fluxcxd: add whiteboard

.sops.yaml

@@ -0,0 +1,13 @@
+creation_rules:
+
+  # encrypt secrets files
+  - path_regex: \.local\.dec\.yaml$
+    encrypted_regex: '^(.*)$'
+    age: 
+      - age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
+
+  # encrypt secrets files
+  - path_regex: .*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age: 
+      - age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g

README.md

@@ -148,6 +148,12 @@ su -s /bin/bash www-data -c "php occ maintenance:repair --include-expensive"
 - All kustomizations can be executed using vscode task `Kustomize - Build & Deploy - Selected File`.
 - Helm charts can be deployed using vscode task `Apply App`.
 
+**Required encrypted filed on repo:**
+
+``` bash
+sops -e ./deploy/whiteboard/whiteboard.secrets.dec.yaml ./deploy/whiteboard/whiteboard.secrets.yaml
+```
+
 ## internal logs
 
 ``` bash
@@ -163,7 +169,6 @@ kubectl exec -it ${POD_NAME} -- cat /var/www/html/data/nextcloud.log
 kubectl exec -it nextcloud-mariadb-0 -- mariadb -u nextcloud -h nextcloud-mariadb.cloud-limbosolutions-com.svc.cluster.local -p
 ```
 
-
 **Restore database:**
 
 ``` bash

deploy/whiteboard/.env.d/.gitignore

@@ -1,3 +0,0 @@
-**
-!*.example
-!.gitignore

deploy/whiteboard/.env.d/whiteboard.env.example

@@ -1 +0,0 @@
-JWT_SECRET_KEY= ????

deploy/whiteboard/kustomization.yaml

@@ -1,15 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-secretGenerator:
-  - name: whiteboard
-    envs:
-      - ./.env.d/whiteboard.env
-
-generatorOptions:
-  disableNameSuffixHash: true
-
 resources:
+  -  ./whiteboard-secrets.yaml
   - ./deployment.yaml
   - ./service.yaml
   - ./middlewares.yaml

deploy/whiteboard/whiteboard.secrets.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: whiteboard
+type: Opaque
+stringData:
+    JWT_SECRET_KEY: ENC[AES256_GCM,data:36WwQQzfpQcR2YOZELt49UVvmd+/TuEDKJ8Q8D/W7Ivy6QwVFch0cxeISfY=,iv:JMjFvRUuXpE3aEILhGkWUZT38z0EsQ33MUDJow8S3kA=,tag:Y5VINENyAxqxbLE45XsHJQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYU0JXcWtXOHc4amJmcXRC
+            eXdSQi9DenowZm03WHg3aHRkRHRJN1k0dVNzClVSWDNUZGhBdHVRaGI2UmdsZnZs
+            WVdzQytENjR0ZjdrZSsvNTZOS0ZZS3MKLS0tIHRCTUdabFM0WWpWSW1ieFFuRjRy
+            RVk5M1RvT1k3LzJmRHJMTlU5d0hQNjAKycFfu4WkePIIqj0aIjivwvdoZuGEKqTa
+            8xjiIB6Vukyg9mJNQLPb2Mv1/ZASqhCn5TSXnMknFIKJALAt+oXtBg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-07-16T19:38:13Z"
+    mac: ENC[AES256_GCM,data:PKw9lBAGDMzPZR3I4AcSME3+b27aUymK6LKp5gXK/YRAy49PfiCbWe3ZDkDyiTMyGswct3xkg7F5MBoqb4rEOAStkGFAYux0Eri0PIJfq2gSTKaJuggQYu7InKC6XSNFrweDRnpvL0b9kBnmWMKI5i8kFT15VizFkrAHi5xuKLY=,iv:zvhIK2hVFi5g44M/uVpP4bXNcfSsITLoQ8leNvRGuSQ=,tag:IP2RAeOJjGhS3IedG8jsGQ==,type:str]
+    version: 3.13.1