rsync from nas for immich

clusters/base/apps/davical/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: davical-secrets
     namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:ot/FvyTD9ktiTWCJZyK92fdZ8GEzBHnyA7e5WxHGgV8POzqR5oFOA/Y74JHsKMYX,iv:VbnSMWRqxinfgpXbMvMNM+7m6JwEYexCPx0i586Ox6M=,tag:iSCfUhQw3rDSyV4BTo56vw==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:2kRbWVqtV5zO7u/qWoDSIxg47EsizHdAEThLBYTwtJoVDZczmfcj9xWS09h657Bc,iv:c8iuC4j7qUf0Wc05gYNEMxVFQecnsZyOGi5Pl5e0qys=,tag:SqCV8wuWCB+TrqobFGw0zA==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:/GcRS3isWJXo9EKv0c6SfsfeDjLcsm+x1Z5sQDmDsz8WWpQtbHr6pcWgiyXlZd18,iv:QdVBA4rJxBesXKDyOMtwHbLpJDqlukvsHsWYeRkHiA4=,tag:IQpqXpBUhr1AcfOAorJfoQ==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:CYBGbETwl3BqtH74KyzCsn8FmfIjWoTDYja/PciylYT5LL2w1sWiuwNRYbYLSEkE,iv:t1HsIMIOMj6uYaHfka8X7avxw67dMNCRWFsy9jcfoCY=,tag:khzPFAV75g7ATt0S4qC/1w==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:BnxYn9LfNUikGRBYt25uMvvr9Rl0AEPVJ54Os6esPUY=,iv:Bxa4FwdKd9+rVIbpIi/53/6gmutegZ4igIDf/oRRziI=,tag:pKpSL2tURnkuzxqoxt5VOw==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:KjtBM1T90jzIbjERlATj6mqm5pVxUx+YYK8BFRhyyBg=,iv:rR1123LQxOFSZV4o5N91jLVHsUEqLXiYnb3qw/EZyKE=,tag:KrEm+aE/Cdb3mbprtUPI2g==,type:str]
 sops:
     age:
         - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjbFhSazBocW9NN09zQlBQ
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdU42TGo2ZllPUEtDU1hB
-            eUVMekx5Y1ZIblQ4SFQ5OHlEd0pzMjdtU1VNCjFBbVVHZHJER1JTUmg4OXNBRHNw
+            ZTE3Uk1vYWpFTnpTN1dRR0R5WGJXWnh2ZndZClRNeFl1THpFWnZJZU12WG41Ky84
-            YitnVUIyajFyYlU2WFg4UVU5Ky9OZ3cKLS0tIGJ0RkNGbjVLR0QxbmxrdlRPOFor
+            U0VabjY5UEd3cE9qRmM2L2JtSlZqRkUKLS0tIC9HeVgzTUdSbWN0dVR3NWU4bWVy
-            SFJLQWxOZmg3dlRsMVRHYWVlZWYxQ0UKmrCTho4Fr853ifFYbrAjxzENxAMBbgXe
+            WXVIbUlQbnlWU0dHM3hhaEhFSTZtUW8KrhrGWGj81qdJ9Re2om9ABladtpd57Eea
-            ycI6h8L1eNyHZcFBA4MNkB7qN2mY6PoFIEZEuv2xzq4MOW5KTBP8tg==
+            GYETUjHiDHQ+FStiAEENZPYewYOgoj2JZqLyc4V6V9b3lKPwlNgS4A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:01Z"
+    lastmodified: "2026-08-26T10:28:10Z"
-    mac: ENC[AES256_GCM,data:YAVSvyAiao3askqk1NYzhGuMKFCs2EizsZMQiyUckacefJqrkD4PkX/3IDMedM04xvHUL/jL2A+3H893EDlR25EWUrLu5la9F9XRb1sG4P8HzpDiHAW+pbtNaUjFpI8ULDq4rZNIfH6E7uy+mJxddaIaLHv+Vx/BDfUkz0HsZrc=,iv:E0FG8cLpwzCU/5KkaaZLVfqm9wZdt6tSUWK93ADKHwQ=,tag:x4ohoVvT5Dq3uNHh11enBA==,type:str]
+    mac: ENC[AES256_GCM,data:K/56l898ni9QiT+JNFUDYNVdV7xOURGDwXNDSB7E+UPDI+SLP0oD/rXcodZ4Kx/SoW+ixCtwWv1S3Lutoi1gGmxHGLDQX1g6+Kc38a0l/Rf/KwjGI4yfIEpsJmqhvbcz40rWK9fQeh9q8huGwgyDuQwV1OoCDSWLYMgmXCajWdw=,iv:BqIGK6GwhA5h2Vz2MQa8noY4nc6BOc7AF8MDfjIrRpE=,tag:Wj/sUVLolwDT1Q5m0SPdkQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/immich/configmap-rsync.yaml

@@ -0,0 +1,168 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: immich-rsync-script
+  namespace: photo
+data:
+  rsync.py: |
+    import os
+    import re
+    import subprocess
+    import threading
+    import time
+    import json
+    from datetime import datetime, timezone
+
+    SRC = "/source/"
+    DST = "/data/"
+    OUT_DIR = "/www"
+
+    state_lock = threading.Lock()
+    state = {
+        "status": "starting",
+        "percent": 0.0,
+        "processed": 0,
+        "total": 0,
+        "rate": "",
+        "eta": "",
+        "bytes_transferred": "",
+        "started_at": None,
+        "finished_at": None,
+        "error": None,
+        "returncode": None,
+    }
+
+    # matches lines from `rsync --info=progress2`, e.g.:
+    #   1,234,567  43%   12.34MB/s    0:00:12 (xfr#12, to-chk=345/400)
+    # the "(xfr#N, to-chk=X/Y)" suffix only appears on some lines (once a
+    # file completes), so processed/total only update when it's present.
