markdown-vault-mcp to authelia oidc

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -23,6 +23,18 @@ spec:
               MARKDOWN_VAULT_MCP_STATE_PATH: /data/state/state.json
               MARKDOWN_VAULT_MCP_READ_ONLY: "false"
               MARKDOWN_VAULT_MCP_BASE_URL: "https://md-vault.mcp.aggtaa.com"
+              MARKDOWN_VAULT_MCP_OIDC_CONFIG_URL: "https://auth.aggtaa.com/.well-known/openid-configuration"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_ID: "markdown-vault-mcp"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_SECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_CLIENT_SECRET
+              MARKDOWN_VAULT_MCP_OIDC_JWT_SIGNING_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_JWT_SIGNING_KEY
               MARKDOWN_VAULT_MCP_BEARER_TOKEN:
                 valueFrom:
                   secretKeyRef:

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,19 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:1p00cuLAOJdh7COKPwd+qRYaxrx5wrq2zZuEokyKO17kjIW38w+ysORrXnEU7HhDIGoCku6OncGgD/LT7DesVA==,iv:rLsqkLitasEbKWiDStMqbFZZxkLDe6L4XFBdpwZ71b0=,tag:67qGG4hqspLY6eLFyiQ2kQ==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:ORotrm7daYx9g29sSYgazIy4dcrjxKnbq6W14yRpU6cwVdsEuyt7fptLhRqn/bVIJ+dI1ixUlKrBvMQgEUvxGg==,iv:FQdum1UffqC/z6adMV6udruTo4z4m+HmjN1UDGN+enM=,tag:wkWhS5pal0NX15v7MN7QWQ==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:vGSasv6vrAmcRaj03BkzQqpoPB27ln0NC4smyp17XMDxz64pn8nVOYHatiRa2ROZy/sNJy8wgCAo5W3FsrdQkg==,iv:DmlO4fqPKvrOv2n41CbpENkSlm8us5q1TSq+Syuu/b0=,tag:+8ZZLoqmlmmApiWgloaZiQ==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:LrEEhV+JL/yTJGDhpqhSS0kM9RyhkXqaDiuff3GDSzxdKm2mqHMQTSMlcQ8J6HL8xml6jrzXXgefu2QZo+zxhg==,iv:K+FKH2ef9B6DIj6hxtNL9eRDPcKbNG4Qorc40UJYp/8=,tag:6glxFrjXiNykwhxpDb6wJQ==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaWZFTkVJbW1pQkxOamRs
-            enFOdVRNMXE2WU55aTJSb0hab0FBUmdFOFQ4CjY5ajdLSEgyYmo3TUdwNmx5TXdx
-            Tk4vc0tVaGIyT1lvUjBXcWdTbTUvMlUKLS0tIHlEOWR6bTBQSlpyaHNzbkxBNWxL
-            R2k0OGFGeGtlSi96UzQ0eFRYM1FpM1UK4eKyOlemUF/YngrXP2ud0MbsFNw9KrhI
-            ptwFfhdE7j0k9z50w2InLjSvpK7W4vJgf440Wgry6qw1m48HprWn6g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2Y3ZtUmFaNzhubGlxaHJ6
+            M1FtQjBoYVg0aWY0bm13aG1OTHdCVHVDMGlVCjZydEpJa2RlaWp0UjlPV1ViM21N
+            ZUVOV1dyTW45TldOUm5kWk5xaUxEZDQKLS0tIGpaL0dpNWE1L0RDS2FlVmlXWWJy
+            WU1Cb1ZYTkFhQVRkUTFXT1dweW9yYnMKGhvMuqq6hclKEv6ssmQXQAGM7aVC1EHE
