add all sops secrets

apps/authentik/authentik-postgres-credentials.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:a7nwc49lItIjjg6f7Vaz6Kyyb4CgwMmudHpsQAY39539fvCWtYjsoQzEqEXZdcwPyqB2qlOHewXcStBgG1B1iKKZhqE=,iv:yK9EZWhBNLm9lNs7V7Fm2MQWv3Lfb1o34P25+p00FgQ=,tag:ie24X9bcK1NdxZWhEKITHw==,type:str]
+    username: ENC[AES256_GCM,data:VmGN5YxRGZcS/EWy,iv:QKGSkxBSfMusEkl3sS1m3KQREvwUCP0aag8u7VPzWxo=,tag:zXthxvtKBex3XpRqO6Qcyg==,type:str]
+kind: Secret
+metadata:
+    name: authentik-postgres-credentials
+    namespace: authentik
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZFlqTWZzTVNOV294bXF5
+            MEFFWGNXZkN6YjgrdGx2NkZyMHVWN25KSm5rCmxBQzNsSk53bDZiK3RQUCtYbjRu
+            NVUwZHJPSUhZTnEvdmNYNENSR1NSTTgKLS0tIFlmMTRSOWlKU1dYT0ZQQW1yTGx5
+            dWt0TXRDZ2VVVjREYjIvdTFUcVNxYjAKVYa8GZoKORII5nN0590OWzdbyoXe6Eyi
+            mRKUxtVsbhCPtfabQGn/tu40g7A9CFcWh51geIGewkTVmVlx0ulv/Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:32:24Z"
+    mac: ENC[AES256_GCM,data:N81ubg0zmCZpZKa+Z/IJZunsUUT8dZrWfp48cBNLg5GPr1O2SrvFUPo+ZWSDLRWWgea5E00kU1luDHcnTuHtjSF457anCc1LpezJnIIfPHQBE7wIrWkZMW1QYsScZhtNvkDf1LhXuo2JZnRkAZ249JzzPEYxy+GjLXU3hNaaeyw=,iv:V6Op3ZA9Rw2g20gzZapZt7GfnW7TW988psIIDlwxzaE=,tag:anOAkNKfUFhmntDH/i/v2w==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/authentik/authentik-secret-key.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    key: ENC[AES256_GCM,data:0YHxGccmrLh2LFfAeySEqdfuE35FfzsAVI/XNcKKWKUS4HZ5sKUVy8PLSrl99nZRtC66Vj2Vsj/Zj+Ir/3/n8Vzhy04=,iv:whuMt5eTvp962tNisNDc5ygBaCzRs1MwBtOxWP+atv8=,tag:mcerAaPbzujtI25tPLETnQ==,type:str]
+kind: Secret
+metadata:
+    name: authentik-secret-key
+    namespace: authentik
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRlB4Vjg5cU1QWWovRTFW
+            M1Q0cmpaWkNUek54T1VheGxMbVlIeUlybjMwCnVTY2VLTXVSbEpUc0lTRUtETUV3
+            TGRmVDB5cnhpU2k2YkNuL3d6OTVETW8KLS0tIDZoNjlTVERvR1FSczB5d09IVnpl
+            QnloYTFKNGdyR3FuS3N2WjVVVGFKRWsKd8MPL8raiwfz/fLsjL76tdeCBDu/cirV
+            DKFx+Tu8KTugK6gGteXA2/PHZPEB/U9Zh1OD3t6AdPZMQJaiNKq/4Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:RlZUTVt/3acp5BX92MI3USohXoAlZy8QAgr0HwLu0IMc+gUcykCXV/voYSJgIQlHhKDo/Jwa0+KhU3DLT/9GS4UF/E2GCJhj9t9DlagnchLxxJXYyP/7FPUkoOfDKmG1Sc2Gq3i/gTVklzQ0DpwQflF0F50BLDv1FqxUD84jVoI=,iv:T/Hd0kenM4LikCB9mkSrFMVD1UeA+Dvwi+3TLziwsdI=,tag:rfosFTQZo695lnznWC8JcQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/authentik/wasabi-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    ACCESS_KEY_ID: ENC[AES256_GCM,data:cJS1WkKlhgbWGqgOhFs9xjqriMIyGwaSq2W1tQ==,iv:5qj9+BjOPGvVFg9gIH9128nlOaQ27KMgjlIPIMF51IE=,tag:m80qHYyAbXGt1AGe+cXUuQ==,type:str]
