thesabear
b2f308a135
Adds real Vault Agent secret templates and non-secret env vars for all 9 productivity stacks. Sanitized several real leaks: a real residential public IP (ghost's UMAMI_IGNORE_IP), real personal domains/email used across joplin/n8n/ghost/paperless-ngx, and a real embedded OAuth client ID in paperless-ngx's private OIDC config (dropped entirely - the public compose file doesn't wire up OIDC at all, so none of that config was needed). Also dropped n8n secrets referencing the out-of-scope Content Pipeline system (nocodb-content, Postiz), and did not carry over a real Redis password found sitting in plaintext in nextcloud's private .env (unused by the public compose anyway). Every var cross-checked against what its actual public compose file references before writing.
6 lines
457 B
Bash
6 lines
457 B
Bash
DB_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.db_password }}{{ end }}
|
|
SMTP_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.smtp_password }}{{ end }}
|
|
MYSQL_ROOT_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.mysql_root_password }}{{ end }}
|
|
UMAMI_APP_SECRET={{ with secret "kv/host/ghost" }}{{ .Data.data.umami_app_secret }}{{ end }}
|
|
UMAMI_DB_PASSWORD={{ with secret "kv/host/ghost" }}{{ .Data.data.umami_db_password }}{{ end }}
|