chore: migrate hedgedoc to git-age

hedgedoc/.gitattributes

@@ -0,0 +1 @@
+**/*.env filter=age diff=age merge=age -text

hedgedoc/config/base.env

@@ -1,38 +0,0 @@
-CMD_DOMAIN=md.icb4dc0.de
-CMD_URL_ADDPORT=false
-CMD_PROTOCOL_USESSL=true
-CMD_USECDN=false
-CMD_SESSION_LIFE=1209600000
-CMD_HSTS_ENABLE=true
-CMD_HSTS_MAX_AGE=31536000
-CMD_HSTS_INCLUDE_SUBDOMAINS=false
-CMD_HSTS_PRELOAD=true
-CMD_CSP_ENABLE=true
-CMD_ALLOW_GRAVATAR=true
-CMD_RESPONSE_MAX_LAG=70
-CMD_ALLOW_FREEURL=false
-CMD_FORBIDDEN_NOTE_IDS=robots.txt,favicon.ico,api
-CMD_DEFAULT_PERMISSION=editable
-CMD_ALLOW_ANONYMOUS_EDITS=false
-CMD_ALLOW_ANONYMOUS_VIEWS=true
-CMD_ALLOW_PDF_EXPORT=true
-CMD_DEFAULT_USE_HARD_BREAK=true
-CMD_LINKIFY_HEADER_STYLE=keep-case
-CMD_AUTO_VERSION_CHECK=true
-CMD_ALLOW_EMAIL_REGISTER=true
-CMD_EMAIL=false
-CMD_OAUTH2_BASEURL=https://code.icb4dc0.de
-CMD_OAUTH2_USER_PROFILE_URL=https://code.icb4dc0.de/login/oauth/userinfo
-CMD_OAUTH2_AUTHORIZATION_URL=https://code.icb4dc0.de/login/oauth/authorize
-CMD_OAUTH2_TOKEN_URL=https://code.icb4dc0.de/login/oauth/access_token
-CMD_OAUTH2_PROVIDERNAME=Forgejo
-CMD_OAUTH2_SCOPE=openid profile email
-CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR=name
-CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR=email
-CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR=preferred_username
-CMD_IMAGE_UPLOAD_TYPE=minio
-CMD_S3_BUCKET=hedgedoc
-CMD_S3_PUBLIC_FILES=false
-CMD_MINIO_ENDPOINT=2df513adaee2eeae12106af900bed297.r2.cloudflarestorage.com
-CMD_MINIO_PORT=443
-CMD_MINIO_SECURE=true

hedgedoc/kustomization.yaml

@@ -20,10 +20,7 @@ resources:
   - "resources/service.yaml"
   - "resources/http_routes.yaml"
 
-generators:
-  - ./secret-generator.yaml
-
 secretGenerator:
-  - name: hedgedoc-base-config
+  - name: hedgedoc-config
     envs:
-      - "config/base.env"
+      - "config/hedgedoc.env"