+    LINE_RE = re.compile(
+        r"^\s*([\d,]+)\s+(\d+)%\s+(\S+/s)\s+([\d:]+)"
+        r"(?:\s+\(xfr#(\d+),\s+(?:to-chk|ir-chk)=(\d+)/(\d+)\))?\s*$"
+    )
+
+
+    def render_html(s):
+        progress_html = ""
+        if s["status"] == "scanning":
+            progress_html = "<p>Building file list...</p>"
+        elif s["status"] in ("syncing", "done", "error"):
+            progress_html = f"""
+    <p>Progress: {s['processed']} / {s['total']} files ({s['percent']:.1f}%)</p>
+    <div class="bar"><div class="fill" style="width:{s['percent']:.1f}%"></div></div>
+    <p>Transferred: {s['bytes_transferred']} bytes &middot; {s['rate']} &middot; ETA {s['eta']}</p>
+    """
+        error_html = f"<p class='err'>Error: {s['error']}</p>" if s["error"] else ""
+        return f"""<!doctype html>
+    <html><head><meta charset="utf-8"><title>Immich NAS rsync</title>
+    <meta http-equiv="refresh" content="5">
+    <style>
+    body {{ font-family: monospace; background: #111; color: #eee; padding: 2rem; }}
+    table {{ border-collapse: collapse; }}
+    td {{ padding: .25rem 1.5rem .25rem 0; }}
+    .bar {{ background: #333; border-radius: 4px; overflow: hidden; width: 300px; height: 14px; }}
+    .fill {{ background: #4caf50; height: 100%; }}
+    .err {{ color: #f66; }}
+    </style></head><body>
+    <h1>Immich NAS rsync</h1>
+    <p>{SRC} &rarr; {DST}</p>
+    <p>Status: <b>{s['status']}</b></p>
+    {progress_html}
+    {error_html}
+    <table>
+    <tr><td>Started</td><td>{s['started_at'] or '-'}</td></tr>
+    <tr><td>Finished</td><td>{s['finished_at'] or '-'}</td></tr>
+    <tr><td>Exit code</td><td>{s['returncode'] if s['returncode'] is not None else '-'}</td></tr>
+    </table>
+    </body></html>"""
+
+
+    def write_output():
+        with state_lock:
+            s = dict(state)
+        html = render_html(s)
+
+        tmp = os.path.join(OUT_DIR, "index.html.tmp")
+        with open(tmp, "w") as f:
+            f.write(html)
+        os.replace(tmp, os.path.join(OUT_DIR, "index.html"))
+
+        tmp = os.path.join(OUT_DIR, "stats.json.tmp")
+        with open(tmp, "w") as f:
+            json.dump(s, f, indent=2)
+        os.replace(tmp, os.path.join(OUT_DIR, "stats.json"))
+
+
+    def run_rsync():
+        with state_lock:
+            state.update(status="scanning", started_at=datetime.now(timezone.utc).isoformat())
+        write_output()
+
+        proc = subprocess.Popen(
+            [
+                "rsync",
+                "-a",
+                "--info=progress2",
+                "--no-inc-recursive",
+                "--outbuf=L",
+                SRC,
+                DST,
+            ],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            bufsize=1,
+        )
+
+        last_write = 0.0
+        tail = []
+        for line in proc.stdout:
+            tail.append(line)
+            tail[:] = tail[-20:]
+
+            m = LINE_RE.match(line)
+            if m:
+                bytes_transferred, percent, rate, eta, _xfr, to_chk_left, to_chk_total = m.groups()
+                with state_lock:
+                    state["status"] = "syncing"
+                    state["bytes_transferred"] = bytes_transferred
+                    state["percent"] = float(percent)
+                    state["rate"] = rate
+                    state["eta"] = eta
+                    if to_chk_total is not None:
+                        total = int(to_chk_total)
+                        left = int(to_chk_left)
+                        state["total"] = total
+                        state["processed"] = total - left
+
+            now = time.time()
+            if now - last_write > 2:
+                write_output()
+                last_write = now
+
+        returncode = proc.wait()
+
+        with state_lock:
+            state["returncode"] = returncode
+            state["finished_at"] = datetime.now(timezone.utc).isoformat()
+            if returncode == 0:
+                state["status"] = "done"
+                state["percent"] = 100.0
+            else:
+                state["status"] = "error"
+                state["error"] = "".join(tail[-5:]).strip() or f"rsync exited {returncode}"
+        write_output()
+
+
+    def main():
+        os.makedirs(OUT_DIR, exist_ok=True)
+        write_output()
+        run_rsync()
+        # stay alive so the pod doesn't restart-loop after a one-shot sync;
+        # the status page keeps showing the final result.
+        while True:
+            time.sleep(3600)
+
+
+    if __name__ == "__main__":
+        main()

clusters/base/apps/immich/helmrelease-server.yaml

@@ -53,6 +53,46 @@ spec:
                 memory: 512Mi
               limits:
                 memory: 4Gi
+          # one-shot migration copy from the old NAS-hosted docker install
+          # into this install's own library volume (see "library" below).
+          # rsync is idempotent, so a pod restart mid-copy just resumes
+          # cleanly; once done it sleeps forever instead of exiting, so the
+          # container doesn't restart-loop and the status page stays up.
+          rsync:
+            image:
+              repository: python
+              tag: 3.13-alpine
+            command:
+              - sh
+              - -c
+              - apk add --no-cache rsync >/dev/null && python3 /app/rsync.py
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 256Mi
+          rsync-web:
+            image:
+              repository: nginx
+              tag: 1.27-alpine
+            probes:
+              # explicit port: this controller has two services (app:2283,
+              # rsync-web:80) and probe auto-detection picks the
+              # controller's primary service port rather than this
+              # container's own - without this it checks the wrong port.
