feat(secrets): add initial configuration for FluxCD, including sealed secrets and Helm releases

secrets/flux/gitops-ssh-htwg-1.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: gitops-ssh
+  namespace: flux-system
+spec:
+  encryptedData:
+    identity: AgAOzHL/nvgowOSUS8s8OooQSxNrFEBHDZYca7VzfOJLlF+nehigNUS4GSqofRQBJObgPL51TfSyTVYN+Sg5Ddvq8+JKtySkjNil4MpgiT1LPpiL/PylKF3AZKqhpmvwzDxh0TiJFHijljW/YqbnuTo4y3TFs/PKFErrE5WCO/WufG5fEO6izEFnC4YsmD2DVrMewqn9UEokdxsj7IyMtY3hHMBnGoaLsMHeH6HpwWZ/75Di/Cf7Uwl1sEYesMfz21QOR33uGpmQmguIrwrL5A/FQCzMtldZD3fhbad1biqs/uXqn3im5p8o+CCj42dvHnp2wSB3TC78iwdvGGArwVRxh8+GuNAy448JBzh/HveUsrCnzyLKgBwCON8k2w83ZNr0JjoNCmL8MiA/WhVPmF+rj5b7BoBfQ+UZgb1w/Yfn8vD0j8O4D1GINVs8Us2SYsjJ75maBOyU8nOEHzl9ytEUFzCA5yCPslp6Btr41njIVV2G7obTE9hqReea1oIl0K9XxRm9etEIhfnNbPynXTMaHlIvkf1ufRpNH4F/lNVGuwHPLD+y4LXoydu7tr/glL+vKBN+diDKR7R8ilnLbkCNYJ1GELZfGyjeMG5mc/bwXod2BbKNjMVxxZIdw/CtVBTnJE+vGagofNsn/VlbS4iVbwAdAfSazYdTK/HxgmypjxoRGxPNoIdPrFLRL25/M8CcY1o0SUZg6eUtET1dbcw2Vd0lxm29TvKD8RKVsPahque7EVw1aVh5fUYBthbAZ7gzlWpbq/nEXPBQwQSL+yt/4C3hIzbZOV1WRtYpPJK3BrWILfPF1HBrdvSiDwm4H75mms8qon2qbmmeJo6LYQIgG949quUXSeA2Cz4licAQxA3jjDwefW+hsfb7zy9pS6yZscxkpRNb+HjGuIcjZzqT06oRQhslBNqX5CmXqf5ZLg9gfG1Dgq695HjDG+gdFuSdGiY6H/sqbLp9BVwBGMLnwa+iMu+L86R9Y1nI8Hel/nwB/KoeQBzXdVWE4Hf1am4J0soyPgHDClNYwMQO60rxXcD+HurrgZnUOFq281ba6DEHIzY6ymg5soWWlYJ6veck7FS1jaj8Ihbg8ydlMzjUBnBWk4ZKs1nI7vdfvbgTgpA9lxTIrdQRIXxx+o3uUawL6DaTOubTZhyExtn3zhidfHn+cshGSipvA+OZctJ0J9aoBQdWLkhqecUdCJFiwwLmjVbIk5yBEaLQuQB//cw=
+    known_hosts: AgB+ku9oRGCXi2OCTd8gY0QZ5P36YKb7cKL7sItNEvT2hKrD8DtF3eQK2vx4TXRsj8iuBnCTRu0m5ID+Rbi7I+mDQq2CZodpnIyu1iKIwx04xQROFPiKXQ6EFaEl94by6r5jn9cyCrkgG7HifNDD3Z1jXNPgWn94msNH++lA4oXhqzhCzN3sgWrcvEFDv7CizRZ4A2ARaL5pY6tDw7JnqejSsz+dwg6Ar9WlLPtJYAE5ZMtOE5M4tCUZ326z2waisjed86VbnORAX2uu1ARpnxg+jhtNni3Ixk4xZokzknvJfV9Kyq9wc94c2WzVs1MQjhl6IPoyALpii2VdvPqmIsmpLefmLPT1/8/NyHGzgwf6E8BUINr/TN9y2WjIu7/Y4NXlqPV0GI8bES3Y4U1h4yV3Sp6KifFPCUavx7a/D64j0CDC/ZlQglke+qVo6nFTEzgnBDLkaqPnN2Inl1KvhwdAvVCT5eUC12tdbfZ2A9uQIhT0k/A7cn30zcIA+LGT5JtKu9B69aElhDtrrpRksyJsclSzC2YTOSzHlavnaoOPqHM0ywSN5w3l9XIPiHyjKQNzWjzaWVkOq3MQbrPU3yM2zq20KqzIv1eBYstVie/u8yi6CDgumWPEYVzg0gAXlN+RZtoLBhbwrn1Bvlz8bsSYfggmjlFj4RUGkkRGliMbZsLkNGq4zca/437bqSB84oAt6l8lm4RezAg3ZOl9l8pAfmPxKTzy5r6YjQKdQ8lo8DKcjad49M/92fg5xbSfw7MqXclu+L5vPp1DrObueAG8j32xeOBn798ebWTccGag7/h8mwyLmQ6wWQ2SIyozNLWKFGUybZj6tb6vYQ9qW/c+KMXcexvkSMcEGYs+Dtk5KMOkBk/EkWLvbHrg+w2krL5V81WAyjJ7bYPKtArdagpd9c1pvQ6tXqWmqpPwWlDqpj5YmO8xH5LVtXoYPKuvk5qFrZJq1PpTU6zSozGWjOtiA+tNunZZQNOqqe1Q6SM5ZW/7YLTJpP2O5a0dih0X8kjFBbAVLdGQ5aDjnUGLUzWGb4imsNM+vknD9cPUfXv/3x/MY/xb8ghoGby2W5a6dZJO1GHquIfNkTjgDVqdbJvRM4dJC1MsIrnUyeviId4FkIecSSZ7iq+fcKMHKGU6Ljrtz4kz599paL10S/a3Tk3UR/bhCDncr9koChudbKQWdUMwwletTSCCIw/F0qC+wsLS3ul55xYFU3nsKXIm5suF211lutPseOnDne+iizW56uePDpUOJjMlGDFVza/rBaKKtMftTseUM7bxOw/NDcmO3rRqbgPom5UPUifCTWPwKhAVDl7xVlSAK+ARdxOvWs8kOd3DEUzqp4FFl37e54QiihiowG/BYOYiJyFmKmbiMsMLUwH18wM90Xptow9XnZLxYt1Yo4DvOMrFN8qi+hTn/Ddmk8WvK70QSBz0dW04Q1ZleeheN1MKjcL6F3/4+bj80JkRotM6aGgpG9XsYiY0/p0MG6gVLWb2xKYD+3gb8d0y/HLi462XldO8nwlD18KiB24ECV6yw1p2uFrewYsa6qbtMP/yPZbd6mqtj1hrvp5ZtIGLQ+x89n9O4wWyF+4Bk3GEH8VqxVMQKISdrqpL4UJ7rvi9gcRjSHtMsF2H9VlXaPJAZ/02peJEZwGG4zH7+8g5/Zf/nz+i6o89hIvp6rYCCh7HtSPG3fEX7Y19x3C9OtG8harNF9BzDpcLDMnPsiQr9W7aaAc9EK1hR8nwpZf4n6B2B692rzXz9ovHivW/VtaTdRq8AEr898iJ7D9gu587kiyjI9RZwT6qqL+z5JV/pm5UZQV2R5VYbkNjZ5WdliJuWYo+TkE4YSpp7Ut+FJL7+GybhFVJvVTpF5F0VU1FxZJaZ3+9Isw5nk0U9uwIzz1ODePH3wZ8cjuNAkz+1zT8nCGU25oXDLv2GMKSv6cjuZfNvt6Or8bq5FxNm9g5Gdhy29R8VUPWN1kzKLElZE7Ydzsu5ImGFdQ2Fmso6xD42EVw9yL1q2E0kLopyK0ls1aqcdYZ12+o0kvtEn7uGYI/FmbJ5LM2LBpAuoXCRghgv8zGZ+WpDQYssJLija2NSopqV58o+fMmSehqUmccLS1Ng/ZMVnmHa3we2vHV2gDsszKPgTIqBRTBjQNrkpGfQ1bbeN/q+apkYUX0JZ+7tD6c8dcvYI2Qr0v6PQxGhhf+X5VwXm20t6hvlmKCiE2LGADXZNwW71rnQh9y
+  template:
+    metadata:
+      name: gitops-ssh
+      namespace: flux-system

secrets/htwg-1/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# Seal each secret with the htwg-1 cluster key before uncommenting:
+#   kubectl -n nowchess create secret generic <name> ... --dry-run=client -o yaml \
+#     | kubeseal --controller-namespace kube-system -o yaml > secrets/nowchess/htwg-1-prod/<name>.yaml
+resources:
+  - ../nowchess/htwg-1-prod/ghcr-pull-secret.yaml
+  - ../nowchess/htwg-1-prod/ncs-jwt-keys.yaml
+  - ../nowchess/htwg-1-prod/ncs-db-secrets.yaml
+  - ../nowchess/htwg-1-prod/ncs-internal-secret.yaml
+  - ../nowchess/htwg-1-prod/remotek6-certs.yaml
+  - ../postgres-tunnel/secret.yaml

secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml

@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret docker-registry ghcr-pull-secret \
+#     --docker-server=ghcr.io --docker-username=<user> --docker-password=<token> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    .dockerconfigjson: REPLACE_WITH_SEALED_VALUE
+  template:
+    type: kubernetes.io/dockerconfigjson
+    metadata:
+      name: ghcr-pull-secret
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml

@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-db-secrets \
+#     --from-literal=ACCOUNT_DB_URL=... --from-literal=ACCOUNT_DB_PASSWORD=... \
+#     (add all other DB keys) \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-db-secrets
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-db-secrets
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml

@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-internal-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-internal-secret
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml

@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-jwt-keys
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-jwt-keys
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/remotek6-certs.yaml

@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: remotek6-certs
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: remotek6-certs
+      namespace: nowchess