removed rsync & rsync-web from immich-server

This commit is contained in:
azykov@mail.ru
2026-08-23 09:49:20 +03:00
parent 82deffb39f
commit c186e2b765
14 changed files with 94 additions and 483 deletions
File diff suppressed because one or more lines are too long
+10 -10
View File
@@ -4,21 +4,21 @@ metadata:
name: davical-secrets
namespace: pim
stringData:
PGSQL_ROOT_PASS: ENC[AES256_GCM,data:GJrS+Pu7imyQmfVElru5JrQc6gp0BqteMxW3tj1hdzdh6r4uEPEG+AJDQ+8pI8CC,iv:xBK6Ch6VWZ1ElFErTzVF7l98aW/EZ9tZNDvrJEpUjlk=,tag:wUKsgwqaRor9aWQDaYlQng==,type:str]
PASSDAVDB: ENC[AES256_GCM,data:oGE+CbWHf+1nLw0hQsIVJYktmb19hmZDG0qIKvpZc2JrQdY4SI1eAysbaTqvy7K6,iv:vu67jRaLzBNodTzaKUKaSoDXBfgKHEI6qXMjNQAfukc=,tag:+U7EIx+BhmWqObxWH5jY4w==,type:str]
ADMINDAVICALPASS: ENC[AES256_GCM,data:Jk3ZnCdmiIE3iU098wwWB1YjtyBG06auisoainUnXh8=,iv:ouC647V+7BjgZ99IlV8vfs7JFFMC9pVkf8XDOKFpC1I=,tag:9//vLXuP6QbACDgn16eS1g==,type:str]
PGSQL_ROOT_PASS: ENC[AES256_GCM,data:u/YPjF4wIWFN9bxQztfRrwxzZ6jEKEhX1Bem2w5AC4FSOZKUPeD05ikeqL+Xg6X1,iv:aoG21ZdaFefb2fL9nex1npx5JHRf9T7ketCLGpbOhhc=,tag:ElVPbbHnGwfHWwtCoTZCaw==,type:str]
PASSDAVDB: ENC[AES256_GCM,data:3AAXLiLlwNQDWPIEBhi++1xRhwh9PtOpIHJDkV/+XKoGEA6/rGfa8XYoCwNXrUhn,iv:DdIF5kKU3xn71xnZWxPy3KNondZ6/gNmrGZOi5mSfNQ=,tag:WbbkwifIsl8PngZz8887VQ==,type:str]
ADMINDAVICALPASS: ENC[AES256_GCM,data:xbkxusAKbRQSLS/EWPn6qvSXijew9JcmjRuJH98a1E0=,iv:BHsvdRuROl7rfME5eFx4dN0fGwFocbXFP9DpUCdZlF0=,tag:yWiSH7IuADIpynWIrnHJhw==,type:str]
sops:
age:
- recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuUlFVZ1ZpS3p0TE9tdG54
aGUvNXMrQ01mWkF4RXJ4WllmRjJFTUVUWUYwCmNjNy81NGFDZHlxeDluTWNPL21I
VGxxT1ZTSjlwdkRnT29qUTFxNEZ6MWMKLS0tIGplMVdpTEgwU2dFUEx2ZE50Q2ox
QlR1OXhWa0ZmbnNhQ1B6VTAwY3NxN0EK+6FdDmOlYs4KSvxBqCAfr2oj5dOszxCc
7Om720HIdU08HOFV4iaRu3AJmb3cFwEqyDNZoKJa+shoDd2BmoohaQ==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnUmYxNHd2clBuTjNDblZm
N2dQOU9OZmFpejJzbFZPU25FVGltWWdaeVNZCkwyK1l0bnVVZm40bUFIcm0vdGp2
emtBYVEwNjdPV1k2eTRnM3NxZ1gvb1UKLS0tIEhJbUtMNHlpdWNzdzYvQ0VFZGFn
d241b1IrSmk2YkhkaGRJSVZDOTMwR2cKleR6VDoBxi3YY9KLGNopSkB0qr4ztyN6
3JEAAkTdcwRnggh4LNOj/7HLGqFVztKhgWyLY0RK/MjhrH9k9GW1Sw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-08-26T10:28:57Z"
mac: ENC[AES256_GCM,data:Q98/oOwr13+/+6RaPeJfRyhRQuVnf2C7NE6mP/C58fQZbMtETb22/jfh8ABdz9AT6UB8rNbNGBaBahMU+0uGYIxK0dZ6XVvgXz4vgca7RvYcHNVBwbYsRqAo/Qtq6JOJlphxMaQzISJkp9EahbpnLwRtJDGLU1NjUwPjecAinjo=,iv:htpV+O8iasnHgRqmsXXDRRDzF2xLS3B/tdXjAI9Cw0A=,tag:Z0+hfYLP7k+BI2eRkH+kpw==,type:str]
lastmodified: "2026-08-26T10:29:07Z"
mac: ENC[AES256_GCM,data:xeb/F9tEG6f9uaES6FnjXbocFWYz3D0Uv1lJovCbd90YhiZ9rH17x0dMU7Rz3fw/IbcHx+ZZdZjmmHDImJ4/3ea/T+z2QHGCj5Xupo33Q4TVGELeQFjsL3pX80wzfvxr7XCF1PP6nCEm3eSh9XtM6HGtQRUYu/Nwf/vIPWHfFpA=,iv:V3OuMwV+GXHeWWZCdHgiGcjjioOKB6SdN7ZohR6Czdg=,tag:B7X18ywmGfEgURcXO3zCig==,type:str]
encrypted_regex: ^(data|stringData)$
version: 3.11.0
@@ -1,252 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: immich-rsync-script
namespace: photo
data:
