konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

feat(secrets): seed batch — CNPG/backup seed secrets to OpenBao/ESO #174

Merged
k.renner merged 1 commits from openbao-seed into master 2026-07-13 23:27:09 +00:00
Conversation 0 Commits 1 Files Changed 26
+130 -211
claude-bot commented 2026-07-13 23:25:30 +00:00
Member
Copy Link
Copy Source

Phase 3 seed batch per kubernetes/MIGRATION-sops-openbao.md. All 7 values in KV (homelab/seed/*), round-trip-verified text.

sops file (deleted) ExternalSecret target (name unchanged) KV key
seed/{authentik,immich,paperless}/barman-creds.sops.yaml barman-cloud-creds (per-app ns) seed//barman-creds
seed/{authentik,immich,paperless}/hetzner-creds.sops.yaml hetzner-s3-creds (per-app ns) seed//hetzner-creds
seed/influxdb/bootstrap-secret.sops.yaml influxdb-bootstrap (influxdb) seed/influxdb/bootstrap

Drops decryption from all seed KSes: the four active ones (paths now sops-free), the two dormant ones (seed-audiobookshelf, seed-music-assistant — never had sops files), and the suspended deprecated seed KS.

With this merged, the only sops files left in the repo are apps/authentik/ (2) — the final batch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Phase 3 seed batch per kubernetes/MIGRATION-sops-openbao.md. All 7 values in KV (`homelab/seed/*`), round-trip-verified text. | sops file (deleted) | ExternalSecret target (name unchanged) | KV key | |---|---|---| | seed/{authentik,immich,paperless}/barman-creds.sops.yaml | `barman-cloud-creds` (per-app ns) | seed/<app>/barman-creds | | seed/{authentik,immich,paperless}/hetzner-creds.sops.yaml | `hetzner-s3-creds` (per-app ns) | seed/<app>/hetzner-creds | | seed/influxdb/bootstrap-secret.sops.yaml | `influxdb-bootstrap` (influxdb) | seed/influxdb/bootstrap | Drops decryption from **all** seed KSes: the four active ones (paths now sops-free), the two dormant ones (`seed-audiobookshelf`, `seed-music-assistant` — never had sops files), and the suspended deprecated `seed` KS. With this merged, the only sops files left in the repo are `apps/authentik/` (2) — the final batch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6
claude-bot added 1 commit 2026-07-13 23:25:30 +00:00
feat(secrets): migrate seed secrets to OpenBao (seed batch) 1c732045d5 
seed/{authentik,immich,paperless} barman+hetzner creds and
seed/influxdb bootstrap: values in OpenBao KV (homelab/seed/*), all
round-trip-verified text. Future cold rebuilds no longer need the age
key for the seed phase. Decryption blocks dropped from every seed-* KS
(incl. dormant seed-audiobookshelf/seed-music-assistant and the
suspended, deprecated seed KS).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6
k.renner merged commit 977880908b into master 2026-07-13 23:27:09 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#174