pikasTech-unidesk/config/secrets-distribution.yaml

version: 1
kind: unidesk-secret-distribution

metadata:
  id: platform-infra-runtime-secrets
  owner: unidesk
  relatedIssues:
    - 297
    - 300
    - 313
    - 2256
    - 1964
    - 2110
    - 2128
    - 2263
    - 2274
    - 2380
    - 2541

sources:
  root: /root/.unidesk/.state/secrets
  files:
    - sourceRef: unidesk-host-k8s.env
      type: env
      requiredKeys:
        - UNIDESK_SSH_CLIENT_TOKEN
      createIfMissing:
        enabled: false
    - sourceRef: platform-db/langbot-db.env
      type: env
      requiredKeys:
        - LANGBOT_DB_USER
        - LANGBOT_DB_PASSWORD
        - LANGBOT_DB_NAME
      createIfMissing:
        enabled: false
    - sourceRef: platform-db/n8n-db.env
      type: env
      requiredKeys:
        - N8N_DB_USER
        - N8N_DB_PASSWORD
        - N8N_DB_NAME
      createIfMissing:
        enabled: false
    - sourceRef: platform-infra/langbot.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - LANGBOT_JWT_SECRET
        - LANGBOT_API_KEY
      createIfMissing:
        enabled: true
        randomHex:
          LANGBOT_JWT_SECRET: 32
        randomBase64Url:
          LANGBOT_API_KEY:
            bytes: 32
            prefix: lbk_
    - sourceRef: platform-infra/n8n.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - N8N_ENCRYPTION_KEY
      createIfMissing:
        enabled: true
        randomBase64Url:
          N8N_ENCRYPTION_KEY:
            bytes: 32
            prefix: ""
    - sourceRef: platform-infra/wechat-archive.env
      type: env
      requiredKeys:
        - UNIDESK_WECHAT_ARCHIVE_TOKEN
      createIfMissing:
        enabled: true
        randomBase64Url:
          UNIDESK_WECHAT_ARCHIVE_TOKEN:
            bytes: 32
            prefix: uwa_
    - sourceRef: platform-infra/sub2api.env
      type: env
      requiredKeys:
        - ADMIN_EMAIL
        - ADMIN_PASSWORD
      createIfMissing:
        enabled: false
    - sourceRef: platform-infra/pk01-frp.env
      type: env
      requiredKeys:
        - FRP_TOKEN
      createIfMissing:
        enabled: false
    - sourceRef: platform-infra/apistate.env
      type: env
      requiredKeys:
        - APISTATE_API_KEY
        - APISTATE_SESSION_SECRET
      createIfMissing:
        enabled: true
        randomBase64Url:
          APISTATE_API_KEY:
            bytes: 32
            prefix: ask_
          APISTATE_SESSION_SECRET:
            bytes: 32
            prefix: ass_
    - sourceRef: platform-infra/pikaoa.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - OA_ADMIN_TOKEN
        - PIKAOA_SESSION_SECRET
      createIfMissing:
        enabled: true
        randomBase64Url:
          OA_ADMIN_TOKEN:
            bytes: 32
            prefix: poa_admin_
          PIKAOA_SESSION_SECRET:
            bytes: 32
            prefix: poa_
    - sourceRef: platform-infra/pikaoa-attachments-backup.env
      type: env
      requiredKeys:
        - RESTIC_PASSWORD
      createIfMissing:
        enabled: true
        randomBase64Url:
          RESTIC_PASSWORD:
            bytes: 32
            prefix: poa_restic_
    - sourceRef: platform-infra/pikaoa-dev.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - OA_ADMIN_TOKEN
        - PIKAOA_SESSION_SECRET
      createIfMissing:
        enabled: true
        randomBase64Url:
          OA_ADMIN_TOKEN:
            bytes: 32
            prefix: poa_admin_
          PIKAOA_SESSION_SECRET:
            bytes: 32
            prefix: poa_
    - sourceRef: platform-infra/superapi.env
      type: env
      requiredKeys:
        - DATABASE_URL
      createIfMissing:
        enabled: false
    - sourceRef: platform-infra/superapi-development.env