+              liveness:
+                enabled: true
+                port: 80
+              readiness:
+                enabled: true
+                port: 80
+            resources:
+              requests:
+                cpu: 10m
+                memory: 16Mi
+              limits:
+                memory: 64Mi
 
     service:
       app:
@@ -60,6 +100,11 @@ spec:
         ports:
           http:
             port: 2283
+      rsync-web:
+        controller: server
+        ports:
+          http:
+            port: 80
 
     ingress:
       app:
@@ -78,6 +123,22 @@ spec:
           - secretName: immich-tls
             hosts:
               - photo.aggtaa.com
+      rsync-web:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: rsync.photo.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: rsync-web
+                  port: http
+        tls:
+          - secretName: immich-rsync-tls
+            hosts:
+              - rsync.photo.aggtaa.com
 
     persistence:
       # brand new, dedicated library - deliberately not reusing the old
@@ -90,3 +151,28 @@ spec:
         retain: true
         globalMounts:
           - path: /data
+      nas-source:
+        type: persistentVolumeClaim
+        existingClaim: immich-nas-source
+        advancedMounts:
+          server:
+            rsync:
+              - path: /source
+                readOnly: true
+      rsync-script:
+        type: configMap
+        name: immich-rsync-script
+        advancedMounts:
+          server:
+            rsync:
+              - path: /app/rsync.py
+                subPath: rsync.py
+                readOnly: true
+      rsync-www:
+        type: emptyDir
+        advancedMounts:
+          server:
+            rsync:
+              - path: /www
+            rsync-web:
+              - path: /usr/share/nginx/html

clusters/base/apps/immich/kustomization.yaml

@@ -3,6 +3,8 @@ kind: Kustomization
 resources:
   - helmrepository.yaml
   - secret.enc.yaml
+  - configmap-rsync.yaml
+  - pv-pvc-nas-source.yaml
   - helmrelease-postgres.yaml
   - helmrelease-redis.yaml
   - helmrelease-ml.yaml

clusters/base/apps/immich/pv-pvc-nas-source.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: immich-nas-source-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadOnlyMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=3
+    - nolock
+  nfs:
+    server: 10.0.64.80
+    path: /mnt/sdb2/immich
+    readOnly: true
+  claimRef:
+    namespace: photo
+    name: immich-nas-source
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-nas-source
+  namespace: photo
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadOnlyMany
+  storageClassName: ""
+  volumeName: immich-nas-source-nfs
+  resources:
+    requests:
+      storage: 1Ti

clusters/base/apps/immich/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: immich-secrets
     namespace: photo
 stringData:
-    DB_PASSWORD: ENC[AES256_GCM,data:YpKyWkrUydeP3HukOxhgJn/7HWVvWOuDQETfSEiCtO4=,iv:fyD76WEmNiDbvEHWBq7nMFtCvE4+QT5IsooREjVGGG8=,tag:XsvX4X98A7WCvaO7ScAvYA==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:J9j5184OSI2HXrXX53hBsMdSb315T6trhUxV0cxndWM=,iv:bpKI/x1jew+hfmYR9qey/fWNHPwe/GZKNtK+7F6kPr0=,tag:Q32csqiZoAo7bwsfo/00Sw==,type:str]
 sops:
     age:
         - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiVEsyTnhoRzNzenZSWWp4
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvTWFZbUYvaUxUNUhzSUJz
-            bzVQTVBFajhjL2NBVndObUd5NG85MEZOZ0c4ClJiOWd5emR1Z1BPVkRLbSticmhn
+            SFMxcy9HY3hrUEJXdlNRSnFuRFpKbXQyRjJvCmVzZ2crTUtmWWxKU1o5bDJYYisr
-            ZDl2MUowSitsYnhaNk1xQmN1M24rbm8KLS0tIEE1UmdZMituQlVKWVh6cnk4OFI2
+            LzFNbUx3aE9USWpJT3Y2R2piMUNCUzgKLS0tIEp1cEIrLzYyRUtJdFlGRFZkR2xt
-            dC9KVTNhcnZRUXQrZ0N3WWs5ckhTL28KnlerpQLAXI9zFtKSHgZqbNVPUYgnZywq
