM=,tag:jIOzsy4jiSvuHh5GNQsjpQ==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/archive/secrets-sops-backup/netbird-authentik-oidc.yaml b/archive/secrets-sops-backup/netbird-authentik-oidc.yaml deleted file mode 100644 index 81f8d421..00000000 --- a/archive/secrets-sops-backup/netbird-authentik-oidc.yaml +++ /dev/null @@ -1,66 +0,0 @@ -client_secret: ENC[AES256_GCM,data:p8csBIMAuDb1BYLLL9aYIifShpw9uIWm1Z0c59SlzBDP3SJD4I8Z6ipYBETisgxcECr+78zs2wtuebtcHZ3DBqF5PZaG87TJEGotTkjOVSjDLKgelMq0TDfnpWyR1yedsi6/SiRhm4ggTz0Vwwo+TLDNkw3Gv7EP7fZQphYdMyA=,iv:MZcvhiBwDc8FWcNqQvCiTL+9OVEfHpZrzt1kmcKcxdA=,tag:FmEIrw7u2wYiF3ksymC5lA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhYmFWOGllS0ZTeU5yUkdO - QUpHMHdXUDZsY3VFaFJjbkQ5aDJVUk5RSG5vCmJ5RWNhZXZhdkJwdUk3anNjcWlt - WG5WSjA2UzN5TmloUm81VVo4eGdCdDAKLS0tIGtpclRlcjhlSDJnSFBmUkluM3Rz - bm9NK3Q1NEhMSStjM0hSSXlBVUlab0EKeR1I/tAHV0ivIeaJkr0OC8W54Wvwpyuy - qc5QCjXeD9tpMltakMFqk+tDNtItRebWO33RD9TpSkryPhiYxywF2g== - -----END AGE ENCRYPTED FILE----- - - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZelpTaWIwbFN6bUJRemZu - blF6VnlqZDdKNFpaY2ZXTTZCVVZETmtxUGlZCjlEaVIzc3cyVmxXQmNDRm5JdVpJ - bm9hbjNZNGVLSldnak8wWDhqZUpqRGMKLS0tIDhoUTJjU3FDRjdYcFNmekJ3dXAv - QW1tWElyWGJPSldhdWF0ZkFTekVoVDQKlBub868JsuRRrPrHkopMyD+GkeQo7lSn - s7WoYd2q0oKeF4JDgO9yNZbH1zGg+5Qa76wnOqk7z2zphGIpADmyaA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1Zzc5NUJZbjNVQVAxUDdi - WVIvUXZnK21uWmlWVUVLWDBrdmlnZFJlbnlvCjhsRG41NTdRU1NrOTRlMStzZHBl - M3ZZUkpPNFBaRERLUGQ1cGZKTVAxdGMKLS0tIHYzdytHdmJWWHc1eDdHUUxNWnBl - TzJBTFhxZy8vWkFGNnNTNVZjK0ZIaUkKpRokUUB7W1Xt9jP7eVQw9Hch7Fn2oEQM - cuWcayD3w/DliXsEuS3ZGwn7bjzbJKLpDZmcxCNTwd600UdokAc/rQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRUdQZ2k2T1AydGlBRWg2 - YUtVS29BV2VDWGVzV0xuYkF3U2NvbzdtYzFRCkRkK08vaDlOdEFsVHhCaEJ5cXZz - bEZ4cUxjem5oM3RlZm1JZXdUcStGZk0KLS0tIHM1a1VYS1krUlg2OGVNN1pCdTdT - TVVLK2FBdlRWTjdqWEc0WXlibytJczQKUoAigx2KB4JYy+LxbpAdUcuTW8afL7hz - 9eTizEzZRphfoEioIvIes+sLAraTj1hQH/jSFYaM9iS3sE2Zz8u35Q== - -----END AGE ENCRYPTED FILE----- - - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1cXRIWk54U2VyNVNuRGl1 - WkxlbFBMa24xdStmcW0rTUJFcUdDTUNqdmhnCms0cmdIUWtUYXNpTHBOVHB3czZn - Qmh1UFh5RkxXdlpPa2sxK2c1M3RmRFUKLS0tIHFYQU9jUzdqQlVRZi9RNmVzM1ZN - OStmN2VQWHhXMjczRjdtYU9wUUg1WUUKrkjJBSPWowCpNFtPm4kvQKTiKBAquilo - fwV5/ds2gvsidoTeC6aSNIP279TZu+iT6n/K6vdt7h+Gz0Xj5YbyNQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArbFZkV1VmWXFvNE5pMXRq - a0ZDZUVsRXJvVUVNTENDbG15MmV1ZDJ4eWdJCnJWY1dhTlRkUUd5anl2c1hYajhJ - NmNzai9GSFVralRnaHg1NElIeFQxQVkKLS0tIGROK2pGMS9mVTJpanFxQURPNDYr - ZzUwdDBEdS9kNSs5bDFYV0FUT2xuaDgKOwWcRF2vk82imiho3y8RliyBYzhG7AP8 - NIham/3UzYOLViPTHmMhNY3fEwUf7pv07Z1tsAglnPm3iaxbBl0Gog== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-21T20:13:20Z" - mac: ENC[AES256_GCM,data:bi4o17skIOtZoxJGzLFJ7IAv+X265qIhgnQz6wr4bch2xofwPZZfzECck0I0xDhcwxcDtx3VZ5E2VBdvHWk+iSan+clRq7735k9+DIpjdWaGxIHuylmelZl6aE5kE36UO7fQdnwmiqCPHxiVq/sKuqknFXkl1+FvO1ryrtSHQsU=,iv:xxm+5rK7o2c43iGS1j2Q274QCRsbDn+k+wskpp5tzeU=,tag:sZHk9eth/TwqM8tIWSrv3w==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/archive/secrets-sops-backup/netbird-pat.yaml b/archive/secrets-sops-backup/netbird-pat.yaml deleted file mode 100644 index 1117f2c4..00000000 --- a/archive/secrets-sops-backup/netbird-pat.yaml +++ /dev/null @@ -1,36 +0,0 @@ -#ENC[AES256_GCM,data:yB1EyrABkGl4G+Mq67djNXCuySBS1TDZjKwtko8hfZi15br6+L9dlwhVTHrzvHAdGYOvkZu/dCssii0kKXC+3QeJws+SfwUV,iv:r7bb8QjkyfeaATPKN3VzO4H+ykQTyUKRMxoE9bmGo+E=,tag:TA0actRKQmYsgCMAcvQkjA==,type:comment] -#ENC[AES256_GCM,data:oVH2uanu0pyv7B0SKiaSKfAXWmKAimXKR2mHKi/+hvFIQGzf3mYTZ5zGMQdBCLoy,iv:pgQrEqMZmynEHfIIHHi52xSNwn0/uQ2ccnK0T9T/Z7U=,tag:8hdflKb6l7HlqHTto8eEyQ==,type:comment] -netbird_pat: ENC[AES256_GCM,data:cz9pdu7aLR+vKV9QbQ2PtKWf5j5PWxcHEWZ8IEseHS/qPdR4M8282g==,iv:3MCOU0q/7nqQCD6+7qWq++XR9uHi5QHZoenCIT2aYIk=,tag:m4ZE4pDycjwGxoLi1Li1bg==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpYVlocHFacWxtTnhPeTV1 - SnZqVUUwbXVId0dKNTdmaVQzSUcrT3gxYTA0CloyYm1oQlU3QXVUNVIxTXpGQkN6 - cTBxTHViZ0E5bEF0dmx4S3l5WVJZOW8KLS0tIEQ5UmJGZG5aVDhGblFDREc5M1dR - ZlJ1UEVLeWFsQm0zQ0Q1Z2pTbEpFenMKsw+gfYZ+sby1crIyfoy+yGIaQ2WZ2KYU - YgsXY4Vt5b5DC0u/sHKaqXH3bw8ooBQ7tR4WX3JvU6emIAJU0rAuwg== - -----END AGE ENCRYPTED FILE----- - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaM3NXTExiRzZ0VWdRR1RH - RUlBVVBTWFpUQWtCTnc2T0VqMDJITVFiOFNnClZRbElxRFlGb1orbThmdGI3dFRM - V1Jqck9pRzVjWGhVQlIvVUFLMXkyT1EKLS0tIGY5K3g3VDJjUHpjSTNrOTRBUEpz - dHBmQ0FpeHRSc1ZyMjJHdU1pM1FzbFEKqIJ0qC0SY0aSceh0ZhGVDMb/WCkh1JZZ - E3cP7r4Sa6rMZXRR4u23wTHnrckdHgwxSSXYYymy4ilXhgiFQ3ZTBA== - -----END AGE ENCRYPTED