      type: env
      requiredKeys:
        - DATABASE_URL
      createIfMissing:
        enabled: false
    - sourceRef: hwlab/jd01-v03-opencode.env
      type: env
      requiredKeys:
        - OPENCODE_SERVER_USERNAME
        - OPENCODE_SERVER_PASSWORD
      createIfMissing:
        enabled: true
        values:
          OPENCODE_SERVER_USERNAME: opencode
        randomBase64Url:
          OPENCODE_SERVER_PASSWORD:
            bytes: 32
            prefix: oc_
    - sourceRef: hwlab/nc01-v03-opencode.env
      type: env
      requiredKeys:
        - OPENCODE_SERVER_USERNAME
        - OPENCODE_SERVER_PASSWORD
      createIfMissing:
        enabled: true
        values:
          OPENCODE_SERVER_USERNAME: opencode
        randomBase64Url:
          OPENCODE_SERVER_PASSWORD:
            bytes: 32
            prefix: oc_
    - sourceRef: hwlab/web-probe-monitor-db.env
      type: env
      requiredKeys:
        - DATABASE_URL
      createIfMissing:
        enabled: false
    - sourceRef: hwlab/tasktree-nc01-db.env
      type: env
      requiredKeys:
        - DATABASE_URL
      createIfMissing:
        enabled: false
  externalFiles:
    - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
      type: raw-file
      required: true
      createIfMissing:
        enabled: true
        randomBase64Url:
          bytes: 24
          prefix: admin_
    - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
      type: raw-file
      required: true
      createIfMissing:
        enabled: true
        randomBase64Url:
          bytes: 24
          prefix: poa_
    - sourceRef: /root/.unidesk/.env/selfmedia-access.env
      type: env
      requiredKeys:
        - SELFMEDIA_ADMIN_USERNAME
        - SELFMEDIA_API_KEY
        - SELFMEDIA_SESSION_SECRET
      createIfMissing:
        enabled: true
        values:
          SELFMEDIA_ADMIN_USERNAME: admin
        randomBase64Url:
          SELFMEDIA_API_KEY:
            bytes: 32
            prefix: smk_
          SELFMEDIA_SESSION_SECRET:
            bytes: 32
            prefix: sms_
    - sourceRef: ~/.env/TOKEN
      type: raw-file
      required: true
      createIfMissing:
        enabled: true
        randomBase64Url:
          bytes: 32
          prefix: smt_
    - sourceRef: ~/.codex/config.toml.pika
      type: raw-file
      required: true
      createIfMissing:
        enabled: false
    - sourceRef: ~/.codex/auth.json.pika
      type: raw-file
      required: true
      createIfMissing:
        enabled: false

targets:
  - id: platform-infra-g14
    route: G14:k3s
    namespace: platform-infra
    scope: platform-infra
    enabled: true
  - id: sub2rank-nc01
    route: NC01:k3s
    namespace: platform-infra
    scope: sub2rank
    enabled: true
    consumerRollout:
      deployments:
        - sub2rank
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: sub2rank-development-nc01
    route: NC01:k3s
    namespace: platform-infra-development
    scope: sub2rank-development
    enabled: true
    consumerRollout:
      deployments:
        - sub2rank
        - sub2rank-worker
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: hwlab-jd01-v03
    route: JD01:k3s
    namespace: hwlab-v03
    scope: hwlab
    enabled: true
  - id: hwlab-nc01-v03
    route: NC01:k3s
    namespace: hwlab-v03
    scope: hwlab
    enabled: true
  - id: hwlab-nc01-production
    route: NC01:k3s
    namespace: hwlab-production
    scope: hwlab
    enabled: true
  - id: selfmedia-nc01
    route: NC01:k3s
    namespace: selfmedia
    scope: selfmedia
    enabled: true
    consumerRollout:
      deployments:
        - selfmedia
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: selfmedia-production-nc01