+    ACCESS_SECRET_KEY: ENC[AES256_GCM,data:E1/lSR0Crdjt/N0BV0d7PgKSn00sKkNd9s4qsknK3MO4W3JSkwE2g4HyJvbjwDEmWZck7dB//WE=,iv:VoLSzFxrdGKKOVVNE8iiQtGS67yJYjknlxz4fs/DDJI=,tag:aPJEsutmqMobr+vXSCJ62g==,type:str]
+kind: Secret
+metadata:
+    name: wasabi-secret
+    namespace: authentik
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQzVzc1EzaWsvWWlXa2tu
+            U1NXVFh4TDhuUXZZcXNHVVBBeUR5Y2RvT2pRCnZPL0t5RVMyVzRVeTluYVhZNkJT
+            ZjF0S2lsUWFvdTdFaXVGZ2NlOHVGUm8KLS0tIGZVR3lUT2ltR0pLUU4yT1BTWTZW
+            UkZiNmNPbUMvRUs3dDVDNjBnb0htM2cKvsfEiaSE2A5R+pvb0UoaPmvSFMQR2GDi
+            DBJ+OyMFhz0HxQO31/yrlZGcVxBKq/Q4DXD1zDtWapQ3ds/OBjxHlg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:s9DcnPm61QEc8v+VxeCMYlpbEY5XkgciP1f1Mrprix23FoBJOnLn3sJlCc1Ew6tZE4ilyhr6rK6CJA0Aqsvfro5dS0wQUI1CuDjS4+yx1ANfZzxICYNSIHXVhQiSIQ5g0ANaUVvzaj7pBKA/FvV+BTav2UbdDRUGNVsmZY5NZ5g=,iv:oJ8THhyCaB7+sBwqh9fpLIulKMWTDHdLKSZjMAZFDxo=,tag:IhpmqbLYUE9QCS1B28pdZQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/gitea/actions/secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    token: ENC[AES256_GCM,data:k6dhRoR3XCITRikJStLu1+gkW8Xcrt/EnKtq/LtMOdDOC906nyDbLbLXo4yWkUPb4wOT7/FHtjM=,iv:v/7sYpp//k4NgIHIxrSgUCK0ddTS2knRXt7bv/tK6BQ=,tag:t8yskoe9Q+T1UFhzmdEgSQ==,type:str]
+kind: Secret
+metadata:
+    name: actions-secret
+    namespace: gitea
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUWxLU2Z5bmJSYUs2YS9q
+            bFFCSEJlTGtuNEFjVGtsMDFySW5TNnF6RTBzClpMdk9CRU9kTHoyVEJZU1JITnRS
+            aVhjMm9ndTBXYklkWUpMV0hYNWtrVFkKLS0tIEJLRmF5NVNNamlkSWNjam1lY1pF
+            MmtSTTJET3VWQStHN25DeDV6aGRrVkkKcMOwuTZY/meJjQZgzmAU37mUS4VjG7H/
+            q8c+keASqJI511XhWi8K938U8YREge7sDw8sa+RrXpoiy3zyipZOLQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:wr1ngpRm44ueRUsfITsQa9tuWffScHsz66QCfilsc8fO8gprb0eicYAgJ6J7JygGO7hZdnLB4z1Q/5bZFmdsvK2Oz3tV/NX/gZVGbFDqPFHfjDU+5rl7lrBnRh6D1RwvYqJzNL38dDO5oUXTOfDGijS574qB4EpyUnu7+AbJwtE=,iv:7kXdBFzz/M0Kynuk3fmnWWRV7VLN0BXELrYqt/VtQ9s=,tag:FqCzxPTwnL0yBX0+SrWbZA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/gitea/admin-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:wcJdmRnN4nFOaIiM/Lyp8fceSRKpJW9laUYsZU/9UCmreJP3YHGFdw==,iv:35aJWV/ReimElkgHDEvd1VMi1+fL8ayB2YO5Ej6Iqrs=,tag:Vl665zuBbhsU28zXH+Madw==,type:str]
+    username: ENC[AES256_GCM,data:vnhGaPemu1i1kpHOPvRg8w==,iv:Ika50tGu/d6m6UxzUpZFhK/SxLsUMmB/GNeeFPmszdU=,tag:wC5CLp+5OhzLKYolmr1aTg==,type:str]
+kind: Secret
+metadata:
+    name: admin-secret
+    namespace: gitea
