Thore CimbalandClaude Sonnet 5
ac7e65100d
Closes issue #38's automation half (architecture fix + first rotation already landed in earlier commits this session). Monthly CronJob (rohana.axion1337.de/sorb/axion-secret-rotation:v1 - alpine + git/sops/ jq/age) that: - generates a new secret - re-encrypts coturn-secret.yaml and synapse-turn-secret.yaml using the scoped rotation-only age key (added as an additional recipient in an earlier commit) - never touches the repo's master sops-age key - bumps the turn-secret-checksum (HelmRelease annotation) and rotated-at (coturn Deployment annotation) so merging actually restarts both consumers, reusing the existing checksum-annotation pattern already in this repo rather than inventing a new mechanism - opens a Pull Request rather than pushing straight to main - a human reviews and merges, keeping a checkpoint before production picks up new credentials while still automating the tedious coordination work Needs a Gitea PAT (repo write scope) filled into turn-secret-rotation-secret.yaml's gitea-token key before first use. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# Patch: Fügt Checksums der element-values.yaml und des turn_shared_secret zur
|
|
# HelmRelease hinzu. Damit wird Flux die HelmRelease neu-synced (und synapse-main neu
|
|
# gestartet), wenn sich die jeweilige ConfigMap/Secret ändert - siehe Issue #38's
|
|
# Rotations-Mechanismus, der turn-secret-checksum bei jeder Rotation bumpt.
|
|
patches:
|
|
- target:
|
|
kind: HelmRelease
|
|
name: matrix-stack
|
|
namespace: matrix
|
|
patch: |-
|
|
- op: add
|
|
path: /metadata/annotations/element-config-checksum
|
|
value: "401f8a87d0ef5d91d2e5032d4aede42c"
|
|
- op: add
|
|
path: /metadata/annotations/turn-secret-checksum
|
|
value: "9b0383df36943da3b32198b6bd32bfcd"
|
|
|
|
resources:
|
|
- matrix-postgres-auth.yaml
|
|
- cert-issuer.yaml
|
|
- matrix-certificates.yaml
|
|
# Neue Dateien:
|
|
- custom-configs/synapse-values.yaml
|
|
- custom-configs/element-values.yaml
|
|
- custom-configs/mas-secret.yaml
|
|
- element-web-docs-configmap.yaml
|
|
- element-web-docs-server.yaml
|
|
# TURN Server für WebRTC
|
|
- coturn-secret.yaml
|
|
- coturn.yaml
|
|
- synapse-turn-secret.yaml
|
|
# HelmRelease (muss ganz unten stehen, damit die ConfigMaps vorher da sind!)
|
|
- element-server-suite.yaml
|
|
# Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
|
|
- apex-ingress.yaml # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat
|
|
- networkpolicy.yaml
|
|
# Backup zur Hetzner Storage Box (Issues #6 + #15)
|
|
- synapse-backup-secret.yaml
|
|
- synapse-backup.yaml
|
|
# Automatisierte TURN-Secret-Rotation (Issue #38)
|
|
- turn-secret-rotation-secret.yaml
|
|
- turn-secret-rotation.yaml |