    route: NC01:k3s
    namespace: selfmedia-production
    scope: selfmedia-production
    enabled: true
    consumerRollout:
      deployments:
        - selfmedia-production
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: pikaoa-nc01
    route: NC01:k3s
    namespace: pikaoa
    scope: pikaoa
    enabled: true
    consumerRollout:
      deployments:
        - pikaoa-api
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: pikaoa-dev-nc01
    route: NC01:k3s
    namespace: pikaoa-dev
    scope: pikaoa-dev
    enabled: true
    consumerRollout:
      deployments:
        - pikaoa-api
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: superapi-development-nc01
    route: NC01:k3s
    namespace: superapi-development
    scope: superapi-development
    enabled: true
    consumerRollout:
      deployments:
        - superapi-gateway
        - superapi-api
        - superapi-worker
        - superapi-web
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: superapi-production-nc01
    route: NC01:k3s
    namespace: superapi-production
    scope: superapi-production
    enabled: true
    consumerRollout:
      deployments:
        - superapi-gateway
        - superapi-api
        - superapi-worker
        - superapi-web
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: temporal-nc01
    route: NC01:k3s
    namespace: temporal
    scope: temporal
    enabled: true
  - id: public-edge-delivery-nc01
    route: NC01:k3s
    namespace: devops-infra
    scope: public-edge-delivery
    enabled: true

kubernetesSecrets:
  - name: public-edge-trans
    targetId: public-edge-delivery-nc01
    secretName: public-edge-trans
    type: Opaque
    data:
      - sourceRef: unidesk-host-k8s.env
        sourceKey: UNIDESK_SSH_CLIENT_TOKEN
        targetKey: UNIDESK_SSH_CLIENT_TOKEN
  - name: temporal-web-admin
    targetId: temporal-nc01
    secretName: temporal-web-admin
    type: Opaque
    data:
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: password
  - name: pikaoa-attachments-backup
    targetId: pikaoa-nc01
    secretName: pikaoa-attachments-backup
    type: Opaque
    data:
      - sourceRef: platform-infra/pikaoa-attachments-backup.env
        sourceKey: RESTIC_PASSWORD
        targetKey: RESTIC_PASSWORD
  - name: pikaoa-runtime
    targetId: pikaoa-nc01
    secretName: pikaoa-runtime
    type: Opaque
    data:
      - sourceRef: platform-infra/pikaoa.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
      - sourceRef: platform-infra/pikaoa.env
        sourceKey: PIKAOA_SESSION_SECRET
        targetKey: PIKAOA_SESSION_SECRET
      - sourceRef: platform-infra/pikaoa.env
        sourceKey: OA_ADMIN_TOKEN
        targetKey: OA_ADMIN_TOKEN
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD
      - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
  - name: pikaoa-dev-runtime
    targetId: pikaoa-dev-nc01
    secretName: pikaoa-dev-runtime
    type: Opaque
    data:
      - sourceRef: platform-infra/pikaoa-dev.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
      - sourceRef: platform-infra/pikaoa-dev.env
        sourceKey: PIKAOA_SESSION_SECRET
        targetKey: PIKAOA_SESSION_SECRET
      - sourceRef: platform-infra/pikaoa-dev.env
        sourceKey: OA_ADMIN_TOKEN
        targetKey: OA_ADMIN_TOKEN
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD
      - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
  - name: superapi-development-runtime
    targetId: superapi-development-nc01
    secretName: superapi-development-runtime
    type: Opaque
    data:
      - sourceRef: platform-infra/superapi-development.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: ADMIN_PASSWORD
      - sourceRef: ~/.codex/auth.json.pika
