admin
feea06062a
Resend send-scoped key was committed in plaintext in manifests/hub.yaml (ConfigMap) and manifests/felhom.secret.yaml. Rotated to a new key and removed from git. - hub: new RESEND_API_KEY env override (cmd/hub/main.go), mirrors REGISTRY_TOKEN; ConfigMap resend_api_key now an empty placeholder; Deployment injects from Secret/resend-api. Image 0.17.0. - contact-mailer: secretKeyRef repointed contact-mailer-config -> resend-api. - felhom.secret.yaml: contact-mailer-config Secret removed; healthchecks EMAIL_HOST_PASSWORD blanked (workload not deployed). - documentation/runbooks/secrets.md: out-of-band secret model + create/rotate steps. Secret/resend-api is created imperatively out-of-band and is NOT committed. No secret value appears in this repo. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
51 lines
1.6 KiB
YAML
51 lines
1.6 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: healthchecks-config
|
|
namespace: felhom-system
|
|
type: Opaque
|
|
stringData:
|
|
# === REQUIRED: Generate a random key ===
|
|
# python3 -c "import secrets; print(secrets.token_urlsafe(50))"
|
|
SECRET_KEY: "jumZn0XOcO1oDs77siMCgfkg0S2JGLHUiKBAxGleUF0KodBg6SHj-mcLNPxt29Wb6pk"
|
|
|
|
# === REQUIRED: Superuser for first login ===
|
|
SUPERUSER_EMAIL: "admin@felhom.eu"
|
|
SUPERUSER_PASSWORD: "doodooP4ssWD001!"
|
|
|
|
# === REQUIRED: SMTP via Resend.com ===
|
|
EMAIL_HOST: "smtp.resend.com"
|
|
EMAIL_PORT: "587"
|
|
EMAIL_HOST_USER: "resend"
|
|
# Resend API key — NOT committed. Healthchecks is not currently deployed; when it is, wire its
|
|
# EMAIL_HOST_PASSWORD to the out-of-band Secret/resend-api (key RESEND_API_KEY) via secretKeyRef
|
|
# instead of inlining a value here. See documentation/runbooks/secrets.md.
|
|
EMAIL_HOST_PASSWORD: ""
|
|
EMAIL_USE_TLS: "True"
|
|
EMAIL_USE_VERIFICATION: "False"
|
|
DEFAULT_FROM_EMAIL: "monitoring@felhom.eu"
|
|
---
|
|
# NOTE: the Resend API key (formerly Secret/contact-mailer-config RESEND_API_KEY) is no longer
|
|
# committed. It lives in the out-of-band Secret/resend-api (key RESEND_API_KEY), created imperatively
|
|
# per documentation/runbooks/secrets.md. Both the hub and contact-mailer now read from resend-api.
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: umami-config
|
|
namespace: felhom-system
|
|
type: Opaque
|
|
stringData:
|
|
APP_SECRET: "65cee3c4826b2478bcd304d81d3f2193983544d159a7b89dbf2d528479927a86"
|
|
POSTGRES_PASSWORD: "a764dc950f1f065d8b6f5e402d6420dd"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-creds
|
|
namespace: felhom-system
|
|
type: Opaque
|
|
stringData:
|
|
username: "admin"
|
|
password: "doodooP4ssWD001!"
|
|
--- |