From e110918d5f9aea39d2e5b7b297c1049ee1208043 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Wed, 12 Aug 2026 12:00:00 +0000
Subject: [PATCH] feat(wiki): wire up the wikijs-postgres-secret (created by
 sorb)

The SOPS-encrypted secret existed locally but was untracked and not in the
kustomization, so Flux never applied it and both wiki pods stayed in
CreateContainerConfigError (secret not found). Add it to resources and commit.
Values not read; age recipient matches .sops.yaml so Flux can decrypt.
---
 apps/production/kustomization.yaml          |  3 ++-
 apps/production/wikijs-postgres-secret.yaml | 23 +++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 apps/production/wikijs-postgres-secret.yaml

diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
index 49b1ba6..1efccb8 100644
--- a/apps/production/kustomization.yaml
+++ b/apps/production/kustomization.yaml
@@ -53,7 +53,8 @@ resources:
   # Client-seitiger Scan-Dienst für verschlüsselte Räume (Issue #19-Erweiterung)
   - clamav-http-scanner.yaml
   - concierge-bot.yaml
-  # Wiki.js (Plattform-Wiki, ADR-0014, #0048) - wartet auf wikijs-postgres-secret
+  # Wiki.js (Plattform-Wiki, ADR-0014, #0048)
+  - wikijs-postgres-secret.yaml   # SOPS, von sorb angelegt
   - wikijs-postgres.yaml
   - wikijs.yaml
   - wiki-ingress.yaml
diff --git a/apps/production/wikijs-postgres-secret.yaml b/apps/production/wikijs-postgres-secret.yaml
new file mode 100644
index 0000000..3c8d161
--- /dev/null
+++ b/apps/production/wikijs-postgres-secret.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:ALT8e6Z6nZXHWkB6w3ZtkW7z14VAN0LpFITlCQBiJ9Up0O0dVhikfseCygo=,iv:Pn6U3t5QCqnYZA2TAk/fQBnE7FITTVoNzyCzMA/Wo+w=,tag:KAHpwDDRN9bIzMkWFBooqQ==,type:str]
+    username: ENC[AES256_GCM,data:KJQbdaJXroo=,iv:0ZVry78Bg9WRW0+vR7Opib9McGC5pyHtaxXExyh9dAk=,tag:PJvI4tigyIDZc0ASLEvUFA==,type:str]
+kind: Secret
+metadata:
+    name: wikijs-postgres-secret
+    namespace: matrix
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDY2xSYVl1R3M5SVI4UnR1
+            cFpZcXBLL2thdDdWRmtSa3kxM3FkRWIwRW1ZCk8xa25GbzVDQjlFNk0rcmUwcldJ
+            Z0JNVWhXQTY3VWlDYjFPQkFQM1FFRzgKLS0tIDkzME02K3hYTUFWNGpLY3N3emcr
+            OXhrd2pUSnpTU2ZUWHV2MnMzdUFVVlUKyrvbkRz4sM5FjdHbP0vdkqYlQZxr33c1
+            HDScKVKJ++RBXpP4+x7B6rjSiMsV0I8eT678IO3wz/qGugvrTTZt0w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-12T19:16:30Z"
+    mac: ENC[AES256_GCM,data:3uz4TmPnSwNK3vmBmRzGtwl2qMxPMQDWEqxpwQ0AbTOpyCiLmhqh1/eIvH1qOQoV5RQMkfcGa0XF2dxb7Wr4S52m8E19zyOmw2HNHvUj9gt2IUGHBUm5nZ2Qd0fO38VTdRX+Eyv7y/brbz1+guXMOTAwAbEHh51oV7rc7cyRCQo=,iv:8Kl7qOyfF1AlEMIFTaBM7nXZDE6RhsPJjj9QbzIJ8ns=,tag:BtvI0TpoY339XfXcknTVDw==,type:str]
+    version: 3.13.3