        sourceKey: contents
        targetKey: BOOTSTRAP_AUTH_JSON
  - name: superapi-production-runtime
    targetId: superapi-production-nc01
    secretName: superapi-production-runtime
    type: Opaque
    data:
      - sourceRef: platform-infra/superapi.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: ADMIN_PASSWORD
      - sourceRef: ~/.codex/auth.json.pika
        sourceKey: contents
        targetKey: BOOTSTRAP_AUTH_JSON
  - name: selfmedia-access
    targetId: selfmedia-nc01
    secretName: selfmedia-access
    type: Opaque
    data:
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_ADMIN_USERNAME
        targetKey: admin-username
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: admin-password
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_API_KEY
        targetKey: api-key
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_SESSION_SECRET
        targetKey: session-secret
  - name: selfmedia-runtime
    targetId: selfmedia-nc01
    secretName: selfmedia-runtime
    type: Opaque
    data:
      - sourceRef: ~/.env/TOKEN
        sourceKey: contents
        targetKey: TOKEN
  - name: selfmedia-codex
    targetId: selfmedia-nc01
    secretName: selfmedia-codex
    type: Opaque
    data:
      - sourceRef: ~/.codex/config.toml.pika
        sourceKey: contents
        targetKey: config.toml
      - sourceRef: ~/.codex/auth.json.pika
        sourceKey: contents
        targetKey: auth.json
  - name: selfmedia-production-access
    targetId: selfmedia-production-nc01
    secretName: selfmedia-production-access
    type: Opaque
    data:
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_ADMIN_USERNAME
        targetKey: admin-username
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: admin-password
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_API_KEY
        targetKey: api-key
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_SESSION_SECRET
        targetKey: session-secret
  - name: selfmedia-production-runtime
    targetId: selfmedia-production-nc01
    secretName: selfmedia-production-runtime
    type: Opaque
    data:
      - sourceRef: ~/.env/TOKEN
        sourceKey: contents
        targetKey: TOKEN
  - name: selfmedia-production-codex
    targetId: selfmedia-production-nc01
    secretName: selfmedia-production-codex
    type: Opaque
    data:
      - sourceRef: ~/.codex/config.toml.pika
        sourceKey: contents
        targetKey: config.toml
      - sourceRef: ~/.codex/auth.json.pika
        sourceKey: contents
        targetKey: auth.json
  - name: sub2rank-runtime
    targetId: sub2rank-nc01
    secretName: sub2rank-secrets
    type: Opaque
    data:
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: APISTATE_WEB_PASSWORD
      - sourceRef: platform-infra/apistate.env
        sourceKey: APISTATE_API_KEY
        targetKey: APISTATE_API_KEY
      - sourceRef: platform-infra/apistate.env
        sourceKey: APISTATE_SESSION_SECRET
        targetKey: APISTATE_SESSION_SECRET
      - sourceRef: platform-infra/sub2api.env
        sourceKey: ADMIN_EMAIL
        targetKey: SUB2API_ADMIN_EMAIL
      - sourceRef: platform-infra/sub2api.env
        sourceKey: ADMIN_PASSWORD
        targetKey: SUB2API_ADMIN_PASSWORD
      - sourceRef: platform-infra/pk01-frp.env
        sourceKey: FRP_TOKEN
        targetKey: FRP_TOKEN
  - name: sub2rank-development-runtime
    targetId: sub2rank-development-nc01
    secretName: sub2rank-secrets
    type: Opaque
    data:
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: APISTATE_WEB_PASSWORD
      - sourceRef: platform-infra/apistate.env
        sourceKey: APISTATE_API_KEY
        targetKey: APISTATE_API_KEY