+            WENOaUE4N3ROUFM0WnV5SGNYeTg0WHMKrqNsY+rl/Ial17oXA34HRrQDqjIrUfTv
-            APrZoyzM0Pb5H2NuCCpxCX+qmapbv9F3WMmm3HLiJ/PUkAKkVeXqGQ==
+            R5/+4ZANkeR/aOdnsSL45xR4CZQ8KhWJAZyEx2hXvyO+9oaZOFqBfA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:02Z"
+    lastmodified: "2026-08-26T10:28:11Z"
-    mac: ENC[AES256_GCM,data:8O8jqQTfVBsZDAB4N4qf7eyz3n45GZItqpLUP9vvX17sai2l0qt8s3Pt9cZ4Bqlzw9JxRwg2c/hvSd8UNS8J29utCyH4aM1Fs5+NEyC2+zzuXeIFPdaQ3ak9RuhASotsud8wTOvz4oOrs7XDbYVQpEhO6c+Qjj1gw4ilR5hF0dI=,iv:eOxip3OjQZh+DQwY3ygaN4NJK3Csbe+FYjbBvmZuwDg=,tag:ZgskcfWR/3/y7UMd0z6+9Q==,type:str]
+    mac: ENC[AES256_GCM,data:29NQdfh0KhGWDUkpdLMsPL+r9rZrc+0H98NvOQx/p12B3CJmIbNOA19GT9U6dlYzy9X/69jpS2AQoUF+sRCvQ+4kZV5E6pphj7NUVY3Zg1sQcIInkK133aWtoqqjXQAX8INom5HBUs8qRbkSkCnnSIRnuDNi6XTc1NZ/Z6oNul4=,iv:FkPLjcR8at+tQDUpR0a9+df9NZrnEBT/tpHYText7UI=,tag:CI0dPIyhUkPx6S7kTqjXGA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:+iXMMNQD/PRRt2ole5BSKDCbGlON41NuZSaWuTSoS9XWi5am1AsBcx3h3cyEnU9LFGHSERGYOA1EB8l5sSH76A==,iv:fR8TTnI89GUbjg4xcJgSLXsEAMd6NKbf0a0nkPoXG6o=,tag:81hO0FfVoHzz4Rd/TV79sw==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:uuzlfYXUcuHUYUIsyE4tLG/AGLA/itddWrj49Vvu6qldrpvHZ3Ctr8HEbQA5mpMvT+j/Q1akMbWJT8mJREqv1A==,iv:9pjXe+AHYA8xX6N4XD406TFFrLGLyOBa53w3Vp8tLGc=,tag:IdfHN0ssSbQnZnkabTR/Vw==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:KLfB6bpjaAZBINRqhz2f+UIBnqRa5wiTv5BJcM164b34ZnHhaNNb6WAebfpjz68PWAF3traXD3sNzxlQbP3gog==,iv:Q8ZT6LJtpoDICMZ1vZD0L/MJxPYEpzAVKld01pnguwc=,tag:471IfIR+Gr80TjkVyBsyMA==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:Vi+/NhC/cXf2D9msRbQZiFYNGh2k2B/pqZD6bFnqNYp3GMJI5LlQIay7Rne/E3gw9t5IE85U1zVbwgRrioUyXg==,iv:oJaJFGgBm8fJJxhT+p/CVRQ7bDKOt438VhifHHAWS0Y=,tag:Nr+dsT+e2SsOoqaFWSI70A==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:gmQ5QHJw9HD6FM8cdq90iUTJUzvTKJ9p0y02yX3Rth4BWPPui7fiHSroQ/tfj1UoQ04wlJDmvEriCLjIHK5G0g==,iv:Q9ZLTnyUwwAGpU5Uf0o7+lX6nFCUN69hUjAG8dJU4Jc=,tag:3IL4sbtplG/nyVcQ7im2Zg==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:xj8o1rVjGCFOIqpquzdd0GOjp2AV65/ybgOCFfo6cDEfMSRqK6V7vNLNMTzrNKyzFrdQsO2A50vpzqxKtOo4Rg==,iv:zSjTWHCPQ0CsB4V820T/rp8KrDAB5kkLcSzYndXfgyo=,tag:Pl3CPTrCLYD8NRDrqO3zww==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZZnYyRElnRDRBRlRkSHp6
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCZUFMbVpJVTMvV3FZMTBV
-            ci81ZnBqcTBxRzA0dUJ3dGEwajgra2FmQ0VzCktMaGRXZXFXZTVKTEZST1MrMXdq
+            cVpBQk9aQ0FScHZnaWNvYytFREc1SjFidlYwCklVT29aZUlReisrb0V6bmhVV1Vv
-            dE1MRE1aaU9JNVJVMmk3WmovVU1xb2MKLS0tIG4yZE5SWHQwODhTWnBPUlVnU0RV
+            SEphak4xRS9UTHhvVmZsTGRBZWRWdXcKLS0tICs4ODNjUXpPMERqUTRvMzZ5b0ZP
-            TjVYTG9RUU1DclhmSEpyeGp6eFB4Uk0Kr6wWaAnokT8bgxUCZxKGDaWyuIQT/Kky
+            eUFyMXp3aGhtQXVTb2c5ckh6dExTTzQKT13z+t5jzgZWkzlRdukeCSkbVoLZyP98
-            kyJAsUucRsBY52kOECO/Ox3YAVGnqs4PQ+j1UbhD1+Q3TIfFGKSz7Q==
+            hDHjlRGERND5PVJEPZC/2tXkOizCYyybt3qH1pSxFZ8O+kyRkDI4ig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:03Z"
+    lastmodified: "2026-08-26T10:28:12Z"
-    mac: ENC[AES256_GCM,data:LI+o1IeZ3eQIKOfj1KdJWhgpE0pB2tOZ5hZ9dJIW8ORH57562yjfbjGWRoQFWi9234jUMFHK/fzAVA2z5EfEbnGsc8G4NUOXuAnMosbIUkg7F7Al0LA3/KxF7vK5Z011/KazuSFK3PNGQBjkMZECSwqA2U8prgYacnzvfWxh1XE=,iv:EANKwA+JsUI/L5+gYVNDR3frSVJ7XZnhJzzTUTyZ0eg=,tag:zKC0YGmCMKZablBPEQtO5g==,type:str]
+    mac: ENC[AES256_GCM,data:5tzToA6dkfMfSI8Zu9PgpwKDfFco6oqkxkct0isM12apkj+KZ8VgcjCkfVKDsvuZM1WCZ0xJ2TZqYIfUXh9Hrc1U1AlN3iahc2FvuRlpbJ17FkC3TI+C6737cTv69C3iAifHgRiGgSsCEUy28ONlc9MYnp86iASkGPlxRX/mHPM=,iv:tzk6/ByDdhNEHutoXZqnFS+0AHIVtu7zlcN6uHQAKms=,tag:x00QlVn/yMzvxJhdBO+l/A==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:u37YkMH9qO0RIwvQxVKynwhHKZ3sBy6m+sk/0ghHVxojhZvsfNzGgMJJNDhM/4BtONAP20bCK+94ymG6LmUzqmSKxif6aJseeEmtcib/PaIAPfAUS1/DAYtHuaX8CY3nMW+klg9uXkUw8uVtuHFXjWTn8MIfu0bGRvMa6eKGZPbBdn2xHBZy/biakvB49rOm25ePhDj6P9xhOzdKCdSRDhL+QoMFpd/VQ37uOAoRFGpECp92RKY1Kyb2CnKSOw==,iv:UCOy2wMAXzen3anAETpYsPuXbmz91BbPllqpAKyGYHo=,tag:RW9ImBCJs5nDPcRbzsqItA==,type:str]
