chore(coturn): TURN-Rotation aus turn-secret-rotation-20260901-020001 uebernommen

Automatisch kanonisiert: der Rotations-CronJob im Cluster erreicht git.lab nicht und pusht nach Gitea; dieser Commit bringt die Rotation auf den kanonischen Weg zurueck, bevor der Mirror sie ueberschreiben kann.

apps/production/coturn-secret.yaml

@@ -4,7 +4,7 @@ metadata:
     name: coturn-secret
     namespace: matrix
 stringData:
-    TURN_SECRET: ENC[AES256_GCM,data:Cbu5SoxQp0L9WFZFbEiyK8j0IJuSgoJE9OpRKZVXyF+PcTM+ewD+3TI8xq+g0C34XDWeaJdxaj3B4yyKsqQLIA==,iv:lW8lD3D75Z0b0EfBj5myUrv4GWMvRTBELjhCVm+QJjc=,tag:nC5L/PcYPoLJP1whSSfSTA==,type:str]
+    TURN_SECRET: ENC[AES256_GCM,data:ATip8K3DKFyyInoJ9/e6SGJobGNruDgNn8fGopkct2cbTHKXduIZWjMEaZ4y47XS5d52qjbHSGSNm/uATsnN3A==,iv:vcGxyduSlqQPZv7fVmWgUypaSSMCDxF2m8WnDiiRaq0=,tag:P+lZAzQZYK5NY7KIr8igug==,type:str]
 sops:
     age:
         - enc: |
@@ -26,6 +26,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-08-01T02:00:01Z"
-    mac: ENC[AES256_GCM,data:1Tx2/4O/fcv9BPYLXainmsILC2HbBJtJkgVnbkCe9oVSKca/hVf6zAa8Pd6n/tvHHAuU1Ghm2mglk/IxbNKgCDHH+xaEeK5sfhAK0Ot2ffIMLK5chBNMH0DpvTjqP8ttMidgPJ4XYzizB850gq7pSRrZBJCC2oG66F+WPnfKkxQ=,iv:NIDfNbIyWSgvjpXtQFVjnZFjtKx8sV3a45ssiebkHf0=,tag:hNDmHPTu4RyNMvjyfJRCmA==,type:str]
+    lastmodified: "2026-09-01T02:00:01Z"
+    mac: ENC[AES256_GCM,data:SNMa4VdFzNY5cC3Rv53XhH7J9ptePn5LQR6038m09zOaGa6M9iXrK6f3SgSh8+53u40IewyFf/5ZjwH7d7O08r3uZp+VPcEovubElqbQ6in/YPkWGZ/M1rDJ4y1JM5FlfcYHRqzbTsDwJco7SoYtUthSrmQDIX+Bdb04ZgwzTuQ=,iv:D9ZVhMk71lGaFFrdzeosRB4IJMxzic96QqUAkaCLPrk=,tag:feWHR1RQaroIvJlT80vluQ==,type:str]
     version: 3.12.2

apps/production/coturn.yaml

@@ -88,7 +88,7 @@ spec:
         # Bumped on every TURN_SECRET rotation (Issue #38) to force a new pod, since
         # Kubernetes doesn't restart running pods when a referenced Secret's content
         # changes and the initContainer that reads it only runs once at pod start.
-        rotated-at: "2026-08-01T02:00:01Z"
+        rotated-at: "2026-09-01T02:00:01Z"
     spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet

apps/production/kustomization.yaml

@@ -16,7 +16,7 @@ patches:
         value: "401f8a87d0ef5d91d2e5032d4aede42c"
       - op: add
         path: /metadata/annotations/turn-secret-checksum
-        value: "05aad8b742fb02c42f4c1a5629ae31e1"
+        value: "fd34214736091bf3ced17afe7bb4d61f"
 
 resources:
   - matrix-postgres-auth.yaml

apps/production/synapse-turn-secret.yaml

@@ -4,7 +4,7 @@ metadata:
     name: synapse-turn-secret
     namespace: matrix
 stringData:
-    values.yaml: ENC[AES256_GCM,data:jGoBDvjGymp4qEVEB6hzgRJk1ZUVB+jNxfhqpl7tG7UQmZGskix43rMJIOdDZihBTOUHP4emhlOzTxqx3SCAFCb8Ie78xA+DfjuLnQ6PQ2jqN48+yc7QE2xbNr5eWlYYKzl1u/z0kCQT723ptA+tQzYCzUq5U624HHxki0firgoSJmaF9S/vbwXHLPqtnviYX48Eim0suwMnavWdWGd1X3yvqUoZnWKz3eDQrH3cp4fQAdnRosveIcWwz+1na67Zshczq7hhlNp/WZ95guAOiqlLxGMPwJQJou24UYynwQTtDle5IzCxOww+sCNuQtPp29NE1gZ5pxIM7Ys6Ul7UxtPAww6OCVbkYYGmQxIq0cY4CrFrgLDJYQ2JJPIexc1ooeIDcYiNYts/2TCAj9ck+Vd+6xN1NEYwm0ZTLL9naLJJ1PEzRkfy3bCOTfKWCRNwLzn/3gsRgr+hrf5dJ6Av6VbM0Ae9xhTEQ4d64C8YRjb4G9BnDRGuaHu+5DYAqiFUEMm6cM4IV3E=,iv:ZRGQREujdrDCNj1OcgV7HAjZREArdnodnD2J5BxkGQo=,tag:2FOO9/rv4IteyulLnsR/YA==,type:str]
+    values.yaml: ENC[AES256_GCM,data:xc/pUhIbmGizSCS/P5EI+5zgxyoM7SiHOo9loGmUfQ0iiL+EntJlK4WiaHwpvAwCDA/N+4IrUMp5kBjAnCz/Y4qD/geXz932ccG4mIH1ncD5F/2/mFVN+gqo4q+xwy27wzR1RS2p3hJN7z11HrXazqMIgDvz3EXqeYYD6YnM8Z1IfFdGA+daSSoRDiiqh9XFL7g2aVKomWImxkP4kXU4vJCoXXmd3DF8guZv7zQ1uhJtQOzGHF1cST+pxBV4/+zkpdY7Du7L3cNc7qk/oJNbMh3VEyB6Yi3krcLLbXuTSXZ9qBHhXLrsWngxoXRSo++PIfbqAuJ1iSzQ8Zz0NUbqOS+tILLo/Twe9DjwT5hunIPX1vIN/4SOqPgS0ZQm+VISs5eixxYzAA8xvIbc/0twbWA+33HEo5G6mXe6uzoNqsWE1PKYw7gl7vbVqnTYkyMQXdAPIbfKaW4JQ0zkpeFnJpGdKnYse2xwfofEtV6aiV3eNo1IyUjsp2kN7F4RBd1e1SqrI9nyUcM=,iv:MFc+1fDPK5bg607mMN2sDAufmFzE7hHqEmnejMjmiCI=,tag:pgFMtvcm3a9I+coXMO0xXA==,type:str]
 sops:
     age:
         - enc: |
@@ -26,6 +26,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-08-01T02:00:01Z"
-    mac: ENC[AES256_GCM,data:zk0ivb9asZLHUg819tR8GV5R5ViSiJId0T1o2GqYWjc/AcNK1pBKwIJ+S3TuB0fLz3qaFXUBfzcc+CfztuTLcRzAfu3mF8Hv0boZTe0lGl5XugmozQWjoLjSw+roWZHlXd5CfYbDZsHSO70231NyPlpuUkVr2fqAFZgTEev2A9Y=,iv:IkRYK6PLE74i+Kq5fop4ddS+Q9KW8uNVfABK81uFyIw=,tag:kanZfzBXEYodnQtwWdZ85g==,type:str]
+    lastmodified: "2026-09-01T02:00:01Z"
+    mac: ENC[AES256_GCM,data:VdjLTJSa4ZfWLnola8F4u5q50a9Z6+h+Dbb9MKgGz3v+F2II+u29XrmXDS0Xpqx7QMjpzPdDp4gvyBecXxk5p+nzoC2lHSENvrZsloTQi18wEX04C53IXteoB6ijJ8VR6xC0GyKhXgIxo297dqfndSqgsYmQB5w2WKvzmcb+Ctg=,iv:9AWwKsGiJJMe8qpo534/cZT/2bW4DXeiRhzneSPF24s=,tag:n6bSrwV+9WVMzBsh8ou7OA==,type:str]
     version: 3.13.3