darmanandClaude Sonnet 5
ced2b56764
Local Postgres, peer-authed over the unix socket (the "zitadel" role is granted createdb+createrole and doubles as both the runtime and bootstrap DB user - no password anywhere). TLS terminates at Caddy; Zitadel listens on localhost:8080 and is proxied at auth.mgaction.town. Master key and admin bootstrap password come from sops - the admin password specifically needs the sops.templates -> rendered-file route (services.zitadel.steps would leak it into the world-readable Nix store), same pattern as mercury's pihole.env. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
29 lines
2.3 KiB
YAML
29 lines
2.3 KiB
YAML
tailscale_authkey: ENC[AES256_GCM,data:CBMidfdilBn1HP3TAu9TCOpuwPnzVQ/3OGCsf0vhFd8=,iv:V4UdZBPyzH8NkiXV40CxLdnfkCv5oG6xEQbNSmpmrmI=,tag:h8R2AIaFXgPycMIP8NyHVA==,type:str]
|
|
darman_password: ENC[AES256_GCM,data:otLevSn6bXBrjCu7Dv9PN7Umwrb7CD1PhC1i+J8rp2mURMYVuwF/ZnrlPC7/RDZgINIRBOXOkG9lZo3UjuRyqrtvfUzIm1jGL51l1zvZ/07oNW6OUp4IZEQpoOmz1GuXBlx+yKRQeRDHYA==,iv:pnwp3uAsBoiJdF+QV27h0jztgFJKrIqFlmMT7JkcHoA=,tag:Zb9ziCGsLQt+TcJRCv8tWA==,type:str]
|
|
zitadel_master_key: ENC[AES256_GCM,data:LDZwbpwZdQ03O8I2tvIMYnK3MoQTgvOYwrBt2UuCHbk=,iv:sM66sj3JO+bb0Sk2D7M/Ehk7t7VZneuvTRP4IkT1se0=,tag:YKQ4shwZ4sIDWdNehTugew==,type:str]
|
|
zitadel_admin_password: ENC[AES256_GCM,data:q+Od3Juzvl/dVPkm0w1C42pjK7kU8ur8V5fl2JAdQkA=,iv:n8NFzQczJVeqe1ybBldbkv4QGj0xyf9/P+uvsHs3NjI=,tag:rkXvmC8kZZOrWRQd+mIanA==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUOVhzYzN4ekZtNHF2TGcr
|
|
VjRITjg4UldQRStoaHhUa0RPODBVUTNETjF3CkljbzRDNytBanlZOEtjcEFMYW1W
|
|
QThTK1ZGR1plWFVrTThYMk5sU0N3bUkKLS0tIHNYclVIWHhNeGk2QXozdkN3TGdr
|
|
VWNxK3pYM1IxZW9XU2QwYkVEeEEzUGcK0ZvVWycAfDq4Cb4fVFm40mUTLLuqK6DU
|
|
S/QUwFEiVAqMixxhS0vXOlovFQI+lzLLtLBi7Evi7ZI/fmdNqvz0+Q==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbUtuMHNhblFwTHdjQjIz
|
|
MjdtL3VsZE5zU21tVTE5NnlBWVRqRDZGblY4Ck1ieUFkRk9tM25NN0pyMmtBWTZJ
|
|
clhpNnhIQzlwd1VqQ1dzaVBhYjJkVGcKLS0tIFh0b0hvVU9xNVZ6QkNHcCs3UU5C
|
|
SEhKZEdlVkRyTTNzYUkvZ0JWYS83QjAK+2Shx79sIV2lYzAsRegzCnhScn2i2f/+
|
|
Wptkf76aP9UpjhgNkxzedRebQPB7ti+UiVqCvLVimtuHcsm/NJPcRg==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
|
|
lastmodified: "2026-07-19T20:28:23Z"
|
|
mac: ENC[AES256_GCM,data:3dRmmSJqaKi8w1mtmQIaL8AynSUCH4WRUpUax5g+3qKrhQeect7TdCFyTU991mfmUnxfQ8nI7nyAI2DdAb/TTHxAjDgXd0Qn31olGYZRQFRV25YOiXozvXoHVjroW86IQDgh6UBp5BkpU+HrfCfLs/opAx97jLu14M4sLLuu8R4=,iv:qmKCCX70IJ/JQvpjMW1eYM2cgjVx+1PS44ahhTXiOp0=,tag:hi7V9zwo4uZxAjEm3dUxBw==,type:str]
|
|
unencrypted_suffix: _unencrypted
|
|
version: 3.13.1
|