rsync.py: |
import os
import re
import subprocess
import threading
import time
import json
from datetime import datetime, timezone
# source mirrors immich's own folder layout 1:1 (library, backups,
# encoded-video, profile, thumbs, upload all sit directly under this).
SRC_ROOT = "/source"
LIBRARY_RECENT_DST = "/disks/library-recent"
LIBRARY_ARCHIVE_DST = "/disks/library-archive"
OTHER_DST = "/data"
OUT_DIR = "/www"
FILELIST_DIR = "/tmp/filelists"
CUTOFF = datetime(2025, 7, 1, tzinfo=timezone.utc).timestamp()
PHASES = ["listing", "library (recent)", "library (archive)", "other folders"]
state_lock = threading.Lock()
state = {
"status": "starting",
"phase": "",
"phases_done": [],
"percent": 0.0,
"processed": 0,
"total": 0,
"rate": "",
"eta": "",
"bytes_transferred": "",
"recent_files": 0,
"archive_files": 0,
"started_at": None,
"finished_at": None,
"error": None,
}
# matches lines from `rsync --info=progress2`, e.g.:
# 1,234,567 43% 12.34MB/s 0:00:12 (xfr#12, to-chk=345/400)
# the "(xfr#N, to-chk=X/Y)" suffix only appears on some lines (once a
# file completes), so processed/total only update when it's present.
LINE_RE = re.compile(
r"^\s*([\d,]+)\s+(\d+)%\s+(\S+/s)\s+([\d:]+)"
r"(?:\s+\(xfr#(\d+),\s+(?:to-chk|ir-chk)=(\d+)/(\d+)\))?\s*$"
)
def render_html(s):
progress_html = ""
if s["status"] in ("syncing", "done", "error") and s["phase"]:
progress_html = f"""
<p>Phase: <b>{s['phase']}</b></p>
<p>Progress: {s['processed']} / {s['total']} files ({s['percent']:.1f}%)</p>
<div class="bar"><div class="fill" style="width:{s['percent']:.1f}%"></div></div>
<p>Transferred: {s['bytes_transferred']} bytes &middot; {s['rate']} &middot; ETA {s['eta']}</p>
"""
elif s["status"] == "listing":
progress_html = "<p>Scanning source and splitting library by date...</p>"
error_html = f"<p class='err'>Error: {s['error']}</p>" if s["error"] else ""
phases_html = "".join(
f"<li>{'&#10003;' if p in s['phases_done'] else ('&rarr;' if p == s['phase'] else '&middot;')} {p}</li>"
for p in PHASES
)
return f"""<!doctype html>
<html><head><meta charset="utf-8"><title>Immich NAS rsync</title>
<meta http-equiv="refresh" content="5">
<style>
body {{ font-family: monospace; background: #111; color: #eee; padding: 2rem; }}
table {{ border-collapse: collapse; }}
td {{ padding: .25rem 1.5rem .25rem 0; }}
ul {{ list-style: none; padding: 0; }}
.bar {{ background: #333; border-radius: 4px; overflow: hidden; width: 300px; height: 14px; }}
.fill {{ background: #4caf50; height: 100%; }}
.err {{ color: #f66; }}
</style></head><body>
<h1>Immich NAS rsync</h1>
<p>{SRC_ROOT} &rarr; library (split by date) + everything else</p>
<p>Status: <b>{s['status']}</b></p>
<ul>{phases_html}</ul>
{progress_html}
{error_html}
<table>
<tr><td>Library files &ge; 2025-07-01</td><td>{s['recent_files']}</td></tr>
<tr><td>Library files &lt; 2025-07-01</td><td>{s['archive_files']}</td></tr>
<tr><td>Started</td><td>{s['started_at'] or '-'}</td></tr>
<tr><td>Finished</td><td>{s['finished_at'] or '-'}</td></tr>
</table>
</body></html>"""
def write_output():
with state_lock:
s = dict(state)
html = render_html(s)
tmp = os.path.join(OUT_DIR, "index.html.tmp")
with open(tmp, "w") as f:
f.write(html)
os.replace(tmp, os.path.join(OUT_DIR, "index.html"))
tmp = os.path.join(OUT_DIR, "stats.json.tmp")
with open(tmp, "w") as f:
json.dump(s, f, indent=2)
os.replace(tmp, os.path.join(OUT_DIR, "stats.json"))
def split_library_by_date():
"""Walk source/library once, bucket relative file paths by mtime."""
