version: 1 kind: unidesk-secret-distribution metadata: id: platform-infra-runtime-secrets owner: unidesk relatedIssues: - 297 - 300 - 313 - 2256 - 1964 - 2110 - 2128 - 2263 - 2274 - 2380 - 2541 sources: root: /root/.unidesk/.state/secrets files: - sourceRef: unidesk-host-k8s.env type: env requiredKeys: - UNIDESK_SSH_CLIENT_TOKEN createIfMissing: enabled: false - sourceRef: platform-db/langbot-db.env type: env requiredKeys: - LANGBOT_DB_USER - LANGBOT_DB_PASSWORD - LANGBOT_DB_NAME createIfMissing: enabled: false - sourceRef: platform-db/n8n-db.env type: env requiredKeys: - N8N_DB_USER - N8N_DB_PASSWORD - N8N_DB_NAME createIfMissing: enabled: false - sourceRef: platform-infra/langbot.env type: env requiredKeys: - DATABASE_URL - LANGBOT_JWT_SECRET - LANGBOT_API_KEY createIfMissing: enabled: true randomHex: LANGBOT_JWT_SECRET: 32 randomBase64Url: LANGBOT_API_KEY: bytes: 32 prefix: lbk_ - sourceRef: platform-infra/n8n.env type: env requiredKeys: - DATABASE_URL - N8N_ENCRYPTION_KEY createIfMissing: enabled: true randomBase64Url: N8N_ENCRYPTION_KEY: bytes: 32 prefix: "" - sourceRef: platform-infra/wechat-archive.env type: env requiredKeys: - UNIDESK_WECHAT_ARCHIVE_TOKEN createIfMissing: enabled: true randomBase64Url: UNIDESK_WECHAT_ARCHIVE_TOKEN: bytes: 32 prefix: uwa_ - sourceRef: platform-infra/sub2api.env type: env requiredKeys: - ADMIN_EMAIL - ADMIN_PASSWORD createIfMissing: enabled: false - sourceRef: platform-infra/pk01-frp.env type: env requiredKeys: - FRP_TOKEN createIfMissing: enabled: false - sourceRef: platform-infra/apistate.env type: env requiredKeys: - APISTATE_API_KEY - APISTATE_SESSION_SECRET createIfMissing: enabled: true randomBase64Url: APISTATE_API_KEY: bytes: 32 prefix: ask_ APISTATE_SESSION_SECRET: bytes: 32 prefix: ass_ - sourceRef: platform-infra/pikaoa.env type: env requiredKeys: - DATABASE_URL - OA_ADMIN_TOKEN - PIKAOA_SESSION_SECRET createIfMissing: enabled: true randomBase64Url: OA_ADMIN_TOKEN: bytes: 32 prefix: poa_admin_ PIKAOA_SESSION_SECRET: bytes: 32 prefix: poa_ - sourceRef: platform-infra/pikaoa-attachments-backup.env type: env requiredKeys: - RESTIC_PASSWORD createIfMissing: enabled: true randomBase64Url: RESTIC_PASSWORD: bytes: 32 prefix: poa_restic_ - sourceRef: platform-infra/pikaoa-dev.env type: env requiredKeys: - DATABASE_URL - OA_ADMIN_TOKEN - PIKAOA_SESSION_SECRET createIfMissing: enabled: true randomBase64Url: OA_ADMIN_TOKEN: bytes: 32 prefix: poa_admin_ PIKAOA_SESSION_SECRET: bytes: 32 prefix: poa_ - sourceRef: platform-infra/superapi.env type: env requiredKeys: - DATABASE_URL createIfMissing: enabled: false - sourceRef: platform-infra/superapi-development.env type: env requiredKeys: - DATABASE_URL createIfMissing: enabled: false - sourceRef: hwlab/jd01-v03-opencode.env type: env requiredKeys: - OPENCODE_SERVER_USERNAME - OPENCODE_SERVER_PASSWORD createIfMissing: enabled: true values: OPENCODE_SERVER_USERNAME: opencode randomBase64Url: OPENCODE_SERVER_PASSWORD: bytes: 32 prefix: oc_ - sourceRef: hwlab/nc01-v03-opencode.env type: env requiredKeys: - OPENCODE_SERVER_USERNAME - OPENCODE_SERVER_PASSWORD createIfMissing: enabled: true values: OPENCODE_SERVER_USERNAME: opencode randomBase64Url: OPENCODE_SERVER_PASSWORD: bytes: 32 prefix: oc_ - sourceRef: hwlab/web-probe-monitor-db.env type: env requiredKeys: - DATABASE_URL createIfMissing: enabled: false - sourceRef: hwlab/tasktree-nc01-db.env type: env requiredKeys: - DATABASE_URL createIfMissing: enabled: false externalFiles: - sourceRef: /root/.unidesk/.env/unified-admin-password.txt type: raw-file required: true createIfMissing: enabled: true randomBase64Url: bytes: 24 prefix: admin_ - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt type: raw-file required: true createIfMissing: enabled: true randomBase64Url: bytes: 24 prefix: poa_ - sourceRef: /root/.unidesk/.env/selfmedia-access.env type: env requiredKeys: - SELFMEDIA_ADMIN_USERNAME - SELFMEDIA_API_KEY - SELFMEDIA_SESSION_SECRET createIfMissing: enabled: true values: SELFMEDIA_ADMIN_USERNAME: admin randomBase64Url: SELFMEDIA_API_KEY: bytes: 32 prefix: smk_ SELFMEDIA_SESSION_SECRET: bytes: 32 prefix: sms_ - sourceRef: ~/.env/TOKEN type: raw-file required: true createIfMissing: enabled: true randomBase64Url: bytes: 32 prefix: smt_ - sourceRef: ~/.codex/config.toml.pika type: raw-file required: true createIfMissing: enabled: false - sourceRef: ~/.codex/auth.json.pika type: raw-file required: true createIfMissing: enabled: false targets: - id: platform-infra-g14 route: G14:k3s namespace: platform-infra scope: platform-infra enabled: true - id: sub2rank-nc01 route: NC01:k3s namespace: platform-infra scope: sub2rank enabled: true consumerRollout: deployments: - sub2rank timeoutSeconds: 180 pollIntervalSeconds: 5 - id: sub2rank-development-nc01 route: NC01:k3s namespace: platform-infra-development scope: sub2rank-development enabled: true consumerRollout: deployments: - sub2rank - sub2rank-worker timeoutSeconds: 180 pollIntervalSeconds: 5 - id: hwlab-jd01-v03 route: JD01:k3s namespace: hwlab-v03 scope: hwlab enabled: true - id: hwlab-nc01-v03 route: NC01:k3s namespace: hwlab-v03 scope: hwlab enabled: true - id: hwlab-nc01-production route: NC01:k3s namespace: hwlab-production scope: hwlab enabled: true - id: selfmedia-nc01 route: NC01:k3s namespace: selfmedia scope: selfmedia enabled: true consumerRollout: deployments: - selfmedia timeoutSeconds: 180 pollIntervalSeconds: 5 - id: selfmedia-production-nc01 route: NC01:k3s namespace: selfmedia-production scope: selfmedia-production enabled: true consumerRollout: deployments: - selfmedia-production timeoutSeconds: 180 pollIntervalSeconds: 5 - id: pikaoa-nc01 route: NC01:k3s namespace: pikaoa scope: pikaoa enabled: true consumerRollout: deployments: - pikaoa-api timeoutSeconds: 180 pollIntervalSeconds: 5 - id: pikaoa-dev-nc01 route: NC01:k3s namespace: pikaoa-dev scope: pikaoa-dev enabled: true consumerRollout: deployments: - pikaoa-api timeoutSeconds: 180 pollIntervalSeconds: 5 - id: superapi-development-nc01 route: NC01:k3s namespace: superapi-development scope: superapi-development enabled: true consumerRollout: deployments: - superapi-gateway - superapi-api - superapi-worker - superapi-web timeoutSeconds: 180 pollIntervalSeconds: 5 - id: superapi-production-nc01 route: NC01:k3s namespace: superapi-production scope: superapi-production enabled: true consumerRollout: deployments: - superapi-gateway - superapi-api - superapi-worker - superapi-web timeoutSeconds: 180 pollIntervalSeconds: 5 - id: temporal-nc01 route: NC01:k3s namespace: temporal scope: temporal enabled: true - id: public-edge-delivery-nc01 route: NC01:k3s namespace: devops-infra scope: public-edge-delivery enabled: true kubernetesSecrets: - name: public-edge-trans targetId: public-edge-delivery-nc01 secretName: public-edge-trans type: Opaque data: - sourceRef: unidesk-host-k8s.env sourceKey: UNIDESK_SSH_CLIENT_TOKEN targetKey: UNIDESK_SSH_CLIENT_TOKEN - name: temporal-web-admin targetId: temporal-nc01 secretName: temporal-web-admin type: Opaque data: - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: password - name: pikaoa-attachments-backup targetId: pikaoa-nc01 secretName: pikaoa-attachments-backup type: Opaque data: - sourceRef: platform-infra/pikaoa-attachments-backup.env sourceKey: RESTIC_PASSWORD targetKey: RESTIC_PASSWORD - name: pikaoa-runtime targetId: pikaoa-nc01 secretName: pikaoa-runtime type: Opaque data: - sourceRef: platform-infra/pikaoa.env sourceKey: DATABASE_URL targetKey: DATABASE_URL - sourceRef: platform-infra/pikaoa.env sourceKey: PIKAOA_SESSION_SECRET