hedgedoc/resources/config.enc.yaml

@@ -1,40 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: hedgedoc-secret-config
-type: Opaque
-stringData:
-    CMD_MINIO_ACCESS_KEY: ENC[AES256_GCM,data:VqudURssSgmCDVhCRjak2TDG10pwvCNfi0w9FlEh4SI=,iv:VGavO528JfqsUVyvWSAlWkMTXJAmLUablaGZ3VCEtq8=,tag:unvEa2k/9AzfVMEnhCDB1Q==,type:str]
-    CMD_MINIO_SECRET_KEY: ENC[AES256_GCM,data:/iQq6wnoH/WwEzApap6szpr7z+KZJ+twcuINgqtbHOMDXeVz9Yi7cjC0hGlqQHZTCO4jR5gp+OwdIkzRk0zDsw==,iv:1OHm8K3AA340q0xkNCF3RsPpcpKmUE5Yibu+IWIZ7+E=,tag:cB/pckdoEZQlzlRVWoYKmA==,type:str]
-    CMD_OAUTH2_CLIENT_ID: ENC[AES256_GCM,data:x1zEeQl4WM49dmbx9v159APlimVVmQX4uPUTa0Nwu7jazcD1,iv:eXSk8Js2OhKC6q1M2anzCdC30IqA9YIj7rxmzFRE4bo=,tag:zgutG/3INA7DxUY5PRJoIg==,type:str]
-    CMD_OAUTH2_CLIENT_SECRET: ENC[AES256_GCM,data:biyLVbyONbJK2V16Zz9/MVdpdqu3iTzsyBVx0iKK5MCyNfU1Y0lV9g88w44junGvvby/LWOAEGs=,iv:uSRtuu+bHpt8JOVfw5BpCXjqWW07x0jJ8Ja2pIcoQf4=,tag:He4d6BrE1V9OJbNH3hrPcQ==,type:str]
-    CMD_SESSION_SECRET: ENC[AES256_GCM,data:Nq6arL1aE69BeTRjx4pA90xZqcOtqOb3R/Zt98FyIVd+Uq53dWsqURG2M+IQpvl9MEpY8FpUNY0=,iv:JaOAe8YgNVnDBzV2x1TSqMJq36Qwqazk6cCkWwseBZc=,tag:FMKKOhow/w5HLwfNarQdjQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age18e0w4jn03n66qwg8h3rjstz7g5zx2vhvz28aterkfkfetrxtpuysftp6we
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5cHVKUm5Nby9hSjdOM3JY
-            UWs0UWdrNC9FOVd1b1VjK1BmYVdwZng4T2tvCnBhYVdNbGFwWnBPMkJiSk1pbHlv
-            aGJTRjdsb1JrSHpIMk5JWEZNOTBoc0kKLS0tIEZscSs4SFVIVG5NanlUQU1IM1hv
-            M1F2WE1taWZ2bG0reU1EYWw2K1pZK2cKSHxed4HgSf0vKNGBMuFaS99znRPphkoF
-            TgjkD7nI/nyvflV0Bs1lqMlWZJsyY9+HaLp38j95mAcXc224SSBMxw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yssdnqk90tn6zzggmwt70krndw04yfk9hwzdac3wsgfxmttngd7q89qzjr
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtd3k2MzQ2aGx0NmwzYU95
-            QkVNVkJuQmdrOEUwM3FJNGFOZndxYWFTeVFZCmo3RnRQakxoelV6WmJHK3UyMnBZ
-            NTMvYkxqWHhYbjVBSkV5YjZlZTdndjQKLS0tICs5UlQwNHAvdW5oYXlqYTFFOEM5
-            ZXpzNmEzbXhtZDkySFM2L0VQTzZCdTQKh46uRnVtRzzdnnnuCJNwgQo8AeNKpc6B
-            WC91My4qyOtvM9J+FJC71DTovfmHrZw0YWbPwXqNRU6XBWHfC/MViA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-20T20:40:53Z"
-    mac: ENC[AES256_GCM,data:DcoiksdfIUl5cCC8mSbzAUO9lWTeotr/UNMwIa+Z7aq9s4tzVn3YBbAPh5by5U7PVqAPkutoBjUk1IXCqWykkGXw/k9n7mAZn5AiCweLNY/d0gmKTpCUsGqaTg8gH7gQJy6+TNGxnq+Wm4GQNHAduYMJXS4/UdJcIAAc/id4JXo=,iv:+OYzaUHdJN4daTrAg561LxS0i6lozZ+OylhxubZplYc=,tag:7gElSJeGIaqXzjYTe9OTZQ==,type:str]
-    pgp: []
-    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
-    version: 3.8.1

hedgedoc/resources/deployment.yaml

@@ -25,9 +25,7 @@ spec:
             value: /certs/ca.crt
         envFrom:
           - secretRef:
-              name: hedgedoc-base-config
-          - secretRef:
-              name: hedgedoc-secret-config
+              name: hedgedoc-config
         ports:
         - containerPort: 3000
           protocol: TCP

hedgedoc/secret-generator.yaml

@@ -1,11 +0,0 @@
-apiVersion: viaduct.ai/v1
-kind: ksops
-metadata:
-  # Specify a name
-  name: hedgedoc-config-secret-generator
-  annotations:
-    config.kubernetes.io/function: |
-        exec:
-          path: ksops
-files:
-  - ./resources/config.enc.yaml