lib_root = os.path.join(SRC_ROOT, "library")
recent, archive = [], []
if os.path.isdir(lib_root):
for dirpath, _dirs, files in os.walk(lib_root):
for name in files:
fp = os.path.join(dirpath, name)
try:
mtime = os.stat(fp).st_mtime
except OSError:
continue
# rsync --files-from always wants "/"-separated paths
rel = os.path.relpath(fp, lib_root).replace(os.sep, "/")
(recent if mtime >= CUTOFF else archive).append(rel)
return recent, archive
def run_rsync(args, phase_label):
with state_lock:
state.update(status="syncing", phase=phase_label, processed=0, total=0, percent=0.0,
bytes_transferred="", rate="", eta="")
write_output()
proc = subprocess.Popen(
args,
stdout=subprocess.PIPE,
stderr=subprocess.STDOUT,
text=True,
bufsize=1,
)
last_write = 0.0
tail = []
for line in proc.stdout:
tail.append(line)
tail[:] = tail[-20:]
m = LINE_RE.match(line)
if m:
bytes_transferred, percent, rate, eta, _xfr, to_chk_left, to_chk_total = m.groups()
with state_lock:
state["bytes_transferred"] = bytes_transferred
state["percent"] = float(percent)
state["rate"] = rate
state["eta"] = eta
if to_chk_total is not None:
total = int(to_chk_total)
left = int(to_chk_left)
state["total"] = total
state["processed"] = total - left
now = time.time()
if now - last_write > 2:
write_output()
last_write = now
returncode = proc.wait()
if returncode != 0:
raise RuntimeError("".join(tail[-5:]).strip() or f"rsync exited {returncode}")
def run_filelist_rsync(src_dir, dst_dir, filelist_path, phase_label):
run_rsync(
[
"rsync", "-a", "--info=progress2", "--no-inc-recursive", "--outbuf=L",
f"--files-from={filelist_path}", src_dir, dst_dir,
],
phase_label,
)
def run_other_folders():
run_rsync(
[
"rsync", "-a", "--info=progress2", "--no-inc-recursive", "--outbuf=L",
"--exclude=library", SRC_ROOT + "/", OTHER_DST + "/",
],
"other folders",
)
def main_flow():
with state_lock:
state.update(status="listing", phase="listing", started_at=datetime.now(timezone.utc).isoformat())
write_output()
recent, archive = split_library_by_date()
with state_lock:
state["recent_files"] = len(recent)
state["archive_files"] = len(archive)
state["phases_done"].append("listing")
write_output()
os.makedirs(FILELIST_DIR, exist_ok=True)
recent_list = os.path.join(FILELIST_DIR, "recent.txt")
archive_list = os.path.join(FILELIST_DIR, "archive.txt")
with open(recent_list, "w") as f:
f.write("\n".join(recent))
with open(archive_list, "w") as f:
f.write("\n".join(archive))
lib_src = os.path.join(SRC_ROOT, "library") + "/"
run_filelist_rsync(lib_src, LIBRARY_RECENT_DST + "/", recent_list, "library (recent)")
with state_lock:
state["phases_done"].append("library (recent)")
write_output()
run_filelist_rsync(lib_src, LIBRARY_ARCHIVE_DST + "/", archive_list, "library (archive)")
with state_lock:
state["phases_done"].append("library (archive)")
write_output()
run_other_folders()
with state_lock:
state["phases_done"].append("other folders")
write_output()
def main():
os.makedirs(OUT_DIR, exist_ok=True)
write_output()
try:
main_flow()
with state_lock:
state.update(status="done", percent=100.0, finished_at=datetime.now(timezone.utc).isoformat())
except Exception as e:
with state_lock:
state.update(status="error", error=str(e), finished_at=datetime.now(timezone.utc).isoformat())
write_output()
# stay alive so the pod doesn't restart-loop after a one-shot sync;
# the status page keeps showing the final result.
while True:
time.sleep(3600)
if __name__ == "__main__":
main()
@@ -121,48 +121,6 @@ spec:
memory: 512Mi
limits:
memory: 4Gi
# one-shot migration copy from the old NAS-hosted docker install
# into this install's own volumes (see "persistence" below).
# rsync is idempotent, so a pod restart mid-copy just resumes
# cleanly; once done it sleeps forever instead of exiting, so the
# container doesn't restart-loop and the status page stays up.
# (starts after all initContainers - fix-permissions and the
# mergerfs sidecar's startupProbe - complete, same as "app")
rsync:
image:
repository: python
tag: 3.13-alpine
command:
- sh
- -c
- apk add --no-cache rsync >/dev/null && python3 /app/rsync.py
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
memory: 1Gi
rsync-web:
image:
repository: nginx
tag: 1.27-alpine
probes:
# explicit port: this controller has two services (app:2283,
# rsync-web:80) and probe auto-detection picks the
# controller's primary service port rather than this
# container's own - without this it checks the wrong port.
liveness:
enabled: true
port: 80
readiness:
enabled: true
port: 80
resources:
requests:
cpu: 10m
memory: 16Mi
limits:
memory: 64Mi
service:
app:
@@ -170,11 +128,6 @@ spec:
ports:
http:
port: 2283
rsync-web:
controller: server
ports:
http:
port: 80
ingress:
app:
@@ -193,22 +146,6 @@ spec:
- secretName: immich-tls
hosts:
- photo.aggtaa.com
rsync-web:
className: traefik
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
hosts:
- host: rsync.photo.aggtaa.com
paths:
- path: /
pathType: Prefix
service:
identifier: rsync-web
port: http
tls:
- secretName: immich-rsync-tls
hosts:
- rsync.photo.aggtaa.com
persistence:
# Immich's "library" folder, mergerfs-merged from two disks: recent
@@ -229,8 +166,6 @@ spec:
- path: /disks/library-recent
fix-permissions:
- path: /disks/library-recent
rsync:
- path: /disks/library-recent
library-archive:
type: persistentVolumeClaim
accessMode: ReadWriteOnce
@@ -243,8 +178,6 @@ spec:
- path: /disks/library-archive
fix-permissions:
- path: /disks/library-archive
rsync:
- path: /disks/library-archive
merged-library:
type: emptyDir
advancedMounts:
@@ -274,30 +207,3 @@ spec:
server:
app:
- path: /data
rsync:
- path: /data
nas-source:
type: persistentVolumeClaim
existingClaim: immich-nas-source
advancedMounts:
server:
rsync:
- path: /source
readOnly: true
rsync-script:
type: configMap
name: immich-rsync-script
advancedMounts:
server:
rsync:
- path: /app/rsync.py
subPath: rsync.py
readOnly: true
rsync-www:
type: emptyDir
advancedMounts:
server:
rsync:
- path: /www
rsync-web:
- path: /usr/share/nginx/html
@@ -3,8 +3,6 @@ kind: Kustomization
resources:
- helmrepository.yaml
- secret.enc.yaml
- configmap-rsync.yaml
- pv-pvc-nas-source.yaml
- helmrelease-postgres.yaml
- helmrelease-redis.yaml
- helmrelease-ml.yaml
@@ -1,41 +0,0 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: immich-nas-source-nfs
spec:
capacity:
storage: 1Ti
accessModes:
- ReadOnlyMany
persistentVolumeReclaimPolicy: Retain
storageClassName: ""
mountOptions:
- nfsvers=3
- nolock
nfs:
server: 10.0.64.80
# .../uploads specifically, not just .../immich: this aligns 1:1 with
# immich's own folder names (library, backups, encoded-video, profile,
# thumbs, upload) sitting directly under /source, matching what
# rsync.py expects.
path: /mnt/sdb2/immich/uploads
readOnly: true
claimRef:
namespace: photo
name: immich-nas-source
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: immich-nas-source
namespace: photo
annotations:
helm.sh/resource-policy: keep
spec:
accessModes:
- ReadOnlyMany
storageClassName: ""
volumeName: immich-nas-source-nfs
resources:
requests:
storage: 1Ti
+8 -8
View File
@@ -4,19 +4,19 @@ metadata:
name: immich-secrets
namespace: photo
stringData:
DB_PASSWORD: ENC[AES256_GCM,data:qIyLbynKRWbr+HkLKHMPIYKwMY2mfnWeiuji9Ami/RE=,iv:taGELFgp++UOkjJ301AYb+PI93qXJ134yPeyLkC1Vm0=,tag:PpJKK9kxpzp9PeXVBrVlDA==,type:str]
DB_PASSWORD: ENC[AES256_GCM,data:WADkONhWfLLFqA3s6N8E3NyDbHr/Yax42xmTfov39bk=,iv:5W9nnHFT6C2kiHIylb+shQCsXHWmlpxMXItiz5HM1t4=,tag:B3/xbKPK+T0U1ZEJZmj8Aw==,type:str]
sops:
age:
- recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2MHhJaytNWEhlSzBzY2Zt
cUpUZ2UwRTlPWUZHTUkyS1hLZk9qUExTdnc0CkNDOVhkYmRxaG1nckJqQ1lDeEhF
bjJtWGlvWDRJdmpZNkI2NHViTHdMOWMKLS0tIE1zNURyWkJpV1JOc09jbEZmeHp1
VFpZT3I0YThVVXBwTVp0Tk5Qd0tQNVEKU5hd7cj0iWJcQFvzD9VowNgnRQOAjajJ
CaPwQNOqanQ2AesaWEFAAk6ND5AvUW7f2rdk6gA2O9lkoPuVtMtLlg==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRDZ3Y1lHdTZCeDN4ZFhV
KzJMYjRGNVdOZGc1Nzg3NWdmR1g3eGlKYUdvClZyLzVZcHVPSmdDWGlKcEZ0RU45
dzlWUFFNUVFseDQxR3BneWhvUnQySk0KLS0tIEh6TFJKYWdqVWdnSEFLSlE5U3kw
aDRUaWRLaDd4dDh5K3VtMG1PQmYzdlkK0ccZQukupy3OQ/vz+7RY2sXIjOTcrnE5
sMhe/VpXnpVKJihvXx+FQ1ntxzQxyKpqs9oHKjZaE8gt36te2o/Qzg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-08-26T10:28:58Z"
mac: ENC[AES256_GCM,data:xxoauF7/+GAST+o0gGJV+Ezwsg8C5OZgXqkrkyvDt0eVmRgRAN9Oa/OMRGFJP07eNRmGtYv23IzW8f0yCqp8Oxg5YBPES3jKlG0q41rIykvtJ0PGWnn94WY5lQOPg1PC8XezihrEByncu2WyD3nPL3p3LwMG1JjNnWXEN854K3s=,iv:LmmM/koypOWhr+Po8e75zRihhKsbMyQf302dCVSy6tk=,tag:XHC6M4bCsEnVcD6ZnJZPeQ==,type:str]
lastmodified: "2026-08-26T10:29:07Z"
mac: ENC[AES256_GCM,data:RnTkmAsk9VbU848rIWv+yZP7Iryeod+lJTeV2Klpd9NK7BRqYdoP2YoCdXrSpKNmbTDill6bi7tyTt5m+SgSOvySBp/QgPZzBXwdUMUVUd0XkZYWCsEW/4AJEghE3TtzEVSGAymAfTAkRv9gk4T4BdZYABrC1K5IgedXlIxfAHY=,iv:NOaMCirkW0zGpx1OVwmNnulJSjq6kFgoa8pbESfq2fM=,tag:9eq+d16GD6dy72phwMAeww==,type:str]
encrypted_regex: ^(data|stringData)$
version: 3.11.0
@@ -4,21 +4,21 @@ metadata:
name: markdown-vault-mcp-secrets
namespace: mcp
stringData:
BEARER_TOKEN: ENC[AES256_GCM,data:B3CeX0cweSZCZgFURRHfLdLjo7eM/gsilzY2B6O+Cepdt6GhSsdbnGfvz6wy5gsdRt7QbrlStWmCs+iEgoXBNg==,iv:LqXUK3A3Pdel55x804wEIEVq1DXxdnSOBcze1ULW6ls=,tag:eSYFNhBOKJa5415HmL8+GQ==,type:str]
OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:f19QxQmV0awT/cd4OApe8W8OAo7EkcYZHvQT8KrBr6FxiOAJ7EJ+x3ay9tRnmZ3d4b9djeEClxZinpAP+klZKg==,iv:h8yWfNHHworWea09L02M3vs8mqfbP9Basn0naEIA9ds=,tag:gSu3mV3E3pJRhmKbQcv5HA==,type:str]
OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:Yvj3n0nOw/4ALpjvAMX7Urh9VUgZlRZxO+eTvpEoq8uIQ36Oom6bUvMsG3ZNjwCqV8IqHgH0yM8F3Ahvh97f6A==,iv:Arhj7ijzwckfB7lIsHSZI/i6mU0tspDj+rtwtV6N+0c=,tag:ElvHXFcwPpEOXL7iDfbIXw==,type:str]
BEARER_TOKEN: ENC[AES256_GCM,data:XF+9oxE8Wnvk5hhg6+Ko/KXzU0wj+IYDKWCXDcSt2BWx3ovp0PCpSPHs2ABjHnr0eUBnQEaz+H8lww9g9FwLtg==,iv:Xfm7cn6VttvErr2Nu7YfK/9vTks8lkFVmC+txwQbAQo=,tag:UWB7iQxPrgFQz+hUxz1F/w==,type:str]
OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:EepkUwFokohrzIEC9zW0QYd/OPGnSQGhGETt6Nxr3fY5lbFm6qmaiTQvo4cjuGWX35nahExjFv+jfOi5nphIOQ==,iv:o9+BgWK0ewFGhcr10wRCgGa3KV3QaK+0SsTIb2I4XQY=,tag:9Q5KgR7oQRnewWMHDzvbXA==,type:str]
OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:UoWs260WtSc4gWQeSEkvwHmjTMos1iyv+efQ8DEeTo5KM1vJsWH0GdD0qMpzCTnfwdSwc991ecqbyNbyREFT3A==,iv:omf9krmPm48fCfuZLtJomfZcQvHowEJrXvjxCbkpJhA=,tag:cRchu0LD/vm5tG+PQL9/DQ==,type:str]
sops:
age:
- recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBha0dlYTdMT1g3QU9WK0w2
U0x6V2xXUlM5dnZFcURBMXJHK3FCSHRXM1JvCk02Wmo4SG1jVFQyRnptNU9kNDlL
UGs1TXlZWUpLY3ZYMkNVWGNrVjQ4ZXcKLS0tIDc2Ti8wWjJXSFZoa1dnYnpmQWgw
Q2UzYnhUVkQxTFhhRVh4OVNsUUo1bEUK1AsCLnLHuLJPMZ/yoltXm4W6KSXnOagH
IfOETfCaG2r0hXEHtc0+HloVpkcNr5RN7DGrkApYgiJXf98JWvxVpA==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBab3JiSjBuVzI0cjhUWW8r
aFg4aFdDTXRYVm8vS3lvc3dUYVg5ejJDcXpJCjl4ODBsL21mR0s0OEZldTlqemFK
NkJ6anN1RzNWaURwWG1xOGNWaHQwOUEKLS0tIHVibS9BdjYvT2wrRjZNV0tWeWl6
RytrN3htaUp4eTJNWWFVWGxMU0UrVUUKljSm2TXErurBrmQRH7FylbzNq5/n9bVi
f50d6VFq9Wq17zAPeBfluHFaWffRCxidIzo8R6evGxHcK2q4wmxa1Q==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-08-26T10:28:59Z"
mac: ENC[AES256_GCM,data:k/8xnBHKJDXviNjhMaX1lMzC5H7ZR0lxt1uBPkhKarAuT6wWcacIuBBGgnBlxc26AGz5lxGDQzW1czoYGAwxfOPPLh3co7ApeuQIFOOXfCbcfxgXTVLd2/XmE+zSmun1IPTGBnJwuUIURWwHhlwMStBsJr0leKAet0v/5u5xi44=,iv:Rvb4mPEc0HuIOVbxSxB3vfsocHK0xw+YXR3XxDzxrws=,tag:Ka1IM0j7mdm3J2o+Vp+Xkg==,type:str]
lastmodified: "2026-08-26T10:29:08Z"
mac: ENC[AES256_GCM,data:zOhut80PaowUwy5UsVYnHwtu+5/iRqBR2j1JZCpzUR/+UoVyYvVf0Uftdk97XzuWiPwf5C4k4YoWse5RdYiE0YiX0JOsMxOhUzmCe1kBrMevEpVyQr66AUpcxF5So5cGPizWXk+y/zvIn1f77ILMg630uuXiQykCf1khMHhQPjE=,iv:SEhWnz6pPkg7s2oHT7lseKH296z9rc69YDdmOuYS4Lo=,tag:omrZHLFOfGWpvn50XfVeEw==,type:str]
encrypted_regex: ^(data|stringData)$
version: 3.11.0
+8 -8
View File
@@ -4,19 +4,19 @@ metadata:
name: mosquitto-passwd
namespace: mqtt
stringData:
passwd: ENC[AES256_GCM,data:N8EbcPc3P2kJnq6jXggjUZb3icGFC3KxCsRY59CObCFIFT7bb9BC66tZ/hmOmjX6l+OLMy9iLDbnNoqVxKrzNsj96noMxf7vZnJFyyVcCv0x+59Tj1N9TAslWgqD9DilUD5fHz7YoCwfR5Z+tMu7YqClJ9KrLgzuhGwjzx6nzAI0tLOBulum7gIbujpN8GV4UkP+kkH2BKk9kuaqY6grL9SpAbGUb/WEU43kYPdnGAbp/Mp6QTZMrMlslfRPdQ==,iv:vyNaeJmVqlkAU2MMkZBiR/vLczXgqQy/773jlf1F9/A=,tag:ILForA3csphw+/tD1bG35A==,type:str]
