feat(secrets): stateful batch — home-assistant, immich, paperless to OpenBao/ESO #173

2026-07-13T23:19:14Z

claude-bot commented

2026-07-13 23:19:14 +00:00

Phase 3 stateful batch per kubernetes/MIGRATION-sops-openbao.md. All 8 values verified in KV before the swap, and every payload was round-trip-checked for binary content first (libation lesson) — all are clean text stringData.

sops file (deleted)	ExternalSecret target (name unchanged)	KV key
home-assistant/{backup-password, config-sync-token, mosquitto-evcc-credentials, prometheus-token, shelly-ble-proxy-key}.sops.yaml	same names (home-assistant)	apps/home-assistant/*
immich/secrets.sops.yaml	`immich-secrets` (immich)	apps/immich
paperless/secrets.sops.yaml	`paperless-secrets` (paperless)	apps/paperless
paperless/ftp-scanner-secret.sops.yaml	`ftp-scanner-secret` (paperless)	apps/paperless-ftp-scanner

Drops decryption blocks from home-assistant, immich, paperless (paths now sops-free) and the dormant one on speech-to-phrase (never had sops files).

Remaining sops after this: seed/* (7) + apps/authentik/* (2) — the final two batches.

After merge I'll verify all 8 sync and spot-check HA, immich, paperless pods.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Phase 3 stateful batch per kubernetes/MIGRATION-sops-openbao.md. All 8 values verified in KV before the swap, and **every payload was round-trip-checked for binary content first** (libation lesson) — all are clean text `stringData`. | sops file (deleted) | ExternalSecret target (name unchanged) | KV key | |---|---|---| | home-assistant/{backup-password, config-sync-token, mosquitto-evcc-credentials, prometheus-token, shelly-ble-proxy-key}.sops.yaml | same names (home-assistant) | apps/home-assistant/* | | immich/secrets.sops.yaml | `immich-secrets` (immich) | apps/immich | | paperless/secrets.sops.yaml | `paperless-secrets` (paperless) | apps/paperless | | paperless/ftp-scanner-secret.sops.yaml | `ftp-scanner-secret` (paperless) | apps/paperless-ftp-scanner | Drops decryption blocks from `home-assistant`, `immich`, `paperless` (paths now sops-free) and the **dormant** one on `speech-to-phrase` (never had sops files). Remaining sops after this: `seed/*` (7) + `apps/authentik/*` (2) — the final two batches. After merge I'll verify all 8 sync and spot-check HA, immich, paperless pods. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

claude-bot added 1 commit 2026-07-13 23:19:14 +00:00

feat(secrets): migrate stateful app secrets to OpenBao (stateful batch) 94aa3e2fda

home-assistant (5), immich, paperless (2): values in OpenBao KV, all
verified text-safe via base64 round-trip before load. ExternalSecrets
keep the old Secret names. Decryption blocks dropped from
home-assistant/immich/paperless KS plus the dormant one on
speech-to-phrase.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

k.renner merged commit beaa6bf0d4 into master

2026-07-13 23:19:58 +00:00

k.renner referenced this issue from a commit

2026-07-13 23:19:58 +00:00

Merge pull request 'feat(secrets): stateful batch — home-assistant, immich, paperless to OpenBao/ESO' (#173) from openbao-stateful into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#173