fix: removing sops

.sops.yaml

@@ -9,10 +9,10 @@ creation_rules:
     age: >-
       age12kzuwvvedndehkke84apwamungqrcavf2khwjvd46f6lkq0wqq5q3s3vth
 
-  - path_regex: k8s/manifests/.*\.sops\.toml
+  - path_regex: kubernetes/.*\.sops\.toml
     age: >-
       age12kzuwvvedndehkke84apwamungqrcavf2khwjvd46f6lkq0wqq5q3s3vth
 
-  - path_regex: k8s/manifests/.*\.sops\.json
+  - path_regex: kubernetes/.*\.sops\.json
     age: >-
       age12kzuwvvedndehkke84apwamungqrcavf2khwjvd46f6lkq0wqq5q3s3vth

kubernetes/apps/security/glauth/app/externalsecret.yaml

@@ -0,0 +1,85 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.trux.dev/clustersecretstore_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: &name glauth
+  namespace: security
+spec:
+  provider:
+    doppler:
+      project: *name
+      config: prd
+      auth:
+        secretRef:
+          dopplerToken:
+            name: doppler-token-auth-api
+            key: dopplerToken
+            namespace: flux-system
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.trux.dev/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name glauth
+  namespace: security
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: *name
+  target:
+    name: *name
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        server.toml: |
+          debug = true
+          [ldap]
+              enabled = true
+              listen = "0.0.0.0:389"
+          [ldaps]
+              enabled = false
+          [api]
+              enabled = true
+              tls = false
+              listen = "0.0.0.0:5555"
+          [backend]
+              datastore = "config"
+              baseDN = "dc=home,dc=arpa"
+        groups.toml: |
+          [[groups]]
+              name = "svcaccts"
+              gidnumber = 6500
+          [[groups]]
+              name = "admins"
+              gidnumber = 6501
+          [[groups]]
+              name = "people"
+              gidnumber = 6502
+        # Create passbcrypt:
+        #   https://gchq.github.io/CyberChef/#recipe=Bcrypt(12)To_Hex('None',0)
+        # or
+        #   htpasswd -bnBC 10 "" YOUR_PASSWORD | tr -d ':\n' | od -A n -t x1 | sed 's/ *//g' | tr -d '\n'
+        users.toml: |
+          [[users]]
+              name = "search"
+              uidnumber = 5000
+              primarygroup = 6500
+              passbcrypt = ""
+              [[users.capabilities]]
+                  action = "search"
+                  object = "*"
+          [[users]]
+              name = "{{ .TRUX_USERNAME }}"
+              mail = "{{ .TRUX_EMAIL }}"
+              givenname ="{{ .TRUX_FIRSTNAME }}"
+              sn ="{{ .TRUX_SURNAME }}"
+              uidnumber = 5001
+              primarygroup = 6502
+              othergroups = [ 6501 ]
+              passbcrypt = "{{ .TRUX_PASS_BCRYPT }}"
+  dataFrom:
+    - find:
+        name:
+          regexp: .*

kubernetes/apps/security/glauth/app/kustomization.yaml

@@ -5,13 +5,5 @@ kind: Kustomization
 namespace: security
 resources:
   - ./helmrelease.yaml
-secretGenerator:
-  - name: glauth
-    files:
-      - server.toml=config/server.sops.toml
-      - groups.toml=config/groups.sops.toml
-      - users.toml=config/users.sops.toml
 generatorOptions:
   disableNameSuffixHash: true
-metadata:
-  namespace: security