FILE----- - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhSElYV3dkMU5hR1Vnb0tl - L1R0SG0zeFRuZUd2aTVVaU1leU14bHJjVWl3CjhibVp4NWFsazRYWkl4R1NWTUdk - TFdrOXc2OWY0aWxUb3NqM3R1T2xVVEkKLS0tIHlUZGUrRmM5VVVTOEZNYTBSZ2s0 - VWVTdXlZcmJqeU4xc2NLSDY3MWNUUVkKix4IZEbRI7icZciI7bYzIvDiW4M3Nb7O - uopkLc9bC/E+qK9H7jfySkk/zIeW1s/s7fBEKB5utUVpvmKzUB24pA== - -----END AGE ENCRYPTED FILE----- - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - lastmodified: "2026-06-03T19:57:46Z" - mac: ENC[AES256_GCM,data:zez2CaP1NPJJnUbEWT58If6jKxFiAudRRPKVJCzbjtp0loFohvOHt1nFY3g0XldqkNngsSZ83GOeJ9g+CvdD7/plkmjz0C04uHWahnNhjAwNRiN32xt31XFqEejScOHW4dbOunX8wXuQ0Q4SrSLTl5G9O/qbLwlwEiqp8KxwRWA=,iv:ctqQ9TDUM65POxn4v1iILubygU2lloCLz9u0bAP6gsY=,tag:05FpkqIhPRMX5hYopFNK2Q==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.1 diff --git a/archive/secrets-sops-backup/oikos-approval-hmac.yaml b/archive/secrets-sops-backup/oikos-approval-hmac.yaml deleted file mode 100644 index ca2177b5..00000000 --- a/archive/secrets-sops-backup/oikos-approval-hmac.yaml +++ /dev/null @@ -1,25 +0,0 @@ -hmac_key: ENC[AES256_GCM,data:KEvRp+N/NYHlTJZoehf8cehYMpShnP43s+KWX3OR6p9udA4d1B2lMqXFhrXHxEuWDzLdfOP97AG19DDYgjemPw==,iv:SH8cyI9HP974Af54v0ecwN3ICnX+eBudP6XwB/9nwMU=,tag:VzyLoHy5LRa/5hjL43O2eQ==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQ2s4QVJQY1VSZG5JN1NL - Vll1MGZNSGIxQ0NJZEFpYUJ4OWxweXFOUmtRCitsODBCTVhMempzYVFpNHpmNWds - Qk5SL2pOUGVkbzBtanRmM3BVT1JwYmcKLS0tIGpTV3k5OVF2aXZFRk1JZDVNNk1C - VkY1SXpQS2YyM2g3TGpDWG9HdEZqTDAKYhb7yKywJ+jj7ChWCDRmhHsYCASMxBgd - hLZV9pmIYCC4jse8q4wJK+tbT+Za5mklXt+j8nZoqm+sA0+MNlnV6g== - -----END AGE ENCRYPTED FILE----- - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHV0F6RzFiVHF0bS9pNER3 - elQ1YUorYUsvVC9zWXVBeXYzcThOU3JBbEVZCkxMQlVnMVNtNElibGhUaHhJM0hO - cXhFUU5KYzAzQUREMVNJTjhmYlpXekkKLS0tIGhxb3Q3blQ2a29YM3VLdWY2aFgw - Qm9HUEl4ZEd0WDVOZG96WXdORjdGVmMKNDNwkB4IF1xcFqG79dnUpHamOzlwQZJt - 3qfpdXquDeOOomnk7FLlnF/IqyHnhXNGqg+W1XBbZpwvqcAGtTFxQA== - -----END AGE ENCRYPTED FILE----- - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 - lastmodified: "2026-07-05T21:11:20Z" - mac: ENC[AES256_GCM,data:yz52Q1+49ntOFMESD3QHb5yGE7LB9SfSnHIWeMmYllaYTqR/rcNSXAb/b04ZWvLHqESGLLfZif7gNQYx3Fes0AFnAccowec7IWk/wNY0QoHLA8tZOw2Y1J1Hm32uVOWLl+G6MQybHGt9vHPlz33CLDeB/V07j7WjORqtYjVl8A4=,iv:zvx/bV3WX48OzN3Hi+moL+cELOHaw1SzW/eSCjJ25bg=,tag:DiIZfLyljK+xB3NjZsrwlA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.1 