passwd: ENC[AES256_GCM,data:rkbh0s7+DuQwFnQ9P0fayWgIuDjhxHXdofUiz2bnRFSKvddzPSimoEguch0bBcXaEP+EUEvuoJzeP6NQMNo/Ahm1gSbK4ivG8a6fvttCid53ZR3b0phWseX1TYp7pbGIlSjI7+VAXL7mKqCD+qNkshuJ9xh4ynIyv58XHPol1cjWQR+wcoEqOli2bDC2YvBagZb2ZkXdy752PJMFmSZ4RWZhNkdpMazPSMb1kkwy4pRb68hMqsnPlxCfsS4vlQ==,iv:exlCMexPnl5nhDJoMfWtr5a16VRiVqByPaxNcMEYMws=,tag:JsVasqj+p618WLhaXWTjNw==,type:str]
sops:
age:
- recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJNmJlQzhaWUMrdnRwMy9H
VTEyQ0x4WmIrQm91d2xWQWJFZ1BBWEVHS0ZZClY4NDZmZTNvYnVTUy9kNS9pOXpr
d0pxS3NCKzRNdUhoL1RHTFVyMVhneDgKLS0tIGRwS0QvcVVLKzQ5cGJ3WkRialVG
L1hFbVh5OWNHUkY2eGRpdkJQMWJKMDQKiRJHbpJpzkXwwxfeMX/H6miI0gJWiNY9
NFScjS6+aROu4jrAS+mX/A0P4Ih7oCQdlZ4XLziAcfMMJWnp7bscSw==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUDBHZDJNUzl3UXQ0NlNp
Y25rMllsNU1OVkhTRWozdi83VnZ1Qk9XdHpJCjhFb1hNaWVCeS8zWDl0OEI0TlpI
bXVxZnJvWGlBcnpLYzlYOHNCQUtncHcKLS0tIEEvYmNVdmVSeWQ1V3VoUmphaWho
OXJvUWlDQ0N1ZzRldXo4RTJpZ2hCaXMKP+hQu4P8cXvcPik6N2LTZcC0LTVGH99c
MepCObGr8v+QWxkIUSWY570wBIOU7pV915hm0Oi8Vf/XOBB8yAWe7g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-08-26T10:29:00Z"
mac: ENC[AES256_GCM,data:o6czP8KcoaTI7ZBqlKUNeewJ2lnYqiwbGrrvrOWg6nbrJvv+K83AN2JXzxF7fJ7rg9DlvuohxqltCiFWAL0YIx1xYNsBoqad0Wt1QACXg2phybMgF7iRGvaiuL/OrJhqi05oPmE8xQOM7cwY3GCNlEYLk1fTOm2hIPXg8OlDTlU=,iv:Zu5ofO92oHanbXxeKOZjLhNEsIsXHU1KtCyI9A98arY=,tag:Gx/nJYSP1qpyVNunue7/8Q==,type:str]
lastmodified: "2026-08-26T10:29:09Z"
mac: ENC[AES256_GCM,data:dT3FkCsAdeM4cQ4KL6+3g4QjyZ6LZ5z+uhEj75euMfolxrKDE3u6BguiVuvIIGMXAXJ2ReWnGa96M7cIY5Gjj2Thzu5HGuaQb7MH6FDjuVZ3YY0N7BcUgKqpgL17rYLVrfSP7n8zGPJv7wqFWX0Ia+k7EaaIhBxWiY6WZpniYl4=,iv:MR7Y+MWWjLls8bUEuyIp33xfLEwkKx9KhaN+0Hfmsf4=,tag:EfRkYaWmKmyi9teFVrKwdQ==,type:str]
encrypted_regex: ^(data|stringData)$
version: 3.11.0
@@ -4,20 +4,20 @@ metadata:
name: vaultwarden-secrets
namespace: vaultwarden
stringData:
#ENC[AES256_GCM,data:svXTMBzJkDDyydT//pbl/Er1s7/pR4ojqDprCFROWXh8W77hTVuUonin4NIcTpV7C8U8Tbiu3pHb,iv:1GOqQqoMDYou+jz4L/XxWZsj0L8xYmp58zt8LK+6CLE=,tag:HkkZDaINRz2/u73Aceoldw==,type:comment]
ADMIN_TOKEN: ENC[AES256_GCM,data:vmUpLXjCWKzRXNm4sLcv70Pr6AdDqxu/aZmHavqvgqjB37B7sdyHutAlYxSVjkYCv5nO/Sz9i93kwZAyX3XtnjMBRGUgt2oXYeloytWrVVeViiCl1PowqYo8XJ9NvTmi4qOCYeerhfHcBiILmV2JsSNxKKgd2w==,iv:EFVx/2204/syMYRsoHph7TXwXUUTTgxT5YnOrWtxSJQ=,tag:fF4ZoEmySF718XiqbdYxOw==,type:str]
#ENC[AES256_GCM,data:gvA63cWf5rsD17XYe0AUBBJ1GHtWfD7sM/t2wuMo1DaTGCe+kBcj327CWweQlgXiMliPRE7KVVNi,iv:9pSRahjx6P83SzPlX5aHR+0SiWvTy/KhOAGp0SrriJ8=,tag:7dPIeUsiX6HtKRT7e2UByw==,type:comment]
ADMIN_TOKEN: ENC[AES256_GCM,data:gTjUFWMBSwuu5JJj7SzPQvN292NOvBb6aoYGCV8SkhKwlN6sEk9Gn1ir/yLyId2sKr6818FgsK4etDDNvm6ROm0cjvakZyVia+RlWcdHWZyiA1mh/fNKYIXlCi5ZDFiR8cHc/HVtaCeBgNkWCu5/KLPO8gGDbQ==,iv:otfPPJEOMdk/kwVVHC38LsXHlKUPMZNHY7HWTryylhA=,tag:moNe68G1RjKfMHPifDjk+g==,type:str]