+    passwd: ENC[AES256_GCM,data:5mCWvOcCXvcsu2p27YjIjeC8Gy00unjz331wczvIuE1jutD9oE+15DE5wimenVFPLZ1XwmVd/dp0CAZnQZCQobgqFg64YntxfHmFgHHaTytnyENNz32PXphKnLakURnCr/Ij8sN6rswNpTb1ybrzOd7+qto4jomSpXOKnGlc/WNJ1U193y2XH7viMBSiAIJbOUpfDDGLHPr+Hkk5cI0NzG/wFfxQ8e0FADoia6aCpBZE1gvk0d01FjtSH5AKJA==,iv:OrAtoDnnGG4O+y0h+IA+FTCHPjdWSYHnSN3Dnb6jl4g=,tag:0SG5N8SDbfy/1FnbcpLLEA==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WGFQRUtYRHVlQzE5cUVN
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaaUR1SHJidU0yZ2UzOW5O
-            WDhPOWM0RFowSkZXbk93ZHRiTy9LZUZiRjBZCjhRSlgrVnNTMHV0TldKakFCcGRL
+            OElQaVFHakNBUGoxTXNVR0FScmtGeGdQZTJBCk16L2lNTCs0QlZsbEVPMmxqSW1M
-            aGJBb1BpdGdLdTBRQndWalE5SDBBRFkKLS0tIGt0TFdqb253ZnFROE5MaG8xSVJE
+            WTVSWENvRU9mVGtsdmtzUmphQVIxc2MKLS0tIGhBU1JKckxMZGNQSEs2Z0VQTDdZ
-            bWUzV1VsK3o4SGhTQlNQM25oRGZRcWMKibweD+ZRX87DSafALqTVXFG7Wg5kq1ie
+            MEludlZ1YWxrNzE2cGkxK0xVdDdjVDgKZkuhUlz7iEe/y0JsztjiAXjm+No9/hWe
-            wUDpv1o9Qt0bLaSMexwfbkq5QdBXV14GDPmLMdAN5b4y4E0ygF0zWw==
+            lE69MySq96oMq6lrGX2p/jEkoOLypyoRf8qnHju0fJzKvvxZHCR3Bw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:04Z"
+    lastmodified: "2026-08-26T10:28:13Z"
-    mac: ENC[AES256_GCM,data:cGXHK4KF3A60cQtAxvxRHrHpxQc5sBKCe6iyQb0xSwLYbcns4h94zjJF65kZQGiUyjaAQPoQyjpNfEkrSOtMZutei/F+07egrV9j0wiae8ZBPtIVUGXTp1NXvXNARspX0RPGqPbnS+yEKuTPX3v03hOWi7RR81FP7jQHmI+jnu8=,iv:7yVy2Bfqawcim3K/AA01VK9fXdPXnBlZC2VQTaYzqIY=,tag:x5pxMUBvyN6OREVKtAo2Tg==,type:str]
+    mac: ENC[AES256_GCM,data:d9XwzcmIHYSMhmGvljIH0LZwfk4Nd2KOQJIRx5UkUK7fNqBx6A+gbt2GlLN3HJwwQpnhBGAkYtCe12ryVsuoy2TP22Dsa+6SzDjzTVuAROeCxHTNA1RVfhrSdb39mzUgV5Ff/1i1vdI5NFaoLoTVHDS17VH7ITZlR3v4dzYBgXA=,iv:nD8eqgG/1W3G/gxEsXDurthQT0Y9wWKmvXFsKLaunBo=,tag:I1eCzQ2KMCdgds9WrcPLFA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:kLpGTFPEhZHW1rf/2E9nbCdvbjt+ePqAP0c+L5iZyAVlty7mWYTWSy8gmjfiIKCHsBlUn85IQop1,iv:qb1RJU4NSoO1zhgeDIUUFj1LBu9UGiD0aBDOnB/mUy4=,tag:fmZeErXoSG/imEOLhpID7A==,type:comment]
+    #ENC[AES256_GCM,data:CuHBAvv807EeGmG/tLZJjjrXWujTCX1b7aica0lTIg7fEwn5/DxYI3Nmc9wf97MeW8BY0M08WKT5,iv:da75T2elDQ6ikT/T8U/oRHg1Wbgi5nSVd2b/XTTRZdU=,tag:S9QHjM5ngAvM8fog3sYhOQ==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:9lfJdxPmMOvoJqP0suH/ctE4OhK6Xh8BK0JFxmXdTFjS+/nVsJ9ILietODGk7NBh0p0NpkTVtO0qC7nDtA+vNZsVs+KntRkOY84wiE+HSEZwLW709nKNevUFC7v7hnfyWddMURXQGlEIcZuk5uOBE8VRY3f2ew==,iv:ZZI8iqzC0TfCwaUDWjkbtL0522ON2EvtMGfcNk0j3wI=,tag:rS38eTgIKpSvYprp3KtJmw==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:R+tVrpuEUtwqJrAhYXc0+q8X7ZAp7SBtYUCc555tCbVjAiXW5Ha7GpPP6ZugaLAZ+LKAoSYSD2jUcwXbH3NaZnujf+tMvT60AWFFgi/KWzJFxHj++ygyZOamsNU+CJwszI3aQFJnFq8Ul/ncZdAE6i6B07KSMQ==,iv:ZQcsGpSHlnq4dN+N4OPk9URvoUvQ/B6zZqxanPF+1RM=,tag:eFPIRdU2hiyFzvMZpbviqg==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIZjNFN2k3SzZDczR2OHlY
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMUlhNkN3ZGViRHFwRFZP
-            RDJnS0pob0RLdU5UNml6V2VSeEVDbk55ekhNCmxYelFjR3JpSGVCQjIxT2FvenhV
+            MmFycy9iVWxuSEZseldPZ2ptZW1CaDIzM0E4Cm5ITHRoSkJ0d3ZEeVNvYXZGa1p6
-            dE1FNGI1VElmU2dReUF4bG13NDE5UG8KLS0tIER4TEZHR1Y5UmE5SW5JemkvbjVL
+            VC9FYklIRnA3YmJZK1pzWnZtSHFXS28KLS0tIFZzejAycEEwNzZLUE83djg1YlZj
-            cmU0cEFYd3VsdGpQeU5DQ1kzUjZ3TkUK5AZsAyXUice8+1dqmjYQrcWlRW4FJeld
+            L1hsb2RhQjFoVmtQY1pPT2doay90UVUKF2k4fElOUCBOD4x3N148v2A9gr1ak/el
-            YSdN7lKb3Zo+DnNly1WF9i907rrQp7i7jkDR7P6hi7vNLlmMUcvILQ==