+            FIGhE4KpMaAZEyqB+ZvzsTpJcdzobFj0IukVwR4zSBOuzNFTxcIK3Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:32Z"
-    mac: ENC[AES256_GCM,data:14fHPrNNGuEFohswUrGuP5H8/7sMSP47ew3wf+lzLCzWOpCynyjRzbT0Ym0Vrgyz/GmGzLFrPyzxAE0Lj9hgrNO8wTT03AcaK9xVfza0gEdRGdRPVS4Ue1RFe50AZ+FmW8FmMfjKQLss383psHHvD+sj+EpGwsxZrgpNzC+BZxw=,iv:ZK/tXph8MKS2Pp/2muVQZvZhlHcsdE7l2Hv/qkUz9Sw=,tag:9wr8Q0OB6vQdLtgewl/cJQ==,type:str]
+    lastmodified: "2026-08-26T10:20:38Z"
+    mac: ENC[AES256_GCM,data:+CCJSTpbj1rJWkUYHToEYY1mLS8uB+0elxpDq5EqHtYwmcJH06nTksHXIrEbnracX49a48niRCCZxbnXyBYIQ8lnxrV0gWfmjeZNFPTSTMd/Nn1DdzsJ9RLEZ/v+q2uX0RPc12gNfetRWwR+Piqcepo2Ka4ypIO/wEnrKLQp3D4=,iv:yUV5PQLMRFgUyZbQVMPQTQthv3mcVJ06nKPf66/BpGk=,tag:uACBK7VPsOSVG4VdV5aHqA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:TwTP7OhOiH6IyUfiPYkoZr5FkQ46vqV1TjsP8WiTPHtcqV6ie45MHAaAyG5CuS7wC0yKE1bYXazLhcb6TRNfw5eGD+idgzPBkC1ZCdu9NCK1VGuUBdhre/HCcr2i85W513VrE2rrUm7ULs4UFtDN19/44PXL7OGUyppXsx/jQfCW+aIFbewo4QTpff6n6KIj8cgeeezia8i/PbcqhvE6LbXn+z1dBt7uNO4WvRFOq60GxnlloSx73EGM47Woaw==,iv:FigtA2rt+2Z0H40+Y+D2ZEp5seTwnJMvRF9sD3Vn18U=,tag:hl47urwb0/PNMiQagrOuuw==,type:str]
+    passwd: ENC[AES256_GCM,data:UlSXAQsrgTioLgMqyWrq7eraGR2mKj1cekV5M8m2JOkISpcdCy5z6cD8WucoSSUtpXwqLh5qwHmQ2sqPucJ/pdWm50ugbgy9evoPyNACSIQgpRsU4IpUyxjM0W5uzViOeqxqy0Ui+8F0UbqAuAWI8OHVQisdfNpQBWbVaPoylC5+VEvi7kQX8bP9lQofzP9ljPLEVXkLgABVJ4puAQCNOw+5pJmE7JXWT9oq/XL3AtqlWWH3RVmwm790C3vzVA==,iv:zItw3K9pCQNxbLwr3EPfb7iKrzJjbNfpdbK7kwRhI6k=,tag:aCCnvFCsg/sb9fVuGwTb4w==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZDhrVlljbHNLZnBEUFow
-            amJ0MEEyY3E0RjM4MTRON3NrcVVzd0RoakFFCkExWlF6Z0ZHTjVtS3UyQlVFSFk1
-            Uy9TRXJicm5JbjlKVFB0M0lPUVorbjAKLS0tIHlpVTVNdGdmOEpaK1VCWSs0c2d6
-            cktwWndLbkRZRnBzcVJidHZBd25TYUkKZOC5+Sr5OiRttsrxImMcOOhWcvC7b5Wv
-            fRaGmUBw+Ah4K6RAlWh5ep4yMNvDNDcTBex779+69Tl0yZauTZeAFw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmNFRZcmZUYjFpWElVK3pI
+            bitNZUJYOVpXd2dQTmZ0U3JvMnZMWWdZaXdBCk9DQmV3ejlTTWQza0hDZ0o2NmIz
+            SFhSakUwSDJZNEE1NWdwQm90ZGRhbUkKLS0tIEI3dFltUGNqbFdjRDlpOVhZRmo4
+            WkdtMlZPdU5Iak13OWtUVmw5a1NETnMK1omvPw4glMKmbhOZP6iLCrkOr8j9MTdM
+            IeOTl4X8AvOiTm8AnF5eKFNRGUFWfNLcJ5z7LbadoKSx8AUNRPwrBw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:33Z"
-    mac: ENC[AES256_GCM,data:RLr6PSln1jCnTaxvqrjaRScH4QTFUuyXspuyedAHlVtO0k+4kTr/jfEXaAwPMSVrNWonjnsNzqpVyiNhD1KEuepQ3lEE1SWVVG9oRuxoQwxNe959lkW7WKUhYj1ArUe5cL4PaSU23bYp4nN64S2P3mASAPWAXvUfdbcc0lnToP4=,iv:7PZcuB0LnTwLptdTuzAv3MTc8A1J8H6mH83PxS13On8=,tag:VVPcmDzYc/dW+JNQX6cPXA==,type:str]
