infisical: bring self-hosted stack under GitOps (postgres, valkey, backend); secret.yaml excluded template

applications/infisical/secret.yaml

@@ -0,0 +1,23 @@
+# ⚠️  BOOTSTRAP SECRETS — do NOT commit this file to Git in plaintext.
+# Infisical can't manage its own bootstrap secrets (chicken/egg), so these live
+# in a plain Secret. Manage via SOPS/sealed-secrets or `kubectl create secret`
+# out-of-band. Values below were randomly generated for you.
+#
+#   ENCRYPTION_KEY   : openssl rand -hex 16
+#   AUTH_SECRET      : openssl rand -base64 32
+#
+# DB_CONNECTION_URI password MUST match POSTGRES_PASSWORD.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: infisical-secrets
+  namespace: infisical
+type: Opaque
+stringData:
+  ENCRYPTION_KEY: ""
+  AUTH_SECRET: ""
+  POSTGRES_USER: ""
+  POSTGRES_PASSWORD: ""
+  POSTGRES_DB: ""
+  DB_CONNECTION_URI: ""
+  REDIS_URL: ""