+            ZelKh0Zi2r3+cx22Ti35GbfrsagHkmaQjAybNbmWsQu+X2i1KyggZw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:04Z"
+    lastmodified: "2026-08-26T10:28:13Z"
-    mac: ENC[AES256_GCM,data:HRWlMcLiKDSLbPoiUKlBLPFByJkTKp0eaZheC8lSnCgh7+ybodAmkEZHdWYkR2GDenOVaqWrJ+qJo96NKKKyfSd04U9WHkKQ50jxJgSjA5l+3+VxDG5Kt2IUcEzuXSJx8PAvv61IIMHYjYKVi1Uy6sr9imgYgu7RDZOMb1wV0QY=,iv:swEs+WA2na4E+VCWkx5Us9M9+7JgTH68pv0dLbkzjhI=,tag:ZVXrrqa8/jXs2WIbsQJVTA==,type:str]
+    mac: ENC[AES256_GCM,data:2qbCr85rY872A++tcQ/a/oyPNeuWzqf57So2e/ox96Cn1erFU5ZBJRLcL5GAERWfu62oKyV/HXuizcLp3/gxQUBbTZnVNrqpvnsvAsmP+kdEyZCfiIfh1giB6Umor9fW0/8g2Lf812gQ1K924ZsGi33O8PVt+IaujiFivCXVLio=,iv:WfV0dPTgQpTh4eJcBmSZz/Ft8ozHnQoZPS9Xwo+yfds=,tag:LHJjCwrJJkxE8Uh+0mJolQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:/Wx8o58=,iv:Qi6HSuJfKSIWE/41OyY5fNRJWFDTAwEELK5WIZGtu/E=,tag:EHq4Eh3KfY1/T9fcT50y8g==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:V/YQmBw=,iv:Z8izxMOc9ht5nk7Y55a/QAbR8GecXtVAuAIakuPq5bI=,tag:B39vbArko8N3fENPYZ3sOQ==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:/GxEhme44Emui1v6flcXH9WocIKFvSi0FlBB1fGFY4c3225qsuF1PZqbnNBLv1TH,iv:NvruJCmb09Nn+yP+cx26tGz6K8T5X9UPuQZ1t5VEn0I=,tag:NjqO/tHbCN/c3K0jzt1utA==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:q3MOgNstBWMArXPKjfoVhwei42xVuZbg+yOfKwcrN8/IWXi+PE+cyl4FXoPwlsUq,iv:3G+nwqFqw1FIJ/MHqZBxa819rFWqnHnA4BbPcJa3qYQ=,tag:O5yiyzZfh2ye7uOlWd0vqA==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTHZXd3gxV3VURXJvSFFQ
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5WFlsR0Jtbkd6M05QdmVa
-            a0pUTHgvbWlWczE3UU5pbkdnODhwSlZKVWlrCmlYNkU0ZzVTdnBJcjdXTUpyb1Vk
+            ZHptSUVzcXRhWndTTE5hNk9CMVk5NENhUEUwCkdHTkkxTjI1WFdodzYrK2Q3TzdM
-            d1dFM01aK1paNGtNVThXVU12WElwUWsKLS0tIFpoS0NJV0czYWlQMldTWjN0RWMr
+            SkV6NVpUb2VtZnlNaTZOUThCQjNra2cKLS0tIE9FeDNHUWtSVEhSZlJqdVRLTWh4
-            NFQ5cWV4R2VVMVNFSUVGaFY4YktDc3cKThdOq2q8U7wS67h3NLqbZOqmLL5Zvni+
+            SnJ6NzRRZUxTY1JOODRpa0NMUUFsN2sKhZk5Qb/qENAVD44AYJDSNjyBYVttvZkC
-            CdsAOsye+k/cQ0wcEGkmlkO4TvOeFQBR1GJsdIqVOkRB1VitqJKguw==
+            tr+QDm4ZAnXj6eAwn2PvNbAS0sIsrWmIVwYQyjoRIvFWzfGSDPK7bA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:05Z"
+    lastmodified: "2026-08-26T10:28:14Z"
-    mac: ENC[AES256_GCM,data:SWUvInDDQLhed2esu4SC4eaTXfOcV5+C/vBpYi3JCVKNU9uTs9GAmXrAr38S668Uc/YYPTlSPPNPDAU/F1hOFVyEtXebnv1P7qCrIcILvEgQZ2glOXT3ciFGYs7XCcBeoa/FCYBfgRgvUDVvPkjlwD93ABpUHgKP8SS2Jn951nk=,iv:BH2QdulB1gGP396xjo6KWQlc06+HUKzyyYnsypYhCzM=,tag:3PpiJcXtz3pjjx8N4dIpnQ==,type:str]
+    mac: ENC[AES256_GCM,data:l8PX47cXCZX+eaQR3/MiKGGRUsoZem+rpsVOQoB9u3e9A+pnLD9Gnq2UytJ4Ly77U6x+a9SN37CYUadsmjtB0nlb9eL8Ylziv4hrRY5fPWBBv6lLM7pFRfmpJ2DskJo4bIEwBAXlqv0U7a052ObBd3+USukNqGod4kfG5wWkh8s=,iv:pZWrUdHdZ6epiJL/k8CAxxgB3dzHrlw0gJBLznNNby0=,tag:mKF0kqN/86GizxYoJFrT7w==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:e8r3UJTzBiaVbePa7eSFtrtfUsF7jiMO7AsIG1AXL4WQDnhpLoLvx5y111gjbw2wuoDj0Tk9rWOsiW2rl5os17n/gI6q3coC2MF77OT31/HMOMbAnxHSdhXP0zxw9KxBoPIBDuTcm7emIQLRQhQY0bJAfrO5PTpr4MZkUe8=,iv:DQkSCYxEIwptbqO6tI7LuKdz1QGXJtNQbrxW+6Pn2vE=,tag:BrYc/T7oaSE5H4vBnijxww==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:Oe9hfmWYTPMpAIEhp1mpr/Sh9roVg3vkRxxLIfsTE60iaAsFJuT97/ARBMK6eWMkHbZp+MJVcZIz/FvhGuwghVTz8maIUE+ECdAqby8SHOkod2AQ280/To0W7ztHjzAexd6earAki77+gq01qsISRX+I4kbnOlOJVVh8Yxo=,iv:znXWWbT4VbbHbrEYcUFVbXqY/hbODF8DBvE/p14rGJg=,tag:u/bwu5AoMe6UFcuaFKoSfA==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtK1hhTmdhbDZsMGpRKzU1
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVnJ5QlRZZWZuYzJLTXI1
-            ZWVTYW1lRUw3emg2M1hKbDlUTW4zK3Z6TWs0CldFK3FKSWI5V3VZdXhIaE9yN3pK
+            Q1FwNGtEZ3N4aC9nTHlVSU8vck82Rk03aGtZCnA5ak1vRUZZOVBBdVhuNkMrV3Y2
-            SHBUVzZ0TGZTZnM1d0EwVno2N0RvM1kKLS0tIC9ZU1VLbWVNWlZlTkRhRTQ1ekNE