sops:
age:
- recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkdEQ4NEZvNDl1cWYwdTdR
ZmZoTFlEWUFGa0NWTmFCVS9IcDFwVTE4ZndRCmF3WWFpd2cxa0tUWHpRbFptd3Iy
ZVVyenIvdVFRanhPMGZtMzg5Yit1Z3cKLS0tIDRZSlJIaERQbUxKdHVyZk9rZ0oz
SnhYOXp1bk1Ybk10Z2Jrc1NTVjY1OEUKa8sJLT1DFkbtVb6Y2haso8Ll2xXsuV4w
S6GBqS3XNZvLTyCq6ux9YiU3JGRzlGGZExz6gnYA5SRC1rfJI5lXGQ==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1dVdOVVdyd3lGMTNoTUdQ
cmwybGUwcGVBNWxOMEZ0bTR5Tm5HWlhCVTN3Cnk3cS9jOHR3THVvZUg4a0NzK2JD
QTF1VUVIaVNNSlRUSnB2NCtoZ2ltaGsKLS0tIFJaY0g1TDExQXlYZEtjY0t5dzdI
RlBCMjhBc21lTUJMSHlEQ3FaNCs4djgKarACm++dJ558JgOzyIsXdmMIrFgyd0+V
A0J1NIctS1F2+Rl+pdXr8nTkbvrjWYbNanX/tFV6m5abXGJjOOns1A==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-08-26T10:29:00Z"
mac: ENC[AES256_GCM,data:yORhS+6cpYOo/JLorsXGJui+M0UxkseXQrYC5qi79DIul10tTN7p1SdiUGvOR7V+xxA3ODSlNJRReoqKHX6ozCOZ+lenyuP84OxOH9YnwUtVfVbdqyd/YR4LsvjHl5eVSJG9GkpRBd8NwtlawOYc03KmG90Jy0tPJ517C+BSQpY=,iv:uXnil8ZeRwXg0Eu9nECm2mzzGlnw1p6y+115wMrFJzk=,tag:flrAqPDKnL3S79PRdhuu/Q==,type:str]
lastmodified: "2026-08-26T10:29:10Z"
mac: ENC[AES256_GCM,data:9SJsqHgUv1Ukcl559Pf3JB0O3W1EyyuwuUzqZAp8m6u8t5WKk4GXLq83h3aSxhSy4skaJyMdM0+wmSmjfvmSXmoyGyFq7YtgkHop/D6K3Jdww21kp/O14e9j824rnS0rvV4hUWxrn4LMsnBrD+dj1Cad6WpzBDTv+yZjpIH8qvM=,iv:WA/etiAtqbG1AgNPVmGRSjWuJtxjOWgybyUyUaGnBWQ=,tag:2g7f5Pa3Z1pjTyZwvkL10g==,type:str]
encrypted_regex: ^(data|stringData)$
version: 3.11.0
+9 -9
View File
@@ -4,20 +4,20 @@ metadata:
name: webdav-secrets
namespace: webdav
stringData:
WEBDAV_USERNAME: ENC[AES256_GCM,data:e7wBejI=,iv:wz8d1yJ6lKoW0Nopk+2PmfuSqLLGNpM0EQzGzJzfHP0=,tag:CyRvnhTfaM5rcEY+jWfbGQ==,type:str]
WEBDAV_PASSWORD: ENC[AES256_GCM,data:APmQ/yfCz3Imf2c78IvPsvz8+hefd8wTgNUnZfHPE442GUcZGnKWEIOuz8Fu9B6A,iv:eRHxbcQiOOubujVCTnAvM1hi1BqLoELYTl3yrm3zzvI=,tag:oMuQrd8ftO052btTEHJoqQ==,type:str]
WEBDAV_USERNAME: ENC[AES256_GCM,data:om6FSaM=,iv:X/Nw2xVxD19rKbgz2WEmxkzEUip9ig9/ZDDERy/nTKQ=,tag:g0OySPAQu1y6v1s9noSNiQ==,type:str]
WEBDAV_PASSWORD: ENC[AES256_GCM,data:xz7/r6krE//Zcmqjtasl/8trdkibsmDAyljdubgBUgV19NO5ox6B/G02bj/coRcO,iv:VBNCs4dhgVcu6Tyh4guTlt1tkcKt3t6KRyVR4ZWnQeA=,tag:VIup7URYo4Z3xtN5NxKs/Q==,type:str]
sops:
age:
- recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpWTZLOHZ3c2Nkam5xUGJv
MHNLVFRyRjlsL3k0NDJ6UjZ1M29WQzNXb0NNCjNmelJtWUJuWitKMVdrc1VzYkZ5
RHpmQ2trcWR3ZEd3TFcyZm10YnFGV2MKLS0tIDMrWHV6Unhlem1xN09veWtFSm4r
alNLK0pFQ3VadkZOYTI4VUpqR0RtbmcK5LtVgQoo1dnuORCj2FZ2IjN4wlN5CBYw
6/0rE6X48antjDx0o77mSBUb0Q9wqO+3trZOUM7md60ZEV0Ae3G1TA==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPK2dhSGJYYXVVbXBiK0dU
d2s0LzE4c01yR09kUG9qaUltV0ZZZm1WeUVNCjEwY1JMVFJJVVNTd2RJOHZ4amY1
REFmbm1MREtNYjNvenB0SkpaNFBZZU0KLS0tIDlycytoNjlyeU01Ujd5Z3lwVjBD
UWd1eDFIY0gxd21vbW5sS0hzVytwSmMKDQPViYmtN13z3hLLIBbkxM520HfeYkBj
