Graham McIntire
ca7bb75472
- C1: Replace innerHTML template literals with DOM textContent in sites_map.ts - C2: Derive user_id from current_scope instead of client params in policy consent - C3: Fix broken halt() in GDPR data export (orphaned _ = ... halt()) - C4: Add owner/admin authorization check to MembersController update/delete - C5: Require HMAC signature on agent release webhook (was optional) - C6: Fix Repo.all_by/2 (not a real Ecto function) → Repo.all with query - C7: Move auth exemption to before_send callback in BruteForceProtection - C8: Block </style>/<script injection in status page custom_css validation - C9: Create secrets.example.yaml with placeholders; secrets.yaml already gitignored - C10: Load Stripe key from STRIPE_SECRET_KEY env var instead of hardcoded value - C13: Remove credentials from PubSub backup broadcast; channel resolves them C11 (no force_ssl): by design — Cloudflared terminates TLS C12 (device quota race): false positive — FOR UPDATE serializes correctly
93 lines
2.6 KiB
YAML
93 lines
2.6 KiB
YAML
# Unified template for every Kubernetes Secret the towerops Deployment
|
|
# references. Copy to k8s/secrets.yaml and fill in real values:
|
|
#
|
|
# cp k8s/secrets.example.yaml k8s/secrets.yaml
|
|
# # edit k8s/secrets.yaml — fill in real values
|
|
# kubectl apply -f k8s/secrets.yaml
|
|
# kubectl rollout restart deployment/towerops -n towerops
|
|
#
|
|
# k8s/secrets.yaml is gitignored — never commit real secrets. Real
|
|
# values live in 1Password.
|
|
#
|
|
# Secret-by-secret:
|
|
# * towerops-secrets — application secrets (REQUIRED)
|
|
# * towerops-db — Postgres connection (REQUIRED, envFrom)
|
|
# * towerops-aws — AWS credentials (REQUIRED, envFrom)
|
|
# * towerops-redis — Redis connection (REQUIRED, envFrom)
|
|
# * towerops-billing — Stripe (optional)
|
|
# * towerops-llm — DeepSeek API key for insight enrichment (optional)
|
|
# * gitlab-registry — Docker registry creds (image pull, separate workflow)
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-secrets
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Generate with: openssl rand -base64 32
|
|
RELEASE_COOKIE: "CHANGE_ME_openssl_rand_-base64_32"
|
|
# Generate with: mix phx.gen.secret (or openssl rand -base64 64)
|
|
SECRET_KEY_BASE: "CHANGE_ME_mix_phx_gen_secret"
|
|
# Generate with: openssl rand -base64 32
|
|
# CRITICAL: losing this makes encrypted columns unrecoverable.
|
|
CLOAK_KEY: "CHANGE_ME_openssl_rand_-base64_32"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-db
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
# Full ecto:// URL — what runtime.exs reads.
|
|
DATABASE_URL: "postgresql://towerops:CHANGE_ME@postgres-host:5432/towerops"
|
|
POSTGRES_HOST: "CHANGE_ME_postgres_host"
|
|
POSTGRES_PORT: "5432"
|
|
POSTGRES_DB: "towerops"
|
|
POSTGRES_USER: "towerops"
|
|
POSTGRES_PASSWORD: "CHANGE_ME"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-aws
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
AWS_ACCESS_KEY_ID: "CHANGE_ME"
|
|
AWS_SECRET_ACCESS_KEY: "CHANGE_ME"
|
|
AWS_REGION: "us-east-1"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-redis
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
REDIS_HOST: "CHANGE_ME_redis_host"
|
|
REDIS_PORT: "6379"
|
|
REDIS_PASSWORD: "CHANGE_ME"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-billing
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
STRIPE_SECRET_KEY: "CHANGE_ME_sk_live_..."
|
|
STRIPE_WEBHOOK_SECRET: "CHANGE_ME_whsec_..."
|
|
STRIPE_PRICE_ID: "CHANGE_ME_price_..."
|
|
STRIPE_METER_ID: "CHANGE_ME_mtr_..."
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: towerops-llm
|
|
namespace: towerops
|
|
type: Opaque
|
|
stringData:
|
|
DEEPSEEK_API_KEY: "CHANGE_ME_sk_..."
|
|
DEEPSEEK_MODEL: ""
|