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLMFNmREJGMStuTEhyRi9w
+            OTc4RTlrWWJwNlc2Z3liOXQrd1Jmc0VMQ3hJCjlJMzJDdDYvNWhtUVF6ZlBmR0Nx
+            RGNrZWlBcnpjSjZLaU95aGZjcXZVNWcKLS0tIHk0UkFnWkxFRHB3THQ1UytRSzdL
+            ZTB2WVBmWnZLT3FsekFhSHFkQ1RLNlkKbQfo7CDYk/EadaE6SEmsCZX5ubOTcbD3
+            lj4rj1v2dYME/wDj9rFp5IwESalXwKzUVzC8e1GuzbY6pDQPx5EW4Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:ApUlG4FA/KYrwm6u/6qNU2Cqz08MxRNmiBmiwCZgNF4aX0CWzRZ9+VbO/jIJUpzKB3W7EdpbiyuT7Ie3h0lwYIZY5xUXP4CDxsZ+TozAFJq/CgXs/BacTZIVhSEL93W+O4ett/UuIL66rtuiZcBY0CdM80j7aTy20ilse8wwusM=,iv:UWdNu4hW6OcMHkqQcrzmLZlU4gevBwAMInbjtC9R3hI=,tag:W+SgpfrOvR9HnGRfnGSgwQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/gitea/mailer-config-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    mailer: ENC[AES256_GCM,data:baGCpPHJejjMFeiBcgSroJWqmUj/8PzvwAdzZ+nLacen2I91iaIRIgztvsk=,iv:6M2+sKRc1ZC5CqY4X43xgGO/CeWOfjMVzNgelYd0V6c=,tag:I15tnxf8CQaLu+/0GNdeOA==,type:str]
+kind: Secret
+metadata:
+    name: gitea-mailer-config-secret
+    namespace: gitea
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJMmxwWGZUb2JRK0FHdFd6
+            SFN5MGdZR3puUDNhMElTTy96SnVRUzJwYjFvCkJsdlJCRG9zVXdzOEY1REQ4NWRw
+            R05taHVZMlpySXVXWmNIc25VYng4WWsKLS0tIERoL0tUVmUvbG5ha0h0cWIvZDND
+            NkI0eUlmYjg3Zk9iVmNkZVpXWkh2TW8K/coOzGAPF42522cM6DZVAEEv3LmZaIhu
+            BVyl8ijATNLMIfiFpP5bHpljPHrn3lGP70RzwoCV15t1fC6pjeParA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:QBxnUAGg6xchZ9iqKK8gAmdJhDfma5BZlJVRZcfzGM57diuO2OE4JDbjW5gqf21OACL4d2funVlXRVlioLoe0tfZJY3AAedOmyQVXdrr0PwarbPztbWAFVvIMeQWPZUyPd3GxgaAATeBVCanSEgVTIOVqCN/DXNSHY2XcQ9x9Y0=,iv:ugLYt5NxsTIy0wUul748IGIzayG+zPQ/z5kH3T9IfiE=,tag:3yTjZ+MMMVNmi/8p321fFg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/immich/wasabi-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    ACCESS_KEY_ID: ENC[AES256_GCM,data:ad1Xc2tUS5JCGiaOoL5udd058QxG592R7a+66A==,iv:erHAPm5E5w2B0fZ/sagwTsT16MTLnbYzmamT9OS3fEE=,tag:TMRosj0L+u3JL3o6ig0/rw==,type:str]
+    ACCESS_SECRET_KEY: ENC[AES256_GCM,data:QJ3RkLWP8QNPt+JoD1B3ZCQkZKH82ImgnR8ZgfPPnEDFYj2rRuTbZva33yL/wAz95ll8YbjxtQw=,iv:cO96syX0ZdukwhKvvtrTzQcy0qQGEiL3NSxigcop+EQ=,tag:JS9sT+iFgdFMkTM74ore2w==,type:str]
+kind: Secret
+metadata:
+    name: wasabi-secret
+    namespace: immich
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPa1lwSXVIM0ZRa1NhZ3lv
+            U05sZi9WbkVidVVDYVdXWWNZejRHNW9MNUF3CkNFVjc2bjFUZXhuQzAxUDBDVGxi
+            VGpZcHdZMHVWVW40NDRvY2RURFJ5OEUKLS0tIGlwRmNTZi9WWEhuWnB5TW1leVZt