+            aHBLRlV6TXJPTWtTdS9mRDF3V2cxT28KLS0tIGVlWW5sa3VxWGx5RDc1Skt4VWtu
-            RUE4OHhZWmJDeGtCMXpkNTl2U2tub1EKgALG6zKXUGe+XopWc4viT2A6EzxXdczy
+            MWtuRHZWR0RKY1JCNnd0SlRiQS96QWsKGv38cWkWbgNJpL7jAwcBG+6mzZKGt5gv
-            e5Xa2LofykDQDmaZdOSOHCw510Kvqd0BTziGqR4S7HRYoNXGx+aEag==
+            ljZj8de741rxDL/S6ezsC3whCTFdqxHNnlAIG3clTbP/q0kPT1pHAg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:06Z"
+    lastmodified: "2026-08-26T10:28:15Z"
-    mac: ENC[AES256_GCM,data:Y67AZoBQTfNAAXAqEOHNdbOzmiyTyka711wu2D8Eq8ROwDbif7REdMLHcfar6oOarr+fGtP6z6/MePaM/nsuayM1dUCrsnUZwYifQ5mC88XO57ZpGKNyOYI4Xe/PqCAj/PvLrEfTMslEfzy45Z/XnS2dMGgL2tvN1a1Un0clPww=,iv:xwokG+Z4wTALJuHvIk39FqkVqDCOXWYXdlujxIRXR/s=,tag:ukAImt8nrE+3jCiShukW6Q==,type:str]
+    mac: ENC[AES256_GCM,data:UWCsORqv5xz8GInJCK8Ac+QcqojkEKfgSbhx7cAz9WXVNeTltfH6xWB7kBXiYHccmUXCuJh/1XwOjgYb9rhZFY6l7+Uo/AIhCQy4e3KM02BRL8jvPINVspUsoLZS4bwpuxM4u34EJ0Oe/ctvLbqhdAbyY9+mk+TrYmR+hNoFazA=,iv:gr2lJWNDeJ5hNJ4sIxZbbSFVZP8pVWai0MFe5wMwlcE=,tag:d77RwFndHhzOH0Tup82cJw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: longhorn-backup-target-secret
     namespace: longhorn-system
 stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:3sg48JwLZHp9YHriZeat+cdEz7M=,iv:rl5jSMzPU/BsadS8ugPCUlLcAlsqDUrp4v1LLVercmU=,tag:sd52c0VFo5EKp8LypQW3DA==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Akh0DxVhXHZ2k+WF7aMrFw/hACE=,iv:paBNYuRrY/0FMncyQ4eFgC2YUvVAxHizyLzHMm05AVA=,tag:DWF2f8ZA3KjCm+ntwsXBmw==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:eCj9h8KNjhZCWll5A5txeEAGzXkpE0mAK5eebUWafsUTkTnORiYoIw==,iv:rCJCnHuUEyKWiaUAsaCEw1g1t2dGcRK+tzCUugvlsBA=,tag:GvALxbt4fPMepvVQLUda4Q==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Sq/Uw36WY/U5PfuJUaUKXS4HeGy5qxAunrVPQalUJnMoiZcW3nJl1g==,iv:LKjOAIgnw9TV0wXE7bS8JCueoMtNxCw1Xc3tv2l5y5g=,tag:odBa7M6WofI+K8EBbae5ZQ==,type:str]
-    AWS_ENDPOINTS: ENC[AES256_GCM,data:2pG7Kr4mpmHJ2xYn6BGCPNZ4Y5HL4taaVBbihrAJdH35Oa2rIg8o4JfW/uzWP2QigE5Xe4dfmacuNa/nZg==,iv:CE1QKdObvPBWCo/QUjvCya3Vr+ebCSm3I2IErxS77nQ=,tag:oiINRfBAuBQObiskCV6A/A==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:xsaA3N6FRxUkhzME3APlQ7jBSyoEXqH6VQU1DPIbS77EqE6QXZbiDdARYTszf0pGCr5oWlKEcnHS7kb79Q==,iv:shKaXAd8cgCJBP11bAUlvruaDjuIiuLabPeMt7tks5g=,tag:I1DN5aWWN1xbX0O9SEu5Jg==,type:str]
 sops:
     age:
         - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRdWRIbG9lZjEvdjlNWGNt
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHZEthbGxvN0V4ZnY1RnBs
-            Nk1zcXZySS9tZXEvZ1BoWDBEV1JjclEwU3hZClhNc1pBUGZZTEw3bUQzWDJkVnpm
+            T1JYRmFNU0tvbjk2bnVQbEVFWEZXT2t4ZFZRCnRzakNVTWxPTFZ4eTZIRExzMk9I
-            MjJVWUluODRYZ3pkb2VXRDY3eGZiRXMKLS0tIDhPcllYejZPOUo1dE92cWZDWHpa
+            Wk8wWEhLdU1NUEo5QVQ4ZWhrMTh3bTgKLS0tIEQ1cEg2a2lBd3FvRDhtbHhXTUVR
-            TlJaYm5OWGROTGFKMUtQdUgvdFVBbjAKBHsrBKCFo6nvDh6/H2ziPUjmTGpMx1iO
+            b2dJUDNwSGxkRkJiODNkaXVuT25hMHcKL9tic5Uv0PfL2eAHswzuU37t+WVxlLl3
-            qBHLXae6YWY0Del59N8esO8AY50npp+awv6Cc9AR3dNhAGVqVUr6vQ==
+            rjTMdpn74BtAOFEsJxsSf4V/SCg2usGOJStztSgaeWEWBEAuDpvxTQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:07Z"
+    lastmodified: "2026-08-26T10:28:16Z"
-    mac: ENC[AES256_GCM,data:J/TjkixhR9RJ2k3cjY2+75e/M2/Mo/G1KRumir3z44/dWv5frkX/sJKZE6qBOH4+03Nq5F6aOFDSwo1JaDIhjkejuduewkGwjgIpdNeklG5S057xNQkqTAPHGoatBeUQj/FtBqf3dtnq9e72dL3Fb+ZQcLrZSQGV13aIHthcHvI=,iv:MC1YxFMAIqyoHkLP9xVUQ3WFuaytevpM59S2afsyLNQ=,tag:dEyw+tetLezNZ7AD5L3HMg==,type:str]
+    mac: ENC[AES256_GCM,data:Fj6l6TpDCG5DM3rFTqdMWhsgrckeFcjpw0pLiBqWgBadRveeaUdYuN18qttGmWUjoqRG36VsGMme00RJc3eWcwfWbUscAegcfwttqujTQe87gke0KBXnuiSmUSHvDwbFpcAB9tlk36SrBAbX7gFcZ9tb7XEre9l11zT1Q6f9plQ=,iv:d3elLJQrYMhH039jayxLZTcQn+q1eVThMbiMMi4oasw=,tag:xUxXxujqqs2ShH6Yd8zOkA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -4,24 +4,24 @@ metadata:
     name: s3-backup-proxy-secrets
     namespace: longhorn-system
 stringData:
-    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:VUn1+696SysYn6eaDl4QLMcYcT0=,iv:bRmqkIwDu6nW0qZqhnRUbTH5RoMgWgMSt4e7BaZoXJQ=,tag:RI7OhrEszz0JSwE2v6eU3g==,type:str]
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:mr9uhOPnoyE2btwGi/g6TfrJeD0=,iv:uhGakLzqmPKBoqHz0QQf9m7jyJyCoi9wgcqmIIby9yA=,tag:a/fNKNYGsU5XCS/ITo0MQQ==,type:str]
-    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:vyk6028Tn1qgIkabP5n5Cq/e66KOhYp8oQH2eqSDA+qN+iREb4QZbA==,iv:TXbb32bGM65+DCjv4jR/k0GSyyaKlfx7YHq1GO51Il8=,tag:53Su0yEijhOpAG3YFQ3boQ==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:IFDS4Jn/30Kjn66pLh3oCT708L+WLb5RgaLvo7/r2hOCnF88/BNpQw==,iv:0kN6KIl2ZfhGKDMjvUH0Z/4W1sIFEW4KMU1aR61TVGs=,tag:MZ6ECMgnqRqDPPbHs8N/bQ==,type:str]
-    CRYPT_PASSWORD: ENC[AES256_GCM,data:92MbGxg93hka2Cig6fYCVFQS/S9XkpckMh9bi7oonDTxbHx5yQIeNEvQXw==,iv:ixUR21XowxZg6sH+HSFYN6prS0q6fCfWrt0+qNSQtpI=,tag:P8R489K8FipGcBElDXwNyA==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:7znzUa+aqfuMuE+zUTU/eJGBdRJ/w7kI6TYAk3reNrVGhoYeClfDwsEWdQ==,iv:aLHHyPa7NPe8C7/XDfthFz69mKyCmmv1X7WdZgGoj1w=,tag:FVu582F3+hwFtDm5PVDyWw==,type:str]
-    CRYPT_PASSWORD2: ENC[AES256_GCM,data:8V0a7aMSN1tJb++fB3hso/9p3i5sQJ4IP+G9drA7x9ocGM3TLCIWHrMMLQ==,iv:XHzXFnqC+4Lx08akwZmziXstrab6Rb3h9a6+xLAfbSc=,tag:VDwnNoyt7ohzSYBZBHcu9g==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:FM+1vKdaQMgOilOICQog2CNC8mq75lo1n/JHssph1eqzcdZpIu6dyk2Cxg==,iv:MP+F3KBpUWq9J6pbUkbm8wGL8JZs1AXElN3b4FPtxHs=,tag:8En7RaoGrk7XS0ArZ7Pe3A==,type:str]
-    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:mQchTvLd3DsJuzgROgNpotrcJPs=,iv:y62xF4vVqEFvMK7COZaFgQKFnGsPrqm65841zmh6KxI=,tag:wRNuLk9Pb53gSFE9WS8IHA==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:sd4tlvucLvCnoLkMdxwYPg7uX4A=,iv:K6ffAPFcJ9YU+dl1mzBENZETwLb1yMmkr1VDbY5QTBc=,tag:j46xiPytBUq7r8lIMO9QzQ==,type:str]
-    PROXY_SECRET_KEY: ENC[AES256_GCM,data:vUuVFal7paDcPPBT9QA65eVcCl8gPXIrRhYHVS+7HP++OsnSz6ZoEA==,iv:7DkfHXkxfW5w9RhxF/TsyqbZO3hCK30ZuyYXAT5vI1s=,tag:jF6htLAgeZhbtXVBt2iyHg==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:OAW0LfJWdr9GXbnCPOJ5sL4OPaqDgseBboMTnfmz6C4pvqxMK8eDLw==,iv:xG1FSmDSu0KRqUb6UIHCWrtbgXDae9hwi7gpwRPmYpc=,tag:EXC3vWxmDQ2Qx4FcMQig0g==,type:str]
 sops:
     age:
         - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUN1A0L0N2R3V3MndBdVJa
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyL0kxc0tSamlRRUJPU0t3
-            bTRSZVhMVU56OG4vaXA1d2tWVDAwK3lhc1MwClorUnA3NHAyRDlwRlBJNUZGRWNs
+            TlJ3MFNyL1dtbTBGaDF1eEJ5TGdLSUZSeWpFCmpEeHFReFU1dGNFbU9hNUhGYjZZ
-            a0V0ODdWVTFMZjkxM082Z2pidHgySzAKLS0tIDYxMjNFWWRJT2xMeTRpVEVBbWp6
+            MHZhTVphTW1GWi9uNmJzakoyMGFDdVUKLS0tIHVLWEVZd2hXbWxqdXo0d0NzM3ZN
-            T24vbURndVNpL0lieHdody92a1RVaHcKTvVWy28L/jVAnimDsgd1umn8rNSQFkfY
+            MFNQWGpBMUFIVWpnY0VJUXluS0NkSUkKQ5GNVac42YilzXegqymJzslpe/f+cmmR
-            Cla6YugaRcEK9xQNZL2pmw4jkCdKr+l/NPtHRjty61f+UneV7tuIjA==
+            U4gVl9qOQCczGJ6YD0Vvc5XtFC+SMHSPFtw12JJOU13FWmPtyQ9hSg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:07Z"
+    lastmodified: "2026-08-26T10:28:16Z"
-    mac: ENC[AES256_GCM,data:jEK00qN6lLy83ZA2RHnnDhiGCg7xST6YqRB41HAcwKv5PbAlDscHzKq2hdpUlPGfWORWtF4rQXqV05R6JD+MQxgLC2rdG7hwEGok6biurdGpmKRh4jSBTHQ2hJhBbIsLyv1eVlPhGdH3uP7skKl42PMfTvwzol5CT9UgZYD7Igo=,iv:ElEIRDblS2EreVYiS16BP4JaPjHOb1+tOowA92joHyU=,tag:C0DpDSgmhDa1ehlyYlkfoQ==,type:str]
+    mac: ENC[AES256_GCM,data:nGVX45yhwwz6Bj9GlUjX/0QEDu1AQLShCZ+IWoPbWq7bCfYHHuNKeoIHKtPFr18qmGJ0i0LPXF5Y+Pl5Fac1JedzE28WnPNPsEyunYf+tzW13CQpVWiE5ZUFwQLlf4dQ2FwixQnQeZI/X2AprG8KqlVv6x1w8gNOH8iMAvNb5JM=,iv:t+yDPoRfqpDkuNutD16vYySWpRvO5XD2a9safEocrsM=,tag:/zNyJuoIVRwBXTymcS3V0g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0