settings.yaml

secrets:
  secret/khuedoan/notes/password:
    VALUE:
      type: random
      length: 32 # optional, default 32
  secret/git/deploy:
    admin:
      type: ssh
  secret/platform/cloudflare:
    API_TOKEN:
      type: manual
      description: |
        Enter Cloudflare API token:
        (Generate it from https://dash.cloudflare.com -> Manage account -> Account API tokens)
  secret/forgejo/admin:
    password:
      type: random
  # TODO maybe centralize to Dex
  secret/forgejo/oauth:
    key:
      type: random
    secret:
      type: random
  secret/netamos/forgejo:
    password:
      type: random
  secret/netamos/webhook:
    secret:
      type: random
  secret/netamos/oauth:
    client_secret:
      type: random
  secret/netamos/cookie:
    key:
      type: random
      length: 64
  secret/grafana/oauth:
    client_secret:
      type: random
  secret/kiali/oauth:
    client_secret:
      type: random
  secret/clickhouse/credentials:
    collector_password:
      type: random
    default_password:
      type: random
    grafana_password:
      type: random
    netamos_password:
      type: random
  secret/actualbudget/auth:
    client_secret:
      type: random
  secret/test/example:
    MOCK_API_KEY:
      type: random
  secret/temporal/oauth:
    client_secret:
      type: random
  secret/temporal/postgresql:
    password:
      type: random
  secret/backup/restic:
    password:
      type: manual
      description: |
        Enter the durable restic repository password.
        This must be preserved outside the cluster; changing it makes existing backups unreadable.
  secret/backup/s3:
    bucket:
      type: manual
      description: |
        Enter S3-compatible backup bucket without leading or trailing slashes.
    endpoint:
      type: manual
      description: |
        Enter S3-compatible backup endpoint without a trailing slash.
    access_key_id:
      type: manual
      description: |
        Enter S3-compatible backup access key ID.
    secret_access_key:
      type: manual
      description: |
        Enter S3-compatible backup secret access key.
  secret/dex/auth:
    ADMIN_PASSWORD_HASH:
      type: manual
      description: |
        Enter Dex admin password hash.
        (Generate with: echo mypassword | htpasswd -BinC 10 "" | cut -d: -f2)
    KHUEDOAN_PASSWORD_HASH:
      type: manual
      description: |
        Enter Dex khuedoan password hash.
        (Generate with: echo mypassword | htpasswd -BinC 10 "" | cut -d: -f2)
backups:
  volumes:
    finance-actualbudget-production/actualbudget: {}
    forgejo/gitea-shared-storage:
      mover_security_context:
        runAsGroup: 0
        runAsUser: 0
vendors:
  vendor/charts/clickhouse-operator:
    kind: chart
    ref: oci://ghcr.io/clickhouse/clickhouse-operator-helm
    versions:
      - 0.0.6
  vendor/charts/opentelemetry-collector:
    kind: chart
    repo_url: https://open-telemetry.github.io/opentelemetry-helm-charts
    chart: opentelemetry-collector
    versions:
      - 0.146.0
  vendor/images/clickhouse/clickhouse-operator:
    kind: image
    source: ghcr.io/clickhouse/clickhouse-operator
    versions:
      - v0.0.6
  vendor/charts/app-template:
    kind: chart
    ref: oci://ghcr.io/bjw-s-labs/helm/app-template
    versions:
      - 4.6.0
  vendor/charts/cloudnative-pg:
    kind: chart
    repo_url: https://cloudnative-pg.github.io/charts
    chart: cloudnative-pg
    versions:
      - 0.28.0
  vendor/charts/snapshot-controller:
    kind: chart
    ref: oci://ghcr.io/piraeusdatastore/helm-charts/snapshot-controller
    versions:
      - 5.0.4
  vendor/charts/volsync:
    kind: chart
    repo_url: https://backube.github.io/helm-charts
    chart: volsync
    versions:
      - 0.14.0
  vendor/images/cloudnative-pg/cloudnative-pg:
    kind: image
    source: ghcr.io/cloudnative-pg/cloudnative-pg
    versions:
      - 1.29.0
  vendor/images/cloudnative-pg/postgresql:
    kind: image
    source: ghcr.io/cloudnative-pg/postgresql
    versions:
      - 17.6-system-trixie
  vendor/charts/dex:
    kind: chart
    repo_url: https://charts.dexidp.io
    chart: dex
    versions:
      - 0.23.0
  vendor/charts/temporal:
    kind: chart
    repo_url: https://go.temporal.io/helm-charts
    chart: temporal
    versions:
      - 0.58.0
  vendor/charts/grafana:
    kind: chart
    repo_url: https://grafana-community.github.io/helm-charts
    chart: grafana
    versions:
      - 12.4.0
  vendor/charts/loki:
    kind: chart
    repo_url: https://grafana-community.github.io/helm-charts
    chart: loki
    versions:
      - 17.0.1
  vendor/charts/vector:
    kind: chart
    repo_url: https://helm.vector.dev
    chart: vector
    versions:
      - 0.52.0
  vendor/charts/kube-prometheus-stack:
    kind: chart
    repo_url: https://prometheus-community.github.io/helm-charts
    chart: kube-prometheus-stack
    versions:
      - 85.3.0
  vendor/charts/kiali-server:
    kind: chart
    repo_url: https://kiali.org/helm-charts
    chart: kiali-server
    versions:
      - 2.26.0
  vendor/images/dexidp/dex:
    kind: image
    source: ghcr.io/dexidp/dex
    versions:
      - v2.43.1
  vendor/images/immich-app/immich-server:
    kind: image
    source: ghcr.io/immich-app/immich-server
    versions:
      - v2.6.3