+            eWpOMDdyakJEcWxYaFZiZ05nbCtWU00KmfoVxNBH7N44v/Xxcmjw/D/YQ93DA7yU
+            6/kk/7R2ya2JWtuqkOx9QPU8/TKaucU5V/IxPhoWquytevHkL5QhUw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:1iNzgy+OKP7tZXkiMLr/9oFLjLnEEKAkQdzceFkGUYiq7gHmujuplt9vU2JS+Kc7l5m9FyB7cFOjHpJec08owJf7gDXcHBkUQmGGIU6eso/n/G5lj2bDKoQgrZcS3+cgpDGY/oiFh34ZapSL1uEbgQudRWsfQZr7o8iHLGEir4s=,iv:md9IZ9n2ecQDnBHIkBGZHhc34uIi9aWzbsDbZo2hx/U=,tag:U3m6q5TfHiii7cGPsK0MOw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/karakeep/karakeep-secrets.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+data:
+    MEILI_MASTER_KEY: ENC[AES256_GCM,data:hGTazo5p3b+k9c1FsCzV8lkCKFqEv/pXbAF0FqnYK0euPusL20skBIBP/hZQCllL9ZIpHuHAK8ZA57TMrnBtBA==,iv:E/1DsMVmQ6r3IgF0g4UBvW0rLTUmc4OOBx7FJh0/fP8=,tag:I9NzdG8hkndQEEa+RwHGJA==,type:str]
+    NEXT_PUBLIC_SECRET: ENC[AES256_GCM,data:x0lLGcfMX4o76y+wpSUh4oTh4bm0CIw8+epVX3uO8BpN79xYFLMV3EzbUOi4Isldb0zdPzK6xlnF7tqCvTDY9Wq/SUs=,iv:vIfucp8BM9FaXUtoUUTXCQuRWTngFokKFpIwhA/IpXI=,tag:RykRRY1q2iV9zqe3rvxSkA==,type:str]
+    NEXTAUTH_SECRET: ENC[AES256_GCM,data:Z9GlM3phYB9WtU2K2HH9oAU7F7xZP48IsbK1JrwE72GZP53MiZmGDzTTzU/aP9DfG71PWqEgCPC56bQFr7UtvQ==,iv:SNNpv6J44Q4hxRvgzNNgt7NMUAoNMDAy3Ff7jrFAimQ=,tag:kvp3H+DgVAtXMwKzIPTJRA==,type:str]
+    OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: ENC[AES256_GCM,data:qQAQg6sCJO0=,iv:EqNG67j5uII6+TBnMY9wt6E1jq52vevccfs+pmn4zs8=,tag:UP2omHyj5qCw/jIErW8GVw==,type:str]
+    OAUTH_CLIENT_ID: ENC[AES256_GCM,data:IK87xFx5N0he669UzhYLeFbpfAcZB039p8bgw+6AGDi17MIRBmoQkVJ1bvnGM+EaG7A7ezdrEQk=,iv:OG2HE2ubV/2ZIllyKIFnA7nRNEZfCoyh7AX+M8rLqtk=,tag:uCf8YI9RymbjLzVR2h/btQ==,type:str]
+    OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:OA6t3SU4uhD3AXFYxk06dhYdQhESr2LaWJ58jTGDCIGS2hIb6Sx7tS1nlDK/7G2LB8IZbRDfLSXc+DoYlQ/WwIlFSi9gDbiBYpk0ZYtfuo0hapc0MMCOpdvh7nc9d1p5/tMkX/ZbO0N2BHSBVbtwWaXntDDUd5YJxRubE6pnN3jKRbqY6BGfSdWytf47n8SEK6O2NWIgxnvlkKPLX0H/iKOxaTKHpasyEVv9xw==,iv:31nVzU3o4TuIGlH35oD5PRXbWWIX8FZ2u0OnYorM7sY=,tag:5Y8YFbt28UPDKr7EVJjApQ==,type:str]
+    OAUTH_PROVIDER_NAME: ENC[AES256_GCM,data:lcMWx1XJ/86FVyB4,iv:jVH7sDJo7Gag+hWNbUf9FC+jGqjts7liXomeOeW0eJ0=,tag:ISkJ2s/ZMOdLsxKh1Iauqg==,type:str]
+    OAUTH_WELLKNOWN_URL: ENC[AES256_GCM,data:/29zd+yLKKPQs9KfYCDOOPLqpay3Hd/+6YE3NcufDCiBCGEzHE9YtqrwyYGhq/Z3RPBNB85aYgCZbEVVgTezOvMGeoOUWzrQirD0ZF7JYPQt+jbpLRKMgsD9YF9iySRCPickdp17Hh6ukwhPfcf1ucT5tT9sjXm6JVFJFg==,iv:hzF9F9btpP/7Add/g/E0RlPDO5npIbVaj0JoJ0Na/SA=,tag:c2rigTpq0vtct4FCIBPE6Q==,type:str]
+    OPENAI_API_KEY: ENC[AES256_GCM,data:am/9P6389pS9IrxX2oAiMP5NawG8oj77rY8mgfJCjaXfGOPARIGtOSkmFVyY1oQR51oi3jDAg++JR72IW5k1NFkQp9JehMZeNXgLIc3aBIVIjJ+8G+q4AZ63TJrPAnDd+XiXf0aOAyyMzwmRY/j9Gu4cZXGxvqdz5HAmQMwcBfpWRXpEA1+YnDea2YhXW796JHI6WPBD4dzFMUZ1q5PGWwMOsAi6ArIXTN30EK1AqM8EIlK5quubbRxbJCI16DGDzIbXnuLB7MW8mvzm93Yz1Q39Q01reO3XZbihLw==,iv:G9XIKNcqUIizhgzj0POi0tQ/nHOne3DLeDtRaP0lXUg=,tag:o1zZ8ZoYbQZad3ciV9lqjg==,type:str]
+kind: Secret
+metadata:
+    name: karakeep-secrets
+    namespace: karakeep
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAreXJUVW5FVUsrc2k0RUk0
+            ZkZRS3pZUXFaTUdManhKVWp1S0JiaHRQV200CjVUYlAwN09TelNsK1l4aTQzSEF0
+            SFVkQnUwaFAvbGN5Z0dVTVdMdmRXR1kKLS0tIEk4S2FINWU1ZmtSYWFsVm94UTVS
+            RTBKZEtZMUhLMEFlejNEek5iL0J5Q28Kk07rkAd/qNVyS40Iz7yfSJMpa2pGtvrj
+            0YBKgyDoKmQ1aNzPo5aiaKyaUdh1PYrkAI7q5J+rmXj/70DR662nSA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:4gHyTL/1DH/s4S/GdQOS7THzXNwo0xvMGdUqtEwgsjTSnoEZQMiUFLGOSnCy3LVG6JiPvCrJKDRrralrdaoSSWcmwy3pA/EG2eS58ooa02Hum2DgJ9XO25ZNSj16/gGJwgnEscGHSsAjRA3guAPAIbGip6DrhJJ3EfgVXT+J0OI=,iv:gV6QwYfTXiz4bfJNmW5yiZflspI3zULTEtVsWxirjvE=,tag:388de9lUv88lH3JoGsnlug==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/nextcloud/collabora-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:jFpz9bSZvldMHrXZWPEFLCZk+WU=,iv:Gr01uTyy1LLodCrr+e+QPCaosA0ad9qg+51vxQKu7nM=,tag:mQC7HYeycSdnVi8QXKgqhA==,type:str]
+    username: ENC[AES256_GCM,data:ODJU7cK+lrQ=,iv:biwQxLX4xjZMVWF2phEuOrR0s+oWoiTw6at1YlLIdGU=,tag:oA3/NPM/tFJBfclJDJUP6A==,type:str]
+kind: Secret
+metadata:
+    name: collabora-secret
+    namespace: nextcloud
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdm9XakdSZFF3ZWhsaktu
+            Tm9aWU45ekhQeTdEc2FXbmVZZ2FYa3hrTWowCnkrM1hxSkNkTTFuVlh1NEZDbHBp
+            cWppL1lCMlpaZ3I3ZHVmRS9kQkwxM2MKLS0tIGF2bFh3SzJ3azVpWlhHOUo1Zzhp
+            QVhKelUvY1hiR2FiR004YnQzMEFIN1EKa1JN+ra3csHPICDfyOS/DtE6SyRrGveW
+            9KigyHoAzOAjvr7Cjzirl9J7tgA9iasfbVE4mfcuqwJGR14ANJ7OPw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:sFjlG7K93WOS4QZXV/bcdVC2YwcCzzZ2lS6vtsR6v6SK0Lmw2neR5rc5SF6IESrUU4G3M/Y4VFTmb8Zttk0Tlk2nRlqXo35MIN6S+KTL/ssiCHSN4+J20Yp7HeQ+3DkLLY5+RiYAhrfzy/yUVRPWeAF3KKGwwfjknCR+avtLL44=,iv:QmesKHhkXUAD+lFS/ijYmsNVF8FFnmxiHk7IDJF5kmk=,tag:K4COX2z99gGuO2PBKUz7Zw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/nextcloud/nextcloud-redis-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:sczdgF2gOu+NkUmPPS3ipwRPSkgsL69QwA4zUFGV70GRTpC+,iv:0sA/fN7M4Gg7FuOAH/+j8PhY26wT94UNCfbdJ36JKg0=,tag:V3G9nSJOtVh0yzNZkX3Uzg==,type:str]
+kind: Secret
+metadata:
+    name: nextcloud-redis-secret
+    namespace: nextcloud
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1aDEzNEFlUUNIekRib1hv
