mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
ca94282552
PushSecret (home) + ExternalSecret (VPS) pairs for the four chart-generated secrets whose values must match before Phase 1c's Postgres replication goes live: gitlab-rails-secret (secret_key_base/ db_key_base/otp_key_base/openid_connect_signing_key, all in one secrets.yml key - confirmed live, not four separate keys as first assumed), gitlab-gitlab-shell-secret, gitlab-gitaly-secret, gitlab-praefect-secret (the latter two also needed for Phase 2's cross-site gRPC auth). Same pattern as infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
100 lines
2.9 KiB
YAML
100 lines
2.9 KiB
YAML
# GitLab cross-site replication Phase 1b (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - pushes home's
|
|
# chart-generated secrets into Vault so the VPS's ESO can pull them back
|
|
# down BEFORE the VPS's Postgres becomes a real replica of home's.
|
|
#
|
|
# Why this matters: the GitLab chart generates these per-release, at
|
|
# random, on first install. Home's and the VPS's values are currently
|
|
# different. Once the VPS's Postgres is byte-for-byte replicating home's
|
|
# rows, the VPS Rails app will be reading home's encrypted-at-rest data
|
|
# (2FA secrets, CI/CD variables, integration tokens, PAT digests,
|
|
# application_settings encrypted columns) with the WRONG key unless these
|
|
# match - Rails raises OpenSSL::Cipher::CipherError on boot otherwise.
|
|
#
|
|
# gitlab-gitaly-secret/gitlab-praefect-secret are also needed for
|
|
# Phase 2's cross-site gRPC auth (the VPS's Gitaly/Praefect need the same
|
|
# tokens home's do, to be trusted as nodes of the same virtual storage).
|
|
#
|
|
# Same pattern as infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml.
|
|
# Each of these secrets happens to have exactly one key (confirmed live),
|
|
# so one PushSecret + one ExternalSecret per secret, no enumeration needed.
|
|
apiVersion: external-secrets.io/v1alpha1
|
|
kind: PushSecret
|
|
metadata:
|
|
name: gitlab-rails-secret-to-vps
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRefs:
|
|
- name: vault-backend
|
|
kind: ClusterSecretStore
|
|
selector:
|
|
secret:
|
|
name: gitlab-rails-secret
|
|
data:
|
|
- match:
|
|
secretKey: secrets.yml
|
|
remoteRef:
|
|
remoteKey: vps/gitlab-rails-secret
|
|
property: secrets.yml
|
|
---
|
|
apiVersion: external-secrets.io/v1alpha1
|
|
kind: PushSecret
|
|
metadata:
|
|
name: gitlab-shell-secret-to-vps
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRefs:
|
|
- name: vault-backend
|
|
kind: ClusterSecretStore
|
|
selector:
|
|
secret:
|
|
name: gitlab-gitlab-shell-secret
|
|
data:
|
|
- match:
|
|
secretKey: secret
|
|
remoteRef:
|
|
remoteKey: vps/gitlab-gitlab-shell-secret
|
|
property: secret
|
|
---
|
|
apiVersion: external-secrets.io/v1alpha1
|
|
kind: PushSecret
|
|
metadata:
|
|
name: gitlab-gitaly-secret-to-vps
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRefs:
|
|
- name: vault-backend
|
|
kind: ClusterSecretStore
|
|
selector:
|
|
secret:
|
|
name: gitlab-gitaly-secret
|
|
data:
|
|
- match:
|
|
secretKey: token
|
|
remoteRef:
|
|
remoteKey: vps/gitlab-gitaly-secret
|
|
property: token
|
|
---
|
|
apiVersion: external-secrets.io/v1alpha1
|
|
kind: PushSecret
|
|
metadata:
|
|
name: gitlab-praefect-secret-to-vps
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRefs:
|
|
- name: vault-backend
|
|
kind: ClusterSecretStore
|
|
selector:
|
|
secret:
|
|
name: gitlab-praefect-secret
|
|
data:
|
|
- match:
|
|
secretKey: token
|
|
remoteRef:
|
|
remoteKey: vps/gitlab-praefect-secret
|
|
property: token
|