targetKey: PIKAOA_SESSION_SECRET - sourceRef: platform-infra/pikaoa.env sourceKey: OA_ADMIN_TOKEN targetKey: OA_ADMIN_TOKEN - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt sourceKey: contents targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD - name: pikaoa-dev-runtime targetId: pikaoa-dev-nc01 secretName: pikaoa-dev-runtime type: Opaque data: - sourceRef: platform-infra/pikaoa-dev.env sourceKey: DATABASE_URL targetKey: DATABASE_URL - sourceRef: platform-infra/pikaoa-dev.env sourceKey: PIKAOA_SESSION_SECRET targetKey: PIKAOA_SESSION_SECRET - sourceRef: platform-infra/pikaoa-dev.env sourceKey: OA_ADMIN_TOKEN targetKey: OA_ADMIN_TOKEN - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt sourceKey: contents targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD - name: superapi-development-runtime targetId: superapi-development-nc01 secretName: superapi-development-runtime type: Opaque data: - sourceRef: platform-infra/superapi-development.env sourceKey: DATABASE_URL targetKey: DATABASE_URL - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: ADMIN_PASSWORD - sourceRef: ~/.codex/auth.json.pika sourceKey: contents targetKey: BOOTSTRAP_AUTH_JSON - name: superapi-production-runtime targetId: superapi-production-nc01 secretName: superapi-production-runtime type: Opaque data: - sourceRef: platform-infra/superapi.env sourceKey: DATABASE_URL targetKey: DATABASE_URL - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: ADMIN_PASSWORD - sourceRef: ~/.codex/auth.json.pika sourceKey: contents targetKey: BOOTSTRAP_AUTH_JSON - name: selfmedia-access targetId: selfmedia-nc01 secretName: selfmedia-access type: Opaque data: - sourceRef: /root/.unidesk/.env/selfmedia-access.env sourceKey: SELFMEDIA_ADMIN_USERNAME targetKey: admin-username - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: admin-password - sourceRef: /root/.unidesk/.env/selfmedia-access.env sourceKey: SELFMEDIA_API_KEY targetKey: api-key - sourceRef: /root/.unidesk/.env/selfmedia-access.env sourceKey: SELFMEDIA_SESSION_SECRET targetKey: session-secret - name: selfmedia-runtime targetId: selfmedia-nc01 secretName: selfmedia-runtime type: Opaque data: - sourceRef: ~/.env/TOKEN sourceKey: contents targetKey: TOKEN - name: selfmedia-codex targetId: selfmedia-nc01 secretName: selfmedia-codex type: Opaque data: - sourceRef: ~/.codex/config.toml.pika sourceKey: contents targetKey: config.toml - sourceRef: ~/.codex/auth.json.pika sourceKey: contents targetKey: auth.json - name: selfmedia-production-access targetId: selfmedia-production-nc01 secretName: selfmedia-production-access type: Opaque data: - sourceRef: /root/.unidesk/.env/selfmedia-access.env sourceKey: SELFMEDIA_ADMIN_USERNAME targetKey: admin-username - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: admin-password - sourceRef: /root/.unidesk/.env/selfmedia-access.env sourceKey: SELFMEDIA_API_KEY targetKey: api-key - sourceRef: /root/.unidesk/.env/selfmedia-access.env sourceKey: SELFMEDIA_SESSION_SECRET targetKey: session-secret - name: selfmedia-production-runtime targetId: selfmedia-production-nc01 secretName: selfmedia-production-runtime type: Opaque data: - sourceRef: ~/.env/TOKEN sourceKey: contents targetKey: TOKEN - name: selfmedia-production-codex targetId: selfmedia-production-nc01 secretName: selfmedia-production-codex type: Opaque data: - sourceRef: ~/.codex/config.toml.pika sourceKey: contents targetKey: config.toml - sourceRef: ~/.codex/auth.json.pika sourceKey: contents targetKey: auth.json - name: sub2rank-runtime targetId: sub2rank-nc01 secretName: sub2rank-secrets type: Opaque data: - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: APISTATE_WEB_PASSWORD - sourceRef: platform-infra/apistate.env sourceKey: APISTATE_API_KEY targetKey: APISTATE_API_KEY - sourceRef: platform-infra/apistate.env sourceKey: APISTATE_SESSION_SECRET targetKey: APISTATE_SESSION_SECRET - sourceRef: platform-infra/sub2api.env sourceKey: ADMIN_EMAIL targetKey: SUB2API_ADMIN_EMAIL - sourceRef: platform-infra/sub2api.env sourceKey: ADMIN_PASSWORD targetKey: SUB2API_ADMIN_PASSWORD - sourceRef: platform-infra/pk01-frp.env sourceKey: FRP_TOKEN targetKey: FRP_TOKEN - name: sub2rank-development-runtime targetId: sub2rank-development-nc01 secretName: sub2rank-secrets type: Opaque data: - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: APISTATE_WEB_PASSWORD - sourceRef: platform-infra/apistate.env sourceKey: APISTATE_API_KEY targetKey: APISTATE_API_KEY - sourceRef: platform-infra/apistate.env sourceKey: APISTATE_SESSION_SECRET targetKey: APISTATE_SESSION_SECRET - sourceRef: platform-infra/sub2api.env sourceKey: ADMIN_EMAIL targetKey: SUB2API_ADMIN_EMAIL - sourceRef: platform-infra/sub2api.env sourceKey: ADMIN_PASSWORD targetKey: SUB2API_ADMIN_PASSWORD - sourceRef: platform-infra/pk01-frp.env sourceKey: FRP_TOKEN targetKey: FRP_TOKEN - name: hwlab-web-probe-monitor-db targetId: hwlab-nc01-v03 secretName: hwlab-web-probe-monitor-db type: Opaque data: - sourceRef: hwlab/web-probe-monitor-db.env sourceKey: DATABASE_URL targetKey: DATABASE_URL - name: hwlab-nc01-v03-cloud-api-db targetId: hwlab-nc01-v03 secretName: hwlab-cloud-api-v03-db type: Opaque namespace: hwlab-v03 data: - sourceRef: hwlab/nc01-v03-cloud-api-db.env sourceKey: DATABASE_URL targetKey: database-url - name: hwlab-tasktree-db targetId: hwlab-nc01-v03 secretName: hwlab-tasktree-db type: Opaque namespace: hwlab-v03 data: - sourceRef: hwlab/tasktree-nc01-db.env sourceKey: DATABASE_URL targetKey: database-url - name: hwlab-tasktree-production-db targetId: hwlab-nc01-production secretName: hwlab-tasktree-db type: Opaque namespace: hwlab-production data: - sourceRef: hwlab/tasktree-nc01-db.env sourceKey: DATABASE_URL targetKey: database-url - name: hwlab-nc01-v03-opencode-server-auth targetId: hwlab-nc01-v03 secretName: hwlab-v03-opencode-server-auth type: Opaque data: - sourceRef: hwlab/nc01-v03-opencode.env sourceKey: OPENCODE_SERVER_USERNAME targetKey: username - sourceRef: hwlab/nc01-v03-opencode.env sourceKey: OPENCODE_SERVER_PASSWORD targetKey: password - name: hwlab-nc01-production-opencode-server-auth targetId: hwlab-nc01-production secretName: hwlab-production-opencode-server-auth type: Opaque data: - sourceRef: hwlab/nc01-v03-opencode.env sourceKey: OPENCODE_SERVER_USERNAME targetKey: username - sourceRef: /root/.unidesk/.env/unified-admin-password.txt sourceKey: contents targetKey: password - name: hwlab-jd01-v03-opencode-server-auth targetId: hwlab-jd01-v03 secretName: hwlab-v03-opencode-server-auth type: Opaque data: - sourceRef: hwlab/jd01-v03-opencode.env sourceKey: OPENCODE_SERVER_USERNAME targetKey: username - sourceRef: hwlab/jd01-v03-opencode.env sourceKey: OPENCODE_SERVER_PASSWORD targetKey: password - name: langbot-runtime targetId: platform-infra-g14 secretName: langbot-secrets type: Opaque data: - sourceRef: platform-db/langbot-db.env sourceKey: LANGBOT_DB_PASSWORD targetKey: DATABASE_PASSWORD - sourceRef: platform-infra/langbot.env sourceKey: LANGBOT_JWT_SECRET targetKey: SYSTEM_JWT_SECRET - sourceRef: platform-infra/langbot.env sourceKey: LANGBOT_API_KEY targetKey: LANGBOT_API_KEY - sourceRef: platform-infra/langbot.env sourceKey: DATABASE_URL targetKey: DATABASE_URL - name: n8n-runtime targetId: platform-infra-g14 secretName: n8n-secrets type: Opaque data: - sourceRef: platform-db/n8n-db.env sourceKey: N8N_DB_PASSWORD targetKey: DB_POSTGRESDB_PASSWORD - sourceRef: platform-infra/n8n.env sourceKey: N8N_ENCRYPTION_KEY targetKey: N8N_ENCRYPTION_KEY - sourceRef: platform-infra/n8n.env sourceKey: DATABASE_URL targetKey: DATABASE_URL