+            NGZITHZMTjhlWlQ3MHk1djlUVk1GeFRVRzBNCm12bWhPaHk2REo1RCtZUDhnLzF3
+            SXFOMzlVaDdyZk9FQVhiZmV3ZEo3RlkKLS0tIHVrZGZ4cFp2SkVubCtxUWQ1aXBw
+            Y095N2YrRTZBdFBlOWlPYXpWS0R3dk0KTUGr2gfHK5NszjDWSJObcGNdvjiBQ0lt
+            ujeskIYbKzRoY8cCRxiGc17SFTYnp+2q0hBm8V9H+ywI74Chc1gOgA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:wISm9FeJ4cyF0I+QAMjte3/nwzwtk8c5VQltYzPlcsqUqOjLkmD6iLqtaOteZ3pZQOf9AylRTGaoow1kZ44X5dk/fx6Sy/JrQuhuc2JK7llgBqITp3S/sRK1Dtvb4r0y8x6iiKs8+sd/PA9TUqekPtmrC4dVcHKGzd1bX0DopU8=,iv:2bmJIOt1JUUk2TJbcQIg6/FwpvLpYTwpzKaSd39Lo9c=,tag:FbURmraQwP2NaB8CEVArww==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/nextcloud/postgres-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:+gp5N+elMS/vn3N6u8z7+/IDVl6w3VDnE6UrIsRMak3f1qag,iv:TY+iRf28IvZzpc3wJtIVkflgzuSyQxpucUttce71iTo=,tag:A/LsCq31oVsjINhi2BH7Cw==,type:str]
+    username: ENC[AES256_GCM,data:LFfYK587FmlJy8Gl,iv:CtTz38aswJ87iWp8GslxFH6PMS9ZJ7puGprrURhidSE=,tag:5vSMUAyjjxpbHlx1/2h9IA==,type:str]
+kind: Secret
+metadata:
+    name: postgres-secret
+    namespace: nextcloud
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRemtSSkl2K01QSUlSbDha
+            dEdsa0JEWVZUeEtYSXM1OXRDQ3R1U01Zd0RNCnFKOWJRTElZRWxvdW94ZWRvUmNY
+            Y1IxM216MUhLWjhKcFJJSE1YQjlTTlUKLS0tIExFSDdnVWZEZG43VFJwUGVPT1Bu
+            ZWljcWVZcXpOUjJnOStvbmgwVHRsT28KMF4lDFhHbI+yqXDhiIuDe2NeuhPaReS9
+            Z6wiLrOWcXfbNN6DnLSBNAt0IqQzIYWHAlZayGPqA+JJCS/gkZnA1Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:TTAiIjKHCnA+mQ1fM0J3TEdqZkTRZKSHjRI4SsaiUut+uwWxN3nxUUlcBpyo3m62ff9WkyYvGtxfLsOXevrshN8WFB2H49NYA6TjyQgAzJ1XFeJZhFfSLM1nd/46a5KU/6mSBN9ZqUmnhXmBNo7wZdDKSJUlZ8tFwTtwDJve2o4=,iv:2idsk3hZOOWKGVZ+4Z9C82/+lF/tjokm3uBPMsE+WEw=,tag:UxQ6XtP9+iNaAn++IDYaHQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/vaultwarden/admincreds-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    ADMIN_TOKEN: ENC[AES256_GCM,data:N0kMJfrvylK/MiG+Yq9IpaPx0Q0=,iv:GR/ZxbKOim54hbryAw5MbktstNZ4upqXi/tsM4CPGmA=,tag:4USciX0i9f0cPK6BAy8zDw==,type:str]
+kind: Secret
+metadata:
+    name: admincreds-secret
+    namespace: vaultwarden
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTjhIQUJjRWZzR2VSMldz
+            M2d1YUZ6QWl6Z3hJM0xxMGV6N1d0U2RUTlVFCjZHSTdBOTd1QW5Hb3BsZEc2Ykdv
+            ZElxUTgrVG1EcmM5SGxiNW1WMHRpbWcKLS0tIG91WmRsNzhWa1R1dHZ3QWJqbnQx
+            ZEpndHIyQzllejI0K0t0bkVKOWloYWsKeSb8P3ZijFvLy9IzVDkxMakfyWS7tt8e