S4JFF0i7PzAV7nKAroK8RebM+7181Ss1oUe32h2ZwNVnNOLdOaEs+A==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-08-26T10:29:01Z"
mac: ENC[AES256_GCM,data:ozjZJR4fOwHPPEZ+w50x1mEVbI9ADn6G1T3o8kTo4psRnSrZCpBYmO+3GD+nOrqLXo9BzHIQWtQygkWGCCO6zkfXChTe4v0nQMraMXtDBwr0x2JXc+BOjn7eeyoRoAz2oWL8RZDBUhttmAIq7MQwW8rwbCvP/J7JrscxUQ55gxs=,iv:VVDVubbt4/7BJappvJjMyaxvAztfnviFDtMbG/4ZWYE=,tag:9YQeNSXNFrmbSgHpMlV7nw==,type:str]
lastmodified: "2026-08-26T10:29:10Z"
mac: ENC[AES256_GCM,data:iL+InzZdnx+KAm7E5Zisjw0QE7HPJ8yWy440E8kNmLCPMRfmPIjd8yC9YLSELsIEUC6gZYP79myLrKUnyCF6u4AO3ayTz7mkc+ISPiHSo/aAvd50FaOXifuj36cZyYKSRU7WBknbzEZSPmAr7Qgo1UcANzN7XS3b2R8g87JoiJQ=,iv:DtmCTZzEKQYafatpU7t1Uu8lV/rEWKNyKSoQRKsKVkc=,tag:mMUAIl4G4rAV109Dk6hToA==,type:str]
encrypted_regex: ^(data|stringData)$
version: 3.11.0
@@ -4,19 +4,19 @@ metadata:
name: zigbee2mqtt-secrets
namespace: zigbee2mqtt
stringData:
secret.yaml: ENC[AES256_GCM,data:jdgmkxB5S8ijMdGRJ2oVMPa3lQFPcxvTV2hMmUidRWpGx5sumseXH+UNtqoXUsmFDykLMa9mBZkDaxl7OBo0aR+xPQnaI4lY5laQJAS75Vi0n2T1aPn2Agg+k5nP1X1ELyUapZrEBQVIOLW4PY8NGLQn5eMPxukRzXqvNgA=,iv:916/21txCuRBJ8HvmMtDfnU3/bAeeY+WwahajLccQD4=,tag:hDoSdJmPNFztzc0NbYn0jQ==,type:str]
secret.yaml: ENC[AES256_GCM,data:Cy7C63Ru/PWnOA09h5d5HOFmQUreOEM31dNYIIAkV2mZ8XN9LFEpBSOx8nPHRznEPalOkzI3hZcJ/8LWm/ezXICgudqd9r8T4E7sotluLMpaMXGmXQ4Xe1H2Y4z1ZtKjMxX52zJmDCc4Jf8o75lPlnFEPYB4LaZH6DQADwE=,iv:opddb32H9cgW5czGzNmgHbKwcEyh5qnRGqWQDRrIV+M=,tag:nWe+gXf6LVo7YFm9s7ccZA==,type:str]
sops:
age:
- recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1MkNsQUd1RTNZSVBoUUdE
NmZhb1kvWjVHWFZnWXZUWUNJVm5yN2NybjBJCm41b2lkME9OOHRCeVBhU0RaS1lv
b0Y4azFmc2xxRDliR2VZTVIzaFNDRmMKLS0tIGhkZlY0a0lhZ3M5WTdaRlE3M2k5
dkJMbXNCUGpFSG5ORHkxTURPaUt3SXcKkZAskAKLeLhAmVbbZmxH8QsThsWWcZww
m8iVdUIEy9R1EvwuIC91ROQwFFWnjuAABJTLxyzDujdun95hRmv9Fg==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSGFRZFA5dkw0MmZrT2lj
VTZIQzZpRm5aWTJ0RnVPTTE1ZFY5ZGlDQ1VRCkcwdFREZjRNbEpwNmo5YTFTN00r
ck9KYWdERDJ5MHZQM0gxaFFpVlc4bkUKLS0tIHZrQ0RWSkl1Vlg5MVl6Ym9sK3Z3
cVFCUllLYml1ZGNIeFY4R21RUy9leDQKVJUn1z+nkizcTkr6RixUTkHTpaEdiDIi
wf310nXdO0bxKTrd/a6YNFr86KV3Y3LaqLTJl11Ewa+QFmLxAOnUqQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-08-26T10:29:02Z"
mac: ENC[AES256_GCM,data:Lc6Go0XC+vgCGwsjDVjr+TcaPM+n0t/yyH3KsZp02oRvWFLJToCK89HqZabSw982X6BorXkC3EQj6mbanJeTDY7yYeWggBEVqUccfUSx1awwtJsmmD1qPlnbsSdIpQhUx7ECfC1CihwXMUl+N0C2jMpHxyFNfV7zkoIL0aQCwL0=,iv:UkZwqzP6d5HqtG2DZcsznGJduhgUCn/RGV+a5vF5QIA=,tag:IzHVHkvv8E8wpEg/GxM86A==,type:str]
lastmodified: "2026-08-26T10:29:11Z"
mac: ENC[AES256_GCM,data:qs61rBjxyl4PalWnpEllBr4DxRRm2CAqxhOs4cAs3O6xokBuZr3bDGsn9ULsX+5AsDNfu6cOqXyuBkCeKnmrZorhEJONP4hmIb96LbGs29Dapk3ICvr99DvKVlObJ5COFp3BqyzZ4quz014njZOxj4H0rMecNuefdCl6jFOZ644=,iv:1NOey4HE8LASOEplPQNlGcM+yrfjnK7BAXidEugRGBE=,tag:u//2XxFn9jjK8AVt89rwBA==,type:str]
encrypted_regex: ^(data|stringData)$
version: 3.11.0