chemavxandClaude Opus 4.8
58851adf9a
Phase 3a of migration #2: syncs FILEBROWSER_USERS from homelab/prod /filebrowser via read-only infisical-operator/infisical-auth, template-remapped to the lowercase 'users' key Traefik basic-auth requires, into parallel-name filebrowser-auth-infisical. Old plaintext filebrowser-auth secret + the Traefik Middleware untouched (repoint=3b, removal of the Secret stanza=3c). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
877 B
YAML
27 lines
877 B
YAML
apiVersion: secrets.infisical.com/v1beta1
|
|
kind: InfisicalStaticSecret
|
|
metadata:
|
|
name: filebrowser-auth
|
|
namespace: filebrowser
|
|
spec:
|
|
# Shared, read-only machine identity (no write grant, no PushSecret).
|
|
infisicalAuthRef:
|
|
name: infisical-auth
|
|
namespace: infisical-operator
|
|
sources:
|
|
- projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab"
|
|
environmentSlug: prod
|
|
secretPath: /filebrowser
|
|
syncOptions:
|
|
refreshInterval: 60s
|
|
targets:
|
|
- kind: Secret
|
|
name: filebrowser-auth-infisical # parallel name — old filebrowser-auth stays live until 3c
|
|
namespace: filebrowser
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v1
|
|
data:
|
|
# Remap UPPER_SNAKE Infisical key -> the lowercase `users` key Traefik basic-auth requires.
|
|
users: '{{ .FILEBROWSER_USERS.Value }}'
|