+            uo3wrtSTlPHzvozymM/hXVDzKI6XZIZnUBfebGQpk0DgymyYKrwFgw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:sidIbGpK0REcpsX+lQyE6G6/qMH1EWsLzKc6p80X++L5ALzMT3zbKK7JNeGNIpAGdeX+3VF/g2JM5k+mIQdNQUjjxHuej3XQQ1PPKsis7GMpms2PSM9V51GbJ3QSeCW8hLqEDc7fKsB7dYLV+TAcrWtPg/lsV4VJ25eIkCQS7N4=,iv:gdORkFVZj0Rt6Qrx4K+xhk07TwKT6vxPu/sgg0Q/32E=,tag:A0shGOWTVSRPsNDG/kOM9g==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/vaultwarden/smtpcreds-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    SMTP_PASSWORD: ENC[AES256_GCM,data:SxuZaVeYXXhar0Qhi7clkXyO15rBG8xI9QTOzgwqGVCjHOW4,iv:zKgyHRU6GOnz6Vpt1Ko4/B9ySZpbMf2J/bN8WdUaitY=,tag:4+02vnssi0okvMZDel7/mw==,type:str]
+    SMTP_USERNAME: ENC[AES256_GCM,data:NREKMX/dvkejjoiLa764rT7CDl0nPoAaNWkXGnqrgdPhnsMVSUv1RA==,iv:VXe3z426+688ojm4JU3hyytFWCJ2oYgSFVnIOv2ry8Y=,tag:Tj5k8LApkxd+TBJFF/6/Zg==,type:str]
+kind: Secret
+metadata:
+    name: smtpcreds-secret
+    namespace: vaultwarden
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
+            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
+            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
+            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
+            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:402GE3Cqd1N+cQBRnfNb5+/dudSy5pO1Hilc4DW0n+xm4x5sn8wr8C/mL6NDoBKh8fc7JAPPShCfx5B2RdxBL0hs7fkohSIKvtU4hq75enq/bPOtRoxuSxAMH89ayVSbP0V1llWsHFwGJROEMp/9vpqWUFqFvf3uCC8tLOGSy/8=,iv:lp0JMs56ltxFLJOiOWoTa2+D383SgD15v7XJpAwEDdw=,tag:/dezyOAu2W6nTGNQxKTlpA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

infrastructure/controllers/cert-manager/secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    cloudflare_api_key: ENC[AES256_GCM,data:VjKNLUB3TcdHabLxT89+m7YL/QxFYXpDjEPi2dTUjwzKuA4Ynd7Po8xCW8dYkWV86YW2WA==,iv:9jZV/nEC1c3VD8fq2nVVNr43SqIk7P08SAo66Gmcf60=,tag:y6xrwTeZTfN4odpvaAbr7Q==,type:str]
+kind: Secret
+metadata:
+    name: secret
+    namespace: cert-manager
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMGVvVXdGMjQ0N3VGMlll
+            azBnLzAzd2d5WkV5ZjlkbzNickhUeFprYVNrCjdkMmtDRS9ldVI3S05hV1U4b2dm
+            MDZMMUhqS0tta0twS1JQOTZnbGd6NXcKLS0tIEpDc0JzK3lvbVpUZWpzbVJoT051
+            ZWNYV2NFUmFVS2NGUDRmUWRqQTBzbFkKjvzu0zX6KYgcU6iJfUQ5fIh7uNEwcJqC
+            1wjWCyp+D15X3Dxl7l2C6sTHEOJ7zj+HrCTlvzragt6tnbMC2VtNkw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:x33/C5T/eFNeCnjZGEOjj2LVzyFvMIu4dtd7HH0rAhSwSJxtTN7OqCNpw54SWLgQVvJjGLDd7T97BxNTJvyRSeoUsJutBrqkcAx1p41GE6eCVOOU4AkPbR6S1nPFxJveSO62KMf4UvLCvvrvEHnWz0x3b1oL/tLYdgRFmbCOHl0=,iv:MHbnL3uvVVzPXFDnKA1Qn0pZPPcY6bFDm9bZKFZVkqA=,tag:MTvoMeYB0Nc7vudyvdxD1w==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

