- Delete 26 secret manifests containing REDACTED placeholder values
(15 cert-manager TLS + 11 app secrets across 8 namespaces)
- REDACTED is valid base64 that decodes to non-UTF-8 bytes — ArgoCD
applying these manifests corrupts live secrets in the cluster
- Add .githooks/pre-commit that rejects any .yaml with REDACTED
- Add README.md documenting secret management policy and manual
creation commands for each service
- n8n secret manifests already fixed in previous commits (618b1e8, db04fd2)
ArgoCD was overwriting the polymarket-tls secret with REDACTED values,
corrupting the TLS cert. This secret is managed by cert-manager and
must not be tracked in git.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix bot-secrets: replace corrupted REDACTED base64 values with correct ones
- Update deployment-api and deployment-bot to use git.chemavx.xyz registry images
- Add imagePullSecrets (gitea-registry) to api and bot deployments
- Add secret-gitea-registry.yaml manifest for ArgoCD to manage
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>