diff --git a/archive/secrets-sops-backup/oikos-console-deploy-secret.yaml b/archive/secrets-sops-backup/oikos-console-deploy-secret.yaml deleted file mode 100644 index 59f6bfab..00000000 --- a/archive/secrets-sops-backup/oikos-console-deploy-secret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -webhook_secret: ENC[AES256_GCM,data:+/+IOmg+PC1IvItSOEl9PJZ53HhTBC1Qg6NGTQEW5K1mC/7YE1CQEpAr0w==,iv:rv9+eE1OhkudGtBB6VELcHWeDIQz6IvH3nl6H1y8nks=,tag:vzkMN8lfL3Sw1a/OA28i3w==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsNnhBVnpJaUFNcWZYZW5C - Sml0SkI1SVFVQ0hsSDkzMXBWNlZmQmRmRjNBCjZqNWRUQk45elp3VFRjUEpqVHFs - cDNBVmM0aEtJZGplT0EwU01RNGNxZkUKLS0tIFFJMXh6N2Q3Ymg4UXdoTExFalVp - dmpPWXlKT0tuUnhkc0pEUWFuS3l3OXcKCaSTvIPguiHnxPquk9AiT/zKBRNWvgxK - L4Iawa12jTsRSIM6Z+T8ow2eCz0P+dtrUmxc40WXmKR9OI9mPpZQOg== - -----END AGE ENCRYPTED FILE----- - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 - lastmodified: "2026-07-06T12:00:57Z" - mac: ENC[AES256_GCM,data:wGYgH6R6jReR2DUSyBQbs3xxF6tvD/conjODOri85ups9hMqxZUXGsxBBbshjwIZrs1LDOoDqq4tYtWcnLPa6awbx0gZdTe6AJji2ApFDf9Ah1MkysvHio7Qr7GdyxrJbdt80bfP/tF740m9iovv2eEUNJosQOnCz6NQmwd2nZQ=,iv:caYOD2gm596LrJjnFVG8UpD8x9TQaa2ixXreoYKUc3U=,tag:GYx6NpG/lWcuANhtlY3uLA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.1 diff --git a/archive/secrets-sops-backup/openrouter-api-key.yaml b/archive/secrets-sops-backup/openrouter-api-key.yaml deleted file mode 100644 index acb83063..00000000 --- a/archive/secrets-sops-backup/openrouter-api-key.yaml +++ /dev/null @@ -1,48 +0,0 @@ -api_key: ENC[AES256_GCM,data:TbPkuLCidS7cg52DYb0MOCui3TsaiwkOWyYLhp6gcvXI8TqvXej1tNsCF0TNAIr9vvnFaYno/UTEPiOKe/EQqR8uQMyWuvsmMg==,iv:bahy9ae4Qxvkv1OAjx6LwzK5ggqDh2GVHDj95PVP1Mc=,tag:J7PajLaeqFOdz3FESYZmSQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4TFVsb3VYWnVFcnhRL2Vz - SVp6cG9CYzdqSFNkTGhHSmtlRDJjVWwyK0RNCkdEcEJtNjB0aHBZQVZBbTlHMTla - cHduT1lyTWlESmQrVHB6NU9LTmU2MTQKLS0tIHkwQXM5TzZCRXFsOHdjYThZQ0Z2 - bS9wOTBDenRMb2hGcmgrcTl5R3dnTG8KZfSI1pnfpcqtD0Z5N6hONSeuAaggCkZI - VJgh6TF7soOHbvddcNc5RINHQI6XLOZAeSOzvKm3zT8y5xe48Ff+3g== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkb3ZmZmpPZDAzZzB5SmNx - SHFKT3JENnVwZUttcFNYd3RoTHI2MCttQUNFCllZc2Z5Y1dSSnV0bW1LeGJvaURh - TlZGWjhseUdjU1FRWE41aTlMczI0U28KLS0tIHpzajRWWmlUU3FCaEFWMlBsVjBT - bGVRMGF2YjVwcVNCYkNEZVM1TmsyUncKYLscCS6BD3fwVmK3JnkISsEhXvhuRBnr - tJ+v7mcEXj4pz8FjIyY6MG3T+EXx6+HwuWtPyxbmEfqnxu2Ocfg5Dg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUSCtGaUdaR2pVekZCUUkz - am1pRTJSdzgvUjJsTlpXVE0rVlczOFZ3aGpzClJNVXRJV2JqbHB5ZEUvUFJXR2cy - MUpad0ZMYUI2MmtoUm8zcG1RS01WcmMKLS0tIGsvVGhITGRsQkJXcUdmQllOVEVr - QnN5QVZXcFR0cDVab09hcEFiWjRoMmsKYo5ThhNgdp9GUXZkyF6JGGdWnmHmZK5c - QIqk5L5fYq+Wif8bKUJBEv2fGyJJZD74AOCFjQUIDgBnLx2tK3Kf4Q== - -----END AGE ENCRYPTED FILE----- - - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiVHRnMTZXK1FNWmFJZlF5 - MWk5cjRHQ2NuRWJrMlhQVXhPL094elF1MW5VCkx5TklkR1VQSXc1OTljaXBFR2FQ - WEtudU5DNUxTWGNpbUFESjBoSkh6bVUKLS0tIFFiV2NkcktOdnF1djY2UC93OVdF - Unhpa0h5RU9xUHNic0hXVGhqSUthN3MKMAOF3gxkJVFU9aKqeUaViDs+Ka8NI4YQ - Bb8wPf9BcQe0NPjVMrxxP7L9c5oACiiNuA/46YxMYu7K1dOj0KapGw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-06-01T21:23:34Z" - mac: ENC[AES256_GCM,data:DXvUZUOMKQA0aDpN1foKy+aHhBh6daGSRJM1FagTh76qutk4XF9Een9iyy9sQ7olabCjf3oUezvU7XWB83bSDD3e23CFuweOl0RreRFqIsbXBi55Dbcxw8+9fvMyOK4PXu6mkT/PRao/XR5sSMqiHt3FoJbjazSaJlI5teeVXbM=,iv:IICO5ay+KqkTikfxW4kqB2qcSRpbsOP1NjGWtCB9uqI=,tag:MX2TqUxre+ff3RszCfXeFg==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/archive/secrets-sops-backup/rotation.md b/archive/secrets-sops-backup/rotation.md deleted file mode 100644 index 53e2440b..00000000 --- a/archive/secrets-sops-backup/rotation.md +++ /dev/null @@ -1,100 +0,0 @@ -# Secret rotation runbook (Phase 5) - -Rotation cadences per secret type. All rotation is automated via Infisical; -this runbook covers the manual verification and DR procedures. - -## Rotation schedule - -| Secret | Cadence | Method | -|--------|---------|--------| -| OpenRouter API key | 90 days | Infisical rotation policy → update `OPENROUTER_API_KEY` env | -| MCP bearer token | 30 days | Infisical random password generation | -| Approval HMAC secret | 90 days | Infisical random password generation | -| Matrix access token | 90 days | Manual (Matrix does not support automated rotation) | -| Age DR key (SOPS fallback) | Never | Static — stored offline for DR only | - -## How to rotate a secret - -### Automated (Infisical) -```bash -# Secrets managed by Infisical rotate automatically per the policy