infrastructure/controllers/external-dns/secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    cloudflare_api_key: ENC[AES256_GCM,data:KNFMTvtHi0py+wisSr4dMA0u1MoIuckMZ0nBL2TmX0AqRv8D9BusV/cF736fymIVw8+fZg==,iv:dgvMAjl4jSVPkSUdvXhL9Ug6NCpB5ZkL2WWXQQAyB7A=,tag:otKwcgUF/asg7eKBexN1gw==,type:str]
+kind: Secret
+metadata:
+    name: secret
+    namespace: external-dns
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZE8rQy96d1paMi9NZlY1
+            bysrUmNQcFJBM0FSZVAvYXRaWEVwU2dqN2tzCmZOemZ3N2FYUkdwS0E3a1dCR3Y2
+            anlVcnNJY1JMeVErNXRLcE5SUXJncTQKLS0tIGxZQlU1VTZ5R0ltZldCdEZwSXpC
+            dDlYNjAxa3FHaVFrZUhOMWJGWnQ0NlEKtsmpOJ8OEYGqquRnT3bm2MFfjd/AKjyH
+            lLQfpxPol6AIsbVxfJm5GexGI2WQ8lqYdwA8ada0rqzBkjQ6DttE/w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:zyTYwIhNeBPCQCX/cNh/j3yXtftJixu/vbJnDmtQ80qQwLMUnVT6rihvsu1+19q7323YYbha5UMg0HLXcLYUvTlnmQhn708KwY2NPwVnmJpCQWXbaJ89mqJPk8Jn1EuqaLH/x4NZn7+Aj0JOK404SscoXTHLJ6SEGPLZIEefOUM=,iv:ztDN5OBcPCCy6neAlJMhCz0gLAAH5mO+fypBwuaNUaw=,tag:GG3j3kQYt7xaSAu8aDQ9AA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

infrastructure/controllers/longhorn/wasabi-secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+data:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:blCRxZeMzIaYnGtTa0thX602+OSs1Edrn/hhGQ==,iv:fYZLbWElXoC2/9PX/DNHw8IxXult0Sai/GLz9PwJuIY=,tag:oy3mBbehTE7QMQKVz/22BA==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:Azg8k6oWrKCToEJp/P0AC3jfw+u7t/W9oMJ/ynKfMzArDkkoSKWR0PlozcUviqZxaUvJQw==,iv:HpYimQi+e3VRpSaKXHyzePC1E1MCkl6dUBIlWdUKcFs=,tag:k15afsr8AacbO3VAyxwsMA==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:YGIvc6Cdt6P4ZYAQKLkurl/KVUB3sYW4mTK8MeeqfrmPbnLnGCQ2gtZNaAxuzUPHzX0H4GTc2CE=,iv:0zIGmYTlM9Pe03XvBGJ4GVi4+3blzPsLckERtTpZokA=,tag:xPj1OauKppL2MS5PbDBNDw==,type:str]
+kind: Secret
+metadata:
+    name: wasabi-secret
+    namespace: longhorn-system
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqQkVkcTN0cldFUmFVbHk3
+            UGkvMlhYaTZka2NWMXpyZk8zT2p2WVE4VUE4CitUNUxRUklZR2dOeG5uWTVyWmgw
+            MDAyUFhHcFJHcUFEdnRlZWFQbkJXa1kKLS0tIE81TytRNVpHejBPY2lLQkJFMzVY
+            bnhQbERkcFUzbVZRd1psVnZwTk5YclkKQ8fc+qV6/ViA1ZLBh9Yh1CFuSuVcMYfK
+            y6RMe32zh8RvXb6zGer8T1BpMGK4fd9YmOUDPUXx2jHENr84yBoT3w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:mAiPOsRcnbLyG8hzqv2p0lVkBxGNSO1+WmK0CUkoplyql7neeTWhZIQmtufmduPO3mlPTorHMBq/ixOfrXE6H/LkOpfdQ1TLBb9Fs7hWYEj1jFdkqtDhQBVkLU0EUvdJRpYEgnJZpi0OWbwyy///um2VsVuht/l9qguaUvvv0Lg=,iv:zro+6yVcMe2M0tx7n/8eytcHMqhqd8qyMWnda1BE9nA=,tag:nZR4dF/RwIcymP8sovuSVQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0