Files
axion1337.chat-gitops/apps/production/custom-configs/mas-secret.yaml
T
Thore Cimbal ef04d86bc4 fix(mas): reject upstream logins whose localpart already exists
The Authentik upstream provider used claims_imports.localpart.on_conflict:
add, which links a newly registered upstream identity to an EXISTING local
account when the derived localpart collides. Combined with Authentik's
case-sensitive username uniqueness, any holder of an invitation token could
register a case variant of an existing name and be linked into that account,
including service accounts (draupnir, alerts, maintenance-notify) that have
no upstream link at all.

Set on_conflict: fail so a colliding localpart aborts provisioning instead.
Existing links are unaffected.
2026-08-11 12:00:00 +00:00

23 lines
3.3 KiB
YAML

apiVersion: v1
kind: Secret
metadata:
name: ess-mas-values-secret
namespace: matrix
stringData:
values.yaml: ENC[AES256_GCM,data:jKArnf1jeZwgTcCoktZozMHJ8wBulzvI90G5yaY800E0wA0Fel14DDVpJ8u1kyRXKdT3A3YGGdDExuEEC5ZWfU+o6GGlkpLzJKu9MzQyDSsU56nrkn+QB90Ky5m3fFipoINaRjlycafuY2JWLQfdZH2is5phLTRW3vrZtLdnujFqkWKoAISPST3IaN4Ked2BxC/ZzrgTK46PAale1JC2vbxFAPtNTb2Qf0sZ4SGGJfO7NYumUtIc5Lq51x5gHHChRDmi2vBD4/EhPIglnodTW3opUOVZ8V/DIt0zev/10PNvn7zoWrCFRgWHcl1wkXL8RKwJohGf8u00Lom7D/YWaXCq4P6/ykMMLyf19MvMNDb0NJwhdPGnjZExkLmFYRL1kfH6yQVijv8Oj3ySVcvIISau9FWxPHQljhRIFTlpAjUPwZFD/mvg4nf9li5dFdU3RgOx9vgZayb5lM7UhP2ubvSvZqaYRrgBipx3jyNoj6CQ3/fhmpDQB2nOxwQx6OLkAgBDm87Pnxv40U+hO40DmLPtuv5h3KVwzf0Sagx44OevkEeNE1iYMgdWLk4In7Mj1gQe0jRBOE0Ys9sVJ3YiKqQEi4Ul8PlfrT+SFrbI/iZ+Q7NjyfiXLYIAvrAU2DW2RzVA6lO5poZ6lP3BhnA3LzolFgPZh1sE21U479fGY+aZwkdwpQCTAl126/CeN1f6SZXjfYUEBl9lOEL1kPZ0ujyt6HjuvzWJM3fMw+F6MkXayrN8KUBoln8Vn1ma1wxYhvRc8XjAUhU8/vrwTFzGK9b9mg/qLGB1G0CJN8ZV/RHEM0JMGW73Hqg/pYs51GmqQfcZGL4lUFKcdQwjEeWA32A4Eb69GZlRtnhtofgHjFTjSlOChMbBzRQFXV4pOCvc2rO4nPYu8FT6yIYmHaKezN2sVWdZ0dz3NUFZD8nHD62EcTnpYAPvtIeDuyL0dqnsiNeTfeYvWZh+562iQkPiIHSUKvwffrC/EnTEHwi4IBHjEYxGv/CQYcCU2BXw/vKKCJVVcZ5FB7l6PbofreruKxyDof5GWjSehhddYj2MItt6wm2G6tLrIm9zBW5QQVsMc+RSBR5XnglyVFsRXCdWbFfKdIOTBRITH+qpgKLozeh4cVGGSFao4QSzgLgIoEd8xUx9sc8tf65Wkb0Z/qNGRKhBOuwzSYKZSlJF9BvAip6mb9befEnGOOkz6NNWi9/mItLochsKru+V/WhjEykVdHRkxZy5uj4o7hyiRlkCax6e2oSHshH/0u0cv9gp4cNH07JFHiqnrr/OzSizyMHelQF6WLoQXliLzxhNdqiSTsFyxn7DfZLjUokJBk7HVKctO7Hg+PeOuQEXydhJAUhxSds4NQw2Gc3ArKF1NK0F2kjqSzNgtuk2MYZ5nLIqM4inkulWuAT3sZKO05k0kbV+gZftI1khKJ4EPD7+X3sOYYsuxYsNPP8afzQkNEpjKi70AI38i9CuZlZFkmaQ8XJpdfQqXYMecy0khWxTDeLP8qa4P6L8H95py5+fhEih/VkFJVYmeJdYbiz7/nPUh7kTKqE3/bCjj0y6TfrdJvzMm8FTCtQRglO5feUg1SKrEckL8VEvaTawDMHI4psuiCukFoDhs0YauAVYUIfYfzCj+KCp3yn09huCl0hZ79PMO5ddHOsLI+t6M16MXAEbQQzXmfVd008RG9/a1WNzYuc+oEq/hgQ/PtlaRRsLqRDWBBR97/MpedpE+cVAZoJs/pyiGepr+wC5mP8Vg1aRUHnetoARFX+cquqJ0N1VbSUE0QxmmJ/mCQTumY1LtRG1nWgw7NuJ/N7wXSXUkwVjLulsZGI6Cc1xt8xrUfgSky8EDR0zRd2ogPAN+Nm5talaHxxnmDau3wMHFufrsvLy8+pqqJHY/PEIBgf/8yZGk9PwLV4FkeeqAelVyYnGXDdqpsYI8WtgKOIr52TAoq4hKSpNGCJsT634nSP8ZNlZBrWpnrdYvNiWe7tqS+hIz+uY53baYNM8xZiRtvqSL9S3JUsqno49B7DreRCLtypKCSYjQlFFgPt6TlaN9rVWof1mSOtKTQnyOn0zlVgdO6+PB0wN4JcwYdYn5TG55/EE2BDZCceDMt9tryUGWmP6Yvhn0T3JD9mcRmeQxH9O1nipuWuPWQek,iv:YhS6z4F2E7EvhpY2A5rN9mnnllmiieDCUQQEBykJxUw=,tag:Z5i5cJ77CuxMt2ChVIYNaw==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsWDNpQm90aHZLR1MwendM
RC8rTE4rS3laK281THE2Mnp4b2hTdjhQVjFFClRGTExuWVFNVGZGTURWNyt1Qkxy
YnBEaytBTjJqS25zeG5rczVLR256OEUKLS0tIEdBdHNsWit6MjlVUDVSWmZJRjJM
NGN1S3hpNThQSERDZGFtRjBaWi9mYkkKSiRfp0qHxQ+CAKhAjJRhnHl30iteBQuS
Ha8G0sJNHDk/+vg4/3LR+D1hv2i6vbI/Mo0W85GiCpGBu0hajTxgbQ==
-----END AGE ENCRYPTED FILE-----
recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
encrypted_regex: ^(data|stringData)$
lastmodified: "2026-08-11T10:29:33Z"
mac: ENC[AES256_GCM,data:TPCj47C4tHcT71r4Y4BsTCFwRnj3/olDJKjpBW6cXUsV4ee10cmITt7NKoHXxkuux62VPMuL5SMv1Y0pETxVFVpXxIAvonedy/VpZkPbA605rQ7G0lNzcz/NRJVQt0mq5KKIhRsDtovRH8SD6/D3CjATNzvP77nfEaJZclvxSik=,iv:A6Y3ZdMYuB0qGTdJv3X4mr9/tva/7HHqzYRFvrorE3E=,tag:bhXI97dA2KSyZcF66R1nqw==,type:str]
version: 3.13.3