70 lines
2.4 KiB
YAML
70 lines
2.4 KiB
YAML
# Secretos de la app respaldados por Infisical (patrón researchowl).
|
|
#
|
|
# Claves esperadas en /roswell (proyecto homelab, entorno prod):
|
|
# TELEGRAM_BOT_TOKEN, TELEGRAM_ALLOWED_USERS, ANTHROPIC_API_KEY,
|
|
# PODCASTINDEX_KEY, PODCASTINDEX_SECRET, POSTGRES_PASSWORD
|
|
#
|
|
# Un InfisicalStaticSecret por target: el operator (versión actual) solo
|
|
# procesa el primer elemento de `targets`, comprobado el 2026-07-13.
|
|
#
|
|
# CORTE (cuando los valores estén verificados): cambiar las referencias de
|
|
# deployment.yaml, postgres.yaml y backup-cronjob.yaml a los nombres
|
|
# *-infisical y borrar los planos:
|
|
# kubectl delete secret roswell-secrets roswell-pg-secret -n roswell
|
|
apiVersion: secrets.infisical.com/v1beta1
|
|
kind: InfisicalStaticSecret
|
|
metadata:
|
|
name: roswell-secrets
|
|
namespace: roswell
|
|
spec:
|
|
# Identidad compartida de solo lectura (sin write, sin PushSecret).
|
|
infisicalAuthRef:
|
|
name: infisical-auth
|
|
namespace: infisical-operator
|
|
sources:
|
|
- projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab"
|
|
environmentSlug: prod
|
|
secretPath: /roswell
|
|
syncOptions:
|
|
refreshInterval: 60s
|
|
targets:
|
|
- kind: Secret
|
|
name: roswell-secrets-infisical
|
|
namespace: roswell
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v1
|
|
data:
|
|
telegram-bot-token: '{{ .TELEGRAM_BOT_TOKEN.Value }}'
|
|
telegram-allowed-users: '{{ .TELEGRAM_ALLOWED_USERS.Value }}'
|
|
anthropic-api-key: '{{ .ANTHROPIC_API_KEY.Value }}'
|
|
podcastindex-key: '{{ .PODCASTINDEX_KEY.Value }}'
|
|
podcastindex-secret: '{{ .PODCASTINDEX_SECRET.Value }}'
|
|
# La URL completa se reconstruye: un solo sitio para la password.
|
|
database-url: 'postgresql://roswell:{{ .POSTGRES_PASSWORD.Value }}@postgres.roswell.svc.cluster.local:5432/roswell'
|
|
---
|
|
apiVersion: secrets.infisical.com/v1beta1
|
|
kind: InfisicalStaticSecret
|
|
metadata:
|
|
name: roswell-pg-secret
|
|
namespace: roswell
|
|
spec:
|
|
infisicalAuthRef:
|
|
name: infisical-auth
|
|
namespace: infisical-operator
|
|
sources:
|
|
- projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab"
|
|
environmentSlug: prod
|
|
secretPath: /roswell
|
|
syncOptions:
|
|
refreshInterval: 60s
|
|
targets:
|
|
- kind: Secret
|
|
name: roswell-pg-secret-infisical
|
|
namespace: roswell
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v1
|
|
data:
|
|
password: '{{ .POSTGRES_PASSWORD.Value }}'
|