+    lastmodified: "2026-08-26T10:20:39Z"
+    mac: ENC[AES256_GCM,data:91BOuYu/2Lp7+ELsVL/lLk6VXNOmztDwuVnPj2toEia7wUe4iVI1OVG64oRiMi3pYQ6fs3l+2GKtbqb68SgzRqVmQjKHNsPhLGAIhnV6Oj8JcK27q2UCn7JtG5qexpC5OmRlpMCh7ajwJXg3DBrfzaWJ0dbL+fvqa8Iw76XMXYc=,iv:igEu6OFFS6Ay+hMB1ZxbOFTKX5gEGahBIygF1rjnxDc=,tag:MaFrUxiQFtHFFvGMZ5zRLw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:AF76HWY1ixWjrhDoTsqwib2gNLa4GNPeDzSpcmmWshz/2S5bWXzJ9BA3KdXPh+FRf49HcCFhmdXo,iv:Ct8csEq/ZuUgy8yLu/FUdK8CNLMAQ8osxD5aiLUiaOU=,tag:GpAp76v8hDTNnoXassNXCg==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:hfFVx7ChCCo63LJfujg65wE3IAKHh2CCWJh9AJh/VEKkFQLEotk6gaqfF7xfAHrfk+0HaCfi1xdUZjPaa+tQWnmgfsmptNeKADNhmSptymW2oVPzqQfl/vUV5TmgiWt21A6jI2UfCj6zbBKtlsR/Omia+nmQzQ==,iv:K8wPbZQCfMTY6icS2D7KxPcW9o/yW4rijnCAev5jDY8=,tag:4WiExlfkjFIqINMMgtA31A==,type:str]
+    #ENC[AES256_GCM,data:v1B3DSV/0BgzERxNBxom0nqNd8eq+36uY7+wdpf0gk/lzBzXmhTHNvmFLnqm3c2MaF81URBOd1sX,iv:kRfP2YhvMPAEAyLMlTCoqIR2WUjHUZmttrH8VWPtA6M=,tag:cgTOMKcoflk+DGv09OmnbQ==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:Dl8CvxUWH0DZq4+nOktcGNgAPG5+1ni5EopruFdTqaQdvS7z25HCvtTuh1lfuhVLFYvpHaSvk9m+vaofchIv8brb5zOe38nYgBxkdhV/jO+tjJlqECmYeyeo4QiTqNJVfhj+dWZkiyWG60RLMJFNxB93TDO6sQ==,iv:ECFG5z+zNuw0sw4TWCl+2SzXr9rAIiZ/7iSsd8wIRyw=,tag:QzdzXewgihAIiCytaC/CRA==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYQy9HT2V5U2N5MlpkRWdh
-            RjR4VWltdStJMkdpVitkdzRBajZoTXZZWlhzCk5UWHZyMFV5RGsyeG9ldklYc0xS
-            Q2IzTTBSTHVZOTczSTFYUng0SUhiMHMKLS0tIEo5TXBINW1KOE5jZ2kwdFNtUWFV
-            eGlUcFdmRXBtSVV6dStOeEdzT1dFQXMKZBhKMLKQgg8BBDjmncKwRR4JXeOqnNbd
-            d3TmtEmOfWP+KUJjLDttZ3KiLLseLYPodQYfuPJomJsl9bRHR9lDpA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpK2M0WDJUaU5TVm42Yllv
+            b1ZobVhmMW9aMEdhVG9UUkgyVE15V3BjT0RJClVjQjVnQ21oMW5uTWtWM0ZWLzJp
+            RlAxWmlKMWZMNCtPbUlmbmJtWXFkbk0KLS0tIE1DMjVreFQxUFRLbDV6NUhVbHpN
+            MVczYzBxbmxsNzVJbmVMSkd0MW1JTUkKs6QQgi5CpOHwBYmaQWCpbDDglv8T4TAL
+            6shXpG2U42Z+4mOFLAVFRKUWtTtwceiNNyM/EGilFrnBqqCtRHK1tg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:34Z"
-    mac: ENC[AES256_GCM,data:5qDLi0hsdQtwwA4vEdkA63ShEOetc/IxrNYnC+FFnBvN3/87kb+C/z4lZQVKZ0Noc1euRDY+VH0HLgw5QMc3Lf5OKbitLafTYQZos8qX50/3OyPTLCMhATYv108ujAVoVjdx8SuI6dK0r/kP7ziE25Kosqdg8whs54Ot/85LYk4=,iv:ldbU58+hl9aJzapvsQF1sp/NoFaowxA3mS78HncCftc=,tag:yCLUwY+J/mIF+W3gMqX0cw==,type:str]