      - sourceRef: platform-infra/apistate.env
        sourceKey: APISTATE_SESSION_SECRET
        targetKey: APISTATE_SESSION_SECRET
      - sourceRef: platform-infra/sub2api.env
        sourceKey: ADMIN_EMAIL
        targetKey: SUB2API_ADMIN_EMAIL
      - sourceRef: platform-infra/sub2api.env
        sourceKey: ADMIN_PASSWORD
        targetKey: SUB2API_ADMIN_PASSWORD
      - sourceRef: platform-infra/pk01-frp.env
        sourceKey: FRP_TOKEN
        targetKey: FRP_TOKEN
  - name: hwlab-web-probe-monitor-db
    targetId: hwlab-nc01-v03
    secretName: hwlab-web-probe-monitor-db
    type: Opaque
    data:
      - sourceRef: hwlab/web-probe-monitor-db.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
  - name: hwlab-nc01-v03-cloud-api-db
    targetId: hwlab-nc01-v03
    secretName: hwlab-cloud-api-v03-db
    type: Opaque
    namespace: hwlab-v03
    data:
      - sourceRef: hwlab/nc01-v03-cloud-api-db.env
        sourceKey: DATABASE_URL
        targetKey: database-url
  - name: hwlab-tasktree-db
    targetId: hwlab-nc01-v03
    secretName: hwlab-tasktree-db
    type: Opaque
    namespace: hwlab-v03
    data:
      - sourceRef: hwlab/tasktree-nc01-db.env
        sourceKey: DATABASE_URL
        targetKey: database-url
  - name: hwlab-tasktree-production-db
    targetId: hwlab-nc01-production
    secretName: hwlab-tasktree-db
    type: Opaque
    namespace: hwlab-production
    data:
      - sourceRef: hwlab/tasktree-nc01-db.env
        sourceKey: DATABASE_URL
        targetKey: database-url
  - name: hwlab-nc01-v03-opencode-server-auth
    targetId: hwlab-nc01-v03
    secretName: hwlab-v03-opencode-server-auth
    type: Opaque
    data:
      - sourceRef: hwlab/nc01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_USERNAME
        targetKey: username
      - sourceRef: hwlab/nc01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_PASSWORD
        targetKey: password
  - name: hwlab-nc01-production-opencode-server-auth
    targetId: hwlab-nc01-production
    secretName: hwlab-production-opencode-server-auth
    type: Opaque
    data:
      - sourceRef: hwlab/nc01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_USERNAME
        targetKey: username
      - sourceRef: /root/.unidesk/.env/unified-admin-password.txt
        sourceKey: contents
        targetKey: password
  - name: hwlab-jd01-v03-opencode-server-auth
    targetId: hwlab-jd01-v03
    secretName: hwlab-v03-opencode-server-auth
    type: Opaque
    data:
      - sourceRef: hwlab/jd01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_USERNAME
        targetKey: username
      - sourceRef: hwlab/jd01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_PASSWORD
        targetKey: password
  - name: langbot-runtime
    targetId: platform-infra-g14
    secretName: langbot-secrets
    type: Opaque
    data:
      - sourceRef: platform-db/langbot-db.env
        sourceKey: LANGBOT_DB_PASSWORD
        targetKey: DATABASE_PASSWORD
      - sourceRef: platform-infra/langbot.env
        sourceKey: LANGBOT_JWT_SECRET
        targetKey: SYSTEM_JWT_SECRET
      - sourceRef: platform-infra/langbot.env
        sourceKey: LANGBOT_API_KEY
        targetKey: LANGBOT_API_KEY
      - sourceRef: platform-infra/langbot.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
  - name: n8n-runtime
    targetId: platform-infra-g14
    secretName: n8n-secrets
    type: Opaque
    data:
      - sourceRef: platform-db/n8n-db.env
        sourceKey: N8N_DB_PASSWORD
        targetKey: DB_POSTGRESDB_PASSWORD
      - sourceRef: platform-infra/n8n.env
        sourceKey: N8N_ENCRYPTION_KEY
        targetKey: N8N_ENCRYPTION_KEY
      - sourceRef: platform-infra/n8n.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL