feat(secrets): apps batch — non-critical app secrets to OpenBao/ESO #172

2026-07-13T17:21:28Z

claude-bot commented

2026-07-13 17:21:28 +00:00

Phase 3 apps batch per kubernetes/MIGRATION-sops-openbao.md. All 9 values verified in OpenBao KV (homelab/apps/*) before this swap.

sops file (deleted)	ExternalSecret target (name unchanged)	KV key
evcc/evcc.sops.yaml	`evcc-config` (evcc)	apps/evcc
otbr/dataset-secret.sops.yaml	`otbr-active-dataset` (home-assistant)	apps/otbr
libation/bootstrap-secret.sops.yaml	`libation-bootstrap` (audiobookshelf)	apps/libation
external-dns/cloudflare-secret-apps.sops.yaml	`cloudflare-api-token` (apps)	apps/external-dns
monitoring/{alertmanager-smtp,grafana-oauth,loki-basic-auth,pve-exporter-config}.sops.yaml	same names (monitoring)	apps/monitoring/*
woodpecker/secret.sops.yaml	`woodpecker-secret` (apps, label preserved via template)	apps/woodpecker

Notable: libation's LibationContext.db is a binary SQLite file — it broke the naive JSON put (mangled UTF-8), so its values are stored base64-encoded in KV and the ExternalSecret decodes via decodingStrategy: Base64. Also drops now-dead decryption blocks from the apps, evcc, otbr, libation, monitoring Kustomizations and the dormant one on grafana-db (its path never had sops files).

After merge I'll verify all 9 ES go SecretSynced, and run a Woodpecker pipeline to prove CI still builds.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Phase 3 apps batch per kubernetes/MIGRATION-sops-openbao.md. All 9 values verified in OpenBao KV (`homelab/apps/*`) before this swap. | sops file (deleted) | ExternalSecret target (name unchanged) | KV key | |---|---|---| | evcc/evcc.sops.yaml | `evcc-config` (evcc) | apps/evcc | | otbr/dataset-secret.sops.yaml | `otbr-active-dataset` (home-assistant) | apps/otbr | | libation/bootstrap-secret.sops.yaml | `libation-bootstrap` (audiobookshelf) | apps/libation | | external-dns/cloudflare-secret-apps.sops.yaml | `cloudflare-api-token` (apps) | apps/external-dns | | monitoring/{alertmanager-smtp,grafana-oauth,loki-basic-auth,pve-exporter-config}.sops.yaml | same names (monitoring) | apps/monitoring/* | | woodpecker/secret.sops.yaml | `woodpecker-secret` (apps, label preserved via template) | apps/woodpecker | Notable: **libation's `LibationContext.db` is a binary SQLite file** — it broke the naive JSON put (mangled UTF-8), so its values are stored base64-encoded in KV and the ExternalSecret decodes via `decodingStrategy: Base64`. Also drops now-dead decryption blocks from the `apps`, `evcc`, `otbr`, `libation`, `monitoring` Kustomizations and the **dormant** one on `grafana-db` (its path never had sops files). After merge I'll verify all 9 ES go SecretSynced, and run a Woodpecker pipeline to prove CI still builds. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

claude-bot added 1 commit 2026-07-13 17:21:28 +00:00

feat(secrets): migrate non-critical app secrets to OpenBao (apps batch) a76b18a887

evcc, otbr, libation, external-dns (apps), monitoring (4), woodpecker:
values in OpenBao KV (homelab/apps/*, loaded 2026-07-13), manifests are
now ExternalSecrets keeping the old Secret names. libation's payload is
a binary SQLite db — stored base64 in KV with decodingStrategy: Base64
on the ES. Decryption blocks dropped from apps/evcc/otbr/libation/
monitoring KS (paths sops-free) plus the dormant one on grafana-db.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

k.renner merged commit 5ba99ebac1 into master

2026-07-13 17:21:58 +00:00

k.renner referenced this issue from a commit

2026-07-13 17:21:59 +00:00

Merge pull request 'feat(secrets): apps batch — non-critical app secrets to OpenBao/ESO' (#172) from openbao-apps into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#172