+    lastmodified: "2026-08-26T10:20:40Z"
+    mac: ENC[AES256_GCM,data:AXMpGUNEb3GSnjhus/RA/MN1KMJZbnCDPyDvRuS09o8M++LiwLXi+2JYWb9s+hHQ1ZqpHtE6stlC4Awnk/ReQKaFsFIVW5xGMDWZ6RFQ0JbhpmepDZ0nCDtOFah2PCaPOP9cNEiv1JC4dQlUJFnEOUa+jBCd408ZJxjZUFmD9mk=,iv:WmQIrcCgXEmnJCWosGrw23AOhzzTYxb2NpwjVsa+yuQ=,tag:SLrMjRq6TrOizjvpuil60g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:YmjhgdO7tF4lCn259w0LB+/NeURtopl4lNDDgW/+uPvGAs2sSkiTPDvGQWXQf/+z3ELbY0a+XOsrdBhL4XqctuyyoFkLFT99lXBDhEpFKmw0drkh86gozwOaqUn8dPTPVvW7BHJY+tEjDRxfgDFc6iyzWNUMoZyZ6vq5YkQ=,iv:2fykB+v0qtglH5SwegIAQIgk2F5FTYOdAEWW+dJKtCE=,tag:Jf+25sMjVu6KbrI2/9Tmug==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:4PGRZfs1VmoFMtksL9NqlVoCo++r4huVzz4jK/xoqW6g4x2BWJVNimlcg2wPAm8Zropg5alNckJNJbRScLHzsie/XAOpuihou/egRNrFHpMTQuR7F9WDfU6nzPE+k4qy+GHj/qETAPBirAHcWeRQ90ojRCR3FMAq5B9dx98=,iv:aKRrL7PoA9inOTOUoFSS4UrTj2CJIXlEz1XOl8ZncMk=,tag:mbPhwQrbOyXj9Z8WMMTdsw==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLYjd3dXNZNlJ5dGx6d0p3
-            R3RjOVhpTzJuRStkWnh5OStyNy9OZDQvY2hFCnB5WHg2bk9pSlZkMEZ1b01WS3VR
-            aW1MWHlXV2FvMURjT0laZnkvdGp2OHcKLS0tIGJBMzdlWHkrcUFqTkEzVytsNnpE
-            YmlOWWxaVG5nY3Uwenp2Z0Fod0cwc2sKsmuW028YnPoBr+70aMKyA1QGckfO20GC
-            01wvPX5M7sNPrk6QNPG/jU/JT8EwSy/RunSiVVtnU8mpV4Or+wIHZw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwRzU5UnlZMDIvWGZoelph
+            MTZGT2haUndxOXcxREtuZHNzYXNhODlYWlc0CjFtaFhwQ0tKb3RWdVp1b2R2L29P
+            SDJ1K0gwOWROaUVIRk8zYXZmVndvQU0KLS0tIFhrN2pFSVhQcUNRNUdpMk4rZVBx
+            YXl4ckpzWGM2UmtpUFZSaXpNNzhkOGMKIDmsERC3WS3dnxZQ/4q3KmgUhgQa7BZv
+            kAviMCdI5hYpTeNUAHO5YuIB+d3TMwpTb7BL+AITKByFsckVf+Wuvg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:35Z"
-    mac: ENC[AES256_GCM,data:W7mgRCLbjYXBosxjhQskVMfTzGyczDGPt9BCFE5DvRgsNHYFxJsrNJqn6YQXDfHyOzHhzSo3Am339mvHWxSCUqO/tdtelSi5YMiiNLegOTm/upoLpRQN6vwATDQ3/6Y0ZSfkipWtMNTFFn0e3aR6LkifU0eFcWa6x7C6HHlfel4=,iv:VouYG5DGpOIeC7q3pUvtRh0BeFxM+FRx6c4rynqAjRE=,tag:udccaNj0tjdd2YqmPxFdbQ==,type:str]
+    lastmodified: "2026-08-26T10:20:41Z"
+    mac: ENC[AES256_GCM,data:rsi3JkUeKqnGHFK9G/cE2u6WJPNXHQyksgPC+HEyo+2P0Vjt6TZY8y1QjQphkFjhr7NClaM1a9rYjMgsRxcdyXFKQYoKmIV8nn1/7L8u18gGaJEpKPsvgN2lJDqgcegp83ia0jwALnEh7FdL8c0fIXSoLmzejMdO901x+Nl+1Jk=,iv:c1RyYxHSuhQ0P9Lruw4II2FVeayxNbNO6Jq+kVK44CM=,tag:WgXpaSdpam/qIexokpmNfA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0