From e1fcdd06e2b98c44a22da1922e0b8ba1fa777b7c Mon Sep 17 00:00:00 2001
From: sirius0xdev <sirius0xdev@proton.me>
Date: Tue, 6 Jan 2026 03:40:37 +0000
Subject: [PATCH] secrets in place

---
 apps/base/customer1/configmap.yaml           |  2 +-
 apps/base/customer1/customer1-db-secret.yaml | 27 ++++++++++++++++++++
 apps/base/customer1/n8n-secret.yaml          | 24 +++++++++++++----
 mise.toml                                    |  1 +
 4 files changed, 48 insertions(+), 6 deletions(-)
 create mode 100644 apps/base/customer1/customer1-db-secret.yaml

diff --git a/apps/base/customer1/configmap.yaml b/apps/base/customer1/configmap.yaml
index bc574ca..92fd247 100644
--- a/apps/base/customer1/configmap.yaml
+++ b/apps/base/customer1/configmap.yaml
@@ -16,6 +16,6 @@ data:
   DB_POSTGRESDB_HOST: "customer1-db-rw-customer1.svc.cluster.local"
   DB_POSTGRESDB_PORT: "5432"
   DB_POSTGRESDB_DATABASE: "app" 
-  DB_POSTGRESDB_USER: "sirius"
+  DB_POSTGRESDB_USER: "customer1"
   
 
diff --git a/apps/base/customer1/customer1-db-secret.yaml b/apps/base/customer1/customer1-db-secret.yaml
new file mode 100644
index 0000000..2562da4
--- /dev/null
+++ b/apps/base/customer1/customer1-db-secret.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:/GaqE1EHzx3HpolrzCvT2vrB1Ak=,iv:RQTLUG7H3dLKtrB+0nNROutMrzkfPPvcs5t8hm50gAs=,tag:fWnIDOc2esltvuhnhKzXqw==,type:str]
+    username: ENC[AES256_GCM,data:flHwx9IxggUj8npq,iv:qaxmCeRPNy0ElUFVNXoFEFB+qgjvFLUEZCtj/0QnaHs=,tag:FY2e0BlXh09LuIdTHcipBA==,type:str]
+kind: Secret
+metadata:
+    creationTimestamp: "2026-01-06T03:32:33Z"
+    name: customer1-db-secret
+    namespace: default
+    resourceVersion: "1767670353472527021"
+    uid: 51eea94f-26cd-4878-826e-8522c9ee28d9
+type: Opaque
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMVVrcXorZUpoay9FYUJ6
+            QitJamZzaTl4VDhwek1YUUdGN1dsb1BMN0FzCjc1RXJMOHFxVnNsbXFGNC9nL2lF
+            RGhvMGFxTkM4ZUQ0TEJZcWtCRmh5azgKLS0tIHFDclJKcDF4VGRSaW14UTR5cFNz
+            dVEyaDVIdFdSMytjMnI4aXdQTTRMVDgK/oybKfXRKUclRCS9R56QS7AKjDZW9hwL
+            sqs08gMeUvifRVvW41mpVBDIwS/VdS7874GX1+QzwDuPWCggEnpU8w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-06T03:36:54Z"
+    mac: ENC[AES256_GCM,data:gUEpgvPXJhDDBTaCYtcA6rtkicHCd3ebTzjUy+WA0jMJwVYLvHIis0wlam6JtWfXQq2Z7em+d1UjwDzycDaBDvoxNo6mIYnuzg0LP+Lqb5+v8dd754APhfXEkhcgntI0Bb1DDnBswhAHMG8yglpS90N9jmavWE5vlCnzX+rmcys=,iv:/fRZXrRf4qK6XkHE0iy+2/ZkKr9YvtQpjA/DL6bVlQg=,tag:aN56uPKGHaRX9CQHVYEjGA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
diff --git a/apps/base/customer1/n8n-secret.yaml b/apps/base/customer1/n8n-secret.yaml
index a0682c5..b088394 100644
--- a/apps/base/customer1/n8n-secret.yaml
+++ b/apps/base/customer1/n8n-secret.yaml
@@ -1,8 +1,22 @@
 apiVersion: v1
-data:
-  DB_POSTGRESDB_PASSWORD: 
+data: ENC[AES256_GCM,data:APQ5nJznd+lpVS7cPzEN2OE4wEFqQTm8FX4/ayYtKMI/6Hg+YnwG,iv:rbpMzYgjtCAZDretQH1X1Q+B6Kjzc1ZdBLWEF5/rr2k=,tag:QIP49Xll4vR9Om9+AsyRUA==,type:str]
 kind: Secret
 metadata:
-  creationTimestamp: null
-  name: n8n-secret
-  namespace: customer1
+    creationTimestamp: null
+    name: n8n-secret
+    namespace: customer1
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIVjJ6cjJRQVpWZmd1QUNa
+            OEM4NGFrMElQWHFWeW9uamw2azhyeUxHVkRjCmpTYzVMRTE4djA1OHVJNXRQcENR
+            RTdEZ3E0K1dQQ0xVM05NclNmNStEbFEKLS0tIGxWSHNRY1EwT0lQUXd3RWdKMW9J
+            ajhGaTJUYVV6VDk4cjlGT1lBRzNSeFkKLPJ4npljYF9wZG37vZq8T14mm66kfqq2
+            nYmb5iHr/8U7XbrUeIoDk5xh6/2We5NA13QTJzvnaeUvjwCfjvXVBg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-01-06T03:38:52Z"
+    mac: ENC[AES256_GCM,data:dNemv41znSffIq0CM3t+CTohnMmB4Atwa07DFcqnnP17t4hBYLLxmPB+eUnHWn0b8i8ULGXTiSzNT0rItgqk69OE6KM5t+2rso+KASOyykcmMbuQ4LmfFSXTujaaqYSF2CKOU6fF2QlBURHhi7fwQlz4I6FWE4/v5NCB/9rAs20=,iv:ZmcrL0ShXodKUUVVsVShndO0IuFU0kYkW9nF3r83LtE=,tag:tMv6+I0vZU+1NRMHJmbAcQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
diff --git a/mise.toml b/mise.toml
index af05b47..18ba6e2 100644
--- a/mise.toml
+++ b/mise.toml
@@ -2,4 +2,5 @@
 cilium-cli = "latest"
 gcloud = "latest"
 k9s = "latest"
+sops = "latest"
 terraform = "latest"