From cf5f216f8b67d331c14390313b7c150575faa91e Mon Sep 17 00:00:00 2001 From: mdimonte-dinum Date: Wed, 19 Aug 2026 15:06:16 +0200 Subject: [PATCH 1/4] chore: add a .sops.yaml file with everyone's keys --- .sops.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .sops.yaml diff --git a/.sops.yaml b/.sops.yaml new file mode 100644 index 0000000..32039e8 --- /dev/null +++ b/.sops.yaml @@ -0,0 +1,25 @@ +creation_rules: + - path_regex: (environments/prd/.*) + key_groups: + - age: + - age18hnsrz7twfcecjgzu97gs6pcs5xe3vg3swfwz827833yx2qs6stsjer0aq # Mickael + - age1uhrgt2qzj4cj267xs9ff63yqdgqvtrz0szzwwr9c7m6glcst559qxh93kq # Alexandre + - age1wmt8s7nq7aut66npp7j9rysl7uszt6n7z8cm7q2fsxmext8pldus4nlh8a # Kevin + - age14slkhgu3zqjg3ljp8fre77ru9m83jd678nppdqfpkgpdr9en7etsl3ywr9 # Steven + - age1vtajxluy46cfx343e0kwssvrndu8sk2c3p5j8zmwzcg4j0f8rvnsv8l3ef # Erwan + - age1z2nhhjvvx708f86cdxmxn6j7waljdt2835vtv7lehy3q4tpttaxsvhyhuk # Oscar + - age1qa8rxew3h5txw5hshn099fa3r8h8ds27fr4pfsn45ya3ajnu2upqwfzaa4 # Loic + - age1taj6c5y8fep076sxzn0wyqxwwy8xfkgca2pswvsqmk9gx3p7psrqf77xn5 # Florian + - age1nef2pmuzen5zrgd5k2ek5tvtch43l22dektr5a274kyq5ts0yggs5e0xk6 # CI Argo prd + + - key_groups: + - age: + - age18hnsrz7twfcecjgzu97gs6pcs5xe3vg3swfwz827833yx2qs6stsjer0aq # Mickael + - age1uhrgt2qzj4cj267xs9ff63yqdgqvtrz0szzwwr9c7m6glcst559qxh93kq # Alexandre + - age1wmt8s7nq7aut66npp7j9rysl7uszt6n7z8cm7q2fsxmext8pldus4nlh8a # Kevin + - age14slkhgu3zqjg3ljp8fre77ru9m83jd678nppdqfpkgpdr9en7etsl3ywr9 # Steven + - age1vtajxluy46cfx343e0kwssvrndu8sk2c3p5j8zmwzcg4j0f8rvnsv8l3ef # Erwan + - age1z2nhhjvvx708f86cdxmxn6j7waljdt2835vtv7lehy3q4tpttaxsvhyhuk # Oscar + - age1qa8rxew3h5txw5hshn099fa3r8h8ds27fr4pfsn45ya3ajnu2upqwfzaa4 # Loic + - age1taj6c5y8fep076sxzn0wyqxwwy8xfkgca2pswvsqmk9gx3p7psrqf77xn5 # Florian + - age1xvckqrat9q6lfh24ax6y65qzde6krm4a2s0uc83ursr7gas8eavswf5kpl # CI Argo dev From f93d9fed123e2413298e242bb6bbd0db20851cf3 Mon Sep 17 00:00:00 2001 From: mdimonte-dinum Date: Wed, 19 Aug 2026 17:05:17 +0200 Subject: [PATCH 2/4] feat: init appli --- environments/poc/secrets.enc.yaml | 100 +++++++++++++++++++++++++++++ environments/poc/values.yaml | 101 ++++++++++++++++++++++++++++++ helmfile.yaml.gotmpl | 20 ++++++ 3 files changed, 221 insertions(+) create mode 100644 environments/poc/secrets.enc.yaml create mode 100644 environments/poc/values.yaml create mode 100644 helmfile.yaml.gotmpl diff --git a/environments/poc/secrets.enc.yaml b/environments/poc/secrets.enc.yaml new file mode 100644 index 0000000..807738e --- /dev/null +++ b/environments/poc/secrets.enc.yaml @@ -0,0 +1,100 @@ +s3: + auth: + accessKeyId: ENC[AES256_GCM,data:1gmrCVvQLBOYm8oU0fDz/NeGD0h5/D2bpQBMSK7/o2o=,iv:GcscH30c/jwu/9u+gaMgmPUqBiyePRdW/5W8Gof+9/o=,tag:DFF/KaE46V99W+SO9+5KGQ==,type:str] + secretAccessKey: ENC[AES256_GCM,data:WqJjCn10MvTnAXLCbzM9Huv5aj7BqTYC3YxhJVo3Whc=,iv:48cn5k75iSbbq93W+e/zdpIbubJHZRXbq9qpQF11J/Q=,tag:xCBgx0BNAx4jWtCpRPKZMA==,type:str] +sops: + age: + - recipient: age1wg6z592fc3l6u8gceyqptqyy8l4eg76yq5987ffj8wn6hur0v39qdvvkd0 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4WUhERFVNdnkyckEzTDA0 + SWkxdHprZEp4VHdLN3k1dzgwdm1Mc2tmWXc4CjA4YjdUdjNXQ3lFbnpLM3M3Y0o2 + U1RHYVFCdzhtcWVVRXJSVEtsQllYN1kKLS0tIHoxckhLV0V0aURYRFp4RFdEVUgr + elh3MFFCQWl3eFFTN0hVSnd4S2hoM2sKL1B7PyfTs6feaLP3A4Qf0CWnYSN4Wiq/ + WvouHoQfwkJdqmYypjcAyW42vtcyRhWEncsgRs0DWXyqcKopM0H4Nw== + -----END AGE ENCRYPTED FILE----- + - recipient: age18hnsrz7twfcecjgzu97gs6pcs5xe3vg3swfwz827833yx2qs6stsjer0aq + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByc2Z1RS91czVGV3ptSHRZ + SVlaa0tvMEJHeGFEczlmOXcrTks4c1M2eHlrCjMyOGg1R0dnTVFBTS9iYWlrMUk3 + TXZFY2ZIQytCRlBZQ0hlYUIvc0NSRkEKLS0tIDAzQ1dIazdDMk5YcWtSZFBEdjVW + T0pmaytxRXVlcnZXajBqYld2TGlwK28Ke43EzrL7zBSwrfzjDE+oNmo0JEbbDVmS + 3KZYYDYM6VDLxO0lKKyqmC8Yx9EVFUw1UuOQh9SWvcGOK7ld4xEPBQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1uhrgt2qzj4cj267xs9ff63yqdgqvtrz0szzwwr9c7m6glcst559qxh93kq + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WUw5YUVLU2h2Y2lEUkE3 + TVNScjFwTnAxVExrNXBKRzdTL0xrT1l5bjBnCjkxSmM5cWpHWE1NQmZ6TjVUazRF + U2swbWw2OW1DaVE3WFFsZldSOGRXK0kKLS0tIEhKNXpkc2huMi9DMmxWU1RnSmhp + Q29tYllyYlhvSDZRVDlDMXpsK2dMVDgKHNxbAUWscCS7iIeD/dyRimteWg/9QPba + 5xHx+Fn3/yozmavJAx+acRwdP6FeXnPbfWjMGUTb6SXS0G6uEFURvg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1wmt8s7nq7aut66npp7j9rysl7uszt6n7z8cm7q2fsxmext8pldus4nlh8a + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNeWJYdFNSZkx2MGhSUUxQ + ZmxDSW5RNmxCRGZQa1hlQlMwNHQ2WUs3eFhJClZJc0tEVHYyeVcrT2JrbStrVzIv + UVdRRFZaTlhWc1RUZkE1V01CT3c3MW8KLS0tIFRVQy8zRFBWMnVMZ2I2WHI1M1p4 + WUxDK0xRa2FlYXRGMklzR2V2QnMwbm8K3kXv0a9H/HWEVFCSB0uzsGWJAio3S6bU + dHWvo0qS4oL5yT4OQKz/OkyAUfMnz32jINe6FJihGsyQc/yb4YsrXQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age14slkhgu3zqjg3ljp8fre77ru9m83jd678nppdqfpkgpdr9en7etsl3ywr9 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2U1hoSFBOOEp4anVwYmh1 + TzdQWVJjM1JhbGRlUng0bnV1TnE2aXUra21RCjVWYUlWY0RFUWxLZDJpSk9aQ2Ur + VUJzbE1yM1AwMm4ybmtKMzhBWk9oZW8KLS0tIFZjdnVrK0ZxdUY5Rld6bzZJeWk2 + aE1BSkpXeHFFejNtQW5neThSejk1dkEKfr5AMzx6gdsCd4ZZlTQEnI0fskbaGvdx + OKmfk8kRvUr7vxJ2H8euyCUZBR5R71FaPYd0u4BH9AwQ79A50a78dQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1vtajxluy46cfx343e0kwssvrndu8sk2c3p5j8zmwzcg4j0f8rvnsv8l3ef + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6Szk4c2hpOXJHTXEydzhn + UlBUZjlVOG9zVEx0a3p4cUdoWHFuQ3dKZEhzCjFoSXoraVNWMHVveldDSXFZcmRr + c3Z4Z2UwM2VIVnFqcXNxMk9CRk9nZU0KLS0tIDlOUkJhYVppeGpEcUtSd2lrNVo2 + blN5d0Voc2FtMGZFem9KTjUwdWNOS0UKSdgEFil5QUss+NijaZYng1VR4IthZPSn + h33UvGS+nT1UMBLk5MJKi+a/L/k7eWNXZfcBXw6RmT6Cs+5mLXLHaw== + -----END AGE ENCRYPTED FILE----- + - recipient: age1z2nhhjvvx708f86cdxmxn6j7waljdt2835vtv7lehy3q4tpttaxsvhyhuk + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5TzZ3U3g0cGdkYVp5R2tT + L09JaGZMZXJiSHdIeUNYRmNwUHFLeFE2cHhZCjZYUVR6Sk9TMmpIdlBrNEV2d3JR + ZDZaS0Vub0syTjVrY1dKakRkMnhSdVkKLS0tIHpUMDFtV1lQOEZTS3RUd2VlamZX + S3ZsU0NVZkxGRThybnVMYzdWSFJ1RTQKvZaV8eQ7zMJvCFlTLY2jkz4Jk/vBC5b3 + 8wJPHdaNybnOIY2QoVoUGJfwHN/Qj3VhaOcTjy0hx4DORKiaUVOCQg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1qa8rxew3h5txw5hshn099fa3r8h8ds27fr4pfsn45ya3ajnu2upqwfzaa4 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudzVPUWZVa1N2WW15SUZv + RUZ6ZzNkcnR1bmVUMWs5dDRTN1R2djdQTkVNCjNmaVA5QjBJQTQ1MlZFdnZETDM1 + VzBKT3JHWUc2YmJIaGwzYThKbkpBNXcKLS0tIElNdjBndi9ON0ZjS0dJOUNSRXVl + WnVrUWNoRHVWYk4wRlZ2NGozUTkwdlEK2n2MbiEr/MDMru1PX4ZtQd+yPRQ6Lb9u + WppiRQmNqh2x+zW/ka3enXTQ8lnrK6+YFxHpPm1PzzOM5lKIwnU0TA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1taj6c5y8fep076sxzn0wyqxwwy8xfkgca2pswvsqmk9gx3p7psrqf77xn5 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrV0JWS3BuempDOEpZNXFi + Slh0K1A0dFI2QlB0ZnhocUNMV1JNa3I3a1dVClZ1ZG5ZbDFhWVhwR1Y5TU8xRzFE + RXZua3Q0bnJ0d25iSDMyUEFwaklMVDgKLS0tIHUxL1ZMN0xqT1lEdDFUUlZGRTV5 + ajRxMmFqZDk1cWlhU3hpQlNOZE9XU0kKJ3EsHo3maDaKkMXRCidnJlxYiEAwbYqw + 7TjJ0W9SF30KOtaItmucgsrA4nZ5wkmReMak3kBqYD7NROz3hn8nUA== + -----END AGE ENCRYPTED FILE----- + - recipient: age1xvckqrat9q6lfh24ax6y65qzde6krm4a2s0uc83ursr7gas8eavswf5kpl + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZ3pNZDkvaDR3cGVEcGt5 + aWN5Q1NEUk1QejNOMktyWGpVZFVkTkwwNUc4CnR0RFBSRERCd0ZpdzN1VFRSVDZq + YXNXS1lUOStwN2hRcTdZSUl0WUk5Z2MKLS0tIE5LOFdqa0xLb1d4T1pGVWQ0bEVG + RGFhS1UzT3FxVERwdm5QQXdoS2N1WU0KtGk2AlToWgQc2KCVPewSF8x7J0qTvQsr + AgaoZwTYAhgerdhOnZusIDeMA/IQKu2tK9YE6t6psHnzpMbsdqbDnA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-08-18T19:38:04Z" + mac: ENC[AES256_GCM,data:LeSipry+Nd0AV2cXRq9P9ldtf2OXZAm5GvjfCMQPBONnlw4DkMraK1RDZyQKJoA/zmRD+IpqC3glsyU7rnfWZImdgd5/MKNR78iJnrwnAm6k3MWoAt+/NEXqfylT2Sks0NWUwTgSyk5EHv2ZtYKPIr3ODwlmjFrrzAC8YXQKzKM=,iv:XeWXtKseMReXXkDNuTtNQAG7Jo4pkSyiTcSloRZ5Dac=,tag:OeBodX+EVYC6bYf3F8h+sw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.10.2 diff --git a/environments/poc/values.yaml b/environments/poc/values.yaml new file mode 100644 index 0000000..8f2559f --- /dev/null +++ b/environments/poc/values.yaml @@ -0,0 +1,101 @@ +# see https://github.com/opf/helm-charts/blob/main/charts/openproject/values.yaml + +global: + imagePullSecrets: + - regcred-opicloud + +dbInit: + image: + imagePullPolicy: "IfNotPresent" + +ingress: + enabled: true + ingressClassName: nginx + annotations: + cert-manager.io/cluster-issuer: letsencrypt-staging + host: "openproject-poc.dev.opicloud.fr" + tls: + enabled: true + secretName: "openproject-poc-dev-opicloud-fr-tls" + +image: + registry: "docker.io" + repository: "openproject/openproject" + imagePullPolicy: "IfNotPresent" + tag: "17.7.2-slim" + +hocuspocus: + image: + imagePullPolicy: "IfNotPresent" + +openproject: + https: true + hsts: true + + admin_user: + password: "admin" + password_reset: "true" + name: "OpenProject Admin" + mail: "admin@example.net" + + useTmpVolumes: false + +persistence: + enabled: false + +postgresql: + bundled: true + +s3: + # S3 is required for attachment storage when storageClass does not + # support ReadWriteMany + enabled: true + + region: eu-west-par + bucketName: openproject-poc + + endpoint: https://s3.eu-west-par.io.cloud.ovh.net/ + host: s3.eu-west-par.io.cloud.ovh.net + port: 443 + pathStyle: true + signatureVersion: 4 + enableSignatureV4Streaming: false + + directUploads: false + +autoscaling: + enabled: true + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 70 + +metrics: + enabled: true + + ## Metrics endpoint path + # + path: "/metrics" + + ## Metrics port (added to service) + # + port: 9394 + + ## ServiceMonitor configuration for Prometheus Operator + # + serviceMonitor: + enabled: true + +## Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). +## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 +## +resourcesPreset: ~ +## Configure resource requests and limits. +## +## http://kubernetes.io/docs/user-guide/compute-resources/ +# +resources: + requests: + memory: "512Mi" + cpu: "250m" + limits: + memory: "4Gi" diff --git a/helmfile.yaml.gotmpl b/helmfile.yaml.gotmpl new file mode 100644 index 0000000..55a54a9 --- /dev/null +++ b/helmfile.yaml.gotmpl @@ -0,0 +1,20 @@ +environments: + {{ .Environment.Name }}: + values: [] + +--- +repositories: +- name: openproject + url: https://charts.openproject.org + +releases: + - name: opr-poc + namespace: opr-poc + chart: openproject/openproject + version: 13.10.2 + installed: true + createNamespace: false + values: + - environments/{{ .Environment.Name }}/values.yaml + secrets: + - environments/{{ .Environment.Name }}/secrets.enc.yaml From a742fb5f3f14bd499764283d26aa4c292b821713 Mon Sep 17 00:00:00 2001 From: mdimonte-dinum Date: Fri, 21 Aug 2026 16:53:16 +0200 Subject: [PATCH 3/4] feat: adjust helm chart values file --- environments/poc/values.yaml | 150 ++++++++++++++++++++++++++--------- 1 file changed, 111 insertions(+), 39 deletions(-) diff --git a/environments/poc/values.yaml b/environments/poc/values.yaml index 8f2559f..ff26701 100644 --- a/environments/poc/values.yaml +++ b/environments/poc/values.yaml @@ -1,32 +1,80 @@ # see https://github.com/opf/helm-charts/blob/main/charts/openproject/values.yaml -global: - imagePullSecrets: - - regcred-opicloud +global: {} + # imagePullSecrets: + # - regcred-opicloud dbInit: - image: - imagePullPolicy: "IfNotPresent" + resources: + requests: + cpu: "50m" + memory: "128Mi" + limits: + cpu: "1" + memory: "256Mi" + +appInit: + resources: + requests: + cpu: "100m" + memory: "256Mi" + limits: + cpu: "1" + memory: "1Gi" ingress: enabled: true ingressClassName: nginx annotations: - cert-manager.io/cluster-issuer: letsencrypt-staging + cert-manager.io/cluster-issuer: letsencrypt-production + nginx.ingress.kubernetes.io/whitelist-source-range: "92.171.69.105,100.65.103.101/32,100.67.22.185/32,100.67.72.140/32,100.67.23.180/32,100.67.65.200/32,142.44.63.86/32,185.24.186.4/32" host: "openproject-poc.dev.opicloud.fr" tls: enabled: true secretName: "openproject-poc-dev-opicloud-fr-tls" -image: - registry: "docker.io" - repository: "openproject/openproject" - imagePullPolicy: "IfNotPresent" - tag: "17.7.2-slim" +networkPolicy: + enabled: false -hocuspocus: +# imagePullSecrets: [] + +memcached: + bundled: true image: - imagePullPolicy: "IfNotPresent" + repository: bitnamilegacy/memcached + tag: 1.6.24-debian-12-r0 + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "1Gi" + cpu: "2" + networkPolicy: + enabled: false + metrics: + enabled: true + image: + repository: bitnamilegacy/memcached-exporter + tag: 0.14.2-debian-12-r10 + resources: + requests: + memory: "64Mi" + cpu: "100m" + limits: + memory: "1Gi" + cpu: "2" + serviceMonitor: + enabled: true + +hocuspocus: + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "1Gi" + cpu: "2" openproject: https: true @@ -35,16 +83,19 @@ openproject: admin_user: password: "admin" password_reset: "true" - name: "OpenProject Admin" + name: "admin" mail: "admin@example.net" - useTmpVolumes: false + useTmpVolumes: true + tmpVolumeStorage: "10Gi" + tmpVolumeStorageClassName: "bsu-gp2" persistence: - enabled: false - -postgresql: - bundled: true + enabled: true + accessModes: + - ReadWriteOnce + storageClassName: "bsu-gp2" + size: 5Gi s3: # S3 is required for attachment storage when storageClass does not @@ -63,6 +114,34 @@ s3: directUploads: false +podSecurityContext: + enabled: true + fsGroup: 1000 + +containerSecurityContext: + enabled: true + runAsUser: 1000 + runAsGroup: 1000 + allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + seccompProfile: + type: "RuntimeDefault" + readOnlyRootFilesystem: false + runAsNonRoot: true + +postgresql: + bundled: true + primary: + resources: + requests: + cpu: "250m" + memory: "256Mi" + limits: + cpu: "1" + memory: "1Gi" + autoscaling: enabled: true minReplicas: 1 @@ -71,31 +150,24 @@ autoscaling: metrics: enabled: true - - ## Metrics endpoint path - # path: "/metrics" - - ## Metrics port (added to service) - # port: 9394 - - ## ServiceMonitor configuration for Prometheus Operator - # serviceMonitor: enabled: true -## Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production). -## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 -## -resourcesPreset: ~ -## Configure resource requests and limits. -## -## http://kubernetes.io/docs/user-guide/compute-resources/ -# +seederJob: + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "1" + memory: "1Gi" + resources: requests: - memory: "512Mi" - cpu: "250m" + cpu: 100m + memory: 256Mi limits: - memory: "4Gi" + cpu: "4" + memory: 4Gi From d9de7d43b8047ca5ab861ee313193cd4c4337912 Mon Sep 17 00:00:00 2001 From: mdimonte-dinum Date: Mon, 24 Aug 2026 14:44:45 +0200 Subject: [PATCH 4/4] feat: take into account feedbacks from reviews --- environments/poc/secrets.enc.yaml | 7 +++++-- environments/poc/values.yaml | 8 ++++---- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/environments/poc/secrets.enc.yaml b/environments/poc/secrets.enc.yaml index 807738e..8bdf593 100644 --- a/environments/poc/secrets.enc.yaml +++ b/environments/poc/secrets.enc.yaml @@ -2,6 +2,9 @@ s3: auth: accessKeyId: ENC[AES256_GCM,data:1gmrCVvQLBOYm8oU0fDz/NeGD0h5/D2bpQBMSK7/o2o=,iv:GcscH30c/jwu/9u+gaMgmPUqBiyePRdW/5W8Gof+9/o=,tag:DFF/KaE46V99W+SO9+5KGQ==,type:str] secretAccessKey: ENC[AES256_GCM,data:WqJjCn10MvTnAXLCbzM9Huv5aj7BqTYC3YxhJVo3Whc=,iv:48cn5k75iSbbq93W+e/zdpIbubJHZRXbq9qpQF11J/Q=,tag:xCBgx0BNAx4jWtCpRPKZMA==,type:str] +openproject: + admin_user: + password: ENC[AES256_GCM,data:iWzrZHk=,iv:CvjYLes9T2oEnHGKBtB52NVxFc2517grk36g68nEGLI=,tag:HFFSJv3QBLmo2EX24u/lHQ==,type:str] sops: age: - recipient: age1wg6z592fc3l6u8gceyqptqyy8l4eg76yq5987ffj8wn6hur0v39qdvvkd0 @@ -94,7 +97,7 @@ sops: RGFhS1UzT3FxVERwdm5QQXdoS2N1WU0KtGk2AlToWgQc2KCVPewSF8x7J0qTvQsr AgaoZwTYAhgerdhOnZusIDeMA/IQKu2tK9YE6t6psHnzpMbsdqbDnA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-18T19:38:04Z" - mac: ENC[AES256_GCM,data:LeSipry+Nd0AV2cXRq9P9ldtf2OXZAm5GvjfCMQPBONnlw4DkMraK1RDZyQKJoA/zmRD+IpqC3glsyU7rnfWZImdgd5/MKNR78iJnrwnAm6k3MWoAt+/NEXqfylT2Sks0NWUwTgSyk5EHv2ZtYKPIr3ODwlmjFrrzAC8YXQKzKM=,iv:XeWXtKseMReXXkDNuTtNQAG7Jo4pkSyiTcSloRZ5Dac=,tag:OeBodX+EVYC6bYf3F8h+sw==,type:str] + lastmodified: "2026-08-24T12:40:20Z" + mac: ENC[AES256_GCM,data:CCJimuAbPiFLiMx03l92CRXT4kSh2Md7GNEdvUcAZwwZGyNvuzGv0MTY0P9h6B7vxkONEDeRnDtS53gxr3BimURVIcyyG52Z4eTaGE40Nv/yFewB+XnE8U+vIvslLBmrecPTeNi2+6ZJGk1G+//mbwBF9IOtSTLS8EmUEUkFxPE=,iv:yrqf25QHeMuN1tsBN7zESv+hAqi6oa5UBwTRWCVmg+s=,tag:5RnM8SDmkKb0fIZsJHmPTQ==,type:str] unencrypted_suffix: _unencrypted version: 3.10.2 diff --git a/environments/poc/values.yaml b/environments/poc/values.yaml index ff26701..4a9b1a0 100644 --- a/environments/poc/values.yaml +++ b/environments/poc/values.yaml @@ -81,17 +81,17 @@ openproject: hsts: true admin_user: - password: "admin" + # password is encrypted in environments/poc/secrets.enc.yaml password_reset: "true" name: "admin" mail: "admin@example.net" useTmpVolumes: true - tmpVolumeStorage: "10Gi" - tmpVolumeStorageClassName: "bsu-gp2" + tmpVolumesStorage: "10Gi" + tmpVolumesStorageClassName: "bsu-gp2" persistence: - enabled: true + enabled: false accessModes: - ReadWriteOnce storageClassName: "bsu-gp2"