Jeffrey
0177c73fa9
gitea: migrate to envFrom with per-container InfisicalSecrets
...
Flat CR narrowed to recursive: false; it still serves the SMB mount credentials and the Actions runner token, which the runner Helm chart reads via existingSecret.
2026-08-24 00:20:29 +02:00
Jeffrey
079830a8ff
authentik: migrate to envFrom with per-container InfisicalSecrets
...
Server and worker share one Secret since their env is byte-identical. Database and SMTP values are Infisical references rather than copies.
2026-08-24 00:16:26 +02:00
Jeffrey
3e13b76c6a
react-resume: migrate to envFrom with per-container InfisicalSecrets
...
Stores PRINTER_ENDPOINT pre-assembled instead of building it from CHROME_TOKEN via $() interpolation.
2026-08-23 23:47:13 +02:00
Jeffrey
3c24cd4b9d
gotify: migrate to envFrom with per-container InfisicalSecrets
...
Stores the fully assembled database DSN in Infisical instead of building it from three helper vars with $() interpolation, which envFrom cannot feed.
2026-08-23 23:38:16 +02:00
Jeffrey
f382c87f58
pelican: migrate to envFrom with per-container InfisicalSecrets
...
Folds the pelican-config ConfigMap into Infisical so the container has a single envFrom. Pins imagePullPolicy to IfNotPresent because ghcr.io/pelican-dev/panel no longer allows anonymous pulls.
2026-08-23 23:16:37 +02:00
Jeffrey
0329546d87
azure-ddns: migrate to envFrom with a per-container InfisicalSecret
...
Also moves the manifests into a component directory, matching the other migrated apps.
2026-08-23 22:42:09 +02:00
Jeffrey
c408522988
immich: migrate to envFrom with per-container InfisicalSecrets
...
Flat CR narrowed to recursive: false so it keeps serving the SMB credentials that immich-data-smb references by name.
2026-08-23 22:15:10 +02:00
Jeffrey
77b8bd4475
passbolt: migrate to envFrom with per-container InfisicalSecrets
...
Also removes the now-stale flat CR files for searxng, outline and passbolt, which ArgoCD would otherwise recreate pointing at emptied folders.
2026-08-23 21:54:06 +02:00
Jeffrey
14ef1c6e91
zipline: migrate to envFrom with per-container InfisicalSecrets
...
Flat CR narrowed to recursive: false so it keeps serving the SMB mount credentials that zipline-uploads-pv references by name.
2026-08-23 20:08:43 +02:00
Jeffrey
3bec829396
infisical: repoint secret CRs at the rebuilt machine identity
...
Also tracks the auth ServiceAccounts and RBAC in Git so a namespace rebuild restores Kubernetes auth on its own.
2026-08-23 20:08:28 +02:00
Jeffrey
7956c6b1b9
Migrate to using EnvFrom with the use of Infisical Secret sync for env vars
2026-08-23 18:23:56 +02:00
Jeffrey
1d026f8d57
infisical: migrate all InfisicalSecrets to Kubernetes auth; drop universal-auth secret
2026-07-16 21:18:47 +02:00
Jeffrey
fc4ca1f3f1
infisical(netbootxyz): use autoCreateServiceAccountToken (short-lived k8s auth)
2026-07-15 22:07:22 +02:00
Jeffrey
596fa5380a
infisical(netbootxyz): switch to Kubernetes auth (pilot)
2026-07-15 21:54:43 +02:00
Jeffrey
be9bd3a227
Add Outline
2026-06-22 23:32:35 +02:00
Jeffrey
c40577589d
Split manifests into infra/ and applications/
2026-06-21 12:23:20 +02:00
Jeffrey