feat(secrets): add initial configuration for FluxCD, including sealed secrets and Helm releases

secrets/nowchess/htwg-1-prod/ghcr-pull-secret.yaml

@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret docker-registry ghcr-pull-secret \
+#     --docker-server=ghcr.io --docker-username=<user> --docker-password=<token> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    .dockerconfigjson: REPLACE_WITH_SEALED_VALUE
+  template:
+    type: kubernetes.io/dockerconfigjson
+    metadata:
+      name: ghcr-pull-secret
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/ncs-db-secrets.yaml

@@ -0,0 +1,17 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-db-secrets \
+#     --from-literal=ACCOUNT_DB_URL=... --from-literal=ACCOUNT_DB_PASSWORD=... \
+#     (add all other DB keys) \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-db-secrets
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-db-secrets
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/ncs-internal-secret.yaml

@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-internal-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-internal-secret
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/ncs-jwt-keys.yaml

@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-jwt-keys
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-jwt-keys
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/remotek6-certs.yaml

@@ -0,0 +1,13 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: remotek6-certs
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: remotek6-certs
+      namespace: nowchess