above. -# To force an immediate rotation: -infisical secrets rotate --project-id $INFISICAL_PROJECT_ID \ - --secret-name --env dev - -# Verify the new value is available: -oikos secret list -``` - -### Manual (SOPS fallback) -```bash -# If Infisical is unavailable, use the SOPS DR fallback: -sops -d secrets/.yaml - -# To rotate a SOPS secret: -sops -e --in-place secrets/.yaml # edit in place -``` - -## Rotation verification - -After any rotation, verify the consuming services still work: - -```bash -# 1. OpenRouter key: test Hermes query -curl -s -X POST http://localhost:8092/query \ - -H "Content-Type: application/json" \ - -d '{"query":"fleet health"}' - -# 2. MCP bearer token: test MCP connection -curl -s -X POST http://localhost:8092/query \ - -H "Content-Type: application/json" \ - -d '{"tool":"list_entities","args":{"limit":1}}' - -# 3. Approval HMAC: create a test execution -curl -s -X POST http://localhost:8092/query \ - -H "Content-Type: application/json" \ - -d '{"query":"restart caddy"}' -``` - -## Disaster recovery - -If Infisical is completely unavailable: - -```bash -# 1. Export SOPS DR fallback -oikos secret export-sops > /tmp/sops-dr-backup.txt - -# 2. Configure services to use SOPS fallback -# Set OIKOS_SECRETS_DIR=/opt/homelab-context/secrets -# This switches the secrets manager to SOPS-only mode. - -# 3. Restart services -docker compose restart api hermes notifier scheduler -``` - -## Restore drill - -Run monthly: - -```bash -# 1. Export all secrets from Infisical -oikos secret list - -# 2. Simulate Infisical outage: stop the container -docker compose stop infisical - -# 3. Verify SOPS fallback works -OIKOS_SECRETS_DIR=./secrets oikos secret list - -# 4. Restore Infisical -docker compose start infisical -sleep 5 - -# 5. Verify Infisical primary works again -oikos secret list -``` - -## Changelog - -### 2026-07-07 — initial rotation runbook -Phase 5 rotation cadences, verification steps, and DR restore drill. diff --git a/archive/secrets-sops-backup/turn-shared-secret.yaml b/archive/secrets-sops-backup/turn-shared-secret.yaml deleted file mode 100644 index 882f1701..00000000 --- a/archive/secrets-sops-backup/turn-shared-secret.yaml +++ /dev/null @@ -1,66 +0,0 @@ -password: ENC[AES256_GCM,data:C9uA7LHAc/SmWJsICGMNLu2OOYyowIhLq/sTfuNo/w==,iv:211oFm7MdphnXwYszRxWrHLeKw7qeh0BNzP0yomTUTk=,tag:zfhfkzLm0AivKwD7TZTEqw==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3S0pWdGZGSFcyTG1pMnMr - ZWpOQ1RpR1R4T2tDYTNMdmNtcnFwVzlCRHhFCkpJQm8zaDNnWS80OHA4dksyTE1P - c1BnenJ3ZWRESlRNajltWXgwUSszYzQKLS0tIDcvdk5CaHgwWlBQanIzYmJ4V1Z2 - V2pEb0M1WmxGZFF3TmZacXFBakNpZjgKyv7Z3XvyLYTGoyS2e8ptPgIALQWKi18t - b3qO9TTY98HGUwTLBU7Tf3IcHy8aO+u67sCVMbDhfFTd4g0bfdrNOw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByZGI0ZmhWMVlUT0x2MkpM - dUk4cFBZSXFYcHd4dWt1d3hCYlFzUkJEdEJnCkdIaFBDcHJyS0p0aUZXb2xKckIw - Ky9CT2lLWXp4dkUwNEpoRmd3YWNDaGsKLS0tIHdROUx1Uzc4NEVrZnBxMHVmUi95 - SXdZaUZGZklIalYzd2xZdjZtMFQ0MnMKxEKbyLvlwdrDx4G1CmUs2qs1nJbdIlSu - coXVNnkbt6FIzNO08DxTGBP7Q2XQWQKMvRpBFDYYUssOGBHL3JPVgQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWU243SmlKVHRwKzMvaFk1 - U2ZpcnJxK0RwZXhzWFpQOUNyS0JOZlljbFgwCitQU1hTbzMwNlltcUZaSUxXK01T - VGFxLzZCZGZsUEtXWjY5b2dBZmxDcGcKLS0tIDM4S0Z2MW1rVmlyZjJ6N0NZQytq - d0xLUlNHdE1mZVhOZjVManA1OXhBV2cKgoo6S6kVypzCljJSqSRQP2fSYHizdZQF - H6GNSOCj5fYbkZQwa3WUyun8YRl0BMgdkg1Uym++b2EGGCOFoHSuyg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrWU5PKzk2R1h0VVIwMFFl - MzBCN1BXUGdvS3FobkNiTGZWRnVkckVWUGs0ClVSaVEwclBDdnkwalllUFF3T3ln - V1dHL2Q0MnR0Nm9BUTdIbTRVUlJQZk0KLS0tIDRjd1hjT1lja3hPS3FyQndnNXJi - SzczZU1pVG5xM05TMUdtcHNNbHE3WjAKITW1sBP9TqZ6+cKNMnvQPzuNAdawaX8m - H4aAjlaR+BCrJPNJmv3J+VT3NZxw8rFIKQBu+c5h9RaU3RX1o/A2PA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3d0p3Z3J6VXBvVjZpMXVa - TDZ6V1BEdTQzYzErMitDeHpRT3NFQ3FVRURzCnlWaVkzYjhXbStVSmp5eThBcXZY - RG5MQXpWYXB1aVhISmNJZ0p3K0k4akUKLS0tIFJWa3NkQ0tEc1NscHRjR2FmalpL - SVBrem8yT1FqRjI2dlpQTzB1N3JSWXMK08Gj8cRPmImMVPbS2/0W2qHqJCZ9Gy9S - VgvSaI1PX1ieOkpqvl6nNUfWLzykZkdcAu9DhHC9MSwDDYy8vOBHPw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSdVBpMmFEcUZkYjdKY1Qz - aCtWOXFoc3FGd0dZUHNwNExuRFF3cDhXNEhBCnQxZWNkbmxQMnNSaGhjS0E3TS82 - a25OVytyK2lnUkpwYmRIUEJmZG1yLzQKLS0tIFA2U1VVUzdNb3B1SUFnZmF3VndQ - R0NuY0NWRjU0MmVEWGhyYWN3dk9nbmMKbN0hg8Sd8/TJxTSvhMYicpwLnR7LPD7P - HeH+hwrqzT/3CRDpL7DRpILommAEQ+3j1dbaLTdbE1xhBp7jegfD3w== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-21T20:13:20Z" - mac: ENC[AES256_GCM,data:PXXEpDbJIoIwWuNwMetpALtxrcB7yJhDYqp6LSKV8WFQI2TJSDgDHiNQ2cngfB9PXKmUNNhlvhmB52Hi6WQSWQdXjiy79T1fOjMhbUAKmykTaZDrwvlrDGkPgiZ1cFSb8+hx/5aZw7YhdQO9+7LAmymeIldZIFEpEO2pvuPZ6MM=,iv:mJb3K8TnsnY183OX7o9pF7oVMDcwVU/rOgX74KTRpr4=,tag:f+M+FT0Vjozm7a8LFDI8lA==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/archive/secrets-sops-backup/yuvomi-api-token.yaml b/archive/secrets-sops-backup/yuvomi-api-token.yaml deleted file mode 100644 index 61b12ef7..00000000 --- a/archive/secrets-sops-backup/yuvomi-api-token.yaml +++ /dev/null @@ -1,48 +0,0 @@ -token: ENC[AES256_GCM,data:LgiLFEsli412rVxSo9YU69wx9Lh7eDGBw6nmROh6Qbw7bYN8lylNjSDWkjNJ/UJvDg==,iv:vNmiV/D+SQaMtgwTK/mFDQIwSQ/L0JRatmoj5AWfBiw=,tag:W5P98TlmevQ0j051044LPQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQYVBwS250T0ZFa2VGbGow - R0MwMzNsY0t2N1ZBVnlnbkF6UEIyUStaUEhJCnBuNWNZT1VxRFlKNFBjOTZHNEd0 - cCtxN1p3TjkzWUZNZkdZeXRJVEhaQzgKLS0tIFVSWUpVQ2k3VE83eHU4VmR4SnVH - RVgxdDNnKzMwM2c2bm1YS1ZSRDdsMVkK8PVncSpesaxIEz7a39rVBzB0V3RphmAA - ANV8fY4W4tLuxo+EhB90ciy2dnAHaKEbxHBWMMjN4u22yZRT4lPWQw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Sk1hdENFQWIvZXhIK0U0 - TmhCWkw5TWhSVXdIbDN5SmVNdHkwYm1aOGxvCmlnQmZYWitxUmdURzNYRDBFUUVM - TjdIN2FEd2ptWG5UVlFCb1IyVzFjMmsKLS0tIDJMZHlXVHFNUlY2bnhlS3hFT3FY - U2szdVB4MGxxUnpJN1BBaUhKVE5WQkEKz7BkFIfs2RSyAww73dH5+PyDNjo4Ocor - mX5pLhSRGGf13bfA5lMQiGvqtd3jw1c4zKVZD9BcthIk5H/oqallNQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVWI2L05GbjdLR1k3a280 - N2RRWmZsZWZPeWdmd3I3aThrV1ppOEw4VTJRCit6aXgwTVIwQldkSmpRNkM4UTh4 - UEcyQjkrMFk2UGVBL1JZdGg2WDI3c0EKLS0tIGV5VkRWYWpXZXZGN1FXNmhTSmR5 - cjQ0TWg0TkFmMnIyMDNBNVZXa1l0REUKVHdvbXFwLgMECi2JLg8aoYIkOWHwYyZh - v3mVVaaki5KceuyUhcGsdthNadrM0RDi89uUw8O2cfADdDgLlha/iQ== - -----END AGE ENCRYPTED FILE----- - - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnemkvTUxHZDNxYmJ4eGRK - Y09laWNnN0pXN1VHQzUzSWlJZGFqcmkwTWdJCjkxZG9pVVVzWXBTU0lpL0JFR2w3 - TWhPTDNFSXhPTkVMVUpOY0xHMlN6RkkKLS0tIDB3d0ZyRVpGT3YzSXIrM1pPQ1Uz - QkpQYXRWaGtabnU5c1RpeE9vb0MwMWcKVRnpepDJ8a2ECD5uaK6O3fMKwWcLJP8a - uFWds5rvwDfrM1aNLXYbPIfXtqLx4fbxkoRZvHcuZ2/lYLDBFBrFlQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-06-28T14:02:13Z" - mac: ENC[AES256_GCM,data:NDjBNtSzGdm0+SqAvaUlltljXcyXzLQx3b9RUWZIlS/D3ox1BTO6t3t4WT8szbSnKcT51mJGJ8EIqppNWkmOpEaMNGdMw70DmGnf/IJAzScTpRyvhfsGlohCVaekMBjF+wg1uoB91vSKcTFq/wfUW79KICmxMF6woavRQ94yfQs=,iv:1f9sGKyTITSslqDXB3Khk/OGiPaJM2BreSEG6aTbZDs=,tag:UulDl/JQamg/p/q4esvtIA==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.9.4