k/forgejo: bump version to 1.21.11-1

.gitmodules

@@ -1,6 +1,6 @@
 [submodule "src/website"]
 	path = src/website
-	url = https://codeberg.org/distrust/website
+	url = https://git.distrust.co/public/website
 [submodule "src/toolchain"]
 	path = src/toolchain
 	url = https://git.distrust.co/public/toolchain

.sops.yaml

@@ -3,4 +3,5 @@ creation_rules:
       6B61ECD76088748C70590D55E90A401336C8AAA9,
       88823A75ECAA786B0FF38B148E401478A3FBEF72,
       3D7C8D39E8C4DF771583D3F0A8A091FD346001CA,
-      F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+      F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D,
+      C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD

Makefile

@@ -7,7 +7,7 @@ ENVIRONMENT := production
 REGION := sfo3
 ROOT_DIR := $(shell pwd)
 # TODO: automatically determine
-TERRAFORM := $(ROOT_DIR)/out/terraform.linux-x86_64
+TERRAFORM := $(ROOT_DIR)/out/tofu.linux-x86_64
 SOPS := $(ROOT_DIR)/out/sops.linux-x86_64
 KEYS := \
 	6B61ECD76088748C70590D55E90A401336C8AAA9 \
@@ -15,13 +15,13 @@ KEYS := \
 	3D7C8D39E8C4DF771583D3F0A8A091FD346001CA \
 	F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
 
+EXTRA_ARGS :=
+
 .DEFAULT_GOAL :=
 .PHONY: default
 default: \
 	toolchain \
 	tools \
-	$(patsubst %,$(KEY_DIR)/%.asc,$(KEYS)) \
-	$(CACHE_DIR)/website/.well-known/openpgpkey \
 	apply
 
 .PHONY:
@@ -76,6 +76,13 @@ infra/backend/.terraform: \
 	$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
 		env -C infra/backend $(TERRAFORM) init -upgrade \
 		'
+	$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
+		env -C infra/backend $(TERRAFORM) refresh \
+		-var environment=$(ENVIRONMENT) \
+		-var namespace=$(ENVIRONMENT) \
+		-var region=$(REGION) \
+		-state $(ENVIRONMENT).tfstate \
+		'
 
 infra/main/.terraform: | \
 	$(TERRAFORM) \
@@ -85,6 +92,13 @@ infra/main/.terraform: | \
 		env -C infra/main $(TERRAFORM) init -upgrade \
 		-backend-config="../../config/$(ENVIRONMENT).tfbackend" \
 		'
+	$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
+		env -C infra/main $(TERRAFORM) refresh \
+		-var environment=$(ENVIRONMENT) \
+		-var namespace=$(ENVIRONMENT) \
+		-var region=$(REGION) \
+		-state $(ENVIRONMENT).tfstate \
+		'
 
 infra/backend/$(ENVIRONMENT).tfstate: \
 	$(TERRAFORM) \
@@ -96,7 +110,7 @@ infra/backend/$(ENVIRONMENT).tfstate: \
 		-var environment=$(ENVIRONMENT) \
 		-var namespace=$(ENVIRONMENT) \
 		-var region=$(REGION) \
-		-state ../../$@ \
+		-state $@ \
 		'
 
 config/$(ENVIRONMENT).tfbackend: | \
@@ -107,9 +121,17 @@ config/$(ENVIRONMENT).tfbackend: | \
 	$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
 		env -C infra/backend \
 		$(TERRAFORM) \
-		output -state ../../$< \
+		output -state $(ENVIRONMENT).tfstate \
 		> $@ \
 		'
+	$(SOPS) exec-env secrets/$(ENVIRONMENT).enc.env '\
+		env -C infra/backend \
+		$(TERRAFORM) refresh \
+		-var environment=$(ENVIRONMENT) \
+		-var namespace=$(ENVIRONMENT) \
+		-var region=$(REGION) \
+		-state $(ENVIRONMENT).tfstate \
+		'
 
 .PHONY:
 apply: \
@@ -126,7 +148,7 @@ apply: \
 		-var environment=$(ENVIRONMENT) \
 		-var namespace=$(ENVIRONMENT) \
 		-var region=$(REGION) \
-		'
+		$(EXTRA_ARGS) '
 	$(call maybe_encrypt_secret,infra/main/talos/talosconfig,secrets/$(ENVIRONMENT).talosconfig)
 	$(call maybe_encrypt_secret,infra/main/talos/kubeconfig,secrets/$(ENVIRONMENT).kubeconfig)
 	$(call maybe_encrypt_secret,infra/main/talos/controlplane.yaml,secrets/$(ENVIRONMENT).controlplane.yaml)

config/make.env

@@ -22,7 +22,7 @@ SOPS_REF=b6d3c9700d88e0c9348f3ec7cd2f10ce4a4b3ee1
 BUSYBOX_URL=https://busybox.net/downloads/busybox-1.36.1.tar.bz2
 BUSYBOX_HASH=b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314
 TOFU_REPO=https://github.com/opentofu/opentofu
-TOFU_REF=f9d8b3ca2c0926f66757241baf81af523be73726
+TOFU_REF=5d05dba18b6e276a6262a4722fe90c13350c5428
 KSOPS_REPO=https://github.com/viaduct-ai/kustomize-sops
 KSOPS_REF=ac33c40e1b78d9847a8d0f58473e99419be5b170
 KUSTOMIZE_REPO=https://github.com/kubernetes-sigs/kustomize

infra/main/dns.tf

@@ -16,13 +16,6 @@ resource "digitalocean_record" "billing" {
   value  = "45.16.98.153"
 }
 
-resource "digitalocean_record" "chat" {
-  domain = digitalocean_domain.default.id
-  type   = "CNAME"
-  name   = "chat"
-  value  = "distrust.element.io."
-}
-
 resource "digitalocean_record" "www" {
   domain = digitalocean_domain.default.id
   type   = "CNAME"

infra/main/main.tf

@@ -10,21 +10,18 @@ resource "random_id" "suffix" {
   byte_length = 8
 }
 
-data "digitalocean_region" "provided" {
-  slug = var.region
-}
 
 resource "digitalocean_custom_image" "talos" {
   name = "talos"
   url = "https://github.com/siderolabs/talos/releases/download/v1.4.3/digital-ocean-amd64.raw.gz"
   # this gets reset by DigitalOcean otherwise
   distribution = "Unknown OS"
-  regions = [data.digitalocean_region.provided.slug]
+  regions = [var.region]
 }
 
 resource "digitalocean_vpc" "main" {
   name = "talos"
-  region = data.digitalocean_region.provided.slug
+  region = var.region 
   # Note: This is VERY CAREFULLY chosen to avoid conflict with k8s and cilium
   ip_range = "192.168.0.0/16"
 }
@@ -45,7 +42,7 @@ module "digitalocean_talos_cluster" {
     size = "s-2vcpu-4gb",
   }]
   vpc_id = digitalocean_vpc.main.id
-  digitalocean_region = data.digitalocean_region.provided.slug
+  digitalocean_region = var.region 
 }
 
 module "digitalocean_database_cluster" {
@@ -63,10 +60,54 @@ module "digitalocean_database_cluster" {
   }, {
     name = "forgejo",
     create_default_superuser = true,
+  }, {
+    # We're creating this database, but then need to delete and recreate manually with LOCALE=C. Otherwise synapse won't work
+    # CREATE DATABASE synapse WITH template=template0 owner=doadmin locale="C" encoding=UTF8;
+    # GRANT ALL ON DATABASE synapse TO synapse;
+    name = "synapse",
+    create_default_superuser = true,
+  }, {
+    name = "telegram",
+    create_default_superuser = true,
+  }, {
+    name = "mautrix_slack",
+    create_default_superuser = true,
+  }, {
+    name = "matrix_slack_appservice",
+    create_default_superuser = true,
+  }, {
+    name = "media_repo",
+    create_default_superuser = true,
   }]
 
   vpc_id = digitalocean_vpc.main.id
-  digitalocean_region = data.digitalocean_region.provided.slug
+  digitalocean_region = var.region 
+}
+
+# Crater App requires MySQL currently, when it adds PG support we should migrate
+# 
+module "digitalocean_mysql_database_cluster" {
+  source = "../../terraform_modules/digitalocean_database_cluster"
+
+  cluster_name = "distrust-mysql"
+  db_engine = "mysql"
+  dbcli_name = "mariadb"
+  db_version = "8"
+  size = "db-s-1vcpu-1gb"
+  node_count = 1
+
+  databases = [{
+    name = "crater",
+    create_default_superuser = true,
+  }]
+
+  vpc_id = digitalocean_vpc.main.id
+  digitalocean_region = var.region 
+}
+
+resource "digitalocean_spaces_bucket" "matrix_media_repo" {
+  name = "${var.namespace}-${var.environment}-distrust-media-repo"
+  region = var.region
 }
 
 locals {
@@ -80,10 +121,11 @@ locals {
   ])
 }
 
+
 # `jq .database_users.value.forgejo | sops --encrypt`
 output "database_users" {
   value = {
-    for db_user in module.digitalocean_database_cluster.database_users:
+    for db_user in concat(module.digitalocean_database_cluster.database_users, module.digitalocean_mysql_database_cluster.database_users):
     db_user.name => {
       apiVersion = "v1",
       kind = "Secret",
@@ -111,6 +153,11 @@ output "database" {
   sensitive = true
 }
 
+output "mysql_database" {
+  value = module.digitalocean_mysql_database_cluster.database_cluster
+  sensitive = true
+}
+
 output "vpc_id" {
   value = digitalocean_vpc.main.id
 }

infra/main/provider.tf

@@ -2,12 +2,13 @@ terraform {
   required_providers {
     digitalocean = {
       source  = "digitalocean/digitalocean"
-      version = "2.28.1"
+      version = "2.36.0"
     }
   }
   backend "s3" {
     skip_requesting_account_id  = true
     skip_credentials_validation = true
+    skip_region_validation      = true
     skip_get_ec2_platforms      = true
     skip_metadata_api_check     = true
   }

kustomizations/digitalocean/digitalocean-config.enc.yaml

@@ -14,85 +14,105 @@ sops:
     lastmodified: "2023-05-17T02:32:42Z"
     mac: ENC[AES256_GCM,data:/r3XV5k2UXxRwNv+comZBBSKftovXuhx5opWa6w6u4aM2vfJcjwdAZ/ZvgHpoLJxk3tjm77beCnCMLTmGfL2L2eT/WrBCiZHofXd6bHZQ6t8jNiPz4R2P4E0Cb/O4sSGCw2/TUxyiBlQKNJfVhNPmtfpBrgQ+eXQIuuSM+lr5UM=,iv:krSMU45WsO7Ew/2EmyJUQc9/yH/ejiI0MXdd9kYC7KE=,tag:2kugMJ710d67vO806tzMyw==,type:str]
     pgp:
-        - created_at: "2023-12-15T04:04:23Z"
+        - created_at: "2024-01-11T20:55:07Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA82rPM2mSf/aARAAuXZljFMr5LOSFOmnyD6FVYqdzhcIQylkpcqUHVb/vIU6
-            kRxuWfAzSMZKtmNPNNO/QCO5gS0jAD5hoYQ/3tVF1cHXh2en4O9IQNWuKEmy3Jid
-            aIrxBCgeXxfTe6/md+FTZ8FDkkTVeglmb+nx5LPuv0c8I5yY4HdrzB2yB29iHGTQ
-            i0OGtoH9oZH2Q00jSrUpq71pAHLdq08MYRxXI+zY1lZeNl7gGenvBUkhAiEwhQge
-            A2M3P5DEULqi0Uvc7/072U9K4RuwUD/NwGkfpy6TO5o4qCCA9P4BjRKCL2hK3GnO
-            7YtitSLALTEDQj3qh6MB6NWRg4bWtQH7bM1LqcKNrDblhhaQau5ViB+/WYZFuVnM
-            rfvfTTtCkgUx6Hs7BoH16b1VT3uIktEkVE0lPvKYlwb1NU9BYI7+IVLv/SrWDcu6
-            TLv3ymHgqV9YuxJJIA+7SBCqejOndXjqMwBVihQeKq/tXSeWHWyao6IehQFOD8bI
-            evE7qhZmB/jMq+n58971hK8dMPSvAC34qMcrn0yehNqpT3kNoQUS7EkdEBp2Qgbj
-            60r8eK6LDkp/jf+FV8Wbmt/9iMdvFtI5DFTaj+kcqnJ+y+WhyhkMqgEc+5q/h5KH
-            yB5MUMU9nRm/zxVpV3NU4DC2V/kjfOQUaQ3zYjPCtlePR/xIB6mhYU2G0mXdaQPS
-            UQH497sEf1aAKU8QBhVxce1gJc0X+ayUmj+Pqjb0C0UiZNlW9b3zc4Hjgg6EFlVt
-            61WFb8ZZ0IB3fjClIC5nhxGDHbtIFSg/OosNeuvuG3Bkeg==
-            =eJw8
+            wcFMA82rPM2mSf/aARAAkFACzQmqyF9BqaD1qEjIO4e6owS/n4h3U6ee0Y7fhO8y
+            a5RJ4/HvMmfXcYeHm+CZjsFaui4YJkPS93clGTJzV4w15yXJUunIVjAmkvSrVh6P
+            GqRUtNpi1y+JCS3sjlAfvm3h9b08dNxFv7rTwZtDiP8zmcNuB0zbLBFR7G6ixetx
+            ZxL7piPYX75Rqoz8A/+V7VAtsoX8t3xv5xgjHzzfhiM3TeoQUgLnF8aN5huiSptf
+            dMmNMa0GGu5QaUjYJ3iHjv5eMtCJ79KwpuCfv5iX34Q++rTe5VUWoQabNAiE/Frt
+            Rc3JB8o8rfL6WME9qIIa5k654JlVDKqOvTH3mtHkOIWhD2+CEK89Siq3G35Kkct8
+            Ym7UNa6gE8IdSGkCOH81G4ZheU6Z8OKF1Z7dO+o7IdgIURTwLEFeBIC2PtWOKOJP
+            PnzqZNk1w4n4XK6hQg4bmIj8VaZXXgHEXcO/jaGCoRyr36BHCE1Sj1ae5cMUgDje
+            p6WKVO6gXfRg7SRJqQNUh03Lz0YKIjsI/429UPyf9mtXbHfvVyrW3+wyByok86FG
+            cGL1Y/N7thxAxXqHy4OZFCE0NMP2bobMzzGJTtDY9oPsGwTb6xk1g0wE5zg6IoQa
+            9hnObBJhdpvYcD6juz+V0wkeI30essnz7ZTtsLdfCox6mnP5BMTtzxmcRrCpNvHS
+            UQFIZa0XryYoXv3rcw6yUpkqv6aYzD3L4PnqYtGUEtbMoTb8NXa9Cp+1OeypqZ0g
+            7uO5zCKJgL6sBaPnJL5/n+afafzYcIOsQc2O+q0s4O1d5Q==
+            =3E6w
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-12-15T04:04:23Z"
+        - created_at: "2024-01-11T20:55:07Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMAw95Vf08z8oUAQ/9HE7Rxy7JcoqYA2+nZOkCvtodbqOq3d78DD/bjmvZUoS/
-            aFig2nNxeKjq4NUve2z72YDPL62LPwu5XNJXQnxCBOEO9aFjfYyO9yDcEL+h04KQ
-            2XqPIPAp1EFh8ykqRlUoqUD3a+uzIR99sNLDsrWGqzCjFMo2hVI4rSgVr0JA1JpI
-            KwxFyK80TqeV8RMbSx964yn60QUGsnpqZBUgB+mLx9pUahZtaN4mczN8hpPD3ZuO
-            9cwFXoz+uQsyncMOYH52blfJTByAC4vw1Ddw7swZSi7p+EccP2BzUlyrZ/WOLst6
-            4qM6KlW4szw259PM4zWfxfZsMQN27HlXntyWo3/J3K0m8IkBlc2Ji6X18EwNQQrw
-            Z83UVyHWuGqM4RP3SI8kB6T27dugbv76RQfYR+9SZVLZYEAA0OJdhb/WLb+hg0wj
-            6Gv2/1c4ZX9Wk/ZHP8LV5cnM89sxCntDfHosYpc5ZmDE9kk3EVLAPHMQqqPuLq0R
-            eULpPpiasclK1hBruJX5Bn8Pq5w8UFXpMV9Rf31nnxZgDy4swFmFZE9zhh2PYV09
-            MtTiMH9+BYK94n2RRQFghrmo04lCzb/3YM1muwSm4zup5x8Yz6ZMzuwvkzZ2JGke
-            NaIumbRfs39BfftHY1AhrM3x29xQ4Z01rrT7CYcppyVjFuBC46wT3GEKvnNaAD3S
-            UQG0RjIwT+RMvhgGn3OVTKauAYZ4GIB9uT2KYX1iLw9gPpdLR/0cAjydSJpEIpzi
-            92QigJWRL+cbPYtIWU717ttrCw8oVDsVk2KafDuSDsc4kQ==
-            =ZQRI
+            wcFMAw95Vf08z8oUAQ//abo3n5r8YdQ6p+/X031/n8MCvWKw+ERGSvDuT2r7g8m8
+            DqrBQmX578jHVmZkC2B6fYqEBuQAeyEJyQ56MLMuGMNSET8dgNS4Uj/gwvsuEDQf
+            NhU10WLkfQ3g2/o654BVzPC2b3UQTL4mmXqp0+ID79uynn0/WZ0TQQ8xj/uUaDS1
+            h6/uC7mmDGTHaxF3gFuYkvWMghU0bqX5BfrAPdICAr8FIqxUGIvUD6KkBu9hWTYP
+            RLtfwpU/DAcT/7pNtic25WzzQt7W0mok3zUZZq5r2UqO35x2XOrgC5DQ69QYf7JZ
+            a9S236gEpAS0Kl1IWSvY2kDzj/J27T3nonY2kX3a+UqVWX15LEmVmNNUMwjz91/b
+            0G+26vustzinHBs30EHGBqhyELjRW0RjcmlVGNXvZwhgGL5/LNIEcfBi19tIang1
+            dRYE9TasSeRbyTU/A/CXFDeuGtC8K552SzXjv1zP6gkwZFb0/zd0/XHPSyGyOLbM
+            1PC3JhkA8GEYQ7l9y5BdPXxZseuoSHDPHfMRIcnogx6w6rfBdd9+78M1WjnGzhYi
+            /utORBaiwU9Zk+Xm3B+WbkDl5+jio+UIp9nHoYAGfuJ9A6TZYBIavB6K171wALke
+            Kl6hoTxef/VGwdfXB9ikUy0bi0Km1vVpZGVzIjSFXiSlLkaamhxUFSgDPGZN21rS
+            UQHeXKkhgKXTEVvi+kypRbN2/174bElGTWz1C2TWPNJAcvvKmRw66t5g8pahnXbm
+            SYQoB5JaAl0URu6zHWBYhCjQjiyePhnxHV4tgGtEYAdY3g==
+            =xXRR
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-12-15T04:04:23Z"
+        - created_at: "2024-01-11T20:55:07Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA0/D4ws+/KPtARAAoL8ljaHl9S5NJ/2VmG9m/AQXcRD7qTFWCBY+fjN0R8dX
-            pKRg93R1ImBtpV8WKxGjN4QDSMJ1Lh5SYr7VLo/k9hbsqL+hbbSWRDYkqv3jQ1Gm
-            W9f1ZC5aHoT/VkgKafHJMyVEbGiTeGaWQLuMKH5GFMl6Av/Ox7f7YijuOfCua6O9
-            IyAer66sz2xSt3ulswGedqVcqTx2Ky+w5tZzk6O7/meQ8+kgUEcRIU2+dkRn5MYh
-            KQQZUfiZDgMyrw1r4Hm/U9rajP6damhzeZLcHiFngqz6NDJmBkXGC69KVJZlrTca
-            e7WfoQZepE+IqYxpGIlpqlmyeIJPAsvSOPSxEXgklG3Z/ANn9jCGJCW2KhLibYZm
-            EhErVHHgnmdtjg3Twwkd7QJ5ryOsvgi0aYdyvG6S/vlsCNt8FrLfsBk4NmF9wPvb
-            xfPhZXqFGVVNLg7FaPp/M0jAuoWXsuh77xlh339Wmr3WRUZIjVfGgTh8xArP+byu
-            z1UG6jd7aZ6ix0cJUhZb6k1FxrOSjWnp1p4F43IcT2B7158z+l7YQGqlksE4agfM
-            Qoke3kQNiwSIuouHP0aA7tTVJQz1hH8sZ5afyudIeAhpo6ke8mklNToz4kpSaIT3
-            JFv4+OZSC6NI62xYDkFKQ1iv7/0GdMyYXSzub36+pxm7/arsuN7aUJnv0/uSctrS
-            UQGmPJ+XZVVEFw8Q38EnEnexKf17W7A5n8DvEQk6OR8AHwIGUApzkQcza1JEJedO
-            r+SY+hcabG9GmA1sm8FcBJBs4qndNwXLb2hFtnX31R2djQ==
-            =Yxyq
+            wcFMA0/D4ws+/KPtARAAsxa6N9jRT1AUqfWI7gIfJK6i6g0F5oxRYJ5A2mjhc89k
+            ZAN4/tO9GC+Fg8+lLhPHdiz6v2T1+92AFXET3jm+ax6rYei2woMHNXKzgqxjkQEQ
+            xQ/3LcQ3+FOTrvy7Gir9HQ/DoWSePBF7tx16unxH75hi6AgOiT0nFoEbXP3CJXie
+            lVOO5r5jKgBg9LENj/U+9LHjXB6W0PbVdhxdeStk2TTKcmuDnrGeqKZ3SyZ9V33p
+            DEfydW+T0ac156Eb2tdszzW5e87oPmW78wvLkotboZcPVWBadRtJkzVn3JXoMAda
+            gN+W2+I4/4iQN8ITBQ+2i5GsdbHtnrmPkzSbtSqhujwZ1k/a7uRmHy46ejDK9QnT
+            lQzm2OKyjTlCDhnxnKj0eTE4nN0CDyxGBNlNVG2piKd8i+HpqrjKJ9IUcMj7oO3U
+            8rtQ2A0LHquNvu6ZatP6fUk3tKgLaEslV4ORXMlILdZXlYqgznmvWJaII3XVeu8l
+            G/tHPkOhrcQDIecBeYcTLZYXtPtmY1UNJZfbDazG/9J0rdq/r9NmnB7woy7FSYEp
+            yRNji1i/89nVLsu94ra1D6FHyxgIFTSLkD7s1iCMTsz0UdwfbxqdLIWumYrm04XF
+            wM2eTB8OAGe8mdfi1q4te0FEDMLTpdYBhYDDjHmBv4fXwKPcWkgixvNJtT6xPgLS
+            UQEvOn03hQ8MCQ5kh1R1FoTOw1UpgV0eqJSateC2wkBKbZ/4NWPbnZA7XAW6Jb98
+            JidKJ8TiYiI33hxUhu4nUeZWjNcd7MgHyl1Do2r7SfyICw==
+            =TXST
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-12-15T04:04:23Z"
+        - created_at: "2024-01-11T20:55:07Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA5Wf+FyJ+zFJARAAnf+0htLnYzxZM84cdyV2XGR1E79sbCO4ARbPQBE36fTI
-            qGfrX+E1DMRvN0mxTJd42LwtMBqAVZMeeJgkYStnRIZQzVKx5tH1VF+HEULBLdIj
-            Wae4fdALpvwXIo6jhk/0iQLbjU8diFPFZzLJyFOwVKNV9WxU9sGKqG2ezcM0sgJf
-            G7yTfcVNAyzJn//BvXzrfKdUuE4AMxiPGxBkAsUJvmw2Py5oGk8+zze6VakzHaNk
-            MnOCgyEpUnMYGk0lqagUdrWEBo1iQ1thhViB9yK+z97M98h4bxCi4Q+nrAOZPVdg
-            1p7/TV4daUTalUft9WFn+Sdp2LAnjEre194zC7q7E3gJxnC9vEIzW/fl9OGlWEru
-            /N739SOjAMyiQNqaBozGllRMlWFSJk5dAOyq0Wfp9JSrX6Y9xlkqjezx1n4M5JMv
-            IJA3AmXlqa83gq+o/uZyZ9zfEF80Q7WstRPK89f3I0HKv0DRaVYJJYLzsUAk8qhH
-            INVEv1fDFHzkAJCucwepiwLBOraKBEyyhsrtjtkCYJ7iOIjqaR+uS3O7YWBchJ9r
-            c8E/b9XMqUsl6lHn+A22SKGK88gG7NY/vTv0e2khmtl8TskOejhfo9gr3mEcPBQW
-            JaRNv+dGM0BdwhhUccqECAvpG5PG3FuHV9AdcJVx2nHKfGNIq/850WrAQzgXR2fS
-            UQFVde6oDYarbLcJqVw/9j/Nb+cRPirCYouw2lWf0H5XaYW8wuGBd7kImGrNwoqG
-            Vq6ugFr69vDFyJfbG6vZrSkDWHei+tQneFvQJ4yG7xSxnQ==
-            =RVdS
+            wcFMA5Wf+FyJ+zFJAQ/+I9khYJfqjCHhrAaElVWKgn4c+7C+oilVNE0132pQZfLb
+            u17yv6AYY5zThK6Lg0GZMKaKFn+JuF9wonTyixJQccJ+w2MxsJQRNQZTV/t19HrQ
+            B+6YFLVPNyOglr7jf+o5BnOdIvpR0Cog5JDzn0j4iwpRWRSGW1sWXiABKWUIW0Ks
+            nR7Rm/k3Jm8zYO6LtoyYog5HGUEHRMuOY6Yoj/EEbfDLKFU5WZ+hfKnbGGM9KW31
+            RkXoCtjm2AstZTia5+Y0E3wNb9bbvpbkewyQd5KqaHmHaX3MzuoYKNHGVEgPMfla
+            Y26aED5uSLETv+C1U/jYJyxyVJxNYb2JBrS8a7+p+mo00Cvbs/pbM/cr5Y/Ogu7Q
+            Ed0+Ixst3LzSTOcYAAiEC/LpWztaIp/4h/cAfE7eKnsoFUVcv2lLpLHyI7fS/sJH
+            Ywp8tlqlfx7DaCqYEVjPMSfI9qBbJomoQ77szHL+Gyi4ibyF0iRz0/NnF5lmu5H5
+            sDAYiqnHEIpk1v+gWXoj/CQq7a5jJf044cYylcO+al27cugr+jr5TBQQVv+wDNJV
+            LqpAxmmz8yUJ6RlTSg5JwNlNCCOONv6f+lX0Cjk7V0kPcOMgbVn19Su7zIvhM7wd
+            m9mzuVWWx2SBGzORdK9W4tt7lybU7aCvusT1jP1nwXF/JCz9lyEbb1syaNIAiXHS
+            UQE2Va23CUVgB+cV/ImXBCEuAjZhiSMFVCtWOZrcqPS8EZX9s6WzscpsEmFnDE7t
+            GVR3u1IyjxTsuTxxYU0ldSjHqYFjQrgRD3ZBzwZcgeajqw==
+            =bF9b
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+ARAAoMRyGipvXTgUChfL1Lryej14FI9+8dvWQculBjPQzg6x
+            oxdPzz07ifIX8D64zfToE+qc439l/RYwiMx9XyGscEim0D1GIFPwxOm4DCXT+/5m
+            wlLkOBP7oMwirqSazS7dNF1hE83717QTi1GqC0UqhoMINtxrhQIv1Y6xxREqD1Wd
+            eW3M45p1i8iSZkzF7n0EhIK3J59Wl3vxt9FUX3YRWk1JH0oaqIc1VCH3TJc73DAx
+            9e1jIVQSo4R8BfQc5Y64xRh0eq/87Ud2E2x9JbZmpnw4FN/OHg9QqRMaZ9r6EQ/l
+            VerhJFkfSj3UVAfODzViKXyNTKRak1GOcQBE5lfAXynAW1nfTTx0re0rl6/tvOwC
+            i02a/raksTI8afak1RMclNFqlihsegGU239ZGDRPb4apL32nYY0SMim58vET8rv5
+            eTiQE1udg+1ttIRAGq/PxzHKlc6FUEdyJ6i2Da16c0K76FpF3Gnxxhw+Tleixx3h
+            6+PbhC2qEgt7LS8TNg9J2WTDy4Hlw5YEmzOAM9NA6UYrH9BHsR87sbdriz6pAC55
+            CnFkWptrME4CjUP72qIezRYt/4784ABTw6poQ51jP30641YhgPoYLrWS8hWQYaE3
+            jcrum3JQnLTjsE88OclcreKNvNj+b1t0uxuHa/6UdMnyRCd8osJ22s6JJHLGgB/S
+            UQHvy+Rv0QJ65DjsJ4TfdRBLcKXaF7Ar5SaANqGi8EYwjVbhfImwx5VSEsvQclEU
+            7JihoETtCrRwJM1BkJz3nuBAaYDm1Y+lWHSyVZ6xi8G0eg==
+            =n6cE
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

kustomizations/forgejo/forgejo-config.enc.yaml

@@ -15,85 +15,105 @@ sops:
     lastmodified: "2023-05-17T04:43:13Z"
     mac: ENC[AES256_GCM,data:iVoGf44NRRbZJJ7zZFxKeqt9ab81+XrWJXzKkfGHxh5CNPtY6Ruq7v9W3KZkoHUhci3xWdm+0WbJVioNLb4zxbg1cdqxcQ+4HDPnCWR6pfE4lsvjfPCDJ/hraphewWisKpjbIV39o6LyfmaRh2gAkirFiCWI8DZRJ7RF9HRI25Y=,iv:z0gPB+pAHC/sBU+hjMw66wK5NpIvpx/XMvj0XHjbn/4=,tag:eG/iF4oq/s4jX9aBqXgsMg==,type:str]
     pgp:
-        - created_at: "2023-12-15T04:04:44Z"
+        - created_at: "2024-01-11T20:56:10Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA82rPM2mSf/aARAAkyHsIMZIwt8M3DpVkBItvEUc7oLEk2xpDU5Hn9GYCoZM
-            n+q7TjpRy2BLz6XlrYm7JoTfNjyWUhmB8B4PIr8lhKMl1cMHrUhH5b0PuLC3MH0A
-            8d/ER1BP0a+i4MI0PaMEr4Traxsv6khHnpBwGcKJv1T/sp2P0a4zzTktbQn1T86z
-            R5NS/yBm5PCzf8LnOMa/C8hE6gEJdzlslYRFDa2XcRy8YAAP4hipp38TCZ+13x2Y
-            WbZYVj6cSvDZcpYG8u5Asgt6DjAjlwXKuwXMeC82XTREbC3WnzkTmdPmogvM7B/X
-            JWD32pMzl5Tll+Ie+iG3WkPXtMyNF+NStcp5uBAWso/lj3hhr2+sRCSem8RT41i7
-            hb8plKAdAuGnli2ztfPuCCSjHetRj1tLMz7WfUn4MHX0ZDg1JOF2rnLTqTzyT42p
-            4Eh5jriOLLoTgg2eKiuJqAw+So6IZO4fVkz3tC4fi32EJhSjTwtu+ws3v4qwBmxl
-            dcv0Vku3rs8a6A2bi++zqVYEMoa5hVv5B3IYiORpzvjoU9uz37GccZmPEK6+KAwt
-            QYMyJRSI8D3KgbXFlYwPfvlxxTul0NpvYhDTHMx1PjdM3MT0FtxKaIZPabMs7QWs
-            Bj3fZf3uIKIl3HpLM75I7VwUiIM2X/574yNvdBeAaoUL6Bhi1nXp+OfnEHNtgDnS
-            UQFbzjNSqYHBFMUrgvQ4xf3fxfLDdSnoi53lQuJGtnItxm73uAbyZqKMBU9UsypK
-            RmV2QJMYqMBoSyotCxfdqNFQ4Xs/iBNKJhy1zLFlkskEmQ==
-            =WRPh
+            wcFMA82rPM2mSf/aARAAvQd7qO44LNyywY03qCXI18cx6nj9mo36ehJyq6wuYhWa
+            n95jXEsmRbGt2l8cAJrH9sZB3uE5DCfeZMzEiZ9heaAyxzC34BxSGP+4PBdRqp6B
+            jv7Ej6F9lV70bQYvDDry5ihWRmADEVrnDrs2+pXsMQiui9dZSGB676d2PIdliV6y
+            StqbyudjWZS6fLv2xy25yxJBfzb27rLh1d2yo/9AEm873bFVn7bXQxwOoud8s8KU
+            MLsQxE05zDQrzm+RpDU0mYk3X4ByyL0/J0dyipjHErOLhOCk2MZ4xTVW8U+Jefuu
+            htLAzftc9NGwWHdSVXqfwSWUq/UklzurPdDcA1riEqE4XmE74cdgP0vqHYeGPykh
+            M67Xcr1WLDk7i/n4EISqnp5qwItfJIxWlEpKNANEMveYggHXUz3wTk7qHwjpIDwG
+            7mMfKlL221M1elk1lY60bx//tr2ZqIlN9IXCjOUZOlxlqvYcmie09YbR6tRZAbag
+            KZcq4s5y5HlVQ10ZUe7eY8qjXMlLVm7N+TJRnfgJrr2+7GTy/wCcx5nwsVBeYm8h
+            GrHT3PS0CVRA19ynlEqF1jXfqlRMjX0szPIUGb6/7HLiw514otq3KuZmHYAq2TZ2
+            HMKncOptoUyfpG252v6NJYQC7yF76tdd5YuykeD40ZOBUULtvUEOZyZVdsaAU9zS
+            UQHygqf8d16qbh2rWK69Kqmc8DbZHCH/f1IDwekPOsNltQhdgn3lOP7gNSEwI7yV
+            /qk+5kVHg+Yk0l1K34v5aiWEGrI1SKd1m+nvVW7VcEtufw==
+            =SjUY
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-12-15T04:04:44Z"
+        - created_at: "2024-01-11T20:56:10Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMAw95Vf08z8oUAQ/9HBHcycrAjsZZPy4lXfp/nohb2Q/C6HIqdZBeX+2QevWi
-            ++KOfu28nUxXbnsIweK3o97c5PkhW+nEL77F7PLhwj9t7AYURYDX5NDYmz/b2HtD
-            DjOY2/4IOicOHSr97U1Kk2G9cspHC9yK2ZyOmF1tkT3D2ErR+SwjR8UzCJdptIYj
-            LMzjD6DvQeoYUFl25J/MnNMGnA5sc4cX3u0J8bENNwDEvsjnluHLswIyMVLSkdIJ
-            d9DtVdhaUfp5P4kGPRQS6XoO6vrUCiNajg9bZ8cc8OoW8er1u3EYsRVHq0Dgy5ik
-            /gFjMlGBi/vpOK4kksHrKqVTlhrHBdi8/NXXIQG7jq7kJcclOja/WlP4c/IbjmaB
-            /KPlKJz0AORlRY6W5RrudBgq5SNuhWRWoaSBgTdY9RMMVtnNMZCN700jY+RMGlMp
-            529WN3YBPJdlZ2PTZ6VXcocykNYQTZHkXCwOcXeC+azev/SMFK66/qjPXeoO+OGf
-            ByxrWMPZdROEa9itSl9Qarc2j4wlW34KmyE5lvVlEAweUSetcyMQmrSOEx0e3iay
-            EEH8P4ha/QDPv6LQbDidfkbirMFolJpYKoihOpdCV3nkcEyMAUlwa8g2KDlHAeRP
-            b45XZLoH6kQHg5ch0mjXgjZliAGE9R2cadL4hqi8GakLF56mQS0ZSp9sSnxSqX7S
-            UQHayV/bq/sAPA7KjAzqSgn6MfauLsrSTSyd8ERUI78oEPRb8wI12WTvfargJMBu
-            ZE8PZ+gLt7a3wHuy9woqrw7E5ZHRvAtCtiz7GSKLq6UNTg==
-            =ibic
+            wcFMAw95Vf08z8oUAQ/+OHoip407wu+pF9bWolOK+dViuRhA/X9JUVyQfJer9HM2
+            thZUChYerdnUBn674pVUkjS5szch19pdZLeK5/YqUXyWoW1qHUgYgzHHq6JvxXXf
+            PIC7Q+jCfsmDBGcSJefK9rA5u7S+7rULBZvbMbL7gpCG8cG0aXJBoNLzZ/vva16V
+            x/3Mn6taKjZX0ACeoQ4ma4HS6kB3Nz280S8PKIQeMuUQQfXNWMAlR2ebleovvmvh
+            pJtN0T5dMLEImexLFSgfPoU1OQmfrnQR/mWP0W3LtGn2o8EE5LordJSgMuwd5eqv
+            v+XOHoj5E5O88SO2mIwWY0Oh+6P5pf6PJDL8XLLq+0nm2HZrK1Ip8WvYar9xi/12
+            HClde7vk1ESWw9Kdiop6rSj7C7M3dD+95ufG6F3c1XJQkp3H+AlK7aTK3/rx6Dml
+            FekNVioLC0LjiMZ1ZeVBOtIYoXXyrYE8nQF9E6kkW/o6dajMDo9F0Ck5LWLiES/E
+            34bHkP3p+lwOOj0l8PONG/MaP5j2S8v7LjfuMBxcuoo1RhplLJQLUYGvkywmqDK2
+            2t5vqIkpGAxBN6WNgZt0OwcBlPC3PP3JHQ+kIn9Sk3MAR5plCAhkywTHFwoDBe1e
+            FnlmDyVjgOdtzZl3aNjz7uOiDtpecwPmsxah8ox7H5wOOagAabDhweFXh0IxKKXS
+            UQH4zAt2MLHWqAAGjFPFiYxb/ugU1R5Qjv6NKw8bWGFOrbexMiA2bCGOGmstxd7G
+            SU0tn54SBi+wOEDmJGnaZS89ZzGEoRm6LRJ5EJz+a03tTg==
+            =KOLu
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-12-15T04:04:44Z"
+        - created_at: "2024-01-11T20:56:10Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA0/D4ws+/KPtAQ//c9OUnOrzBXt5gg9znAI5UDV2SOhMQSYeU4FcBxIregXX
-            zphoVjyizZVDZinZ9JE45s1hYL3QTrqXQjk5dTJt/Jh0n6QeFmmSK61mY77/pJa0
-            byqW98/riEOilJrU0LWjGyJEfMBQHpVF9ilP/lMEA+PQXrSHlHH8cHPrM/xWCdP1
-            55BSQQLQxx5SMTeA/z6+Hpv1nZFsq8PQfps4Ul04xvBErd0JBuNwCg+tvCScO0gJ
-            GYeRMbYqA8UEeshzUcII3eXgMZmLrm5I5p+13gZxM4rzsxfcLP9WGUScGibP9Nh3
-            0PfwnorZaYcWQ4CIV52Qe/47ijKNzuHuBPrCWeDA5ZVKLybS5Ix0yk4HMBzxfWko
-            7K4l9lf2oARCVcv2w8dmWb0oB8ir5RUG9eElorrPA0cKWLwq/m/tbqGHjiH/UCkR
-            T0y01aw7gIa5afLp4px3/ccEQBX///uET163MPzY/CNZds+LkJjMGiFJSWRdnuUL
-            1TROLU4VKx2G+TPb9y13NYoIKZ8d/m6SSckBimFWN4Da5/2W0p8mjX25OrDCz0/5
-            NE4wOYtPKHX7xIyIUtlBEoPxU80Wo6lIqg6lKeZgfYVhLaVrw7XMM/TKD5N9Qhly
-            CbCpNBa1F9S/r7Y2bpeNakOZwMFHRdNRyF9af3OqRMe4KLosbI4B80+li002xNHS
-            UQGIMhGskPNdJz3HpUOF/EFOnP6Yt6uR6YKp3yn+IryuHZJH0r7X6jcYPmPfZ9q+
-            +ixORttAHB6j2qUp87hpmGOWWoBR7sSYW0bKLVe5lselRg==
-            =2jUU
+            wcFMA0/D4ws+/KPtARAArZ/F2Sh0LIACUnzLO45O0GsesOm4QS/vVEcZ0BDms/fi
+            Xe4mmJbYTvRIgWfoXpbt79UreBamMFCSpXBPJnx/d2F0s1RHxKvbq7LwNL/qpH3/
+            pUJuAbToVTqLyS329YfJVtGtfYRsL0nIyt28wNjz4XudoTfoaaegk+1SSpedT7gW
+            Wq4ipL3m226yXyTv6DTu61o389TV3H2OR18hawjF6lDfDSCYtNexRCxV3aSqkDU5
+            Ik9n9OkWrIgJ0ZM4DJ7U/Ltx9ju89oWCmjBfw6IPSkQGSBMNbTolVHdrFbtsygK4
+            FnHRJn75Q7RkrobkrusqypFqu+D9QK2tijOhahFxfdU/S/zWuzfPiKv4m+iwRo5Q
+            UeJ43uea8DtnfLCIHISh80mqXwhEpulEb73l7y80EdtHuRURlqer4KPmVtV2Q620
+            OyLHugmLaqJUXzC6sPyrWBO2tPMqD7JRA34fx5gOVRvyd6KdTc/Pn64/nbqWFcIM
+            94VIOdJUGoyDtxLVPu7nttlVddqn0obUmSuSvs1ouTntMkScRS6hNTptxS3BbQZ+
+            FDG/mLgArkrEk/2m/+OuxH4teRqDVcwgbKzkZWgZ0RH6k4v2BJSKnTT1S5TOjJg5
+            H/RcnMtQeZq0G67fz8uwo3Hqm6FAGBuaWkhtDknNtLEXHaOGE8IIM9L2CeLftq7S
+            UQGxv6DQZ7PpMjo4LRCyCHNj9ddykRneojKG5cjQxMhTMH2PmamfpB+c2dUSvqin
+            Ius8vdBiHGuvEwcdJQ3m7cYhkLZWuRgIqGpIrGJX5dvTIw==
+            =Hi+j
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-12-15T04:04:44Z"
+        - created_at: "2024-01-11T20:56:10Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA5Wf+FyJ+zFJAQ/8CtdOsQtfvw7MXX4pCaZ8bF1vDeMCjjy7N/Le77tDVm3o
-            aw1SaEbApxtTdQfnCACzhhBwcBFM4o40zndfhtovLJHKK3DYtEdC7n69YgHauiON
-            oYvzrVYFUxucn0rf0JGZ6hHT16jxIG9QGcdW206o0ulUw+4srNA5AdauFlIj0O7c
-            IyktK4WyD/5840In11YGUPLPCaGrzSkc92Jid4boY5ycSCKpS3cyfmO6a9sVC07R
-            FtyoCr+RhHjjM5Bbahi178wTVk11B26+jdlqdsRED1ZLyILZ72f0cn8sGKzt8E9Y
-            6J4UfwT7beg1jXDqmj7CGri/W141SGswUvZYx2++ypFOwjTh8a/goWeyAMl3uXrR
-            xxqkRdv0GfNAfTG7Hf+2tOCSBQicZKMwgsBXJI9lzjxIb/E/Ry0hplgAKxTsgbG2
-            hn9EKePuSvNYF00d0LKBHioXa4anEVP0bjWi9si1OOe+C5Esq6qMm0MfvQAFfiz/
-            s4/7sfeHBt1D6mx90/7BEKs2BNEE/mZ5JWCkp7cMTo1HSUMg5okB2+w8r1AUVMZH
-            0Asr0HpM6g0HfpZoxE1mX6hgfTrPkA1z8nlH0CuOrjUUVVyZ3WfgcPsCqLUOTOmD
-            0SDnIWWaGFLPmkjtufj/IEJF6GpZYh7AB8iVHs4sH0PyPrZDEJRJ3tf4qAYzKL7S
-            UQFhSykB1rVLzYQI5K+E7Q1mao0hRtsDTdUhwv3hj8oLGVMlQ6IPx2ObqMA9Nw8u
-            XHOz+uJRLpZ2iCCxuOFk9hPH16ZzHKQnt0CiD89wjlYcwQ==
-            =ptax
+            wcFMA5Wf+FyJ+zFJAQ//fyZa4Tzetgnur+02xwrfyxuU3Pvh2+NqSwFQCpo+reWo
+            bO59a5McV5rWnzL59r9XK/SGwBN87JiDFaTvpc2VJnGAxkz6vw5fuXQI7opybVp/
+            exqsqtR6lFLaznAi53oeIgBXIg2svOLr5tD6y9eh6eB4rGrbVf8T2N7TlrSal1RT
+            qoRjtLLZtNXWPMyIGUTjTr4HIUoYvScwQkBhG54R78PXtkW3QfmYJVqXlzTsbKrM
+            uAdC+Fd7k2ko39s64PPG6QsFFBg81UAz8SvQPfe6b8sv5IaVDBBk8IJ1tORX5/26
+            BbXOQLjyqdxHR9/KDeS/wj1e9rpRH3BgHybft0T9vBZyyBZY1dPAisRKXThs/Khb
+            QZUrEd9tNQqGhJrBEKGQuoY39G6mVOywvi4Amubg4L4VbETOD1CM8MMQFlhWmXDP
+            k6UYMY4vUt9O9/R8SljZBejO6Y2+smCzC4lDq5W3sBu5P+JnnHCnM0wgRoS1aCpR
+            tsBIKE1f+rlG+kb6eTGcCCR64H+TK9hT49MtbkFeKUO7rlZkbxqKgYdN/Q1HzCEW
+            YCYsxzJQo4mqTRQ4PYRvo+9Oo9gGtWY48H09qTGR737qayxA3VpdHepABBHC9nm5
+            BogU/3lTH9PzjESZkEckE1sx7QHUs39FiovXDgvsMRt6+wo6Y5L+dKoXU4MszAzS
+            UQE0UZL7h7N+QvTbujVrarB6A6vVlwjV0gbQJDRXmPw2awJjBvsjGNfLQ0mruwqb
+            RLB5G2SvQHiILN/ByD3NxhonQ90mPSjmVBfbdsOp6H4woQ==
+            =J+qg
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:56:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//USOIJ5cPWOQgcqjauvvccC22wxU7Rp/Bx86ajZFpL6M3
+            ns8g3TC4ga8OO2XYjLTHNXPAzPvEE5lskpO+bkDbqRPkkkGeauqupQTtDIMg25kF
+            ouBPcvCirWvBJ3uiHHKw1hvTMXAIwcdvIyvxP4zK7sWU8OScDw9nNS8uhOLH9wds
+            J+Y0qWPuxAJrJF8cgLORxjk5BFh5IdOrmijm72+qEHER6qgYgXoVVbGtIixUTcfv
+            H9TqxHPkeqgMH2QVGEGKGRueoUVWc0FXtVLNRKlZ5VYX+nZUBDdhVjiiG6DBkWtu
+            BayAhjRFh/oGs4Q+WyozKy/mv1hJvxsRjpyK78wYw0yQVuwfd/X73y2EkQQNquCk
+            SyzU+C+5+faJpf9HPq2nv1zrUJid1zSv01IE70OsRFAgKXI9thQlx3VIbLTU6RkZ
+            Bw6BsWoQmanUR3DUzWvL+lhzYLKhVQ9Gf9rPOK0B1XTvntTGgq1zOYQn/FmlhJjc
+            SJoXgNU+i9F52CGIJ0fTZaw+8+aJ6oL9SLETl4T9Gj/XCpuDUGJAMP++V7YLWsEf
+            5tqwHDngm5UJNmqy5vzVbQAIVyLCK868S4xNFRUFwQMCZCHQeW4MhVM5XFE0d0ab
+            A5MSm8X7HmYgvg+WvXzawyEX3OyAnw1RZ+n+b6w2NN8YLP1kRLjirDS3PbsLybTS
+            UQHc1/GvEhu+7CSv118mKOyJwOQ6u1KAblmg2yzyhxN6ZvuwNJ9zvSnovSALJHWQ
+            HSwUH1xcOoL1xQTwJ/+Ha/n1q9i2MqD4uLSP29yYGgdq1A==
+            =cXXw
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

kustomizations/forgejo/forgejo-ssh-keys.enc.yaml

@@ -20,85 +20,105 @@ sops:
     lastmodified: "2023-05-17T04:43:20Z"
     mac: ENC[AES256_GCM,data:ckF80Njd6BQXJpQ4X2z0Os5wvfZ2zjXVyTqtGQ5fFIBDoGa3tWgzIel98xIRgx4f71kKisBsWg3ofxn/3gG1DR5vx8EJwpekpcsTq1e8z4ZKFeGTIMwPb9GdWKUJBvuMxv7dQxmM6HgpwkUsEFUaxmNnOmetK3o1g9LMN0VSpuU=,iv:VTLGM8ZAFsFDNcUop6sqfw5QBRFtmzDdZHWxHMHmzow=,tag:e/KQ0ytN6HfSJohGAtGcNg==,type:str]
     pgp:
-        - created_at: "2023-12-15T04:04:40Z"
+        - created_at: "2024-01-11T20:55:59Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA82rPM2mSf/aARAArulfPtv1a07CnRJ7J2PV7gkuCVdUdSuCBDYdCinewbPf
-            MGiCEV5afgoWnEyzSCrSTbYA0MCZYcVB5FKc/JNrTFsqixGF0AoPUV5aZifF/FGx
-            I7IoKEkFk/3h7WbDV+TDDqdT18G+DAFCGwDkNrn+OYduT4dtsPFpF3pZc1H/iuKz
-            8RUKg80Z1xDOZQFmCCWVDO22meN2bnxQCCROBBB6AbBIKLnXJgEdKzv8jESD9GBb
-            pbtXaodFDYuXG72726URV5ibdvHRTPgAbYOELX0IKMJp7tvZp980RlVuqScqX4nL
-            gZxBQ2HqzPkAE15yhHNzmLFSssQVvq6TGua+BzLA4xBc0/iIJ9vp6XleEXGNTVh6
-            5dZnRGRrErzkzVYN/P6OgSrCQ2YPtYQ6r9OYcDvNorpWQjDg5Mj9pKTwe37Z68Il
-            E8dFonT9jWk9b5dWAym/jKo9KbmjhSf3fcUhtQJ+9E9xY5JBaQKEoDIUoqxK6i8O
-            wWL9N/G7qOZsfIbgXHYshhSQ49PKBE5uJInkw91rpEVjOh+XShq3xCSnXtIhpa85
-            gTjr5v/3RyuXm0T1b2fswNNq6hhP1EQ4Nk6FO2dBy2rr1xurYNlymQRjqh8JQ1Pd
-            ATTjmF8RzXUfcSX0CLaf8LXdBr4vzYyLqOlkiU/IB4w4Yjr63i3PzG0Fiq80q9/S
-            UQEhdhWOZFBmrkJWP+aUxwzJwNiDn/jT3LFj8YtOOkLgi41zcfGm49K+3WT0/kyT
-            KUTTMrn92788ZOVL/6iXLxho45gIgKaRzEBcVDsshnjfPw==
-            =0k4B
+            wcFMA82rPM2mSf/aAQ//b17fa5Vq5YOBP1U3IQHoNPR02E5cLzyzaME6tBusjQ7T
+            oh8DnleMeGfdX8DiiK22rpkz7mFMQWJ6Y8vjE6/s8mcZ1wRweZX3FGBVrC8xV/YZ
+            BayoWFuTuP1EbW7MwvpVg8mGUq/cnEbFa2huf5IIQfX/svNUXDOUh0kJgt581ZOk
+            O1xzw9iWxrg+gc8kGFVKeCwvJDCFtZyUhG76gN7hOVQ9S9mwLpclOcv9k9/EmwzS
+            4brGeMPhx252+yzpPtsawHY0Mv5hyet7YWDwJB9mAOs/hQVDjiIuN+mEjxeJLSJm
+            W8GtApoE3+WpSZA5SXWH7Phj56tUcq9BCVLOzz+puY27VnN6tT/vt17jReVWmIpE
+            /QW4XwPVbrR5lJLIHUwKSg9MM8HOyrPnqU9PmJa/t0cyXzcdFXBr1jFnpXcQ7skM
+            Oyu2gsUghtIRvYlM3KBoAKJ/GralhlQCXM0Dwi5azc+uQeaFYzBHhmADhDyj6xrR
+            e7cSbrho+hN16X2m09sKYXDYQQgT8x7sA/kXtF05/ZwB2KAYYQpegdQsqsg1FYrm
+            +ODUCZ2ygWngxb+9usdXYdo62Yp0CN9Nxl++4vyEav4yE8qi01fM/1ffvy71qZ1l
+            NVMgfz8R32wSYu/hJ/LZMqOHuXxRMw2ior8NOeJogS7wyroA9khVzN1e0mcw8n7S
+            UQFih+x4zMe3MeE3WVk0SypINTGeuZOuObSYLOlgkA6EeDERj4yxRwT8HyTjDVd5
+            nDF6sCSiRqGAh8FD6dbl7s00ojbO6ddakEApGBFERv8NKQ==
+            =VfN7
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-12-15T04:04:40Z"
+        - created_at: "2024-01-11T20:55:59Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMAw95Vf08z8oUAQ/+No7iC6UNWvHeWiGoefDcBwa+nJFbqS8dqVdK8xC3N+p2
-            SkZPoON83cb3qqFio51dhBghe+9ipXqrnGRq4Bmmulr9V++WuwGGqrmUW+qiXdsQ
-            BNghPG+cA/PdwnorCJT0jMs/BQV9AEEDzbPw/1R399zzdjKELBwME0USJNprDF/O
-            kQsGGf36vopDMk/r/A5msBqTkAyLMldoStQHoNgO9VCxIxiHaKccaiBzpHwIMgHX
-            VBixV8IUKPbyjBfdwFYDbaH6Gdgv+MMrNbXevzJCaimd1qyF6JMG9PboJzH7MNsB
-            sE0tsyhlAMntGIt4zzaM43w9S7lNclAc20DFQeaquY41jW00NkPv6cPX+WZNZ+w8
-            7nqOuKBPH+XtYA75Qr889+oSROkVTRqVbzkXVleve/Rhh4244LUu02N6sQH2RMy0
-            ijcoNwtjg2HpPihrTQaJFW8uCrTUnybPH1bS8gjvW5LGXQPZee+yZHLrO8VxSc0Y
-            5cV0DZurV1MNe+FCibMu1ttc2xWw/Jco53aMsPbEsf3cpahj17ZkYD7VnYy+6y5m
-            v2qkDPy5TtevprsYj6ut5uvt1aJ0TXrYZs2OPsV7sDPKmB+T2G/XeVZZRIzxHVsF
-            d38/n/lS+qgPkq00RKnmGrBd9/zv9gvh8Mm84Mu2tIBRIy6+VXoan2CLhHXGw13S
-            UQHvB5rxKaEf7Awlvj9a7GQJ//Q1/maPXSyI9McDlib/BrtaUtVju5H+2t3Q5fH6
-            vRuykOqvlxp51/QyzD3dEJzO1Sa6w/A8PMY5xNOhBtZ4wg==
-            =Aszm
+            wcFMAw95Vf08z8oUARAA1LwlzuB4j3Uc++61hYBnPuXepGx5ROaEKDt1sID5j4uV
+            RN1VXVpNxtqWZrTdtDzzb18uO2f0r3S3IgQiC4/L2/pHdd+3NA8gop5yDeBM+L+W
+            D+Ds6V7XREKl89iTr/kdbSvGxsvfOBofa2fZSmVQMamQJOR/enKe+cF6aO/k9q5x
+            GkNX2fTA8xIyyW1/C3xzu2+baCvYqw2rruylSaMr1wjqOPA3sB+1gwS6GCJyEzlA
+            I27bVozitZdy35ZqSaXl8uXvvOIswKfp6/rMVzqxp+Ng/A1BYWm4+PTSBlf0WCch
+            CsxP6aO6NvtPj3RvGHxD6lXmcaBs++j9a3nwIrBKPjJddEuK7Y8LQdANET0Smhzb
+            SuqLqt0uATxM64CVlTy9MnEun8wzbappRkfd4wz4EY+Yik5WdyPTYrIMqwIcCTWQ
+            IlQtFzXis/svcJVNaQ7iMlo10MtyVSuZ3Bwl+yj14Yjw8QGW6yrb2e3YNBczy8oS
+            1vtseN+Y0Bnbpv0amgubcQhSfi1PPdZk8N3TUugiaabin1CZjSdZgCLnaQvXfMBM
+            5Ngs9N2od3ot/IWUcdqUY54z876xlQgWLlwRBDeejAZSww+0Otd5DjL/h3zizmgB
+            wesl+3xwsgYBGAizALODz9wKuanADWi8zDSWTsxSytmYC+yj45sFuN582JKTfmzS
+            UQG+nmpI5Oa2Fz/MeCeYW3QrKvWHbySvefMg8IHDCP34c+8NQYA/N3LPrziTCUIH
+            drEgSYaT5Qqa5PPXqLFy1NIZV0sPzwRiH2k4f/yNtTTDNQ==
+            =zcOs
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-12-15T04:04:40Z"
+        - created_at: "2024-01-11T20:55:59Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA0/D4ws+/KPtAQ/9FPKxDZwv0oXfudToKgfLOr//SeLBV574qX42TI8iMTZN
-            bNooHAhoC3YUCQd2mDBwz48rtU0dZTN4bX5OrOaWjMzfUlsz43bVO7Jbd1iYATP4
-            Xuny27dYeSlVSnB2joQj/c/VDsMgXGg/tssvlWMKUtbNxYJZCXpxCoXjlQ0g85lL
-            GimTJKrsF5NTLDHE0EqGOJpsWJgbkNdaeJb5uq82YTUG/DEO4g+ZBPDOO/EpR1UE
-            i0KJ2CCqBaXICsdxc7ptxuFejj5coFWaJ20l8g3G2Sa3Y/SfJSvJgBzwnNMWSIXG
-            aJIN1lVAgZFHmfwnmj1DNTfeAvA6C3w/BxgJyltE7VQ6eWvvL5PrzCOVk/fVnISS
-            aA40CeW36XMTAeVaHcqeb0YAqi7NEvK+bNbeZz2vl2AqhOvbYzQPTGT17jBElk2b
-            zL39l5qLFQ2fk4Kle7bLqyB2GreJLfYvVkKrXHpXTJumkmlK10bNI99DOxyWtDgO
-            RpScF07AcSi80teGIuUVYShw/Cy0IfOUD84Rtlcy7DAuz085Y3AAbtUsALiyfhzV
-            ev2J5ZG/EgHmbTfwz2SXwRxMShvFYz3FigR6t9eBIJl/ta48jkjuMxEzvHMBaiMY
-            H7Emj/bNBQc8La80BtZZSzOfBTtoTDJ77z5xC6kC6oly9sQgbArdQxOfxTsEz8XS
-            UQFmy9jua7mKQUFJjs6Z6JtGszfpE0xnTKohLp2jxSpWheARCs9FSUABgDxlESD8
-            jsp+wsE+ZRdcDF/h4X/tTpyJjnuv+hp3dqKF7iqvVRpFPQ==
-            =XuOH
+            wcFMA0/D4ws+/KPtAQ//ZGceuRUrI/TCiQoP8CeqFjrWEMhOOoFNAAXh6NaETers
+            KJ9gMr7Qz600IlQUXSXqZ0fbzgn+46y0u2X5IPnMYvW9osxYUscXCwWw0zqKc7xl
+            ghPkwXTnDWRDwi6Zix7JfFRhHFGbLBeTt8T3fONuIkI9AFdjb4Kc8eo3c5hKxQq5
+            88ELoJ0Rtukn6+NQOlVVgrCwtToIDAiED28YDRzBgAcwcC8yECIQMhWGpA99udVm
+            xMT+PyxVr+dYZTHv+dcXojEkS9h0p75+2VSoIHomTBxZJSm+1U6dS0zEiFzvpYpJ
+            CO1+bre07n4OC2Xtzx9SgyvGJiLKecpLucm3v41Ofj25FRNi7DjQ94xxO6y+9/ZC
+            BViJ0MHRcNqywWSAhu6/ayK/XQMTCgW/bsXTdOhcQfMbO32k3h6vF+QciOnTCRzK
+            jsCK6KgmuMV3mowfysPRsrFA/KspYgeOPHLCMLQytkuZInY00u1UUeWNieD+zAN7
+            YvdQX4g347YSFkvBJg5PQlTlSWBPXVsKZh8D1AGQeRBR1+nyXjRS8AaMh0P9+TgK
+            2bPeBVgVySRxmW7MsF8tjPbRYyEZ/JBAKVcK2SMxldZIHRn3o1fD8BnrxK661+7T
+            G+QT/VQESfr8v4LM1UMEyfJpZGfZCkkUsSaG2T1UxXGZtEOuZz5N6K+DX05JLifS
+            UQFF/iLEZRj7q6FejBF6xzcr8uXqKdGENC95poYPSGRtt3ajH+2NqcT6FYapsG3B
+            zNVJFzjTbVqdZZvRMuDSzKgHngYOmQsN6vI3G3CQTcVeBw==
+            =dgQb
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-12-15T04:04:40Z"
+        - created_at: "2024-01-11T20:55:59Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA5Wf+FyJ+zFJAQ//cRW9mN5TEbjGKa00vdMpDvTMn0sDrID4vVuV64bu78/A
-            IVdoVPm/ZRT6gbHwLSWFX9LhtVhlHaL32cJXlkrJhvvdAE8SZSkfVBOECVmx0HVQ
-            9FF7KHesk0ROepSmSPVQo58GuDX90wtxhDWe+UusXQ75bL6513Xo8G2P2ehjlvpz
-            mQAt7GO8elyD3tlh2BhpH83KxpHILe0SGqzprU4dczHV4wNJOB7JoQ1mu8WhvgJB
-            i/Yk2TRxFKjnrpdjzyRwixxnBqVsI7Fbp7h5OFhO+lKraXB01bLcp9TnV8IoJSP7
-            7CgxqnFoNnGhWwz2T/JUgyeXqTUiwPDEZDc+BgmKLzmAEK2ztXr5bzXWirr+6w4C
-            r50PRpz2jQ08FW0xtb3KMFVZvsXzw1Htds7yL5/S0JFgX73ywCwg+jR7YG31+sXA
-            DFspgJ4vj44+nwLV2tVD2r6+tOKSU/1y6KYPqcq4dPRMeTHUb79tnl4DfZTnvnsm
-            Im2l0drMqSWuoMLOqcqLTtWBGwp4UBKE80rpohI5x802IfE3X2XWOMybRGwSHRzD
-            R3rCrX4EgJsNYi3UfqVunhVgtvYLmIFjXAzCs6hj16Bdb+Q/WN7h4K1WU5xUEPaU
-            9yW/lQWPx1QONhbBH0cxqVI4mC/aTRSLoUGr+8NtxnpnbjjKzkkr9aoNVGU2T9HS
-            UQHMPd+EVi45YFz4YRF1ibyFXYATLOe2OoWriG0RmMoBXYF/LUJqdlNI7nB4HpA0
-            /LcGIQjxpjWhvAsidWcqMAIKcwme8VkoXO0nj/20B7/rBg==
-            =4Kxe
+            wcFMA5Wf+FyJ+zFJAQ//e5fkIVBKl326Oo2RLnG99BH7alCyOqgN8DdOeQCFyLKi
+            5s6jHCjhYJvwcY48PO584AORxeansLdPsuA7rE9Qct5uL6taLMqMDhe8KD5PZg56
+            w+APV5lbqzWib/XK9R4T1sbtirl1W/photmZ55lb4hdjfs4x21QYjIHHYvMVLdfp
+            XoEDbpzfsqEwYkjbs7p6PSwpjhWxvdnajB3Yz3VKkXurM4QAR54MRNZM5tyGq4p+
+            If4vQnC2S481SFS3+3b+w2aL2cVj+kbW46F2ebitjb8kxW73uVgF/YvYEVooDW6d
+            dHkUy8136iWjfX3VIo6uUGOYAVBj6MEpg4ZwwX3vNbOFLMx/2WNhgRVISP94AQmz
+            4iEO4kxAztcNqbQp8Hv3mOlcP3oflHigtIph3uzPoWN8qPumRztHRKVQxXdhIjAS
+            087onTZDagZKLHkghdKXX79XkeknN5w0dBh5AclOYTO3DjmAQfzZ4q9bYQVafj+m
+            008BFMFpDLM8PdHJLkzE7Y2UNiPq1DkdaRi+yDB228RYZEv0DE4wXE+Jnf0o6qyg
+            WEpW2Tj82bMW0MkliMV5McVlDBuu2QGzV1bYYIL3S7TwQVvJmHtjsMoWq3hZOalF
+            aP7/n8UOMIFaxVCte5NoOAUuu2A0o34RkTHhuGXiUgoGa1wHX7HTyTSL0Fk8zezS
+            UQHs9QxMRbTjm9XszYVeMvaagWp1uIyDJ7a9wvVWvcE6KjMk5tP86lfZi1uVNZjP
+            YPGdlqF2/AhMblfpbOAKYcYMM6EZfi9a52HWA0CGLcdk0w==
+            =v7GR
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:59Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//Vv6zdFOfaj5O4sO5Y4c+o8YKVWnXl0jg3wmQAY6bpZ+k
+            U0TOmBvj745hnqKn7vlu3AWiGA/i2zh9EtWeajrm5py4rwVUBzHRSgVT0cZZ3meC
+            f3WMzIHz+HlPZULv8jXpAOoukM3i1YG3rlZCfD1v7teGKWxc/zdYnf1vGENqM5pl
+            IpKQs5jrrC9BPe6hvFapcJHa9k0vVnWOWfOwKtqGfMXC1qSgChZv8QzGRmKIF8TE
+            nC48JvL0bGT2YfeHMntgLE2Y25pAXg4KgpYTpxPbpUf1xZvOcmChoYtHmAkH5lrZ
+            adKRXGHpT1rDTiVhwtCPuzlqhVjAmPzWpM+odbZHy7ij5CYNj0dRrORmxa/9Iqud
+            rWF5kWD7MDRuzwwqW65LWZLP1vZaq2yVvl3yUjpV1DZnrBcLiXKhAj+ogx5hkuj7
+            U+auZYNMAlrkcmNADeZoAHTMdiksvldfgTu+dco1UoBlVTNsVDQz5hw56HcLGSM2
+            JPlCQiXuvIQvduAdZx/6V7vkIQ9YRhdqVa1uiPzYM3Dc4xXBWFFR1WMRP1/6OyMf
+            7pv5Dpyd/clK7LgMtnZsdJwKC29/XDrBPCHME9YeZtiIMoOpCPFJID4qMXTlQOMW
+            f/i5F4sLK0D0JB0PXNdJIH49sJx6Bh0j5az6Q/6C1CYnsktIFLjwvuscytreV0XS
+            UQE5kyDNOIzdjK8Urllbf6XK3C2i0mfcMKwRdGmuUeGUjv7qWjH0axksBZW+fV38
+            u1I8RjBDMHMBoZcseG+xrkXlMIqu0E3ThDg7DNoiooD5EQ==
+            =4v0r
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

kustomizations/forgejo/forgejo-ssh-keys.patch.yaml

@@ -7,7 +7,7 @@ spec:
     spec:
       initContainers:
       - name: forgejo-ssh-key-prep
-        image: codeberg.org/forgejo/forgejo:1.20.5-0
+        image: codeberg.org/forgejo/forgejo:1.21.11-1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

kustomizations/forgejo/keycloak-client-config.enc.yaml

@@ -16,85 +16,105 @@ sops:
     lastmodified: "2023-05-17T04:42:46Z"
     mac: ENC[AES256_GCM,data:yEhIqMzYb1AJIcKkU/8lizXMrhQf8Sm+WvTUp0O0OcBn8eP2RRyTpX5CCk0///Dv/FonfheKTz77Hfs6L+8OY3GU+WxBmo+5F9ACZ4aGLHldvw60gLH5J7PmR7TD2L7D0EE9OMD2EeTKV4NJA0AV63W7PT/Vr7rO0EITGz1RgCE=,iv:OwfyaH1V9KwkEBrrclSMqT5uDjM6s27MkJuQTGoWei4=,tag:65kiPK6WSIAReLJudDkM5A==,type:str]
     pgp:
-        - created_at: "2023-12-15T04:04:48Z"
+        - created_at: "2024-01-11T20:56:23Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA82rPM2mSf/aAQ/+N3nLRZZ7Y4as6ex0xVb3fLVr1EvpuI8nzhvzZFsi3Wtd
-            6VQSeI+nwvWdP3/jotpXfziTTuDNkz/izaPQfuYQlgBIKr3PefIS1gdKDp3xd6Yz
-            IyWCLRrpSqbraNo+BUkmJXsURvM+JQv0Jq1c8gC3rpGc7ZUO3F2cwsHUeZ8PsjCW
-            n5ZoL6P2Uij3P5EhXbXNY1zVTQoAKs6VPTaIi+9K1AHUcJlEhBa/Jvd8YMHWXzr7
-            aKYwzgP8QONBuJltKEKSmvOrBG7178CbYjVmBa5jFZYLXtjWn8fRiMK8d9wgyZli
-            c1u2H/ySzl3RdJb3OBbBbcDxofUL32Lkavq7bMShhf6x/T61Ovr3tF16STyHM5Es
-            y18BPJJt75LgmWcq8TOlMz7dXtVosm4dQJCEpm2nF8JsEqeqCAWjJ2dCj/GMbmtN
-            xbA4Sk4Bj3otopAyhaKPOh6e00qtFDck5QXm4g6K8tOPx2VCg/vVjVnlMb9tx8CO
-            EfVIhiy+J7xcxTengN9QK2Q30wk5XxTtHTm5Z+OLrFn2bUBZmP/hCzcCGrP3SXiO
-            wDDiuMsTdUYDAqlHUCpqR02jTyVQvsmpNV4hx3u58Ps9MsZXzMDjIbCQ4XEQoUPl
-            ZY4sqfr0T9IoxBPuHOlsnYLTqFH4R8PzKTEtVPf6T95iPmduKSMd8uqF/5p1LcvS
-            UQHwK2iL60rQRzfaRhZ9mxBbgTDdIgX4iX4ja6faxub8sc/AsLkcPjmvtze51TDw
-            WKmHc6hhbv+V3A1xnN+50bOBJ60kSxuWUNFTd3QeL3ag3w==
-            =+9mw
+            wcFMA82rPM2mSf/aAQ/+PJZZk8l5rIqLgeZzumY/oZYbgSLhB1+kfrQSFKuWlWU2
+            wO8dabV77egBrHrViU8ZryJeq9rEmAwEZPTlTbvGdP4YWkXuQvjcnG41a9047p4Y
+            t67hvZbqdrLhtpAbYYC4DqEJAlQIFC9CfCCHybU3NvxDOntmSoXJ1VRdDwxeT4k/
+            2/W/4XbzvrV3mK4pocHryFkWfitplt92TQS+N+Y5mrRZAHioQNvSjD+mB5qllIGE
+            OenplDUOR5K28lAhKwJi9YU+4Q+WwRILn4Anh2kbthkOKbR2V01XEE7rZZ7miSmJ
+            HSSebOokY0KEwc5TS4YJjz4VJ25UTcw74z9oZXFh5UOCCbiOHS3vRqd8ZvbAOtxg
+            N69bHW6I61EvAmNj34r8ZIPYDsAUmVWg3RODzrHv53XH+7TIRAVwtyf0sq49BJz7
+            NYOIoAh3gfdt6AcX1wzE3NPO6GaF9loccKHzjZlgPrcG+OIiCfWvLe/ZSdEfWOz3
+            2ts4TH2GCTt8y5A3YZv6TiJTqkeZp+aTKTWHZ8VPbb1f/K/LZCgy8xJtsdPAm76H
+            Hs0fra+/igXCcsTn1hy8ApBd0kQmtaLfMdABJ4rdeft8M8ZYUE3hx0nk6nAY73TM
+            vUdtLKYYTd+8ZY8e61Hop7MEsxnV1MRCmxQYNTBCCLXyEb7EXBAFI3Dd60C29ZXS
+            UQGgFne06+Ylj2sDkWOEVDe6YJJ9uQpFLuVS0wkZv5k1IkSgQn+vIZLqo5ltWFlN
+            5sovHvmmclSlC7m0G90ReoNpSWP7RbSddqI3ht6H5GVYCQ==
+            =HuH6
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-12-15T04:04:48Z"
+        - created_at: "2024-01-11T20:56:23Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMAw95Vf08z8oUARAA79ijZIjA4gAylCsa1IzFiCHubpz8KbjqJLQBeJN+IKL+
-            SowsAYEDiPskXDXKmaF/yWotWHjP8k8ccBu+NW93BOa9a+rWSSa+4M/b52mfWftV
-            bIqbUqRqFOnM3ApGzo/rXW3SRND1jn+xGcZhGz66bmYqFsj/gB1MYK8+Dujbe0wK
-            1fiEBE3R7uCjLUaciS3PGDgMA0zpch2i/qE5eFU5aC6iQYvwCTXu++G2zMZvWGPa
-            VB+FPVF2dS//56NToltxnL2h0ElTbc1RsHdPfBDj7M5MH7dFL3AOHzbYiyL7Y0pH
-            bKIHa/bE2umggB5Hz9QSP4e9Ne0Ln1qeUkfyrLLU9ABnNW6RmsR3h942y6K4m2QB
-            OsMXFpLUDAbUahAJYP3/tA1g51v8aJr3Xk7mZ5is1uxhTstMRGMs+GMUGJUbu+/d
-            4uRTr8FmJTxaQCI7LmFUrGh62NgnF057nJ2tKjyls1zihfQtPeQu7BYesKEGdotn
-            lU3RwFFiwDOou4XbOv5QGcTdUfbPyehJm3u7QdzmylGRISvvKM2TvaUND35+htkY
-            MesvEKnx4/yl5TtY7aVcrEEfUIOyE+P3y+BECQJBu0gGswByiKYUE75KseXJE0+b
-            O9Jd42Ek4sutArbWweHhPyogAignEYNfpRukJaKoaS8QSo6gF4QbofrONu7ofm7S
-            UQHu9LFJM9d4PT1bSOptDi0NGkswr0n6LCvRat04SOr+ataZKiN4d8+zwlc5IgC6
-            CgyqPYNKOzD/432i4Bw/neb6asW7R13Nj+bGoKySNDqxqg==
-            =WybB
+            wcFMAw95Vf08z8oUARAA55KjH0BV0S3PzGBlbxNr2864BRPbHcupAj52Smdh/dwb
+            0GL64ULgfFoytddgYXeXVKPwBw1l8UIZnRDoMZyeTlUGKrwR6UgAtYcs/BId9/jF
+            B8yJzLk19d1ld017Pl/3zGE6/2YxnE56MMeX+4Az8K1z1EBVOI5XFBjYz+r8tG0q
+            9j2ypWtzLK9Az0g4V5kTrnGQwA3NN3siF1Uo8lvJzL+YDVV7d9cfB+slYM0xBOKn
+            6amxxwKwRZegSckPg+/UWXZOdj6NEDpiQz94hQMm4Bm3N0HtrulATAMjAiTFfzst
+            W2R9X7U9FCMwhX1wi9QMVOy5crbBMMc3wmv0b3Ya+5smnrr/91ZDwD8s0fHKk/ju
+            BVMI9DaA7usAvlziX8LQv8Be6EHQSnBF3cDVQSTyM8TFtbQMMKMFQszbsRnvRqs1
+            k4b3veNYev8fJOK5JaQTJ+Wm7uFm22tw7Q6orSoPuD2+gIzfWzPFU1q0I7ROdN9h
+            sMc+/ytwKCU3oGbSLQLAyXI5E5czRJJ2797uwLQ3a5aFUSP3/iR/qfu4/MzGDgnW
+            XNVYadheL5xdgwnugm2CeYNwskZZXgto/bwiL/+jzeTmX9GfKN0+Nl2VqZTSRw+0
+            o9MTmKsZfq7BBJ/eOJhD1xK5rF2bvduQ9re4LJ8+31RGTN0eXWvQ43jU5FA6tF3S
+            UQHrcMjwQaVpVMNRH5AjrMS2ZKfMf+Ehbjoby6c+7W/zkOgYkPLI8dKFpUZGjPAg
+            YifFb+hBtcJTNiNJjVU/QGEenfMho9X9Uu0QmjyEbbXnIA==
+            =upcn
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-12-15T04:04:48Z"
+        - created_at: "2024-01-11T20:56:23Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA0/D4ws+/KPtAQ//XQYmjRThL7awYIjUEJhO0eztn95oYHgmoh/XDqYS/tI7
-            oXVikgiw/Ni0wec9a16PcPM2IGJmw32JRDinON2k3BKyjNjYwECoz9OwhErjwHsK
-            FrwSCn3r078lAJuQ3I5gWhE2kbcqBZsGjozJUL5aGZX45oHS2ngzP77iJ4MZJB0y
-            Sat7kZ2cvou6Fcu0XUoqMeW2AggE/SZEL7WpMD0Ofv4enT+vFMnNo7F4pzqbK/oi
-            b9aTJVCgkYsQIK7ras6iawgQ3NBTKWWfRpUyNW2SBmE0WU8ibXwGWAw0SA3ghfZx
-            dDjQvtGHTI70OYWpTQeBzPnI6eeuFpQJLvWLb7uirT25tgT/6sTF/K5OtlJUQxDW
-            VUxM2ayH4U4w4bq02UDRjB41+MFzbzYtePzAvpNumXjiPZD9A3lKPJyP3Q2EZZDt
-            UHI+YtfT3JwXj7UcfPzIlpZDz4mPpCbkgDGeHX7xetzZB3EWO8WRUikfhDTpyLBs
-            MzIQ03K3k6mfYKHwdkyToxYHjQosWLrrh4ZX/kWB1b50FpflKVsYbF+dqEnoLaaV
-            rgivG6+y65TTWhOt7IsndaDaYbowEn9rbKi59TSCi5EtOPFdKR006Nut7yjLBAZY
-            tcPIVNZ4XHacfLM8Jtfqfqtmpfc7Kc7LBRnd2m+F1e7MwaoU6w/1ij4lzOO8dh/S
-            UQGjxBDCYGf+rMS9kCDu+g8zrvZAqwaCiDXvs3eoIMIWh7TyjN5Piyv6WGPS/Abp
-            z/W84cK7QA1y6PJPlfynWDogcsToO/gL4m6plHAO1W9OfA==
-            =6wbJ
+            wcFMA0/D4ws+/KPtARAAt1m79BSP6vyV/zZNl+2tiI+1KLA4q+lMcWpzD4YAkWof
+            VDKGnr7sxDXA3EP5SZoCz9KJuKHMxc1cDgZ1AGNTNHYRVGyMNmWLbbqfX9XW6pZT
+            MuDr3W4wZc8aJP8sL8VjknbzuXTQPqdu8SYfHSPjXmNz3ai0h1dmYWJBF+2E7Uxa
+            r223JDz6TwS1VMk8TtJvlZgx+hCc1hroMmO5Su3CsbSum8ccRSPCOzXzURloM5Jv
+            xWZrmTWSsvg5lb8MQjnJ2ETG8alQDAZOgsK72Brq2baRZCcWJArFFMx7y0UlbBML
+            PYlC5QzsKFEnCC6lF+V1O1jUFgPYqs5Ck7H0kbfZbSCiF9fs7lhi2tQqRN1My7aX
+            cy5G+rbRg+4+TaA/xBssMiaCVSnI28zotrLX+Q5q+/laL+AdMSWTtfYbGpfEiLx0
+            ejWym/PJfgeozZsUXdcZsrVmMowksVyP0cnczNFBWbUVcSFRZ6+KaNBobjr2hiFC
+            NqX77VhkKnDsNE7HIo42yyqjU5ipqPaLp0qs6pQquWVNb/MBid07S4KBTQ2HJo79
+            tTki8djQBpBGPZJj1hwJvUtb+HuJTWEgI2Az6Pw9S70kmdWLSnp7aJtHAP9/GN+b
+            NainzJJ8mwv+03ohCxPHUercRtlSKjws6miCKQkxdGpqVCMrXlqx5XV1N3BX+PHS
+            UQGLbpsU8EovlP+jyc7WIqPAcGl6UGpHKuEJtk473eWKAwdoGdM2hug/83Iru6DI
+            pQN6SMixNNNpxvhoyaHhFyYFzC5Xj5YO/obEYpDfJa7tWA==
+            =TZtK
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-12-15T04:04:48Z"
+        - created_at: "2024-01-11T20:56:23Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA5Wf+FyJ+zFJARAAkRGL17Ca3/aoI9nlk0sZJ/rbdpDGI647hCPKA2Z8+ZCs
-            vXYlRlbv1/Q8XXuq7vMtMXByVRWDINEI2nPXIFy4uaETzwIvkhNk0IHArhLSoxx+
-            Ia5Xi8+atS3kABJcEkEuL0ZqcGjV6V899yZXVFe1l8eU9jK6aurSgKzvAi6RbXwu
-            qC6i0Tt27rROo2UBbsPdL0jIwb28Ki6qyVHVrjO6GBmKILklx27TUGedSd14LrIy
-            tnHTZFuRUUx+PxXh0260IlfBXIUklUeDBLuxc+y+M+0O5TkgNWU5LgTzy52855fh
-            cALuWyYL4aks1BjOvidEh2mL8vfzeNLWJlZVtXzYvAK6oOBiasllef22Mw8xfHNB
-            g5Q1AtHbOH9ukE+S5qclZ0M7rUz4uWYqFQIguFIREA+iNQPxcMBbDLS6X/D6yA6g
-            NkFjHnlcuyIHxaabdJFJzpWmB9xLSyG6+n+mOWECJ+98GqIy9Uz+Q0/4uYjDFKVb
-            9eORB8SmHMXLDMMB+CvXwtUj62cfKcvrmWAjB01OEsKK9WrTPKBuphIfgJIlQoXU
-            mQD9ckLjxNWEsg+7TpUlDH+mWYgElKlNAR4frRtUqGCjYZzwMv7Ic3vE9ND8Pac+
-            QAMeRVJg8+KtwCM/gBBc9QzzqptXTiy9gWjJMJxsziueOMmL3BUHVNWZ4shlD0vS
-            UQEJBcS4CIIlMTHUF7UiO6FfCemZ5t6e+8JS+MFElxk0OrJmT+pWPXtKatsn0E/Q
-            ff1G/j7NospD+pcCXG+Pgb4ZWpqsCkeJIndHp8QF3h537Q==
-            =s5h8
+            wcFMA5Wf+FyJ+zFJAQ/+OZlDJaJgpA0OZIXM4zRaDwztjdvrsmEkupUH/mC8sXsJ
+            1Q7/pVDJZqi5z/ewl2EJGyar7uvmgVVauvqOGVP8pIb04hL16M7p385U9VdBMa9V
+            IhBIYDKQi8Ia67xz6kQsMvT4zvzo52Z7opb6Rmxf3qQt919iOLdJRtJXUX0Vhjs3
+            m0zyBw4jji5zeBcfNWFxwLe8Ie5+0E2zZpyakQobTLrinEzTqwOpoEi6p18b6tWw
+            /tLHvi52TejXxkfBVsBzHMDz44WEOMu81BG13BY2JvSmOtj9+yPad5SMBy/4ugti
+            6YN974B7Dsetsm8UavMj9kU44nh14oZ8cPJ+sbf0POttSXJJY98+i5eUFptrIZ0X
+            4SyUo8wMkxHtDiL7rx3nkiglUkpG4H4+uzcaS0y/A9zlQas+igYL5YdE7CL/M5ET
+            V0UWNQEVqCk3EjCFYGR6Ccc3nGOtxnc3eWuBDBCd3oYINjqci6ZK+ds8yIqUY64B
+            Y29bvQvLSBGWkJs7ol86LyuQrFC7vvLZelsGvkSjwaRE/Be8AADgreZe1BHC91cn
+            eE0vr1rY8RcVvFjbLonzBhO9aMC5o1FkTbmKbpYcnrB7VyiierGMe9g7wRxcJrEh
+            SMvquMdOZxPgiB6e1yJ44WPsWHZMQvBjacCToX9LhIPe8QsebnrIHny0GYmYS5XS
+            UQGiVLKMnZJkACJGLtotqZWFPJi0oE1B+X3+wQch5aYTDWqtQqY9aDXSHbKSvZ+u
+            MU7a2nFCcMMrlM3Z/MzQNQxD5az/NivyIXjT1tOjc8PiLQ==
+            =3nk5
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:56:23Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//WXsaXLEl1BDCWBw0sDI02p8QKUosA9JOSr9Za5iO/G8v
+            Pn5JU1Fk5hAPvy874pk5jlGSSyXsO9b1PAY0i18kZ8/MMZgolyNgi/mK2B8QvixY
+            zOr6tQ2aG84tbVmBO9rt+AVkhggOx/gu3ZF3gWskjs3dY7/mD2krhNynIReQfTUc
+            MpOWmVsPh2x+8zJ7siECIkD4stNcgRGKAabQHRNig0Zg0dJhsL7z8tVuGzZGCDbu
+            q5fXPF0bM5Rb38g9DC0pXp1WAfdpCoSh8LoOrF7UbWsQFws4+looAoarFzk0tUM4
+            /XTZTzBEAhf/f/RX9yJku+14erwC7hnWnM7Yr2O19lfQ1ZNuOqkZKFLT8kV4PPcR
+            vB/3OD15HGvQD3T7DQUe9C1kFs3u1Kymk0SUocv5xTRTvbQQSEqe3KkEhh3yjb87
+            0ZsEczDafx9b6BSG7hEUyBhND9Rk1FjbGM0u1Kowy+oLMFrEQ0Z/wtm4bam5Nyho
+            5i7BBvFUquSfqh3zM+uzd/69G5AD4B+E3VDtz04cVqzNYbCmRP9Tof1czxiPYJ+1
+            kyqlk1Kd53zU2RtH1K66Dy3VNHtjVheccEHhRYCMv1q1g1+4LgdaBkouqfNld9Zc
+            9OfK8ZYeeH1iiTjgvSB2FN5ZBZYSEfs1Hnfw0XpyZcPXxPw+UA3h0awellWk7D3S
+            UQFE/ARKfbhBbLgbaCduwrF2sWLMAj5WlQv+z4QLJkWire4Z9A13qUEvUNvys+i7
+            /nOXorVH9UnvqXobQSAT8I91/LzkyGZB7lZrTnHzKQm6pQ==
+            =tZkd
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

kustomizations/forgejo/kustomization.yaml

@@ -33,5 +33,5 @@ configMapGenerator:
   files:
   - app_template.ini
 images:
-- name: codeberg.org/forgejo/forgejo:1.20.5-0
-  newTag: 1.20.5-0@sha256:d665129e66cc04fa72aa6a284eb98b17c0eee642aeaad7c88edec21f9edbf519
+- name: codeberg.org/forgejo/forgejo:1.21.11-1
+  newTag: 1.21.11-1@sha256:d036b8021aac6449e3a128fda50bae3598f1403578f3e83bb7717bceb60ae875

kustomizations/forgejo/postgres-auth.enc.yaml

@@ -19,85 +19,105 @@ sops:
     lastmodified: "2023-05-17T04:51:07Z"
     mac: ENC[AES256_GCM,data:VkAYUP6gCIxXq282+aeqeBj9kYNemw3C3k5+twxv58nhz8rFlzXKwEpRmi38WH1mM13bcp5usVz98pIKGZ00kh1BOE8LtvFbyUUBH/WqRBAZBFcuBC94Z9llVMDlZMaUTmSI6bPOF5ZMtB7YieSU8fgfWYm2+jaSLNPc3BiE3k4=,iv:ypClxnTavYFW3PJ9non3YKAUcLHjXN1YpaMIcVRw2DU=,tag:q07HOHb+Njn3xyZ/RgFJEQ==,type:str]
     pgp:
-        - created_at: "2023-12-15T04:04:36Z"
+        - created_at: "2024-01-11T20:55:44Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA82rPM2mSf/aAQ/7BtYLD8s8xFWnqmvCnMhPozumfMkX65AjVQob2a3dtLQh
-            TcBNbhXzLVOFy/qHS1t0hjBosv/BbmENhUJPcu9qxqfG1AAwHkGkYvEEU7gToI9d
-            cKvGopTkLEp8LBGtByf0CLM/dAZUFa/B5UbmGoKg66vuumzD5CH7ilJM8Rr5+rkH
-            UPvsB6RQpRjXuBijHT9oYDjjZd4QYZbGci9IK0vZfkEbPlwz1fXBBU5Knt+5FbDO
-            93RSq86+ag/QjyhB1XpOGIJksu9yH5RwwaTS7ZrdH63NKXoy/9ebSfUKFQMa6M3q
-            6UWHA/uymyizNWTRYGi+R7pF0mrtlFRrEahg/3sE/3eS4ql8EsHDKENlujpMvJi2
-            csoraXrpieKNSB2nSAYcKQ677I/vKYEPnmvdxpiIKBu8ilW42ysE5o1BB2v6wF7o
-            pyygyuv3TYsAd/6ckwHgjMrh02+6DN0XGDUueikbRUSQ9h89N22h+jVZtY3ba2lv
-            5GVllMFJJ140emcqvB7SBMrwTlWxjuiDcSskP6XGq9VGFUylFRmxt3coTVbDQbKH
-            PdwSbT5VGbIZpKJqSSTzH/oE+delB6tGIN96sfk26yFS5rb7eAxE3PBFdvBy4p+m
-            XuXN0y17a0sf6FGU4n08hbM/P7kTHrz1d/ZP6SPRiose6ia2qGTbkNfOkGUFFhLS
-            UQGz+onEB7cj1aoX+cF71QcD0lVmNkzby7KwXq34fh6shjZg0KwqKClgjVQhsItB
-            syFoYUYVGF3dI/qxLZIMnwUT53XeMxV3FAGZGrwsJRyZHw==
-            =OfGb
+            wcFMA82rPM2mSf/aAQ//X36TcJBQaG18C2v3vrS1oeUK/KFrras8tUCkO6ZNy5XH
+            AzTyOg/DMdQ8H0xfCpCxbryScNlEyANpXSYEEtRorwz9R0zghql0q0jmWNxHmIHK
+            034GeYgN/36JJ4fDoHS/SwBw6iCup62e9xKvju7ZqF5cRGoi1oaGDhsWsKJAHIEg
+            XrxWo1pvSd/+xonT5SNJfTgEIUdeHLZMygM2XtjB3EK/sxcmh35brfQihUyyQmU3
+            xLvHgMPUMidOSXVmSrzO6FM/MxFrPLaaF+Wy4b2o7iHFhMq8ZEbeUhbsO20mzM0w
+            GlgvmfyVFSR7s8SfeHMRzbVva9lEJqstqWw9dHUt3gtqdmGgQRuWyXK1L+UTDFb3
+            /nDCCchFnpiZggALdL0klB2NpBo5G3g5I7o+y7dq7ct3EVejWzFyFpaa3B5v/+3Z
+            9ZEuQW0DmFhQY506GDcjdDBVN+q2Xugejrfeojv0rCAaWt5BNnY2nAnt9T1faAH3
+            eTB3ZK1b2wexWODkLYkVgyK80PrfzPWELPqAAGjNr0Dh1otd6xUz0zdbezTUcc3f
+            MCM/17tCXSiHRXDeoeisdyUN3plcdCSnraEDrynVuC/AJf7LMzamCUXKlZsmcqt5
+            zsgEg6PBDhBgdi03rDrsoNqdhlS0SXsHW+s+pY7K5pSsgxP2SatfP00uKMmxgYjS
+            UQHUkEdO8hQR4L7GoAFFzY4tTqYJCKdnEU8Rl1MFyLi36dT124pSoIAxJ7nr+bjm
+            kbtMQx97E6YaUbcVHjO2w3rBuwA0o54mVLGum0BcQl8h+w==
+            =yHwp
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-12-15T04:04:36Z"
+        - created_at: "2024-01-11T20:55:44Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMAw95Vf08z8oUAQ/+JDfeG9ABthy5bwE6Ajg6BmJRvpwOTGn0EJLXPk3VzEfr
-            +Bu582aXXcx2iBz7gOWNbrFmgKCmkbHAqmsiar0qzpbv4CebElRiW4wxEu7bMcP6
-            ayrvt7PRXWdzVAUtcd/73179vwR8W/LWGzAnXWiQlIiOTKGIAPEBw68l3ZfPbSYL
-            eKU0baFn9AhsCdKiTW9XcETI7JMXq8g9StEPHgmpR6vtvtivKmBpsUHGN8w1Xm2I
-            WOBToAhSM7VT9OJWlYBAOXzy5AMlp+ZULGEEjE37qvn8FSkGPLoAe4psxIHc3BzE
-            DvHnneimNNuhlj5U258uE/M/Euuuici2uOErorclBVpM5UJUz1gMFkqh4IZoqoBN
-            a9DeCJX7+Ve7mFEHEm18ynPn0yQW3FQ12rGSRKWX9VUQJZx/fbmbrCILTo2pGmjE
-            IB0QybQQm6s+eF4fx8lb3RFkcgX4/Ny++u4nsFYHyw3xDQihx+VhIFzZStwS1CK7
-            AqqM67cmA/38jObMF2DUMKiHdHVNV6vnOhlKP1/aKUmOaUpUVTNXaZheUV2wiwW3
-            sZym5pi3wDGOHwsnXeuyRfQjU5y9yWVKYDdOEOo6+nHeHwStRZ0/hHPY8wYzH+te
-            H50tVhamMmiogFuz0afX8Gv7Y4uPcomExpi4k7CMD/iftdFT8Xfup4eKvAD30STS
-            UQEgVXMDXfOe6YzYSDoHOWCJePdJKP302Aox5Ut25eiBGynWTje//K3/3NljQ/gW
-            kvOVvJINP9Uj7nHyV8h0TB+0wkfZherpe1WpdCNmxUsEmw==
-            =HvkI
+            wcFMAw95Vf08z8oUARAAumYKOuwaWkecwAfuVYzQdP2sZrGkShRR7ycksnWgkHJP
+            85AP0cGTVI3vbHYMqhA0CmJ2eNFGrFWW8AksRALJhwgASRlORXBG3yIu7YpAUpkx
+            8ZsufOyM4AnJVvCkjuKtVKlqK3V1rcQlV28S6fD9crOv3lyGJiFZkS+DUsZZKnya
+            8ICePc7JBB6mWEshOEMpTK43NNl/KeEDWLjfCXiFdZ9wFnSMgIGe0V4mpD+JTEOP
+            MlRrmkrDKIK6SkzAQpFO9SITeN9Hc9A6rK8RL9AXCqCYwQCJmrs0QLdt3gkkJb3R
+            P7vV2kTYMV7BGiN9X2yJUzutgBjF+KGBh6+7IFzqpL/RD2tUOFlq/WlagPeP05rp
+            z21uWEco28i70WYaJ7hlywDJdO+W/hBHAIcOYhzbGyyKaeM4CE09UTvhohgTUTt1
+            Q6v5CffsR9AvurXcupesVRgcRaipETpN76ldKVvnMpDpl0qZ35SoZMFb85/VUbP5
+            nUnlPBJerarQbkPx0B/y/mTNo2VmzSo+FE1tSvzIMiFiSYnwhjdyeZnnYewOolqp
+            JT3/iMMaBoC6L0XZI+7xGoum/1Bf2N2L6/fxsfftDT3qEhD3KTnOGudwIaiN6tDG
+            Trn39y5jpsmWySwmDtTwcnKvuRzRHB0lVPwWDLN/QQ7u3Q9hpYiakKI0UoP1ycjS
+            UQG9m9CbUzkVzsThw4/B33zC1ODB/UWONwALPJ6jC852bq9Llto+t3xBJEnBkDta
+            /ji8XNFJdkPHmcK0+WIJoiY8xD64XQTaPhjlfoFE6xzaRA==
+            =Bi7S
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-12-15T04:04:36Z"
+        - created_at: "2024-01-11T20:55:44Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA0/D4ws+/KPtAQ/+JMMnlkw+Oew1aNjuWxJw5Q3acjdS9GTEmy1VbOcAgVkO
-            PGHG8bAccNOYNdiriK/fO4bnpX92p2y6a3PZu/uTnCj7Kx+2rpwI7xdnfn3SLUMa
-            SIRKHPynllHdXrPlxd6I/XRs6tW/1Hc0Vmfbt/ki6RFVFUxzBTTu0XG5UT2sUy3r
-            UDaTO7XNJSlU9EhzTqUx9WG0BJSsbLfaIra0UA2g27PgT25becCsVZYC1IrIgN3C
-            pKRK0m7ig/0S4YPjsuPlQ6bO9MIabO0RbqEDTFyOMctOBSzI4a9oyIaqB4RJQrHM
-            a/lLQADBJBTNlIWXnIKYN5IrQHfnaRngtf3irVNp6Xz7jZPGNBqqlrPsK4amfncQ
-            lCqJOzntxRRkHr4BN6hqyxMrVn9gyDWkKoPAYXKcYzj8c77Bc6injM9ulCGTFHsF
-            MP2zjf3ioGYnPX/DWLv2avx7NVzvlX74w2t9REHktomBZJ/Z52/6tAMXwlJsH28F
-            D1PXtd9NODmE0VDjV0KXy9XKzP4sm1PpDdqREDhyPjNLFsoq8Tb2VvsHCJ6qyHyw
-            6Q9BxXmsHaMUkcgYlLmPe5SLyp8p3KfazwEB4FNzYfI3vb62qpch3IJaW2rj+VR1
-            Jkhc9+OzkEy2lO0lOjZLKTK4jGcj5k4llEHrXYDbU/83BVVWISDryLVwZJI107DS
-            UQGSZSkTQOOdvhHJ6b3WMJGQojdPNCmpfx0dqjAdC5DQLLA6FTzOW8S+1dC0MqFP
-            6LjZmszAbv/9UJO8G7AHXYRa5kO5djOX8G8g9og8RKz7TQ==
-            =pRiV
+            wcFMA0/D4ws+/KPtAQ//dRWxqZmpBCCrTxdHCsZpOPfoWhkU3rQv+uoc+0fPt2x4
+            fASTf1LFwPT4y7KkTxf9lC31U6kwkjb7ffZjj0JXFfNpVmusWXO84HDsAQV113tT
+            P/gqIK/x0CmR2K7SOiSdPd5XYKjEAFV0SB32It2MD4WjgRoXmYAxv3DoNQl8DL0f
+            6QHjajKpgHxTY+WMM2cwA/xIvA0DktkkowREorSLudvf+3LG/QhEFGc6aBvRCfX7
+            O+ik27dgSNFVwPlyQtF+nJOltcSPTLefwt6PCw9NZef7vydz7Z+MdyxMm5T1fJEf
+            1Gj2YRp1HCwXqjpbYW6C0rFi9fHOk8aeqY9yEAhxm5Khbjceercmg9Hkai1cw9Wd
+            bb9qM919ZIBJPDdnRq9iWMogRjXA/E7SJuKVttEV4HPW8fM/hDyqDmKE7B7uAxOR
+            TSUHvtwZOZpYZxG6cTckccpJMaWl/xG+h3lKRTnnyQdxwqkkpb/UlvFJlYMTPuSy
+            +TSpUvn7NTLHmyVc9PphwibC9yklLXJyF63TsyYQ+d+D/ea5bzOYADVcFdFV2kn2
+            FqJvreQwVrLvVuVI6qCgg7ABZ1scTMUpwebq6tWNZqMP3VKR/mQlsjHXaVrnbqYh
+            hQbMSW5kpqASIhsU+XIDIZgpUkv2ZmB0wiD4HaosnQf2nqVtznCrXYFd6PDIavLS
+            UQEptmAnRKSByvxQ7ervh6PRYv502QyuCcoFjJd13+Wx45AjbsEodmIr2WmOc4ts
+            Gikj6lDoxpNQ3t4kh4P2+pnSuA1+DbcbiN1tYLnVJbxoRw==
+            =I96N
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-12-15T04:04:36Z"
+        - created_at: "2024-01-11T20:55:44Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA5Wf+FyJ+zFJAQ//aOeuBGx9dV8oQoZ0LmJykZ63gDw/zwL1+7dcx+tZ22+j
-            UAtt315rmqWyPR6I4uyPs8123hM1HsG+WEVCGLuit0YzOC4yf40g7M+870bITe+f
-            9phyl53SqiuWyftIGg99UvQi1JR2TUqTBn6Uhew8PB4HuSRDfzlsn3L47bg/x9HZ
-            uhZ13ck4Mr2mZA0E7I2BvNfPDpobVE0bkhwAxMqDMwejBvZ7nO7NTK4gSwLRk2vI
-            g2lN+NsdGixnpVCfYZHHpfE2FHKkii8YEEavmGU2Sr9/raBGTbILZYzR60AQD8k1
-            cFJ4RkC+UGpVwg1sMy6jHIs4oT0ePv+QL8VJSK0WRWdwRvh3yWSJ9S6/rRFoEltH
-            imDSaMe4UuyC4ky2on4yznzqnDRdwVPAKKPjwT8eSSmAYZEvXLvWx+gYeiypezWG
-            NZX2DDiSRrj04ZBBJulCypXyDT7MmYhaAbP/tIxULh+Td07UTWu0vbFlbBMKXDB/
-            9hry2MjNY2mrsFqVWfFpuVwf/fbvN2p9JoDH8Ev1bBSxpfFXuZxcC9lgvqxYZbpR
-            C9pYxtzAzqouqqqZX+YChlpSfgMG7UVvq7WvTiPFCCj8Yw0XoXkJ7ab39xYcJpU0
-            Cibt3rdTwIcjKXD6r9bITjSRhJs4y46OsTJvzDGJeFHjF381ROBOzZVeFSVa3CzS
-            UQGNWmwuk6OU8e3HuRdHBF3d2Atvdl8p/VImrAMTirtEsUYDgG1iAo2j8jSSnmnU
-            okbDFGibgSLiyvj7GgQ8THpLzZ+731ttSwhm8NK4XRt4pA==
-            =2kUO
+            wcFMA5Wf+FyJ+zFJAQ/9H9FcbLmgNXMAFjy3FLBn2Mp8sfcKxsSootQkCBjk3vWt
+            cjaagdbiPnYox1jnR9y8j2xZLz+eIPkZI27b2AWlOWHGG0/vwOPNtMkkpHMbBxjR
+            6D75iPKCwbBe0xv1MSIFRuy6ZviCRFm3EMXl6XKsuVHIiZ4JudDxHdkm2XvyhyK/
+            AVHKhSLqbFlE9ODyTmeuvJINM7f93VxeO3YDD7+iVGoiDphE+7dxiNSpw+z9YbWI
+            Qj6oao9VskDo3DwQVECL2ewnhoWQXeUij81uLrXY4woO7WXJ/tE628zVycG51J23
+            9RUkxl5QsdpgNYk8FiqEwkpK+rD8IOVoRktIbfgM4mSE3sEO5aeFQjr7wqnfQHOp
+            bgHqzW7fpwGfIrrQv8Tetz3X2dwjMTFxWxUwysEA4ZXKYU/mrB8n0ilGsc5nStGi
+            hh2jc2xf4C2NZXgEvLhth01FFeHpkMIIwymV7795YIxGvUWnqtD+TYPPwKAsldol
+            Rraqgui7BxRLQDyrU2uR647GHjVua8XaFIGoPXoMc11oGFFyw0uaKmV69lHkwXLo
+            bpaUJrHPfB6nMv7pxySSLPHwhRkgWLI/h5h3sZ2akluC4Mj2WyZ3L3y/pwCAnjaS
+            7ZeUsNgv7cKe/1WyuhOvqUM0jQc3Bvb+9MqrvLcyIyi3Dwg2Ts3suWxFifsKS8bS
+            UQFO3qTmZ8WVILJ2beP2Pf0PJFQAOxxlZ+52krEab+l9lelEImT+2bjPz0x26pvY
+            tFteflDpl6lxE7b5bB/thLkGKkeWCtjJ/ZSK/zjScEwv1w==
+            =nvXc
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:44Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//e2XJC2ceYfEuTxuXtTWVCtiNfcB4LsFBStiIe03ZAGvz
+            QFVXwnbhPx1dVHgvV76968mgdzD9sGTkauZ/BjDt5sK7mJcupaFL+pwqRQb4F3gr
+            forkWbhXTkuCxxtx3/qNi5flG3pFbflv97bvQSi3TPwkMepQfznIS1h8ywiExU6e
+            tuEljq7K01oFFK/T2nJDK2bs7nCv8+A09jNkTEku5LNOwbsX0tCmSapeEfFh4lYq
+            17JbzBVKRzTwolIC1C9gGexwOiewA4TDVNmyN5pKy8pLwGNHC5LN5zdPn9pkT8jl
+            HPfZkwIABY/4eXRc7C8F84U5puRwTYNv7yF3ur7WabKSjo0QDefmGO6slJOQwHHG
+            /xeAof623qMD4nBhi+V05yhDLBDbDhO/9lvk1adl2EvdG63fTITQku7ld9XRBtgL
+            AYPp3wo5GKYfXXADPVnSf+uXsuIkH14OEtBKORrw4KmLoQffGZ4wr6GMQJ8ZjrDp
+            BWPInAVVACSK+rfgMr2um2OmrgRfA3yldDqLaq2AzNAjkJfNOtLsZNAANSIOi7bz
+            rEVGeIts98druhW2JrQK1rR1NfV6SYtRVwIc3NBVIcPQee6pBHj3/EONdf6IYFhe
+            B9TJ+WEpfz40YAoFwoLuFtckPdiln1vE0V6mVjGAtDEztxeKopsHSYlOmd4eMLDS
+            UQFQuiIkYKB+HuVFIX+2Fqu5K+evAVfQdnnu89bMZjI2gtmGp9pz9DjLJP/aZBjd
+            ymypRlKY/W+tvqda86i+NUvZlltkR3Y+LQn7GLQqKn5I4Q==
+            =rkGs
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

kustomizations/forgejo/resources.yaml

@@ -43,7 +43,7 @@ spec:
           type: RuntimeDefault
       initContainers:
       - name: forgejo-ensure-directories
-        image: codeberg.org/forgejo/forgejo:1.20.5-0
+        image: codeberg.org/forgejo/forgejo:1.21.11-1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -61,7 +61,7 @@ spec:
         - name: forgejo-data
           mountPath: /data
       - name: config-templater
-        image: codeberg.org/forgejo/forgejo:1.20.5-0
+        image: codeberg.org/forgejo/forgejo:1.21.11-1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -79,7 +79,7 @@ spec:
         - name: forgejo-config
           mountPath: /output
       - name: forgejo-migrate
-        image: codeberg.org/forgejo/forgejo:1.20.5-0
+        image: codeberg.org/forgejo/forgejo:1.21.11-1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -96,7 +96,7 @@ spec:
         - name: forgejo-config
           mountPath: /etc/forgejo
       - name: forgejo-oidc
-        image: codeberg.org/forgejo/forgejo:1.20.5-0
+        image: codeberg.org/forgejo/forgejo:1.21.11-1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -120,7 +120,7 @@ spec:
           mountPath: /etc/forgejo
       containers:
       - name: forgejo-web
-        image: codeberg.org/forgejo/forgejo:1.20.5-0
+        image: codeberg.org/forgejo/forgejo:1.21.11-1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -140,7 +140,7 @@ spec:
         - name: forgejo-config
           mountPath: /etc/forgejo
       - name: forgejo-ssh
-        image: codeberg.org/forgejo/forgejo:1.20.5-0
+        image: codeberg.org/forgejo/forgejo:1.21.11-1
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

kustomizations/invoiceshelf/env.enc.yaml

@@ -0,0 +1,117 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: env
+stringData:
+    env: ENC[AES256_GCM,data:eOLjpVzWl5bamDBmg3an2DrYKJcyMve/RkHha5PvsPFInQLJHlPm0qHP8AucafntFbTg2tV5umcnlJ2+aqNv5h1UF7QGN1oKhe8VTHHxKG4fZWD+m+j+UfpD6eA8dmEf//npgiJsBAx6qRBDWN4SxkryNAP9WsiiN9+VMsJdWe5ItQYQLU+uPNjDHMjYnw1p/JcIxilFFMn6GSV4Kc62ilE6oU5cUKk96xm/JzIX/T4GZ9q3LzCdJtaXsNic/9i6EDDIxNsLYzn0A+T1hp+jZ4k4HICx6ATPA85k1NhH0cH/r4aOv9BYed1375wkWWp4v3qzC8paHATZ5pyPeUrpJqd/uPAE8IYO3sDTimWBKU7X/O0lfTO4tiNVQFDF8cXq8tRJlZWogs67iSSepjb04e7a+OFW9f++E4eeXrbSsVw+YW43Rtbhjw0qlVBM4nBFCchiZk8etTIFkfVvbirvdcLCOCtzjtYO8rVNdj6tzwBFrpFrbvCxgEMLB6P6FwM5epMfiiOLF9DT+ljFeafBEXvy+kU5afYkf1Sh9HNvvs9ifOILyFXjMXb9jAKvNPqd0rZPOQhyvBIwRlhbsWfPO4owa/mFpNmU9mYOwHSFrVZ+V5bDAzXTQ9LKS25/NonBil0c+99peN09U5CwL1gNOtRIaFP3VlRR3/FhUwyKlgeq/Ah0s6jYN7LcNyTj0PKIMjdLotO5XHssQW+Z34s0EDDdkH1t+IODbtE39oVeErfatj+i3kFNSL+E6iVbe3KiWLIWm1xDf0pP5PD/N0OVi6abj/2OD5ClylDzO2q7dRKn3aHlRAZWXeQGMq9hxJm6VCP9HspQs+pGjDiMOs/cYib6LWkoeVN3IDV9rQ9XHeHKAXOQYVQ58auuYAIJ9qbLG0+YQvHoHiFtuK3ucXMbq17oQ/NjZEX/e77ZZCYTfxuxhW9Zwa1abojIwrfKSyhoh91HHvgYmOh8hU+gCthWDNaPJ8XIAaGy+M9V7F2TK4V2vPy6xLp/XmzPUchO78/ZcW71jPDoR7pV5I3vab+c27EWlPw4mv4U+emnVZ1L7VM7+EkpsXuncNaKPCaFz1LDl4sbaAJSS2UK2ZfBBbM/EcGT2Ymm8jOjBwHwDi2VqN/CHMf6qG3P9R3XN/jNU5ShR97D52mSE3zy25wJHcv4Z8iSu98KEC9rNvJviPjncftWkycGjWFXx7mLwsKo6VyfUn/OXuk=,iv:HXTsRJEHxceO1HIA4CaR9CYt3oO18+cdeTAiBk4w0zo=,tag:e44hqgGLC9ugivxaxr+0Gw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-04-01T03:47:06Z"
+    mac: ENC[AES256_GCM,data:mrjkTQF+cKuNzbaAaflQCTMT+H7D0dKL6keVLs1ig6ok4Z6JCKxe9+1Fa3q2OIpgq0bhHZqPPe5e2ztQSAzFC9z6c7YCHGh6kPZ8fQ7F0l2dATqNSeaRMsjsMdo7vOOQjNqj0SkeU5c4PSQpQHz9Rg7CtMupQ60iLbsm8GGM1tU=,iv:uhzyxgDSdJ/jw0qZyOddxP3JZ3S4okuWhZdJE22nDEI=,tag:EYe9MYxL8QDPe9Rf53OM+Q==,type:str]
+    pgp:
+        - created_at: "2024-01-11T20:56:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA82rPM2mSf/aARAAvQd7qO44LNyywY03qCXI18cx6nj9mo36ehJyq6wuYhWa
+            n95jXEsmRbGt2l8cAJrH9sZB3uE5DCfeZMzEiZ9heaAyxzC34BxSGP+4PBdRqp6B
+            jv7Ej6F9lV70bQYvDDry5ihWRmADEVrnDrs2+pXsMQiui9dZSGB676d2PIdliV6y
+            StqbyudjWZS6fLv2xy25yxJBfzb27rLh1d2yo/9AEm873bFVn7bXQxwOoud8s8KU
+            MLsQxE05zDQrzm+RpDU0mYk3X4ByyL0/J0dyipjHErOLhOCk2MZ4xTVW8U+Jefuu
+            htLAzftc9NGwWHdSVXqfwSWUq/UklzurPdDcA1riEqE4XmE74cdgP0vqHYeGPykh
+            M67Xcr1WLDk7i/n4EISqnp5qwItfJIxWlEpKNANEMveYggHXUz3wTk7qHwjpIDwG
+            7mMfKlL221M1elk1lY60bx//tr2ZqIlN9IXCjOUZOlxlqvYcmie09YbR6tRZAbag
+            KZcq4s5y5HlVQ10ZUe7eY8qjXMlLVm7N+TJRnfgJrr2+7GTy/wCcx5nwsVBeYm8h
+            GrHT3PS0CVRA19ynlEqF1jXfqlRMjX0szPIUGb6/7HLiw514otq3KuZmHYAq2TZ2
+            HMKncOptoUyfpG252v6NJYQC7yF76tdd5YuykeD40ZOBUULtvUEOZyZVdsaAU9zS
+            UQHygqf8d16qbh2rWK69Kqmc8DbZHCH/f1IDwekPOsNltQhdgn3lOP7gNSEwI7yV
+            /qk+5kVHg+Yk0l1K34v5aiWEGrI1SKd1m+nvVW7VcEtufw==
+            =SjUY
+            -----END PGP MESSAGE-----
+          fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
+        - created_at: "2024-01-11T20:56:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMAw95Vf08z8oUAQ/+OHoip407wu+pF9bWolOK+dViuRhA/X9JUVyQfJer9HM2
+            thZUChYerdnUBn674pVUkjS5szch19pdZLeK5/YqUXyWoW1qHUgYgzHHq6JvxXXf
+            PIC7Q+jCfsmDBGcSJefK9rA5u7S+7rULBZvbMbL7gpCG8cG0aXJBoNLzZ/vva16V
+            x/3Mn6taKjZX0ACeoQ4ma4HS6kB3Nz280S8PKIQeMuUQQfXNWMAlR2ebleovvmvh
+            pJtN0T5dMLEImexLFSgfPoU1OQmfrnQR/mWP0W3LtGn2o8EE5LordJSgMuwd5eqv
+            v+XOHoj5E5O88SO2mIwWY0Oh+6P5pf6PJDL8XLLq+0nm2HZrK1Ip8WvYar9xi/12
+            HClde7vk1ESWw9Kdiop6rSj7C7M3dD+95ufG6F3c1XJQkp3H+AlK7aTK3/rx6Dml
+            FekNVioLC0LjiMZ1ZeVBOtIYoXXyrYE8nQF9E6kkW/o6dajMDo9F0Ck5LWLiES/E
+            34bHkP3p+lwOOj0l8PONG/MaP5j2S8v7LjfuMBxcuoo1RhplLJQLUYGvkywmqDK2
+            2t5vqIkpGAxBN6WNgZt0OwcBlPC3PP3JHQ+kIn9Sk3MAR5plCAhkywTHFwoDBe1e
+            FnlmDyVjgOdtzZl3aNjz7uOiDtpecwPmsxah8ox7H5wOOagAabDhweFXh0IxKKXS
+            UQH4zAt2MLHWqAAGjFPFiYxb/ugU1R5Qjv6NKw8bWGFOrbexMiA2bCGOGmstxd7G
+            SU0tn54SBi+wOEDmJGnaZS89ZzGEoRm6LRJ5EJz+a03tTg==
+            =KOLu
+            -----END PGP MESSAGE-----
+          fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
+        - created_at: "2024-01-11T20:56:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA0/D4ws+/KPtARAArZ/F2Sh0LIACUnzLO45O0GsesOm4QS/vVEcZ0BDms/fi
+            Xe4mmJbYTvRIgWfoXpbt79UreBamMFCSpXBPJnx/d2F0s1RHxKvbq7LwNL/qpH3/
+            pUJuAbToVTqLyS329YfJVtGtfYRsL0nIyt28wNjz4XudoTfoaaegk+1SSpedT7gW
+            Wq4ipL3m226yXyTv6DTu61o389TV3H2OR18hawjF6lDfDSCYtNexRCxV3aSqkDU5
+            Ik9n9OkWrIgJ0ZM4DJ7U/Ltx9ju89oWCmjBfw6IPSkQGSBMNbTolVHdrFbtsygK4
+            FnHRJn75Q7RkrobkrusqypFqu+D9QK2tijOhahFxfdU/S/zWuzfPiKv4m+iwRo5Q
+            UeJ43uea8DtnfLCIHISh80mqXwhEpulEb73l7y80EdtHuRURlqer4KPmVtV2Q620
+            OyLHugmLaqJUXzC6sPyrWBO2tPMqD7JRA34fx5gOVRvyd6KdTc/Pn64/nbqWFcIM
+            94VIOdJUGoyDtxLVPu7nttlVddqn0obUmSuSvs1ouTntMkScRS6hNTptxS3BbQZ+
+            FDG/mLgArkrEk/2m/+OuxH4teRqDVcwgbKzkZWgZ0RH6k4v2BJSKnTT1S5TOjJg5
+            H/RcnMtQeZq0G67fz8uwo3Hqm6FAGBuaWkhtDknNtLEXHaOGE8IIM9L2CeLftq7S
+            UQGxv6DQZ7PpMjo4LRCyCHNj9ddykRneojKG5cjQxMhTMH2PmamfpB+c2dUSvqin
+            Ius8vdBiHGuvEwcdJQ3m7cYhkLZWuRgIqGpIrGJX5dvTIw==
+            =Hi+j
+            -----END PGP MESSAGE-----
+          fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
+        - created_at: "2024-01-11T20:56:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA5Wf+FyJ+zFJAQ//fyZa4Tzetgnur+02xwrfyxuU3Pvh2+NqSwFQCpo+reWo
+            bO59a5McV5rWnzL59r9XK/SGwBN87JiDFaTvpc2VJnGAxkz6vw5fuXQI7opybVp/
+            exqsqtR6lFLaznAi53oeIgBXIg2svOLr5tD6y9eh6eB4rGrbVf8T2N7TlrSal1RT
+            qoRjtLLZtNXWPMyIGUTjTr4HIUoYvScwQkBhG54R78PXtkW3QfmYJVqXlzTsbKrM
+            uAdC+Fd7k2ko39s64PPG6QsFFBg81UAz8SvQPfe6b8sv5IaVDBBk8IJ1tORX5/26
+            BbXOQLjyqdxHR9/KDeS/wj1e9rpRH3BgHybft0T9vBZyyBZY1dPAisRKXThs/Khb
+            QZUrEd9tNQqGhJrBEKGQuoY39G6mVOywvi4Amubg4L4VbETOD1CM8MMQFlhWmXDP
+            k6UYMY4vUt9O9/R8SljZBejO6Y2+smCzC4lDq5W3sBu5P+JnnHCnM0wgRoS1aCpR
+            tsBIKE1f+rlG+kb6eTGcCCR64H+TK9hT49MtbkFeKUO7rlZkbxqKgYdN/Q1HzCEW
+            YCYsxzJQo4mqTRQ4PYRvo+9Oo9gGtWY48H09qTGR737qayxA3VpdHepABBHC9nm5
+            BogU/3lTH9PzjESZkEckE1sx7QHUs39FiovXDgvsMRt6+wo6Y5L+dKoXU4MszAzS
+            UQE0UZL7h7N+QvTbujVrarB6A6vVlwjV0gbQJDRXmPw2awJjBvsjGNfLQ0mruwqb
+            RLB5G2SvQHiILN/ByD3NxhonQ90mPSjmVBfbdsOp6H4woQ==
+            =J+qg
+            -----END PGP MESSAGE-----
+          fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:56:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//USOIJ5cPWOQgcqjauvvccC22wxU7Rp/Bx86ajZFpL6M3
+            ns8g3TC4ga8OO2XYjLTHNXPAzPvEE5lskpO+bkDbqRPkkkGeauqupQTtDIMg25kF
+            ouBPcvCirWvBJ3uiHHKw1hvTMXAIwcdvIyvxP4zK7sWU8OScDw9nNS8uhOLH9wds
+            J+Y0qWPuxAJrJF8cgLORxjk5BFh5IdOrmijm72+qEHER6qgYgXoVVbGtIixUTcfv
+            H9TqxHPkeqgMH2QVGEGKGRueoUVWc0FXtVLNRKlZ5VYX+nZUBDdhVjiiG6DBkWtu
+            BayAhjRFh/oGs4Q+WyozKy/mv1hJvxsRjpyK78wYw0yQVuwfd/X73y2EkQQNquCk
+            SyzU+C+5+faJpf9HPq2nv1zrUJid1zSv01IE70OsRFAgKXI9thQlx3VIbLTU6RkZ
+            Bw6BsWoQmanUR3DUzWvL+lhzYLKhVQ9Gf9rPOK0B1XTvntTGgq1zOYQn/FmlhJjc
+            SJoXgNU+i9F52CGIJ0fTZaw+8+aJ6oL9SLETl4T9Gj/XCpuDUGJAMP++V7YLWsEf
+            5tqwHDngm5UJNmqy5vzVbQAIVyLCK868S4xNFRUFwQMCZCHQeW4MhVM5XFE0d0ab
+            A5MSm8X7HmYgvg+WvXzawyEX3OyAnw1RZ+n+b6w2NN8YLP1kRLjirDS3PbsLybTS
+            UQHc1/GvEhu+7CSv118mKOyJwOQ6u1KAblmg2yzyhxN6ZvuwNJ9zvSnovSALJHWQ
+            HSwUH1xcOoL1xQTwJ/+Ha/n1q9i2MqD4uLSP29yYGgdq1A==
+            =cXXw
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

kustomizations/invoiceshelf/ingress.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: invoiceshelf
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: billing.distrust.co
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: invoiceshelf 
+            port:
+              name: http
+  tls:
+  - hosts:
+    - billing.distrust.co
+    secretName: invoiceshelf-tls

kustomizations/invoiceshelf/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+commonLabels:
+  app.kubernetes.io/part-of: invoiceshelf
+resources:
+  - statefulset.yaml
+  - service.yaml
+  - ingress.yaml
+generators:
+  - secret-generator.yaml
+images:
+  - name: invoiceshelf/invoiceshelf
+    newTag: 1.1.0@sha256:50787e404725ad4f47462eaf38832d97c627a5d139d51a84f31a9bd90caffb3f 

kustomizations/invoiceshelf/secret-generator.yaml

@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: invoiceshelf 
+files:
+- ./env.enc.yaml

kustomizations/invoiceshelf/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: invoiceshelf
+  labels:
+    app.kubernetes.io/name: invoiceshelf
+    app.kubernetes.io/part-of: invoiceshelf
+spec:
+  selector:
+    app.kubernetes.io/name: invoiceshelf
+    app.kubernetes.io/component: server
+  ports:
+    - name: http 
+      port: 80
+      targetPort: 80

kustomizations/invoiceshelf/statefulset.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: invoiceshelf
+  labels:
+    app.kubernetes.io/name: invoiceshelf
+    app.kubernetes.io/component: server
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: invoiceshelf
+      app.kubernetes.io/component: server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: invoiceshelf
+        app.kubernetes.io/component: server
+    spec:
+      containers:
+        - name: invoiceshelf 
+          image: invoiceshelf/invoiceshelf
+          ports:
+            - name: http 
+              containerPort: 80
+          securityContext:
+            allowPrivilegeEscalation: false
+          startupProbe:
+            initialDelaySeconds: 60
+            periodSeconds: 5
+            failureThreshold: 10
+            httpGet:
+              path: /api/v1/app/version
+              port: http
+          livenessProbe:
+            periodSeconds: 5
+            httpGet:
+              path: /api/v1/app/version
+              port: http
+          readinessProbe:
+            periodSeconds: 5
+            httpGet:
+              path: /api/v1/app/version
+              port: http
+          volumeMounts:
+            - name: invoiceshelf-data
+              mountPath: /data
+              subPath: data
+            - name: dot-env
+              mountPath: /conf/.env
+              subPath: env
+      volumes:
+        - name: dot-env
+          secret:
+            secretName: env
+  volumeClaimTemplates:
+  - metadata:
+      name: invoiceshelf-data
+    spec:
+      accessModes: ["ReadWriteOnce"]
+      resources:
+        requests:
+          storage: 10Gi

kustomizations/keycloak/keycloak-config.enc.yaml

@@ -14,85 +14,105 @@ sops:
     lastmodified: "2023-05-17T02:36:37Z"
     mac: ENC[AES256_GCM,data:Q88SLpF5oLkWM/nCsrmjjnaqwvjZSkbpiuUzTHOPNO1YcPYupuUfiMm5vmwfAl2Z7KXJWDaQgwmRAwb8XId4XOS/5jF8B5wddyusiXqt/Lw5f73XN2BO4KNwJnj4Xz90je1eeC7yRpIIOcMvNL0OQT2JxxYG6HGg3YnXpVVXT0w=,iv:ZwCgmGiOaRWCnxMUZdnII5trS7mh3r9AOubV911wjN0=,tag:6ta5SGvbDtQgZ+omxCU39A==,type:str]
     pgp:
-        - created_at: "2023-12-15T04:04:32Z"
+        - created_at: "2024-01-11T20:55:30Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA82rPM2mSf/aAQ//efmZMzkalvKfGETAkn2lC1JjG8xXidDXVp+HHM/LXMqb
-            esKnb4qx8AfUauq4yRl8iaeCkojXSzMQbQJr1e3BbJLpb9bzw5Q9qHNf0Lxm+n4n
-            AwgrMxMQxTmJmuHhneSK8Vsj1kstJ0tTuGZa7wFH0KC+rWnmAW8TmoTY0ISPcmoJ
-            obhqb6q6U2tYw8dQE+FXPqcJKMSO+M55oOT3v0tZeATHbUKtbuxlLOiLt2iagabR
-            vwLC3wpRMkVQaNmgV+QUs8QjwUsLe3aUwL9JviYHlz+8nv7+S+5Xxl8NZK/q9SqG
-            DkvFXwQUO4kHQvm8r/ufNL4jRC+60zS6GL1YHfDv+GiorYNnfaXIjFIuONGAHzfA
-            vzXU/GgSMU/4i+LEZ5Ff9vUAaoMTD7rVnczM5LRVUehbeoFTjHb46pu6O3D2Icx0
-            6g4bkA99Pp/d8XrNBtvL5AvvV6TrqsCLczeZPAeLTVrNssZk0RGNjoCXiXu/rGTK
-            ZSe1gD6O4Tf83shyCKDyXp7+XA0MtX45qSCkITe7JRbbkidwyhuom5OJARAxmfi8
-            vPEi8l8MzmjpsfHVJqkbKYPY/gLFIEiYW84qILSINY8KHPqk+saQOPk9lHiB8wxR
-            hBRwx/NupdF+EB30D84s2YH9VDbGpaL6IMMdGJY0i6iM9Z4YL9dNLCI+EKrxC3HS
-            UQHH2KTltyJkbTsaSUxEBeMQTGdnFaKJDEZ/YsaPM7tjaOby5VmrSESmyFaxfoaM
-            4gj/kYJz+EEPrvj4jNzTZPDfHXl6ihYHIg5mPnBPhYJygg==
-            =MaI7
+            wcFMA82rPM2mSf/aAQ/9EMkW6v1+5sId5faNH/6ra/GqPwOXzUzleORZOkSn+eH6
+            LO5ugjpSKMaXVru8B1cWA6EA+SaUhKlQSN5+Yhh6KkjnJgs901kQAhJPyEFiYo37
+            JNwDdYiFDUS7pfeJ/MML6F9AHMQmE4vuGxd2ly6jeRUk3LuOmKxtUMTlfSPrbv7m
+            MuQDw2DAslFaw695ReSvO1uOoRC/wQy9AIONdHSPzl3P2JV5sWsGgrj1E61+FMqs
+            uCZMCmQe89uMblxeWHunIA2HVomuus3AGjqzb6YirXkUptHzPqKFDcc42rrdobuG
+            N6gWhhF9AFCD/VVqb1nsHz2BC6DZFBUH0XEMbeyPGBcHzQG0cQtnD9F9sQzDsMxJ
+            lgz676oQBRyiyW4IyHUY1JdOOXhwtoToopa1scE0GrJDdtgeBCtb3BmgalQ/D+LX
+            ENSRTHWHqH8v5FezRITAsq1VgTa3VpQFl3SDS6h50hkkCfqCDZu3wu4Y/zeiq7oH
+            rObnMGQK44yeKQFPuS4cpMtckEL8qJyx9N8xWAxbGYtfEHLBXV3XQN6CYPlFshJP
+            NXbGM/JSz/YR00XXJEJXbU+WpCNRCKfrfvm04S5ktkZtlOe1946RZYaq3VHP+3GZ
+            wICQoV4p4p0E/SRuPS/b7iVcuYDjIsxl6hDDBgwo2NN+qV7uoapeI4hjlY8LedXS
+            UQFy5kearTLkbWjIGX4g+E5YSPQST583v7aMPz0SJZ1dr3gR/RAVNu68FBfEtDbb
+            hz3xou4ZsJ7j9BERXJ70GDoKUFKzBdq9KxhhIZi/HP8JYA==
+            =3xVj
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-12-15T04:04:32Z"
+        - created_at: "2024-01-11T20:55:30Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMAw95Vf08z8oUARAAyUosmSY2ydppqBPsegUzyDk8IRP3TNT801xsWHUkTbU4
-            BLINJM5s+CAcO5E8nwGI4iIVTxXoZZJhISDYi4Wd6mkmEcNJ2WO2DH6OfjJ1xLdH
-            BPUg2YY88dsx9Rbnn74+HqkYKs0mDKU4ik3sXGg4dMyYN0kxCXlObl+ut4CoNz9i
-            AdAyxX7bx96Fpjb+cJJbhO8LOKy67enlHsjGRvYBy6LaSxXivq//ZgZiUMKL4oyn
-            YwRpj1ELXp5yV64EwKfdCp2xomOwVk3Zs5vrWw7ntzz+VXbIWawXLQhko6q0NRXt
-            sj17JREkU1Pqn/6swx4JpI5c5fBXdrcdp7yXFfLGdAFe08yjN/IgKJIx/GC2m+hc
-            tuXawSaQX21Z/ctDpKdPvy7C1vEsO9jvPCtDNxmjMcsAmeuVElFQ9Ks+DnAsx5O5
-            7SRo2fTzsUhwUHv/Sbl0UcAA/aztOJVgbwQ2cbYnxeS7c/tn0rjmwGEYS5E1mk46
-            JoLmYOQWES33puSJh26DITVxeLkSoWBN3cyqU9dPQIakPW97tLlva1LNPICfS6BL
-            4p+8tr1Si2mPCPJJLw/ViQAI67ErFggv4w49uMCocHQWP6zwX1hAHSwFTr4jjKP7
-            6wiyhn4dwh3JqQk9m+W2CgMHnprVBAogYYj+lgnta9fG5vBLymTblr3DpJ5g7brS
-            UQGitvNVvIYBowWvI8Z5WcEDT2YSDWfu4QyolQZfijcZlsp+gSpk17x+K3Zzzxcz
-            ua0i6jx4zh+dW7BxCS+w+TiWEvTMnbwB0oLK7ENgk9nFjw==
-            =AUq1
+            wcFMAw95Vf08z8oUARAA3t44hIiMdccyk8n1VKfllggeqsnkxA8EbX+Jvqdbnk3/
+            7CHGr9Nd1X0L6TZMvF3jPikmtMdyPEh7EtVKAsaszQ8SWrotWij0P/+2V4o0rMC3
+            ipw03Jgr3K/EGVFF7brwOP1LF7bR6jZwB35XfpA23P5n9pDmzx9VBmS3IIMEp8Jo
+            2T6Q9c3fX3/J0XNMQz7P20CUud4kI34d5KZrYDLRfgQq5yN7uXqi/Uo3Y5rO1tF/
+            HhhGFt9/KVH9TnVmO8s/gFHoL2WEjlBq3FaSy/To6iXFl9Olrg8on1Zj5w7K5Kfz
+            /pbDgmj7ovZQyMM/57cehAOZOBWsBcktiP4A7d3M2UZISoh76GPOZNdVMhUm4+2V
+            8TqemtCwahXY7o4zyncpeDExOJFnJZkHDlThV7C7sRacotIyFXQ1RxkzL2NduTjk
+            ulYcpx3L1OXuM2LLy4zKoKzSqAEv6JNmdGaAyMGfCKTvbB9TXITP0ZVkHj3D8Q2o
+            eb/YLBuaA5kmlq8PEJT8K4L30B8uqkwq4L1JOtbMguXlu6uDOGv4zTqKEworey0b
+            KVafj+CvmE/RkLr43TDhf0aYTynh4ad9pONK4fFAEfZwZmhSQOMZQk6AIDPikL49
+            xnwvSxxTSlBYqg2ZmC5nWdPcjydDfFZuX1sUo76mlC0ENjocBdqQiiGoDQhbZiXS
+            UQHyoy8lKgfxjxRLLD4ebU0omzyS8jWJjIX126fUJYvwZUs+tQ92Eui+dgJGATxY
+            gKPcbp3BWwktxVEo7WEb9cKxqMRZ9p2lbI+IvZYUjK+YIA==
+            =AA1V
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-12-15T04:04:32Z"
+        - created_at: "2024-01-11T20:55:30Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA0/D4ws+/KPtARAAqNJ8APgpTwkdURxepuKR6FegabVwEhMnrtVFzY2qICUr
-            e0HvHFuE6WJnP+68Z42pQAdPnScGLpPeWlWkq2buNeA3M5LufTEYu+borL7fJXxn
-            9L62YavEnUtGs85r8MroeADVC0ZPHJam1h2qoAdAjx5IzzLbxB/Eto64F8XAVAp/
-            DFiaM+cTfJ21AJjymgz+4T9FCPSkNU4VkC6UYQxwaeiu2ADhqAVQG1bJlnxHVPnx
-            jNH0zDi21YACXRx2popAuqZoy0966Q2zKDkYSdAgkeytnbnh3/gtizor5OZ/isDs
-            tEIv+el6uFSfish5f8NzTbW4FoEiReDPce3+8nDcipVs76ltEcl0uPbDqVoK0MfY
-            97M78zXDqCrl7HC++/MRfK/3gCmax4XVuPrzfR1qF9YmMTzPdWXwqIzoMeP3Wo0k
-            SDXZzZp8YXrgRVOrgIar0n1AsKy+9v1pV/6s6K8HH/ML1ZDpyNJYN8UC6QnF369S
-            yiqiFwfx/xRQ/vMG79L97pHbv2yYINZID++LF4fmfW/EquPmfLJcxfinKJ9nAfgn
-            CqpC7nK0gNB9ZhCKMoIeDqbZcgfew4qNKMF46yJgna6cTR9KqoE+sKUuFwqMIiTa
-            G24lk62l14sFR+nRCAVMAKxTRQoiEI83bji1Trf9jKuepW3LNe13lHmJ7k7ClG7S
-            UQGISzIpBMYVYrtsYh0xaP+zPuwbUMC07vGSMiU0y+x+705zFac7vvPEUXhGMM34
-            nefAh/L/n3kyN0N2o03dROGpqtKlKGZkbbSQXQUepFsnqw==
-            =s4V4
+            wcFMA0/D4ws+/KPtAQ//Rgug4ckrW9KAbPk2huo82675KPEMo8EgEZYv7Cjq+ilZ
+            ulcVadZM7FQNcaH8EEN6UJN/dSu8i8hh9i23gHwFmdqInHiwlecWnVk6qYWp7H4j
+            6LbF/O8Wov+g4hdq1ID4ceviXwTSpUsSFBsrkbvCGIxHoe3Co16zR9a+LhfAqQ3y
+            PH3UREQeNohEtRmp3RBE2jAbKZGP2ix5ukPpq6XRI1znQM5iotrX28XkCZWieeZl
+            K3y0vm5URfWxujsbCdgAWlmnUOcqzHdjo8uG8hipFSenNDz4sSdY7z4kW/FiU1Ss
+            wQSnG3577oYlA4DTls9nTGb7ScwoxX6xVPF0LImIaZq7KOdTqIdCrEzEFj7UXfUm
+            zx+M1W/XvivfhZRElgixuTUdt3yGuX1lgqWFZgnMjdGam4VxHQ6wr10zLtD7ojH5
+            NFYkzDrR61r79LYZwhq9HekbnzZ2mxkl+YpMRYHF6helwl1Mlx9OmHJg21kmnZca
+            V0eW1XV6AhojoQxe3gskbexGHZYg1mwMEm330tHpDKAR06CLc4oQgReSZVbGAjDB
+            7yhPohO8Sd/Lwu8ALIUzYnIYgyeIs2L9kJMC1q6OMf/4+b6I263eWjOzxnko58Np
+            7GSbPSm5PijPOD+P+QL4hU/6hkloLX44/l2ziqx0OZ310PQsVLc0nDIMhtGSpU/S
+            UQFmfSpGpMJ3buT9is+FqCM6xQuauT3D0qxpeP4RaNrF3pqOXjK7QM0/EPj15bLj
+            Meob32KAftXaEuI7mdX8ODNVY2A6hIv5mjxG/RxZ0MD53g==
+            =0on4
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-12-15T04:04:32Z"
+        - created_at: "2024-01-11T20:55:30Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA5Wf+FyJ+zFJAQ/+KJ6NPC4M3rOfXJHCLZRFWJlxc/HSFVA3OKEm62bwB9IY
-            Oat0Isbsz85sNp+WchFk7QrwgJuQ5Q4eiQWQN0hMkfxwzj5LZTxw1QJaGJ8PnHIe
-            OVOjZGldz1hfOXg7+GvIbaQ+zA6qDkLiV8kzw4Zjbtpzdyc6p9W0BtjAvy8zI8qC
-            QK9WxPpxYXgphDTCt061ycPMNtKyxnNAl49b45xyfKmDoLiyhLnWupKOx9QXaPyH
-            vd/+qwXhLCXTEqcwVlST+Z67AUx5VcWmfSNKiKHwB4fJw60G3K5fH+eVE4NgAihz
-            Ckg5oRIyFqxy/J2DFzziCq+VXRWTpKUW4BCBpeSCtSx7M5SDAQw/HbjuyoMD0k4w
-            Fepx8wtwexxnZZa6ge826vEBNKLJMGfA+k4BDb7YsW6z8Jy3JDJEoA8dLt1FvQq/
-            ChYeM5YzSgkbKVEm7HxiWiUg91UkSsjobW2wJennLc2wq3c+j9WGNOHmaV5m/jRS
-            RBrfHBF8ZHjwdqMbxGB5tYv1XMTaF622kS97ramk/9GXUBfHsd5BSSpXqV89G/HW
-            +Rub8Tp2hYTqR3H+33//pD2YH6iBB2BRyhY61GPqTWS3C8OyYvTjC/nAqR15Eb8Y
-            N5G4LX8oIc9Au93t5yU6YJZm7vxH4RXTqsnEdyUaGt1W1fb9j8H1p0wHhbnuJ23S
-            UQFIp22wajl/QvhM7OT5dOWCvuTfFoNdcWiEdXttaxuIWTtAI3k/Z4Ano//bomKl
-            h+Y6whX98jcVZGvaiTF2ID+AVv/pQ277jFAL+NyUBQfYug==
-            =hOOb
+            wcFMA5Wf+FyJ+zFJAQ/+LSk8MhXgNL3HJRiC5ri5fcmVaKgkdWrSrnv8IUw0MQ7Q
+            5S4p9LMh3+Y5gYq04NqVIR5EX6ZmnGhJ4XylpZbPrycwoFFzCw484VBUp6Xq1LZO
+            uucUhsO4dwYg/38syPhFA+eILNOXAZcy0vMWcenei6Lm8IeEri+sEPzl62nkWNwT
+            Z+FLiy3wasK0A6Dqm7gQUGCKdXyHFgFDZufC+lfvi4+OpYU6N697NPPy5JwY3hnR
+            tfVSkvEPD3+Vn/fYBwpicX84Qit4lxASyJ+cMU6kr22XdNPF8b++OR7gGHLjbpl2
+            PQ2FFCkqJ1QaR9WsOd5JSRCddrr3kFAk0A3D2kf9FDdllsZ59xrqItv7Eq/ZT9Vd
+            jD3HTIv8xv0lUfPA4wwQh5taEKzsbmpo1wUt3afq29s+Vza5n7RlN6jWqBFiC8kM
+            0QFlAzrVPiHCCTya9mXoQqGi1R71in27g0XHgYmTGA4XPgdEMXimX7p+yAPbf54o
+            /16O/5tSAcNkCKLi/yKTLaSzvA0UW+ft9UPZGNpaRPjbbIi5ge1ghLD0wYcMc99v
+            GmliLvmyw1vLIf+qz6rd+ftYscDvXC7MR9r/i5WNIiBipd8zVuh2+0YbULkpX3Fi
+            766HSDuhas7gRF654biiM6/bWvkKNfePs+yY8/sys3imlZucSJDCODKHE1OZ4nfS
+            UQF9FAGIcLUuJNc0g5Dsj2CJp021cpNf12vkeaQisbKj+7nsxOS2VeNnh/YvQQxB
+            sHRh8uO2meaVl10u+J8yHyGiK4fBhoT8bSFauvrg7ppTBA==
+            =Uk54
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:30Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//c/gyglnqxGfD6/dfeKtZ1ULxjpLHSJW7TukmSt5bxJF+
+            1zEWHvAyFaE12wCrGuFwdYymj7OHXHrVIy800Av16iHvlTy5rb5UKEAIFRo+osK8
+            tUIRW0pqXZyHllPr3gtNiUeB9aqMEsGPSlVKRdOBOwR7IPIiNTpkgqS571AInC5w
+            2/tRRVgcgw9ORe7QAdYzpQ9EAAPZVH1+o15JVMAhbp+AyFz85+aVXWlq2bCu/WSY
+            Nx/4rbSzNIEiOIZghuJe6glDuax/A7JeUawKl/k6EhviSNcD8Z0hhTPIXHkQEjvW
+            kbtKsfDTEimpVCX9WNwmmEskHuzK+pjU2xd41oJx+2ZXf61Qsm3AUhYSQdQDZq6C
+            wwQmdyBKDtCUk/unM6KW8gdKZsamZGE2Ym1yb1VqNHa+LSdNpo7nTYOB7RwMZHRV
+            0GFy57tdhg4YswiKMyJkJ08KyuG+c9RrVuGmHJ8+eMjnMLfmgbFrL4+Tlpjy+dwh
+            JTYHspQtBYNh68RW0ssgQh6rglbJNnxc9lsKZwu9j5ScwrAKgzx2Ubp7CFqIqEyN
+            G0NOo6c/mYnAb/g/qxShY9TUwpBvJFKGKAmUUqyt3CUZBGQOv8EG4HueWJCRf49U
+            0RhmbVWbnIZlEadCX4ZXJYdO8KTjvwXeJOFK5uMiN/PVLj4JtAwh5T+d4h5Uh7TS
+            UQHXgssSAESVguyUY7bcS5eM+AFu/qcvC9qo5abAkIGSxGjVCVsML030YSod1gPF
+            w3eo1k0DTyn4wVren1dJM6k5k1aUds7Zql6qkQiW5iuI8w==
+            =3fXH
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

kustomizations/keycloak/postgres-auth.enc.yaml

@@ -19,85 +19,105 @@ sops:
     lastmodified: "2023-05-17T04:43:37Z"
     mac: ENC[AES256_GCM,data:Ya+AhSZyqjbSCa6hnDV48wrWfDSa0XZwsHWAAsJ97rOmZctz53Xt3EjfShKLEoAF3J9I1UtluwB3YZ0XfiQX5oJmwqKOuNZFl8EsXNddbljP+HzJaG02YwOfWhBGBvfYwSjXsd7EG97r7u+KjuQxI6MYY8mr6fdXL6hC5wXWOoQ=,iv:oy6zIvQ/DzLMeOJ47TZS4r4RzUVbOnHRGVxKxmuC/7A=,tag:fQ6oQpXIFQFMyK4DQLyO0g==,type:str]
     pgp:
-        - created_at: "2023-12-15T04:04:28Z"
+        - created_at: "2024-01-11T20:55:19Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA82rPM2mSf/aAQ/+Nu8TkG1o3CXUqSerM5Fj/il1gya33XsqV/kyukg9S6jC
-            2zZ8sbrhu7Ascc2UkZBVELsh6Lc0gVlRdp8CVuhSIDfJZUIgXHDLQ6yZcBmqtySF
-            oDa9VeFf7R8pAsNtxLLxOBjYlHRon56bEH1AvbQsOcLRahlxtKpD/UWTPJH/OK3K
-            bH0UG8PTz6yuiAYv4NL9au9RBYrjmjN/Y4HWcVhjObGK9DO3QDoXJ5Hnu6R+jOs6
-            H7Q7FVoJDfCd+JLwILWHNYCZeOcfYp/3aXQ++GFMB31EPFKmcIx5UuAo2EmA248i
-            4Qg2DACzkzNG+MFk/owfBZJip+1dkTs6xkxk7PFikAjrqPlXlWLCGP+vzYKYJ5wy
-            CjpaYg/g1o8FrfAUJwAX6x9OqZtrncF/OP2WMJPmcV8MOYnZgQBe1jPBfoltUJkA
-            WSDuJ7UzvbmMAh6+eM2pI/EnHGPqelUm3C4tse40KfXWMo1VoSzDrTMy9Lh8MeUa
-            VrjZK0Pj1t0s46b2hvNfOhTcZzXh/53eJRKScLR4MiNWL0UI7OzrSVjzSOJ5P5vm
-            ongbU0JqJLp+JS7G+1WIrahJIQ73Jlwv9uTahB45drIKsc0tRTgYkowYHGtzJeb+
-            TYC2E0JhDf9Uws/JuMWl3HoVZaTqhEUlUIvu0p3upsvFRDY02OhpW20zWRPX5gPS
-            UQGbEg6Ok8XQ6SCOWelhntRk5/CJPJsT6gdQDQMFLziQhLPnVBgoTEJwyUFl40mP
-            0IluUTkWy72/IjR0ZKks+eMZUPnpXYcTgvukZtm9YZUZEw==
-            =H+I6
+            wcFMA82rPM2mSf/aARAAjPnkCDsnuLdgK0shc9Z1uK0gW/bPIsZ9yYBpCRO1mLM8
+            8VXmZfeH/crgCXeMTI9O89KdYel/4BIY8cqrvLCf8Tc0R5T6qUF90xWVGrhvvHhP
+            01btt/csVqm5+X2NPk6EUb7jF7xcsalUDJbPyW5i4XVIf4d1PnITYnnyxUK9WzYr
+            NKsep0GUQql/MXY0HiifLLD/ppYAfg8/UHzlZ1p584gHhUPFQB+gAelvZzdUsDzr
+            ChFIrq9dMFw56WcBeh7iRJD/IsD+nXiBikwSsAOe7QFuH2oeaBDbSxzYTzwq5wdC
+            3e8v31k4fgUfCa4B+tCzuZ/0iPUb/UzKbOUr+LlBm4wfRukjKZ2lhjCYcVeXnamJ
+            L9i45F5Yz2QcndAqcqktjBr+kbORd4YIcmgn5moUqxxVg6bKVfkgoHf4Gkwg5Ozs
+            IQgZsS91Kuejx/YVxidxHvxMWVQLB8EXwOBEtcEkgdnIapjZxQAThq18Q/6/Bv5C
+            m0MgtYdZj1Q4ZIJ68OirAN+l6VQUpoK7JCYDAUJqlSqZfZHK7Rpk3Vie3Go/1tmD
+            3ozM723Iz4MQLMnxEi63/7uqebPymvVCqnezguiZ49aCn1i6jLdbkFHAKwfO3pJ0
+            2w0Ph2r/zPNEeVwtraOJntg4tjJ85PgOdSMOAjPJ3dJvvemd3DqwzPlrZuKMMKfS
+            UQE9JTotyePyBMhhazin4cpUCBBeuxKBCdOjhbLuW/mEfDzxFTyXpjn/650M+m0E
+            z2mKdtR2pnrSYsRCo6EBafCRhoBTGR/iT65jVBRTVw5ycg==
+            =R0Dv
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-12-15T04:04:28Z"
+        - created_at: "2024-01-11T20:55:19Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMAw95Vf08z8oUAQ/8CtOZw45X5jRIkhGhDTMVGgcmQk+7abj031zi5W19zzJ+
-            WS8Ulqep8l1/zr5fvVXL+lEwwLnffe9zkN/SHn8OTi2fxbnmE+UJUNovJdUATJGV
-            V1DVtX8RnddRttf77f81z12eAFxnTyt4CDvCyEEIDnbETSbKbEDRfZLjVvF9+sWx
-            foh06zVj6W/jU7VWzwtaxGDxtvNohuWFQSvMqpeAWR6XOVZpIIg2k+P3fZyv4zpu
-            GoTRYA2s7nrke9t4GbzyGP7tl/woCD0EumrENTabvleOeEP9ork5+ivrV8amoE6U
-            61j2kwhrqzM+p8v29YyoLY3hquZdj0++VVaYEsu6SOwcdZ915oZfKiiHhDdjFGQ6
-            gTmbK7LKXXt22pLQwTKJ7rT4c+N3SI+rOZrWNkKpaEHXq5MUEeYCp2wJuzqkkIIh
-            owKRRjwA6fEwXdyO+DTEEnC8S+kdEoDSfEyo2Dsg2Q0ir/HVP6qPVPR0Z6kWEbC5
-            1VsGV5cIb5c8wnRXDDBhywozYHK3ArD0H/0Xo1Govwu9TWzf7zWWmouzCNgWdI6r
-            iRILhx58jLI+Uih6A7Hl2UFTdGBRWJa5rFHeR+uKvGxIkRiPgOf0qO+w3c4dvE3v
-            fo6JgifwHzO3wreBZ2dh+4R6mgM53Q4atNcwUFpzs2pr7c3YP0BjDphNwjFKU83S
-            UQEsEjcC9wqUStBpQUyu+G49Z84JVdBGa6O46R1fpReBtqtiOeMreGlePQi69Ymw
-            yILVqila8PHsWW8IqMSVOG9oTylUsmZ/+g8uvI8qY9bQFQ==
-            =6SEf
+            wcFMAw95Vf08z8oUARAApwQB8IVlBAPqkePsTMs65szw0+52NBQ2cDiSwSgX7hrY
+            ncf7bibKZ5pkJpd8avYBKXJPiBaZjKbuAB2bZ/1RSE0RquV6e/ZyHMg5q5+BzRjt
+            fVo3Jsx3XkWt6JKw+R3J5iMfcjE9Qzxi4dqhWEtif+eQf05ZezrqSv0Z80t/Rijf
+            nQTgnm0RM8D2unf8tbPZhzm+rluE86IPIFZW1DEswyffu4v1zgEE0/79l1Xqy3UW
+            ltMhE+mHxZJduLjaBot+CgmWL13yG283pke95EVnugFKwK0TlFbfrKlBm8M+Z++z
+            Ik3CVthobhulwdcEZABcXblMO8gXyc60pxaqS1sQusU57gbJbNZGds7Bisa8NNZl
+            I1SsVUObpvxEzmO/1bb98BgBoaZ9Xyc96ch/VdbMriPmfFz0yQ4YmNCK8s7umjkJ
+            GmBRnhbqRqx5OR2XK1nUSaz5k3u0T0dorv9niXaXYv9Vzl0lFoAXN0nmF8VyJECf
+            icWPZsa3DImEzBx2BlYoMXENUV7Cu03SfTYlXmt2FaowY7J5dfIfnmu0tve1PZPx
+            MMhX+M6P8kG7V1eVdfOdyZgZbWiWwkxWeVc0E2rBOoQ1bZRamK67GY87jy/khYys
+            smDn6Ql6/5tNH2cOB6v3okQ9HxZYYVAHcCcJjmZDaS9JdF4GBimqNhg89yme05fS
+            UQHIzgbpMvs1j11T9kxN6MYLfvXMYvku5o9yF+BGtmLE6wHZ2OCfnRhRdkuHFb8o
+            8Z9sORaZBk9gqR7VC58EKWVjzFqA1eLjGvVSHU4HSJyQdw==
+            =GeWQ
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-12-15T04:04:28Z"
+        - created_at: "2024-01-11T20:55:19Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA0/D4ws+/KPtAQ//VTZhEPlC08u/ah0xKIYpnYRhlAzLdsAIEPjn5jlV5ik6
-            WfW7YaRui7xOGSFpyRYb6F7oi9EvsYsMyVrEpjJLAmLGWoTcNwwyMjxug8F5eVQt
-            djEzz92bI8yh4Vk1fhE9i5Zb8ZeCdRDB6FkJCw/GlmEwOSgesGEKtjD3lRl/CWYL
-            2+FJlCY48leA8TwPuzAezDkkzk3HmEInRvcijJCgdhptzi+JwwJJw0o6OR1fIrZz
-            ECRHrgYklwJ/+H1LJ5G9czWVEdbD4/ItVkug5I6O8G+dREvAp6AOvoprj2hsncfx
-            IGbTiY9wGFXntzdgV97i76UO81XKgAe0suUjRmIvCb8uISVEeXDFcq0sieYSPGIa
-            FCjvdxxtDHiPSrQC3cF7r5Atkzqk1Zzd1gBt+SKlhewdEWV1hq7/J1q2xJQfDuG1
-            WY2k648j1v14r1ITe4tpUnVRJpCCkuuzFNnXD86TK/9ZAkCME9byt62cl91VOmy9
-            NBStRWT3iyLdHhjxKABQcol2WP2l9hKM9Eyy386ngMtKMV+U3fs83Jsx0lqTmhQ4
-            wQxpSVpxrzgCoZXkd42xpgVDmbvwXpGLTC4EKVzTrZaOL9WPpazc7Lq+KtbKUbH/
-            g//KQAj6ghMANEzae2Y+FAkQd6kOtY/ymi94SEDjvgeELV5ZJi/FQV0riyDWhZ/S
-            UQEdiN2OHRZqv9QM5jpWERuQbP1L8uePFKQ7QAfo5Qy/NLyLru7fngnENM+TZaYj
-            oAqyL6tHcjSTEbJdA0FjjLATwOvMT/mAg6C/kMzVd7CKag==
-            =gaah
+            wcFMA0/D4ws+/KPtAQ//VnNRkugGNvsbUufffLGeUPHQaIAnqFemioWGcS5prW1L
+            JsS0pr+1VW8MnRVYYPG1WMd8vRTUeMe6Tv8IFhNBuOs+0z1OFYwYXJXPk7kNJbwo
+            WR+WnZ4wSUHI3CLzqI2ZIZ/BWEqCkGPhmSG4lfWo33frqEX/0wpgmHZm1X3S2bWH
+            zyCsqggaL1ZczUHoqT97jEwT+IDBBBD3UD71Pd2hbsKI/+a/K9fjeSRGuLwbk1cM
+            j9hZe7PRYlhfTr/1yqBzpSVSmll+pEn2aF2hUnYmYipszkZRH9sWX/4eEvcziTQ3
+            ppZUfX0l6HfmlzjS1w+VQyF/+4onUvCPKZF/g8Zoj0fcJo0Y5nNo+q4dums0C3bZ
+            sSEkUQd1RHN/lQF8zRcOQLslTxGZ5U4f49mY2rLofJjSoCLLwF44Hw3XXHguEifg
+            H2/jC14U1EuLBCyExDWBMP+OyR1B9/4EckmfKxIZbI8dkhD/qxWXKq9j2mHJyc3l
+            HEYD4JBoI87bbLmLzIHhnFbLBrhqgYeXYcCrdJlBLqwBqncJVmLfUvzJ2QUa5pec
+            NFwPrs4xbPl4ksPjlpMgk9tdsph5iscSWtTGQf4dV+crSNsOnkLZouar4ASoisIK
+            n4Zc18WQHbtv9wPj5Febor482LX5ZFo4o/HKaoyVe2CAZumEroN8U2TRKrevZz7S
+            UQGi0T0b/6fDDlL7fV3Sz4NjYILePIm4IV8wlvaZxQxHZH1qAoSQALNn7sSYZ6pI
+            5Tnsp876K0Q/uLrY6t8ACTr7Bxxksp/eFMJk8MKrENFrDA==
+            =/UoA
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-12-15T04:04:28Z"
+        - created_at: "2024-01-11T20:55:19Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            wcFMA5Wf+FyJ+zFJAQ//QDabyLsHf3raw1Dp/XD3pSO7dG1gy2AZSjXxvHen2C+n
-            QP4XEogvHsf3UjqWGVoVyipoyEGYRoSho8o7sn0nWWLind1q/xVNI677z35yjjGS
-            CYJIf4uDdkALqSHT1o2dz53C0DJ3ZkUC4rlkCAFBl5q2ttV89L1QPRNsHngqNkp0
-            1AbeXhpGytKGm77eEooizW/Dsmad349CVjBcnWpyDGyE4huGebnkND9QdC7TxOo5
-            GINKJ1w0mZOqUCoOC79UJKh0uUDtbcVgS1g/aT9ETRCPDaEAQbJtMnyDWSvaAEcv
-            yl2YFX7aVgRo9VEIsuRgsKpkOFdiHeFGDsWxw6hy+tfhYqX0vzws2vrXAJtRz/xV
-            JagEq23hcQ3JMhwc35tw53IekO25LHs9RtmRRXLKDc6vTWSZT12Ld7ZDfvtNBRBz
-            MFY/9DcHUtjfBuHYqXuf9UTYHK1vdFxCjV/okqcMEJtWOHcauBjpmIukuilqdSxr
-            bPa9PU9Jed2b6zJRdBzeZv9Ph1L5vSRSkmcxqajyOCwpVWnwBnJhzoxuom44F1CX
-            CNQnWXXzTuoVV44uU5ItI4fJhSM1gZpW3WfJLYy0qxMZ4D4p6ijvEmilC1emEANk
-            4FCKbRYkcCPXHyiA4HXcVZBHCfdUbkvxEJUATWGWNtZxeZTMfQuqfAg8OPAtBF3S
-            UQFDXotTqu/Dp+1rSnNZgjWYukDRTecsk144tbfCDjCZXuzXmSgoLr/ArZ4bSBlm
-            nQBOJ+Tc5JL0SHHprOl6XfRLggVsqJ5Im+HSXzzsUnGhjw==
-            =rUGJ
+            wcFMA5Wf+FyJ+zFJAQ//edMHHJ2UjNN8ahEA/uANio9fvt8y5cLwNReom+KUmqR2
+            UY6K8c7cYre8X4Sdz9e/5g+oul8ytx4hJIFGpAEEZ85usTSW6+a1zUubmS1JCwXo
+            YMmw9mHHa9BeH4C2NicfozZwo7GiSfCXDN/NiWLVmwqnimmatuPEsLzkfN+hSeEK
+            c+yC9TGzseJNlbqboEdYab3R7EDdV2CwKIa4Lt/jGmf4lxcJz7aJC9lHC0BMRYYo
+            ghWbR50ypzgTt3r4KJy51IrAuYmyCUbmCFuW+LvWNM5FFmN8am/LVTUjNFDndGJv
+            UhrN3f4eA6CbW8XlMMtl4OEYuQJwAF/bZl7MECiqdV197GMTRfxmSzMA4nunzYtw
+            cyz85b4ec3az3d2ZMYH4oMgZS0/HXaVUrjilzcRS6YgKMJe1N7Hnz2Bhgqth3GXS
+            LPorEXuO5QyuiZgRF20AT38RDPydYzyQ3xZ/uhcoYIWjXaZux45vWGrbRg3W/6Xx
+            zuri2CKlwwMFXbDJVFV4RISge5Sae8BiZcn7t/yCkRKBLZYBloST0peBKzyJdL9/
+            653zIKNXfWd61xbaqTMcFmsiG3A2br6wcfltjBNTWJnfWjhMqKDbQ4JKM5RrMALJ
+            cIKgO0YMt9ddzGE+d3F+8GyRcTmoNySqXJD51N5z/HKNheu+GzhaSs2sprBdUdbS
+            UQEVWUiXr+zfIkCu93a+dXmOGdPJlWX/9Xb37+zRSjFa/8tmT2qd3ztFrG5ERJHx
+            Rg6+twQndKfwMx7Jv6DaIlL0OgnASUgn/NqfhZK+GURDyQ==
+            =O6sv
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:19Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ/+MRuEQwXaMk70Wow206TPSZwt8wMzseGpDkbIvKL+N4Ro
+            IuDKDT0mtECzI2bMFFalAWuvOwt9ENqs8BMErVxVB9SIxlcQkiCmBv12h3RmD5Yv
+            YkUS1uKV9y+GhxME5jL+tEOkzl4lod/7bJwLXHw0celyJCcBE7F8ZlnrY2PH+5qN
+            t85gMjZ5HQxX3xaTTXeUb+qtsTx+/Wp4WePYgV0wfJqHQBC+qbR0txcofeWf5A4d
+            IlXaaB5F/cdyeqlwbqTzzClszU/CKTjCTKSSG4PR4RuRz69rICC7bXTSxlIjPyCE
+            p05XZIiphtiAKqwcT94VH+Eaogy4izl+6ci9FSd/W7oz7xx66k5WInpR7tfeAE0G
+            9Ybcxw3tH3MKJoLVEQVdkf7dWG+TSIYTmas3wmgFvwEauRyaf221OsokHKPpbdpA
+            STJiIgeYa5UeoRD61Ric5pO7fSf/LzmiUWRuON50cLgsyMZFpM0dtDsrTBTA0gMd
+            TaK8/zISZgrLeTJRhkn4fCjr+v8QY7YGk+RwQNUnY7UzmrF0GyOK9jyXXtPojuWu
+            az7HnsASFzktwMzurYZIrQmcfAWoil6kDQ0e+waSLFNkZZcG3640TGRx7iEfezWH
+            StjAqsws0SWn0dNcD7j3xDkPP2WAvga3UcaYGY6lNEIygZtyjlHZRVMuE18qkJjS
+            UQEyVRL2+OpZQJCYRdGKuBnCz/bD7QjJaWCNBjx19/CWt/koLxRucfaADGBQvT3w
+            QUE+2pWQ4oEmz/sUvCSY5XuvCaas8E1sMt/hVkyDtOsLtQ==
+            =ZmK1
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     encrypted_regex: ^(data|stringData)$
     version: 3.7.3

kustomizations/matrix/bridges/matrix-appservice-slack/config-secrets.enc.yaml

@@ -0,0 +1,119 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: matrix-appservice-slack
+type: Opaque
+stringData:
+    config.yaml: ENC[AES256_GCM,data:r4qTOla/LsGtMojbqC0px9vVeDN/308lx19WR1FcHOh/FenPOmhiVN6yqEHiL6NppHm+SfrSdAa58ghF6GVdbv51/Z6K435MPpoAXbcmw2JceZbHZJ2k0u4aY01nWYMKUU+oKcowdzL4bmkA4jkX4XcDVEsA9VlZPAYmSN4O0s4uLl2pJ1K5i0qng2KaCYKAwk5OTK4w//+lK7UhmVC2TBlGZ8MUyuHsvk0zUkWfdXeFtmtVN48LwS3gdjY2ynHDTYl4cmXtErfbqLkdjWLGcTS1LCaIhOSFYTQm04tAWc9TCKB3xYvpx9hSUKN/KrreK7zh6zr2NTYaRMiXPlUT8PC7VdwEkpZPq9fYkeMBBSlRiYUUO2q19Y2rtidWZ3UeKr2MPJA2a9A7l/JGpYeLk7Bg/623xfp2rvqysFbjVQHsR2FUrnhdV/DK6vafRrjPbdKOWjaorc3UdZ6LeS191zwTKUsZHQuW35LXrg+Xhiovle5FetgqVSeMtdAigLQ7rtUzmilZk8clDstibLzmGkKeBsFZKFDkNlMxQmHarA2bH5RcBazugokztEUgRBGVL4XAjStlyYez0EqAXdC7FmxRctx/8fS6n7gLv2eLOxFswNbjpZRDG8ctPGQIF2xPIkV3Ahf9UH1A2Q5pVRCvd49yLflCBE+MFyVjz2FvpkFg915TN3K0j4OKuIW8E5D3whO8e+ofJiZGSgw7+NYZfJi/d1SPMkCyJG5M9wtTJLtLWMDxmvhJlkGO5Hxu/f06EygMKvF1P8DjkpvbFDjClKS/WjmN4IrccYUgrL+kL7XsQZ1EfvFPu/ioKGV9OuHQfOJNqMNPQdGwjg830GSjn2GeyArYSsQ1mJ1QOCPPdlzNpwYf8WRCELAt8LnTWEuKuNpfesvp5pN8DaAa2qagiHMwRKXcwuutgfL3j9gD1wmu3hzbWEilWXXykh75JjM8bPTYkQQWQVJSwjfv9fnlxwxg8bueaVydOyI6TOLfowsDEJR1zy7L5d6uUMwJlrtjHms6N3SYJ4mrgogCrOkH4qX+MMAnkUfVAbxmPvX3u9bxIqbOSoUuzjQto/LJnpPwY6MblEEpkLVo42n2Vaaq2ihMtzXLeq4qd+g7PIQf47RNWtP78+T8csxzlPG7s+c8UPZCoKoVw9EFBXS7SBE=,iv:xNXCfyNWCbWgeDL0oEkPFSxtPxH9SNcUb6nfGo2bRaU=,tag:uy9IUhzGgKgrAI0Fu+hR1g==,type:str]
+    slack.yaml: ENC[AES256_GCM,data:68WCMYcGwY70UwSNdEPeWPWZCJ1+BFO+KJni+oW+1VAnkGgwM7DAw06bWUIlYmwbPMotJqghU8pZicQu2CWaDKxSyvNvTYIyUBSgaUgyhgkAt5iP1fJzM7AA64OLZiJkP3WvfMvQqZpj5q6VMVtci+kETP/C2n2D9SR6g0GqOvSVDOQ14BcEdQZhX/GIqYVy6O1WwER/MMcrzF0gS8Xljhgh1QEwbHN3V6SaDRRt9H3PtxINovs6+N7WBTN6X19npNCvo+vBWc04BqRQOnTbvKDodeI8CSNoZVCCXnGmRdDYmQTX3l8B1ax7pVcq8qgQbT/g10CzIQ4D5/xooXWyPBJO8G3DvWSBS1q6eq/h6Ff5/dof0dpM90r1Snte+rBygioNXNDxZxHiftGHDdHutI2xFsy2d6jpAgSWI9SE+FPrOZO+VVg3oGf1CJ9szcAir9Y3SafwzyNBwvCL9XbRWOb5YR3v9JRbLlyFdPSuBFQciYnxxhPK7xdLr+ggC4YBg5NH51TvPFFrlRBhkHc21GgMpQWW/ambmIPoN8N1ibaIAAywALHVvKcVhVRjSgStRubqkPOw902V1S9YhVl5vb6QtxaI3jZLLtq1uCJwEJ350kY7xIPDvS17J0/HzZBivm8=,iv:BsODzIfvxPxLpZSomElorgtvdn8ejcYIMHE8Ze4VC1k=,tag:xpSnNsE06QEoNAtnCN2vNg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-03-12T00:01:19Z"
+    mac: ENC[AES256_GCM,data:VSdnKuVIv4VBy4MpIuruPVgDqMFLM33VwfWHrQ2V9rWJkqEvWlgrZDZG92qGdBthmcmfhpClCZeAmEI//U5/ejb+rilj1OOkfFqYIHG+JGzEXyKVnWZeHEcWzEGuYDG78n8XgFuCMiexScHOhLcRSiGRN++jzXTAGMp8U2z7feE=,iv:aw7cTJfRq9Z2tJlPFQhE0HYoLweds8b4ybCTofEcMFo=,tag:lgWspTjb1IX8jR1Hq95WCg==,type:str]
+    pgp:
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA82rPM2mSf/aARAAkFACzQmqyF9BqaD1qEjIO4e6owS/n4h3U6ee0Y7fhO8y
+            a5RJ4/HvMmfXcYeHm+CZjsFaui4YJkPS93clGTJzV4w15yXJUunIVjAmkvSrVh6P
+            GqRUtNpi1y+JCS3sjlAfvm3h9b08dNxFv7rTwZtDiP8zmcNuB0zbLBFR7G6ixetx
+            ZxL7piPYX75Rqoz8A/+V7VAtsoX8t3xv5xgjHzzfhiM3TeoQUgLnF8aN5huiSptf
+            dMmNMa0GGu5QaUjYJ3iHjv5eMtCJ79KwpuCfv5iX34Q++rTe5VUWoQabNAiE/Frt
+            Rc3JB8o8rfL6WME9qIIa5k654JlVDKqOvTH3mtHkOIWhD2+CEK89Siq3G35Kkct8
+            Ym7UNa6gE8IdSGkCOH81G4ZheU6Z8OKF1Z7dO+o7IdgIURTwLEFeBIC2PtWOKOJP
+            PnzqZNk1w4n4XK6hQg4bmIj8VaZXXgHEXcO/jaGCoRyr36BHCE1Sj1ae5cMUgDje
+            p6WKVO6gXfRg7SRJqQNUh03Lz0YKIjsI/429UPyf9mtXbHfvVyrW3+wyByok86FG
+            cGL1Y/N7thxAxXqHy4OZFCE0NMP2bobMzzGJTtDY9oPsGwTb6xk1g0wE5zg6IoQa
+            9hnObBJhdpvYcD6juz+V0wkeI30essnz7ZTtsLdfCox6mnP5BMTtzxmcRrCpNvHS
+            UQFIZa0XryYoXv3rcw6yUpkqv6aYzD3L4PnqYtGUEtbMoTb8NXa9Cp+1OeypqZ0g
+            7uO5zCKJgL6sBaPnJL5/n+afafzYcIOsQc2O+q0s4O1d5Q==
+            =3E6w
+            -----END PGP MESSAGE-----
+          fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMAw95Vf08z8oUAQ//abo3n5r8YdQ6p+/X031/n8MCvWKw+ERGSvDuT2r7g8m8
+            DqrBQmX578jHVmZkC2B6fYqEBuQAeyEJyQ56MLMuGMNSET8dgNS4Uj/gwvsuEDQf
+            NhU10WLkfQ3g2/o654BVzPC2b3UQTL4mmXqp0+ID79uynn0/WZ0TQQ8xj/uUaDS1
+            h6/uC7mmDGTHaxF3gFuYkvWMghU0bqX5BfrAPdICAr8FIqxUGIvUD6KkBu9hWTYP
+            RLtfwpU/DAcT/7pNtic25WzzQt7W0mok3zUZZq5r2UqO35x2XOrgC5DQ69QYf7JZ
+            a9S236gEpAS0Kl1IWSvY2kDzj/J27T3nonY2kX3a+UqVWX15LEmVmNNUMwjz91/b
+            0G+26vustzinHBs30EHGBqhyELjRW0RjcmlVGNXvZwhgGL5/LNIEcfBi19tIang1
+            dRYE9TasSeRbyTU/A/CXFDeuGtC8K552SzXjv1zP6gkwZFb0/zd0/XHPSyGyOLbM
+            1PC3JhkA8GEYQ7l9y5BdPXxZseuoSHDPHfMRIcnogx6w6rfBdd9+78M1WjnGzhYi
+            /utORBaiwU9Zk+Xm3B+WbkDl5+jio+UIp9nHoYAGfuJ9A6TZYBIavB6K171wALke
+            Kl6hoTxef/VGwdfXB9ikUy0bi0Km1vVpZGVzIjSFXiSlLkaamhxUFSgDPGZN21rS
+            UQHeXKkhgKXTEVvi+kypRbN2/174bElGTWz1C2TWPNJAcvvKmRw66t5g8pahnXbm
+            SYQoB5JaAl0URu6zHWBYhCjQjiyePhnxHV4tgGtEYAdY3g==
+            =xXRR
+            -----END PGP MESSAGE-----
+          fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA0/D4ws+/KPtARAAsxa6N9jRT1AUqfWI7gIfJK6i6g0F5oxRYJ5A2mjhc89k
+            ZAN4/tO9GC+Fg8+lLhPHdiz6v2T1+92AFXET3jm+ax6rYei2woMHNXKzgqxjkQEQ
+            xQ/3LcQ3+FOTrvy7Gir9HQ/DoWSePBF7tx16unxH75hi6AgOiT0nFoEbXP3CJXie
+            lVOO5r5jKgBg9LENj/U+9LHjXB6W0PbVdhxdeStk2TTKcmuDnrGeqKZ3SyZ9V33p
+            DEfydW+T0ac156Eb2tdszzW5e87oPmW78wvLkotboZcPVWBadRtJkzVn3JXoMAda
+            gN+W2+I4/4iQN8ITBQ+2i5GsdbHtnrmPkzSbtSqhujwZ1k/a7uRmHy46ejDK9QnT
+            lQzm2OKyjTlCDhnxnKj0eTE4nN0CDyxGBNlNVG2piKd8i+HpqrjKJ9IUcMj7oO3U
+            8rtQ2A0LHquNvu6ZatP6fUk3tKgLaEslV4ORXMlILdZXlYqgznmvWJaII3XVeu8l
+            G/tHPkOhrcQDIecBeYcTLZYXtPtmY1UNJZfbDazG/9J0rdq/r9NmnB7woy7FSYEp
+            yRNji1i/89nVLsu94ra1D6FHyxgIFTSLkD7s1iCMTsz0UdwfbxqdLIWumYrm04XF
+            wM2eTB8OAGe8mdfi1q4te0FEDMLTpdYBhYDDjHmBv4fXwKPcWkgixvNJtT6xPgLS
+            UQEvOn03hQ8MCQ5kh1R1FoTOw1UpgV0eqJSateC2wkBKbZ/4NWPbnZA7XAW6Jb98
+            JidKJ8TiYiI33hxUhu4nUeZWjNcd7MgHyl1Do2r7SfyICw==
+            =TXST
+            -----END PGP MESSAGE-----
+          fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA5Wf+FyJ+zFJAQ/+I9khYJfqjCHhrAaElVWKgn4c+7C+oilVNE0132pQZfLb
+            u17yv6AYY5zThK6Lg0GZMKaKFn+JuF9wonTyixJQccJ+w2MxsJQRNQZTV/t19HrQ
+            B+6YFLVPNyOglr7jf+o5BnOdIvpR0Cog5JDzn0j4iwpRWRSGW1sWXiABKWUIW0Ks
+            nR7Rm/k3Jm8zYO6LtoyYog5HGUEHRMuOY6Yoj/EEbfDLKFU5WZ+hfKnbGGM9KW31
+            RkXoCtjm2AstZTia5+Y0E3wNb9bbvpbkewyQd5KqaHmHaX3MzuoYKNHGVEgPMfla
+            Y26aED5uSLETv+C1U/jYJyxyVJxNYb2JBrS8a7+p+mo00Cvbs/pbM/cr5Y/Ogu7Q
+            Ed0+Ixst3LzSTOcYAAiEC/LpWztaIp/4h/cAfE7eKnsoFUVcv2lLpLHyI7fS/sJH
+            Ywp8tlqlfx7DaCqYEVjPMSfI9qBbJomoQ77szHL+Gyi4ibyF0iRz0/NnF5lmu5H5
+            sDAYiqnHEIpk1v+gWXoj/CQq7a5jJf044cYylcO+al27cugr+jr5TBQQVv+wDNJV
+            LqpAxmmz8yUJ6RlTSg5JwNlNCCOONv6f+lX0Cjk7V0kPcOMgbVn19Su7zIvhM7wd
+            m9mzuVWWx2SBGzORdK9W4tt7lybU7aCvusT1jP1nwXF/JCz9lyEbb1syaNIAiXHS
+            UQE2Va23CUVgB+cV/ImXBCEuAjZhiSMFVCtWOZrcqPS8EZX9s6WzscpsEmFnDE7t
+            GVR3u1IyjxTsuTxxYU0ldSjHqYFjQrgRD3ZBzwZcgeajqw==
+            =bF9b
+            -----END PGP MESSAGE-----
+          fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+ARAAoMRyGipvXTgUChfL1Lryej14FI9+8dvWQculBjPQzg6x
+            oxdPzz07ifIX8D64zfToE+qc439l/RYwiMx9XyGscEim0D1GIFPwxOm4DCXT+/5m
+            wlLkOBP7oMwirqSazS7dNF1hE83717QTi1GqC0UqhoMINtxrhQIv1Y6xxREqD1Wd
+            eW3M45p1i8iSZkzF7n0EhIK3J59Wl3vxt9FUX3YRWk1JH0oaqIc1VCH3TJc73DAx
+            9e1jIVQSo4R8BfQc5Y64xRh0eq/87Ud2E2x9JbZmpnw4FN/OHg9QqRMaZ9r6EQ/l
+            VerhJFkfSj3UVAfODzViKXyNTKRak1GOcQBE5lfAXynAW1nfTTx0re0rl6/tvOwC
+            i02a/raksTI8afak1RMclNFqlihsegGU239ZGDRPb4apL32nYY0SMim58vET8rv5
+            eTiQE1udg+1ttIRAGq/PxzHKlc6FUEdyJ6i2Da16c0K76FpF3Gnxxhw+Tleixx3h
+            6+PbhC2qEgt7LS8TNg9J2WTDy4Hlw5YEmzOAM9NA6UYrH9BHsR87sbdriz6pAC55
+            CnFkWptrME4CjUP72qIezRYt/4784ABTw6poQ51jP30641YhgPoYLrWS8hWQYaE3
+            jcrum3JQnLTjsE88OclcreKNvNj+b1t0uxuHa/6UdMnyRCd8osJ22s6JJHLGgB/S
+            UQHvy+Rv0QJ65DjsJ4TfdRBLcKXaF7Ar5SaANqGi8EYwjVbhfImwx5VSEsvQclEU
+            7JihoETtCrRwJM1BkJz3nuBAaYDm1Y+lWHSyVZ6xi8G0eg==
+            =n6cE
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

kustomizations/matrix/bridges/matrix-appservice-slack/files/digital-ocean-ca.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEQTCCAqmgAwIBAgIUJnvJP3vy1FrGBmP3zN/Q6le9D5owDQYJKoZIhvcNAQEM
+BQAwOjE4MDYGA1UEAwwvZWI2ZjdjZmItNjBkNy00ZTg2LTlmN2UtYTliMmU5MDdk
+YWUyIFByb2plY3QgQ0EwHhcNMjMwNTEyMDMzMTA3WhcNMzMwNTA5MDMzMTA3WjA6
+MTgwNgYDVQQDDC9lYjZmN2NmYi02MGQ3LTRlODYtOWY3ZS1hOWIyZTkwN2RhZTIg
+UHJvamVjdCBDQTCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAO41H/hV
+eJYfE+b0aMPj1vLhefmGkdjD5N3HD1StaL95bjiB7U73exQenoEZYTW3Ns7+BzHq
+ffFJwXC3sL8qVxqnNdJy3IkrwJxdmJrj5+KoVUrD8yNbujjQ5q+r0fMRwBwtJYkf
+78b/mCBP7GOllJim3nG4MMzL1sA/5JaOQEwZgmERmIVJi1RK1k8nGuFKbcr7YW6u
+vE8VQR77uQIUffokC6tDzhjxDz8eDzZ3lwsnGavCG31nW5Kc6+rg6Kpo097/ZkYf
+DThwFmGwmP4oT6h2+/LPqsb3OCvFWh5DLHXTa5xvczFwY134o55CW25JNebrTYxc
+ZnvlE1afgiuKsqGsGmvmnjgxKTNKOhMWKd1gXLmQ6Tt0WrLpIBlAVlh4pn0YtWDm
+Nz+YcOnQ20O4pZyOntc2TGFmbHqAp5HnmRmtDWWbUQoRRAIsvvUpIGRxWid124gV
+2h9UxbymVoieFpAjNv6d9Qu9+kKeJ/FOwSq6qatOuI4ILSjG6E1SMeimxQIDAQAB
+oz8wPTAdBgNVHQ4EFgQUpoMewYjVdrnCuCjW/57GlzlMtdQwDwYDVR0TBAgwBgEB
+/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEMBQADggGBAKRENCIP7KTg2ULy
+DCuZAvPDzqRwAstmXP54DZOpeMT81c+m9Kq4urM1PMFvPOfiSSlE3wAA1+oX5wyv
+r4kKgSYqG4QRk4aUfk7NJUQ2yAEtNcwrTc4MSsoFJOJVWdW/E+KNWYKjepg1t2kV
+4hzZNqnIO05sxVp/Sx0tu5dhn8xPwNTVuDD5VjoC7VweSlq+E2vTNz10VBSHJ9Pm
+bBJ32kd0lXdYsmy9vGDLa2NrjeTESSBfk8umm2dIbIFxOShHSs/6jHwCGv5WvPpo
+HoPH69XBnXQuXf+gPltEaAtRwKVqdgMTFQe1gfeK2ddvlzPtGJ1mj+1rPGZApEuV
+Ax+5Klk+711dhJrRQsI0w1Zl/2CgpKToIVbBe5nLyH2Q7SstcdpfnNcs5+k3iXb/
+KMUIMP84ScQ+ojUefMntny2SqUFT/CD1IVpOsHFTbKc2ZHUllrDf1p4qopMdiwWj
+TlnDOh78B94f1O9by4ftQ/g8G5TaKgRsMxrDNy77tCpKy9vR4g==
+-----END CERTIFICATE-----

kustomizations/matrix/bridges/matrix-appservice-slack/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/name: matrix-appservice-slack
+    app.kubernetes.io/part-of: matrix
+    app.kubernetes.io/component: bridge
+resources:
+- statefulset.yaml
+- service.yaml
+generators:
+  - secret-generator.yaml
+configMapGenerator:
+- name: digital-ocean-ca
+  files:
+  - files/digital-ocean-ca.crt
+images:
+- name: matrixdotorg/matrix-appservice-slack
+  newTag: release-2.1.2

kustomizations/matrix/bridges/matrix-appservice-slack/secret-generator.yaml

@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: slack-ksops-secrets
+files:
+  - config-secrets.enc.yaml

kustomizations/matrix/bridges/matrix-appservice-slack/service.yaml

@@ -0,0 +1,17 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: appservice-slack
+spec:
+  publishNotReadyAddresses: true
+  ports:
+    - name: appservice
+      protocol: TCP
+      port: 5858 
+      targetPort: 5858 
+    - name: rtm 
+      protocol: TCP
+      port: 9898
+      targetPort: 9898
+  selector: {}
+  type: ClusterIP

kustomizations/matrix/bridges/matrix-appservice-slack/statefulset.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: appservice-slack 
+spec:
+  serviceName: matrix-appservice-slack
+  template:
+    spec:
+      containers:
+        - name: appservice-slack 
+          image: matrixdotorg/matrix-appservice-slack
+          env:
+            - name: NODE_EXTRA_CA_CERTS
+              value: /config/digital-ocean-ca.crt
+          ports:
+            - name: appservice
+              containerPort: 5858 
+              protocol: TCP
+            - name: rtm 
+              containerPort: 9898
+              protocol: TCP
+          volumeMounts:
+            - name: config-secrets
+              mountPath: /config/config.yaml
+              subPath: config.yaml
+            - name: config-secrets
+              mountPath: /config/slack-registration.yaml
+              subPath: slack.yaml
+            - name: digital-ocean-ca
+              mountPath: /config/digital-ocean-ca.crt
+              subPath: digital-ocean-ca.crt
+      volumes:
+        - name: config-secrets
+          secret:
+            secretName: matrix-appservice-slack
+        - name: digital-ocean-ca
+          configMap:
+            name: digital-ocean-ca

kustomizations/matrix/bridges/mautrix-slack/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/name: slack
+    app.kubernetes.io/part-of: matrix
+    app.kubernetes.io/component: bridge
+resources:
+- statefulset.yaml
+- service.yaml
+generators:
+  - secret-generator.yaml

kustomizations/matrix/bridges/mautrix-slack/secret-generator.yaml

@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: slack-ksops-secrets
+files:
+  - config-secrets.enc.yaml

kustomizations/matrix/bridges/mautrix-slack/service.yaml

@@ -0,0 +1,13 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mautrix-slack
+spec:
+  publishNotReadyAddresses: true
+  ports:
+    - name: http
+      protocol: TCP
+      port: 29335
+      targetPort: 29335
+  selector: {}
+  type: ClusterIP

kustomizations/matrix/bridges/mautrix-slack/statefulset.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mautrix-slack-bridge
+spec:
+  serviceName: mautrix-slack
+  template:
+    spec:
+      containers:
+        - name: slack-mautrix
+          image: dock.mau.dev/mautrix/slack
+          command:
+            - /usr/bin/mautrix-slack
+          args:
+            - -n
+            - -c
+            - /data/config.yaml
+          ports:
+            - name: http
+              containerPort: 29335
+              protocol: TCP
+          volumeMounts:
+            - name: config-secrets
+              mountPath: /data/config.yaml
+              subPath: config.yaml
+          livenessProbe:
+            httpGet:
+              path: /_matrix/mau/live
+              port: http
+              scheme: HTTP
+            initialDelaySeconds: 120
+          readinessProbe:
+            httpGet:
+              path: /_matrix/mau/ready
+              port: http
+              scheme: HTTP
+            initialDelaySeconds: 10
+      volumes:
+        - name: config-secrets
+          secret:
+            secretName: mautrix-slack-config 

kustomizations/matrix/bridges/mautrix-telegram/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/name: mautrix-telegram
+    app.kubernetes.io/part-of: matrix
+    app.kubernetes.io/component: bridge
+resources:
+- statefulset.yaml
+- service.yaml
+generators:
+  - secret-generator.yaml
+images:
+  - name: dock.mau.dev/mautrix/telegram
+    newTag: v0.15.1@sha256:e328dcf5893a3ec782212d9bb008e4f81ac3cf4e3c7abc3a49cf6b277749b32d

kustomizations/matrix/bridges/mautrix-telegram/secret-generator.yaml

@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: telegram-ksops-secrets
+files:
+  - config-secrets.enc.yaml

kustomizations/matrix/bridges/mautrix-telegram/service.yaml

@@ -0,0 +1,13 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: mautrix-telegram
+spec:
+  publishNotReadyAddresses: true
+  ports:
+    - name: http
+      protocol: TCP
+      port: 29335
+      targetPort: 29335
+  selector: {}
+  type: ClusterIP

kustomizations/matrix/bridges/mautrix-telegram/statefulset.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mautrix-telegram-bridge
+spec:
+  template:
+    spec:
+      containers:
+        - name: telegram-mautrix
+          image: dock.mau.dev/mautrix/telegram
+          command:
+            - python3
+          args:
+            - -m
+            - mautrix_telegram
+            - -n
+            - -c
+            - /data/secrets.yaml
+          ports:
+            - name: http
+              containerPort: 29335
+              protocol: TCP
+          volumeMounts:
+            - name: config-secrets
+              mountPath: /data/secrets.yaml
+              subPath: config.yaml
+          livenessProbe:
+            httpGet:
+              path: /_matrix/mau/live
+              port: http
+              scheme: HTTP
+            initialDelaySeconds: 120
+          readinessProbe:
+            httpGet:
+              path: /_matrix/mau/ready
+              port: http
+              scheme: HTTP
+            initialDelaySeconds: 10
+      volumes:
+        - name: config-secrets
+          secret:
+            secretName: mautrix-telegram 

kustomizations/matrix/coturn/config-secrets.enc.yaml

@@ -0,0 +1,118 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: coturn
+type: Opaque
+stringData:
+    turnserver.conf: ENC[AES256_GCM,data:suQA1LL8JiKemZo1LojR4WYSk5ex5DIv4wyOGjS6gZKGCViqR2uvIBT1DVI/LfIjYjuBDM7NqDOSP/kQxChJDrUksaOCU4Q5uc/eE9zlyP7A/c4Cb8evPQ1JApK2GTzFwz8J5x6S4aa+JpoAB5aTvijfcW131pmQOtz6uanEhuU1As9c9g57nbGGR2lLRx7rYVMqGC2fxg30JJewSjIYWsOJoz6+Y/callulnQKznil7cMYwjiMK/QoVgdsvmW4fjcm8PbBKdBZbh7nDQBcvtrr8lqyMBNl/XOTtU4Ael28YWzDtdbWH1jdJMnMieWxpa2D2XnWNqd0XdYxPwS3HnVHVXSgwOYUQutMyWNBA1wnIaC1sg8Z5lzqE38DzXfA=,iv:8wwzXOMCH4zadAtifiFAbwFEQ7O5CO2ogvCiuEDV8gU=,tag:D04paJjlkzeXmuyLvk4f8w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-01-16T07:13:58Z"
+    mac: ENC[AES256_GCM,data:t8y4z+JQ2ua9KcykwoH2rHi1wsHC0Z1TkxkMZvUenQFxvwNTHC4NghwWGN2kcCDO9SjUb1J3BPobZd/EqSitQ7kTxyeBTa+qcylUIDvCmk9S1ZHVyJKhoQABbJX9raClYV3a3zrk5WNi4obXAHgXGpMdq1cVe53GR/X5z5ury7Q=,iv:x+WQ8t86EOrejNyv0grHSyd1bOpWcoZ/lqmFtFHHR0o=,tag:XuiuZUKe32MjNMg4nx9Kvg==,type:str]
+    pgp:
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA82rPM2mSf/aARAAkFACzQmqyF9BqaD1qEjIO4e6owS/n4h3U6ee0Y7fhO8y
+            a5RJ4/HvMmfXcYeHm+CZjsFaui4YJkPS93clGTJzV4w15yXJUunIVjAmkvSrVh6P
+            GqRUtNpi1y+JCS3sjlAfvm3h9b08dNxFv7rTwZtDiP8zmcNuB0zbLBFR7G6ixetx
+            ZxL7piPYX75Rqoz8A/+V7VAtsoX8t3xv5xgjHzzfhiM3TeoQUgLnF8aN5huiSptf
+            dMmNMa0GGu5QaUjYJ3iHjv5eMtCJ79KwpuCfv5iX34Q++rTe5VUWoQabNAiE/Frt
+            Rc3JB8o8rfL6WME9qIIa5k654JlVDKqOvTH3mtHkOIWhD2+CEK89Siq3G35Kkct8
+            Ym7UNa6gE8IdSGkCOH81G4ZheU6Z8OKF1Z7dO+o7IdgIURTwLEFeBIC2PtWOKOJP
+            PnzqZNk1w4n4XK6hQg4bmIj8VaZXXgHEXcO/jaGCoRyr36BHCE1Sj1ae5cMUgDje
+            p6WKVO6gXfRg7SRJqQNUh03Lz0YKIjsI/429UPyf9mtXbHfvVyrW3+wyByok86FG
+            cGL1Y/N7thxAxXqHy4OZFCE0NMP2bobMzzGJTtDY9oPsGwTb6xk1g0wE5zg6IoQa
+            9hnObBJhdpvYcD6juz+V0wkeI30essnz7ZTtsLdfCox6mnP5BMTtzxmcRrCpNvHS
+            UQFIZa0XryYoXv3rcw6yUpkqv6aYzD3L4PnqYtGUEtbMoTb8NXa9Cp+1OeypqZ0g
+            7uO5zCKJgL6sBaPnJL5/n+afafzYcIOsQc2O+q0s4O1d5Q==
+            =3E6w
+            -----END PGP MESSAGE-----
+          fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMAw95Vf08z8oUAQ//abo3n5r8YdQ6p+/X031/n8MCvWKw+ERGSvDuT2r7g8m8
+            DqrBQmX578jHVmZkC2B6fYqEBuQAeyEJyQ56MLMuGMNSET8dgNS4Uj/gwvsuEDQf
+            NhU10WLkfQ3g2/o654BVzPC2b3UQTL4mmXqp0+ID79uynn0/WZ0TQQ8xj/uUaDS1
+            h6/uC7mmDGTHaxF3gFuYkvWMghU0bqX5BfrAPdICAr8FIqxUGIvUD6KkBu9hWTYP
+            RLtfwpU/DAcT/7pNtic25WzzQt7W0mok3zUZZq5r2UqO35x2XOrgC5DQ69QYf7JZ
+            a9S236gEpAS0Kl1IWSvY2kDzj/J27T3nonY2kX3a+UqVWX15LEmVmNNUMwjz91/b
+            0G+26vustzinHBs30EHGBqhyELjRW0RjcmlVGNXvZwhgGL5/LNIEcfBi19tIang1
+            dRYE9TasSeRbyTU/A/CXFDeuGtC8K552SzXjv1zP6gkwZFb0/zd0/XHPSyGyOLbM
+            1PC3JhkA8GEYQ7l9y5BdPXxZseuoSHDPHfMRIcnogx6w6rfBdd9+78M1WjnGzhYi
+            /utORBaiwU9Zk+Xm3B+WbkDl5+jio+UIp9nHoYAGfuJ9A6TZYBIavB6K171wALke
+            Kl6hoTxef/VGwdfXB9ikUy0bi0Km1vVpZGVzIjSFXiSlLkaamhxUFSgDPGZN21rS
+            UQHeXKkhgKXTEVvi+kypRbN2/174bElGTWz1C2TWPNJAcvvKmRw66t5g8pahnXbm
+            SYQoB5JaAl0URu6zHWBYhCjQjiyePhnxHV4tgGtEYAdY3g==
+            =xXRR
+            -----END PGP MESSAGE-----
+          fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA0/D4ws+/KPtARAAsxa6N9jRT1AUqfWI7gIfJK6i6g0F5oxRYJ5A2mjhc89k
+            ZAN4/tO9GC+Fg8+lLhPHdiz6v2T1+92AFXET3jm+ax6rYei2woMHNXKzgqxjkQEQ
+            xQ/3LcQ3+FOTrvy7Gir9HQ/DoWSePBF7tx16unxH75hi6AgOiT0nFoEbXP3CJXie
+            lVOO5r5jKgBg9LENj/U+9LHjXB6W0PbVdhxdeStk2TTKcmuDnrGeqKZ3SyZ9V33p
+            DEfydW+T0ac156Eb2tdszzW5e87oPmW78wvLkotboZcPVWBadRtJkzVn3JXoMAda
+            gN+W2+I4/4iQN8ITBQ+2i5GsdbHtnrmPkzSbtSqhujwZ1k/a7uRmHy46ejDK9QnT
+            lQzm2OKyjTlCDhnxnKj0eTE4nN0CDyxGBNlNVG2piKd8i+HpqrjKJ9IUcMj7oO3U
+            8rtQ2A0LHquNvu6ZatP6fUk3tKgLaEslV4ORXMlILdZXlYqgznmvWJaII3XVeu8l
+            G/tHPkOhrcQDIecBeYcTLZYXtPtmY1UNJZfbDazG/9J0rdq/r9NmnB7woy7FSYEp
+            yRNji1i/89nVLsu94ra1D6FHyxgIFTSLkD7s1iCMTsz0UdwfbxqdLIWumYrm04XF
+            wM2eTB8OAGe8mdfi1q4te0FEDMLTpdYBhYDDjHmBv4fXwKPcWkgixvNJtT6xPgLS
+            UQEvOn03hQ8MCQ5kh1R1FoTOw1UpgV0eqJSateC2wkBKbZ/4NWPbnZA7XAW6Jb98
+            JidKJ8TiYiI33hxUhu4nUeZWjNcd7MgHyl1Do2r7SfyICw==
+            =TXST
+            -----END PGP MESSAGE-----
+          fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA5Wf+FyJ+zFJAQ/+I9khYJfqjCHhrAaElVWKgn4c+7C+oilVNE0132pQZfLb
+            u17yv6AYY5zThK6Lg0GZMKaKFn+JuF9wonTyixJQccJ+w2MxsJQRNQZTV/t19HrQ
+            B+6YFLVPNyOglr7jf+o5BnOdIvpR0Cog5JDzn0j4iwpRWRSGW1sWXiABKWUIW0Ks
+            nR7Rm/k3Jm8zYO6LtoyYog5HGUEHRMuOY6Yoj/EEbfDLKFU5WZ+hfKnbGGM9KW31
+            RkXoCtjm2AstZTia5+Y0E3wNb9bbvpbkewyQd5KqaHmHaX3MzuoYKNHGVEgPMfla
+            Y26aED5uSLETv+C1U/jYJyxyVJxNYb2JBrS8a7+p+mo00Cvbs/pbM/cr5Y/Ogu7Q
+            Ed0+Ixst3LzSTOcYAAiEC/LpWztaIp/4h/cAfE7eKnsoFUVcv2lLpLHyI7fS/sJH
+            Ywp8tlqlfx7DaCqYEVjPMSfI9qBbJomoQ77szHL+Gyi4ibyF0iRz0/NnF5lmu5H5
+            sDAYiqnHEIpk1v+gWXoj/CQq7a5jJf044cYylcO+al27cugr+jr5TBQQVv+wDNJV
+            LqpAxmmz8yUJ6RlTSg5JwNlNCCOONv6f+lX0Cjk7V0kPcOMgbVn19Su7zIvhM7wd
+            m9mzuVWWx2SBGzORdK9W4tt7lybU7aCvusT1jP1nwXF/JCz9lyEbb1syaNIAiXHS
+            UQE2Va23CUVgB+cV/ImXBCEuAjZhiSMFVCtWOZrcqPS8EZX9s6WzscpsEmFnDE7t
+            GVR3u1IyjxTsuTxxYU0ldSjHqYFjQrgRD3ZBzwZcgeajqw==
+            =bF9b
+            -----END PGP MESSAGE-----
+          fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+ARAAoMRyGipvXTgUChfL1Lryej14FI9+8dvWQculBjPQzg6x
+            oxdPzz07ifIX8D64zfToE+qc439l/RYwiMx9XyGscEim0D1GIFPwxOm4DCXT+/5m
+            wlLkOBP7oMwirqSazS7dNF1hE83717QTi1GqC0UqhoMINtxrhQIv1Y6xxREqD1Wd
+            eW3M45p1i8iSZkzF7n0EhIK3J59Wl3vxt9FUX3YRWk1JH0oaqIc1VCH3TJc73DAx
+            9e1jIVQSo4R8BfQc5Y64xRh0eq/87Ud2E2x9JbZmpnw4FN/OHg9QqRMaZ9r6EQ/l
+            VerhJFkfSj3UVAfODzViKXyNTKRak1GOcQBE5lfAXynAW1nfTTx0re0rl6/tvOwC
+            i02a/raksTI8afak1RMclNFqlihsegGU239ZGDRPb4apL32nYY0SMim58vET8rv5
+            eTiQE1udg+1ttIRAGq/PxzHKlc6FUEdyJ6i2Da16c0K76FpF3Gnxxhw+Tleixx3h
+            6+PbhC2qEgt7LS8TNg9J2WTDy4Hlw5YEmzOAM9NA6UYrH9BHsR87sbdriz6pAC55
+            CnFkWptrME4CjUP72qIezRYt/4784ABTw6poQ51jP30641YhgPoYLrWS8hWQYaE3
+            jcrum3JQnLTjsE88OclcreKNvNj+b1t0uxuHa/6UdMnyRCd8osJ22s6JJHLGgB/S
+            UQHvy+Rv0QJ65DjsJ4TfdRBLcKXaF7Ar5SaANqGi8EYwjVbhfImwx5VSEsvQclEU
+            7JihoETtCrRwJM1BkJz3nuBAaYDm1Y+lWHSyVZ6xi8G0eg==
+            =n6cE
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

kustomizations/matrix/coturn/daemonset.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: coturn
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: "coturn"
+          image: coturn/coturn
+          args: ["-c", "/config/turnserver.conf"]
+          ports:
+            - name: turn-3478
+              containerPort: 3478
+              protocol: UDP
+            - name: turn-49152
+              containerPort: 49152
+              hostPort: 49152
+              protocol: UDP
+            - name: turn-49153
+              containerPort: 49153
+              hostPort: 49153
+              protocol: UDP
+            - name: turn-49154
+              containerPort: 49154
+              hostPort: 49154
+              protocol: UDP
+            - name: turn-49155
+              containerPort: 49155
+              hostPort: 49155
+              protocol: UDP
+            - name: turn-49156
+              containerPort: 49156
+              hostPort: 49156
+              protocol: UDP
+            - name: turn-49157
+              containerPort: 49157
+              hostPort: 49157
+              protocol: UDP
+            - name: turn-49158
+              containerPort: 49158
+              hostPort: 49158
+              protocol: UDP
+          volumeMounts:
+            - name: config
+              mountPath: /config/turnserver.conf
+              subPath: turnserver.conf
+              readOnly: true
+            - name: var-tmp
+              mountPath: /var/tmp
+          securityContext:
+            capabilities:
+              # https://github.com/coturn/coturn/issues/994
+              add:
+                - NET_BIND_SERVICE
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+      volumes:
+        - name: config
+          secret:
+            secretName: coturn
+        - name: var-tmp
+          emptyDir: {}

kustomizations/matrix/coturn/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/name: coturn
+    app.kubernetes.io/part-of: matrix
+resources:
+- daemonset.yaml
+- service.yaml
+generators:
+- secret-generator.yaml

kustomizations/matrix/coturn/secret-generator.yaml

@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: coturn-ksops-secrets
+files:
+  - config-secrets.enc.yaml

kustomizations/matrix/coturn/service.yaml

@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: coturn
+spec:
+  type: ClusterIP
+  ports:
+  - targetPort: turn-3478
+    name: turn-3478
+    port: 3478
+    protocol: UDP
+  - targetPort: turn-49152
+    name: turn-49152
+    port: 49152
+    protocol: UDP
+  - targetPort: turn-49153
+    name: turn-49153
+    port: 49153
+    protocol: UDP
+  - targetPort: turn-49154
+    name: turn-49154
+    port: 49154
+    protocol: UDP
+  - targetPort: turn-49155
+    name: turn-49155
+    port: 49155
+    protocol: UDP
+  - targetPort: turn-49156
+    name: turn-49156
+    port: 49156
+    protocol: UDP
+  - targetPort: turn-49157
+    name: turn-49157
+    port: 49157
+    protocol: UDP
+  - targetPort: turn-49158
+    name: turn-49158
+    port: 49158
+    protocol: UDP

kustomizations/matrix/element/deployment.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: element-web
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: element-web
+          image: vectorim/element-web
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /app/config.json
+              name: config
+              subPath: config.json
+              readOnly: true
+            - mountPath: /etc/nginx/nginx.conf
+              name: config
+              subPath: nginx.conf
+              readOnly: true
+            - mountPath: /etc/nginx/conf.d/default.conf
+              name: config
+              subPath: default.conf
+              readOnly: true
+            - mountPath: /var/cache/nginx
+              name: ephemeral
+              subPath: cache
+            - mountPath: /var/run/pid
+              name: ephemeral
+              subPath: pid
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+      volumes:
+        - name: config
+          configMap:
+            name: element-web-config
+        - name: ephemeral
+          emptyDir: {}

kustomizations/matrix/element/files/config.json

@@ -0,0 +1,44 @@
+{
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://matrix.distrust.co",
+      "server_name": "distrust.co"
+    }
+  },
+  "brand": "Distrust Chat",
+  "branding": {
+    "default_theme": "dark"
+  },
+  "showLabsSettings": true,
+  "features": {
+    "feature_new_spinner": true,
+    "feature_pinning": true,
+    "feature_custom_status": true,
+    "feature_custom_tags": true,
+    "feature_state_counters": true,
+    "feature_many_integration_managers": true,
+    "feature_mjolnir": true,
+    "feature_dm_verification": true,
+    "feature_bridge_state": true,
+    "feature_presence_in_room_list": true,
+    "feature_custom_themes": true,
+    "feature_oidc_native_flow": true
+  },
+  "roomDirectory": {
+    "servers": [
+      "matrix.org",
+      "distrust.co"
+    ]
+  },
+  "integrations_ui_url": "https://scalar.vector.im/",
+  "integrations_rest_url": "https://scalar.vector.im/api",
+  "integrations_widgets_urls": [
+    "https://scalar.vector.im/_matrix/integrations/v1",
+    "https://scalar.vector.im/api",
+    "https://scalar-staging.vector.im/_matrix/integrations/v1",
+    "https://scalar-staging.vector.im/api",
+    "https://scalar-staging.riot.im/scalar/api"
+  ],
+  "defaultCountryCode": "EN",
+  "default_theme": "dark"
+}

kustomizations/matrix/element/files/default.conf

@@ -0,0 +1,44 @@
+server {
+	listen       8080;
+	server_name  localhost;
+
+	#charset koi8-r;
+	#access_log  /var/log/nginx/host.access.log  main;
+
+	location / {
+			root   /usr/share/nginx/html;
+			index  index.html index.htm;
+	}
+
+	#error_page  404              /404.html;
+
+	# redirect server error pages to the static page /50x.html
+	#
+	error_page   500 502 503 504  /50x.html;
+	location = /50x.html {
+			root   /usr/share/nginx/html;
+	}
+
+	# proxy the PHP scripts to Apache listening on 127.0.0.1:80
+	#
+	#location ~ \.php$ {
+	#    proxy_pass   http://127.0.0.1;
+	#}
+
+	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+	#
+	#location ~ \.php$ {
+	#    root           html;
+	#    fastcgi_pass   127.0.0.1:9000;
+	#    fastcgi_index  index.php;
+	#    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
+	#    include        fastcgi_params;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#    deny  all;
+	#}
+}

kustomizations/matrix/element/files/nginx.conf

@@ -0,0 +1,28 @@
+worker_processes  auto;
+
+error_log  /var/log/nginx/error.log warn;
+pid        /var/run/pid/nginx.pid;
+
+events {
+	worker_connections  1024;
+}
+
+http {
+	include       /etc/nginx/mime.types;
+	default_type  application/octet-stream;
+
+	log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+	'$status $body_bytes_sent "$http_referer" '
+	'"$http_user_agent" "$http_x_forwarded_for"';
+
+	access_log  /var/log/nginx/access.log  main;
+
+	sendfile        on;
+	#tcp_nopush     on;
+
+	keepalive_timeout  65;
+
+	#gzip  on;
+
+	include /etc/nginx/conf.d/*.conf;
+}

kustomizations/matrix/element/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/name: element-web
+    app.kubernetes.io/part-of: matrix
+resources:
+- deployment.yaml
+- service.yaml
+configMapGenerator:
+  - name: element-web-config
+    files:
+      - files/config.json
+      - files/nginx.conf
+      - files/default.conf
+images:
+- name: vectorim/element-web
+  newTag: v1.11.67@sha256:5dcccfdebc05852e835de3fbb36d34cd34de2776724f0c8c50167d5da382e8ae

kustomizations/matrix/element/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: element-web
+spec:
+  ports:
+    - name: default
+      protocol: TCP
+      port: 80
+      targetPort: http

kustomizations/matrix/ingress.yaml

@@ -0,0 +1,152 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix
+  labels:
+    app.kubernetes.io/name: matrix
+    app.kubernetes.io/part-of: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/cors-allow-origin: https://chat.distrust.co,https:app.matrix.org
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 110m
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - matrix.distrust.co
+      secretName: matrix-distrust-co-tls
+    - hosts:
+      - matrix-fed.distrust.co
+      secretName: matrix-fed-distrust-co-tls
+  rules:
+    - host: matrix.distrust.co
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse
+                port:
+                  name: http
+    - host: matrix-fed.distrust.co
+      http:
+        paths:
+          - path: /_matrix/
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse
+                port:
+                  name: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix-media-repo
+  labels:
+    app.kubernetes.io/name: matrix
+    app.kubernetes.io/part-of: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/cors-allow-origin: https://chat.distrust.co,https:app.matrix.org
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 110m
+    # This combination of configurations allows for the media-repo to function
+    # properly
+    nginx.ingress.kubernetes.io/upstream-vhost: distrust.co
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      more_set_input_headers 'Host: distrust.co';
+      more_set_input_headers 'X-Forwarded-Host: distrust.co';
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - matrix.distrust.co
+      secretName: matrix-distrust-co-tls
+  rules:
+    - host: matrix.distrust.co
+      http:
+        paths:
+          - path: /_matrix/media/
+            pathType: Prefix
+            backend:
+              service:
+                name: media-repo
+                port:
+                  name: http
+    - host: matrix-fed.distrust.co
+      http:
+        paths:
+          - path: /_matrix/
+            pathType: Prefix
+            backend:
+              service:
+                name: synapse
+                port:
+                  name: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: element-web
+  labels:
+    app.kubernetes.io/name: element-web
+    app.kubernetes.io/part-of: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      add_header X-Frame-Options SAMEORIGIN;
+      add_header X-Content-Type-Options nosniff;
+      add_header X-XSS-Protection "1; mode=block";
+      add_header Content-Security-Policy "frame-ancestors 'self'";
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - chat.distrust.co
+      secretName: element-distrust-co-tls
+  rules:
+    - host: chat.distrust.co
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: element-web
+                port:
+                  name: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: appservice-slack
+  labels:
+    app.kubernetes.io/name: appservice-slack
+    app.kubernetes.io/part-of: matrix
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      add_header X-Frame-Options SAMEORIGIN;
+      add_header X-Content-Type-Options nosniff;
+      add_header X-XSS-Protection "1; mode=block";
+      add_header Content-Security-Policy "frame-ancestors 'self'";
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+      - slack-bridge.matrix.distrust.co
+      secretName: slack-bridge-matrix-distrust-co-tls
+  rules:
+    - host: slack-bridge.matrix.distrust.co
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: appservice-slack
+                port:
+                  name: rtm 

kustomizations/matrix/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: matrix
+resources:
+- synapse
+- coturn
+- element
+- matrix-media-repo
+- bridges/matrix-appservice-slack
+- bridges/mautrix-telegram
+- ingress.yaml
+images:
+  - name: matrixdotdog/synapse
+    newTag: v1.98.0@sha256:8d962e48a1d88d2fb646c82b1babf4dd0ed765b21a4cf15600d77e90e46dc413
+  - name: coturn/coturn
+    newTag: 4.6.2@sha256:9a5d44d1aebf28f1a96de4595bbab3eadc1ebd6bda705ca040df907f353f9fb2
+  - name: dock.mau.dev/mautrix/slack
+    newTag: 4530ff397d08d93b673cd71da4c2a75d969ca0df-amd64@sha256:7db11f874c655dd8be77a75fb07bd6071cc0d7e92bc564e1397f5b2e0e1883c7

kustomizations/matrix/matrix-media-repo/deployment.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-media-repo
+spec:
+  template:
+    spec:
+      # This does not currently work as there are some weird expectations on
+      # run scripts as running as non-root
+      securityContext:
+        fsGroup: 1000
+      containers:
+        - name: media-repo
+          image: drgrove/matrix-media-repo
+          ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+            - name: metrics
+              containerPort: 9000
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /home/user/media/
+              name: ephemeral
+            - mountPath: /home/user/config/media-repo.yaml
+              name: config
+              subPath: config.yaml
+              readOnly: true
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            allowPrivilegeEscalation: false
+            # Right now setting this to true is not possible
+            readOnlyRootFilesystem: false
+      volumes:
+        - name: config
+          secret:
+            secretName: mmr-config
+        - name: ephemeral
+          emptyDir: {}

kustomizations/matrix/matrix-media-repo/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/name: media-repo
+    app.kubernetes.io/part-of: matrix
+resources:
+- deployment.yaml
+- service.yaml
+generators:
+- secret-generator.yaml
+images:
+  - name: turt2live/matrix-media-repo
+    newTag: v1.3.3@sha256:59cf338753598af400919caf332c92dd0e8e6c6e6e5d18270e52552c7c1e3c4b

kustomizations/matrix/matrix-media-repo/secret-generator.yaml

@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: telegram-ksops-secrets
+files:
+  - config-secrets.enc.yaml

kustomizations/matrix/matrix-media-repo/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: media-repo
+spec:
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8000
+      targetPort: http
+    - name: metrics
+      protocol: TCP
+      port: 9000
+      targetPort: metrics

kustomizations/matrix/synapse/config-secrets.enc.yaml

@@ -0,0 +1,122 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: config
+type: Opaque
+stringData:
+    homeserver.yaml: ENC[AES256_GCM,data:9O2YODDpJf6FzX6DojwGaIYkRs99K/GP+HCBCb4PO5fNJPmyEaN3DllpZjSn1WlgMIMi46gs7wfZJjoJRVz5wq+owwmZw+4lrAnYN8niNKcYoakuHn57WSzlrrqZDMY5i0VKZ1S+QATGll5Wl19AjHIuVEbJ5nQeeORVq+n7voG4/MX3PcZINjKdr4PnTwCx21TrPb9lRunH+oGhbHjMvx4yxNzqOvrvuFMSqkC/lDWrrSfCcn14qbLhq//OAk+c49IUkHTjJVbaK4mx1dbi7LA3rsZmb5cM9iFLPImWZnlpGM3SZasO91paiV8EaH+EkyA/4TpWODi+0KCiwVrLnOxEvmx6NweGOIaWgk04DgFomD468F1i0VVksk5/FwM8QvS8cIZ6Wqk/mAtbki5pnpvSZMrWXV4WSja+IcpoPYZjYdzttiHhxqoQ9Kkka3AqPEm1Nj6ggYtgjfE78dWVxN0jcKTXLV6C2T59jqpwyT9zmIpTJZ6AbZL6hafBprJenwD4mUO+pGzW1zs2nzDDr49nRSLtnRub5ecdYgZTPoInxxJYqbgZIjCYfwc7Y49JeSxklQXspCYZf+xmS0O4w8FzgwWYKCcajju4cRKHe46oN6QUftcmJILyt4LVSCuKzGsIKRnPazPKWqPUDjAs7j/i+jCha6gIctF5wvihfrCXHqD0gHa92kR/M581C6Ch2LFTupyUZtyZEbE+Y1oPlYyn2psBohVm/izl96QKuX7Ujco5Iahf7A55CTMuoBqXtvhpNwZVcmLf3SWiFTN2LfrkG2rXarvq+2TsgMcFeNia094Yk0gISR8UTu7uhhKuoPoFMN+3cCnXqiqMHoehbT9KyV7QuXG+M/jvGnUKPeTtp/Grmd4arvLpFp9UKAXbVkvFCFyTW+562qRnh0Int88ycr6FBdQl1HTN+mQfz4lNLxNomxu+0iDMaNP0+YTncSRragpjV267IUvWzzu5Dl1StD8YUZ2/J+66helA3IGBVlIqoeoAJyrP+GNuhwInTFVBlVxDyn8N/VqJuFw3B8c2W7BX6+68asZROeaTHDu2rYfxVWhGss7oKTxz4RdiK510tLh5OtI7M5f2b8gnhqwTbsiHM4UaCXGP4JdmIsyLcUEeg9K1jQx/LsYCBi9ZaegzbhIvgi3r12495Fzw5gWfZ5Xsf7gvQYR41A==,iv:QemGZaVH7IHvLdTjhr+R7FMyuJlGk9UsZMn5aILwwNg=,tag:N3dCm2v044ZrOgPjWSrjuw==,type:str]
+    mautrix-slack-bridge.yaml: ENC[AES256_GCM,data:7prhlEl/Ftf2CJWX67OF36fU386C5aGtrG45ofQCepBlI1Chi9ntswRd4VmiOnEt3vepgy4WFPRrAGu+1ycvILgCztK/2hFhEEmnf6vOlNkddXhkyuB9AgOTeCZ/ieTFXw0kErmaAvFwCkdp/SZIh+rqOTGk/3QoPqv7+1mLTxyuUOGeKlizs+4AfzFqpommfQNC2ZPpbOCtih/OZty+nbleyYnwBCyiIEOSI/to8m2aAIlg69fIT6cOwj4xiglO5dovXtr3Qe0VqkxBPOzD+1T5cFl2Q6zW0pFI320lP9MDwif92l8tTUEh12io6QtI5vQj7sNOoJ1FtnJwToL1V/vjESjl5MN1+LpZVicX4V2fUevJbms+7HUJFz4hETv1x/9tNmGSm5blZBz3qtUBJM/mRyBhnznjok0E9EXbGI6ox9O8scsvmXSYnkZHgFTXerqY/DmWmfFenWJLopNy7x1YNXUyb9z90//shUK5/Knau/YcCAKkDmzg6RObgHjkdCx/lfVePIkdKqrwS52lL5+CCgIKDVQm7Ds58E/0b+84N/6FWCwy5YV1+1R0SEywgVQ1WzjxJnR/Yg80tKQVqAzroFO5RWhffQEAyp3YQSURVQiZw4L89UXrfSvDvXu85olcGq1rXWGrDHgZSo7NKCbEQ29q8LsDgw==,iv:GyV3W2Rl+0T3pwrV1/Qv3OV4gYb8btnHMu340brhEcw=,tag:xRywHK6w5TfUdZTfS9XYhw==,type:str]
+    mautrix-telegram-bridge.yaml: ENC[AES256_GCM,data:WI3qnnmTi6/k0BdVOLFndk9nQPlBXMwvB+JAg68Q8o6eUjaFGQ3UzitmexxmX5JK70G6ZdCmqsfsut2M2eGGxYH4FrwP8nMIz/vtD1IeXciu7IFmNOptNC5NZI41C7UP+OO21SFPeu+tWblu8qa3+OrJOQaL+GLLnRDDk21w6HTR2vvRieTy4c8NSC2XYhoiplZ7Z1FIRKTO75jjQN/L8bGVM3a0nNCmi8cGt+LPtyJBv7Espr3l1kUhiLMUxVK2zeP5HRgXWxB9UeUdqdJa8Yfz8QPHQmroOTMsmXLnocM8LVPOleSWLrYfKvML22g1oTesR5LxazdIc5BRL3upPwz7AO6nOcOKNZVuyVUUmrg2wNscKs6r5LDBJzsNxte4OEtzygpVAjHyiAqYU61atycVzYgfziY7cy0dUmkhikyBfmO5mVFP2YkEINtPkX7tJW4E5s2vqRP8L0PB3rwqBPQPHr3llsUQf1rKLjEThwEcWc1OBgDaZJiRxUd/P5m2lMvdh+hW6y8gDNURtY5uwSh7k7DNJ8n6MSzX8ZnhBAsuwg9tXU0YwgR+uT14D3xsGfUJDYTKpsr5ejY4adbQjOMzgbhadz8iKbZdr8cWVPotBIR76SaGgRXqITWl5ygf1N0PVkgzrkTxdLmIv+7ttqndblkjyW/2W5NvY3iU+skC+GZpgLNDEmGGkmITpBIfxEEYBLNQZynD+NaA9hiATr+TVzAcp760FSOqbFLeDMx3YOpbcNQ77FdPq6qcCPxfe1nstzlQixjf4cEpdfuQWkFZIrlV4EBYh/WNH0VP,iv:7PhPWul/rDWEJB5ecn0myPMwbC6akihS0xZEvyeEB9s=,tag:TMAusZ7EneDQgLsthzaL8w==,type:str]
+    doublepuppet.yaml: ENC[AES256_GCM,data:bA8r1TZECeDxIuUxkBcM0MOFdplcB5wus7KEir7LfPWFA06aUCz5o2BU/YKSzf5NlEtwQLlCiaDdONPPfLMvjHxaXBfyd2YCIoqeP7GCCqRnfZE4zaY2QajrUkBZQV9DAvf23Mt9Zw6ByLUHWIGvB95WOGHXxKeyDo0jnUgDWu+Osm+UIkbYKEOBw/rF3NOAUBQxxh9AlxwU/IUMV3++dhbGaTF46RN7FF/XLUJ4d3zt/f9r/UUrPwksiyUFyDRjRuV0ABn0aLneeJhcL2H4MeFnkjuRie9t292ief1UGbbqZnSMSuh//V7UrxKJw3o/asVRQQkxJOVQfAa6TUcBq/kxhuYXDBg1mAFD8/RGmA6pjJGH5+q9Cqaqmj6PgLRU+HS2iZnkkz6FRK6GmSAXu1vcwB0GC6NkLXU75B8j+3b8DV+rM6boKzQgAVNT+McCm0Zg2DdtMvQ//Qqetg8AXOvHXSJZ/zU7HsM42fm8Zk49uF6abKY=,iv:227zkv9T+yoycJNumdo0rV44ngXlM5hYu/1kRBj93r0=,tag:yQq2Aiw2sB4kmp/CeJ0G3g==,type:str]
+    appservice-matrix-bridge.yaml: ENC[AES256_GCM,data:D7v8HJ1UbN/LI0OQ/VZnMqELIE7C2WiaxNYEGZJg6e0zV7sZ+xV16nQkrfmVEHbIfEsdf/LlmEZmf5JTrqfVi4LPAL9zFYwvJAOKTLmjqKWJSUS+qLqzBgoHwuwvn2qWnZjCDDuqQ8h+L8hDcLoI+GOW805icJxrg3ZX8zrVFldoG23YV9WhPQwnTbpi5LRDGMWWDTxxOFt6/ZgLyRTRAs8D601VEAI7ulyMPsIPZzKOx1aBIWb5VzmP+BKcWj8yYTR6UhFg0ac9a7Kb/U8u/soBRnBLmSEFnL6pVrv2utsyS4SdZNaSZN/PZtgxctdvPFYo/fGH+iFeYWZ11izyaTUngSgOvGTwvdEkn98wd2hwKnM0HvOOm28VX76/2wTiqU0e301AD5ouUKvvTFqJqqowQJp5DD5DX4BZ0jS6n9+QsH8MfeSP89ZgKIhNvHQ8KAnm1yJu5nEvaOt7NVkEL9CVFtrymDqRCCS3/FMVYBtq4bjJsrQ6yXqIzSPH,iv:Kv4eGx1vFgs+sV6iwBZD/nR0h2GzLKqjNJmgsRldNrY=,tag:QGmJZUhn23c1pez9+MCrfg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-03-31T21:34:41Z"
+    mac: ENC[AES256_GCM,data:RZ0jexcJq46ByhdZsG/Ab1ONc0cie8UAY7e5pw4+3IZmh1Zgg41vz1+sbitIUVC1tFjND7Jo0Ess+agS7/b45JZU0rta9rKp7WhCOtAVhBO+BDXmRKMtWynd/TSxoBdUtHG+AlGAoPRmz/4HjUMDoeO0CFoa/jR5Ajfv/xrSa2o=,iv:W/XuQZ8Ju6pv3E/b+0ugDsg9J/FXw0ixfFwLNlmLgxQ=,tag:W+xjNY+AJdZb+dxUrvLosQ==,type:str]
+    pgp:
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA82rPM2mSf/aARAAkFACzQmqyF9BqaD1qEjIO4e6owS/n4h3U6ee0Y7fhO8y
+            a5RJ4/HvMmfXcYeHm+CZjsFaui4YJkPS93clGTJzV4w15yXJUunIVjAmkvSrVh6P
+            GqRUtNpi1y+JCS3sjlAfvm3h9b08dNxFv7rTwZtDiP8zmcNuB0zbLBFR7G6ixetx
+            ZxL7piPYX75Rqoz8A/+V7VAtsoX8t3xv5xgjHzzfhiM3TeoQUgLnF8aN5huiSptf
+            dMmNMa0GGu5QaUjYJ3iHjv5eMtCJ79KwpuCfv5iX34Q++rTe5VUWoQabNAiE/Frt
+            Rc3JB8o8rfL6WME9qIIa5k654JlVDKqOvTH3mtHkOIWhD2+CEK89Siq3G35Kkct8
+            Ym7UNa6gE8IdSGkCOH81G4ZheU6Z8OKF1Z7dO+o7IdgIURTwLEFeBIC2PtWOKOJP
+            PnzqZNk1w4n4XK6hQg4bmIj8VaZXXgHEXcO/jaGCoRyr36BHCE1Sj1ae5cMUgDje
+            p6WKVO6gXfRg7SRJqQNUh03Lz0YKIjsI/429UPyf9mtXbHfvVyrW3+wyByok86FG
+            cGL1Y/N7thxAxXqHy4OZFCE0NMP2bobMzzGJTtDY9oPsGwTb6xk1g0wE5zg6IoQa
+            9hnObBJhdpvYcD6juz+V0wkeI30essnz7ZTtsLdfCox6mnP5BMTtzxmcRrCpNvHS
+            UQFIZa0XryYoXv3rcw6yUpkqv6aYzD3L4PnqYtGUEtbMoTb8NXa9Cp+1OeypqZ0g
+            7uO5zCKJgL6sBaPnJL5/n+afafzYcIOsQc2O+q0s4O1d5Q==
+            =3E6w
+            -----END PGP MESSAGE-----
+          fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMAw95Vf08z8oUAQ//abo3n5r8YdQ6p+/X031/n8MCvWKw+ERGSvDuT2r7g8m8
+            DqrBQmX578jHVmZkC2B6fYqEBuQAeyEJyQ56MLMuGMNSET8dgNS4Uj/gwvsuEDQf
+            NhU10WLkfQ3g2/o654BVzPC2b3UQTL4mmXqp0+ID79uynn0/WZ0TQQ8xj/uUaDS1
+            h6/uC7mmDGTHaxF3gFuYkvWMghU0bqX5BfrAPdICAr8FIqxUGIvUD6KkBu9hWTYP
+            RLtfwpU/DAcT/7pNtic25WzzQt7W0mok3zUZZq5r2UqO35x2XOrgC5DQ69QYf7JZ
+            a9S236gEpAS0Kl1IWSvY2kDzj/J27T3nonY2kX3a+UqVWX15LEmVmNNUMwjz91/b
+            0G+26vustzinHBs30EHGBqhyELjRW0RjcmlVGNXvZwhgGL5/LNIEcfBi19tIang1
+            dRYE9TasSeRbyTU/A/CXFDeuGtC8K552SzXjv1zP6gkwZFb0/zd0/XHPSyGyOLbM
+            1PC3JhkA8GEYQ7l9y5BdPXxZseuoSHDPHfMRIcnogx6w6rfBdd9+78M1WjnGzhYi
+            /utORBaiwU9Zk+Xm3B+WbkDl5+jio+UIp9nHoYAGfuJ9A6TZYBIavB6K171wALke
+            Kl6hoTxef/VGwdfXB9ikUy0bi0Km1vVpZGVzIjSFXiSlLkaamhxUFSgDPGZN21rS
+            UQHeXKkhgKXTEVvi+kypRbN2/174bElGTWz1C2TWPNJAcvvKmRw66t5g8pahnXbm
+            SYQoB5JaAl0URu6zHWBYhCjQjiyePhnxHV4tgGtEYAdY3g==
+            =xXRR
+            -----END PGP MESSAGE-----
+          fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA0/D4ws+/KPtARAAsxa6N9jRT1AUqfWI7gIfJK6i6g0F5oxRYJ5A2mjhc89k
+            ZAN4/tO9GC+Fg8+lLhPHdiz6v2T1+92AFXET3jm+ax6rYei2woMHNXKzgqxjkQEQ
+            xQ/3LcQ3+FOTrvy7Gir9HQ/DoWSePBF7tx16unxH75hi6AgOiT0nFoEbXP3CJXie
+            lVOO5r5jKgBg9LENj/U+9LHjXB6W0PbVdhxdeStk2TTKcmuDnrGeqKZ3SyZ9V33p
+            DEfydW+T0ac156Eb2tdszzW5e87oPmW78wvLkotboZcPVWBadRtJkzVn3JXoMAda
+            gN+W2+I4/4iQN8ITBQ+2i5GsdbHtnrmPkzSbtSqhujwZ1k/a7uRmHy46ejDK9QnT
+            lQzm2OKyjTlCDhnxnKj0eTE4nN0CDyxGBNlNVG2piKd8i+HpqrjKJ9IUcMj7oO3U
+            8rtQ2A0LHquNvu6ZatP6fUk3tKgLaEslV4ORXMlILdZXlYqgznmvWJaII3XVeu8l
+            G/tHPkOhrcQDIecBeYcTLZYXtPtmY1UNJZfbDazG/9J0rdq/r9NmnB7woy7FSYEp
+            yRNji1i/89nVLsu94ra1D6FHyxgIFTSLkD7s1iCMTsz0UdwfbxqdLIWumYrm04XF
+            wM2eTB8OAGe8mdfi1q4te0FEDMLTpdYBhYDDjHmBv4fXwKPcWkgixvNJtT6xPgLS
+            UQEvOn03hQ8MCQ5kh1R1FoTOw1UpgV0eqJSateC2wkBKbZ/4NWPbnZA7XAW6Jb98
+            JidKJ8TiYiI33hxUhu4nUeZWjNcd7MgHyl1Do2r7SfyICw==
+            =TXST
+            -----END PGP MESSAGE-----
+          fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA5Wf+FyJ+zFJAQ/+I9khYJfqjCHhrAaElVWKgn4c+7C+oilVNE0132pQZfLb
+            u17yv6AYY5zThK6Lg0GZMKaKFn+JuF9wonTyixJQccJ+w2MxsJQRNQZTV/t19HrQ
+            B+6YFLVPNyOglr7jf+o5BnOdIvpR0Cog5JDzn0j4iwpRWRSGW1sWXiABKWUIW0Ks
+            nR7Rm/k3Jm8zYO6LtoyYog5HGUEHRMuOY6Yoj/EEbfDLKFU5WZ+hfKnbGGM9KW31
+            RkXoCtjm2AstZTia5+Y0E3wNb9bbvpbkewyQd5KqaHmHaX3MzuoYKNHGVEgPMfla
+            Y26aED5uSLETv+C1U/jYJyxyVJxNYb2JBrS8a7+p+mo00Cvbs/pbM/cr5Y/Ogu7Q
+            Ed0+Ixst3LzSTOcYAAiEC/LpWztaIp/4h/cAfE7eKnsoFUVcv2lLpLHyI7fS/sJH
+            Ywp8tlqlfx7DaCqYEVjPMSfI9qBbJomoQ77szHL+Gyi4ibyF0iRz0/NnF5lmu5H5
+            sDAYiqnHEIpk1v+gWXoj/CQq7a5jJf044cYylcO+al27cugr+jr5TBQQVv+wDNJV
+            LqpAxmmz8yUJ6RlTSg5JwNlNCCOONv6f+lX0Cjk7V0kPcOMgbVn19Su7zIvhM7wd
+            m9mzuVWWx2SBGzORdK9W4tt7lybU7aCvusT1jP1nwXF/JCz9lyEbb1syaNIAiXHS
+            UQE2Va23CUVgB+cV/ImXBCEuAjZhiSMFVCtWOZrcqPS8EZX9s6WzscpsEmFnDE7t
+            GVR3u1IyjxTsuTxxYU0ldSjHqYFjQrgRD3ZBzwZcgeajqw==
+            =bF9b
+            -----END PGP MESSAGE-----
+          fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+ARAAoMRyGipvXTgUChfL1Lryej14FI9+8dvWQculBjPQzg6x
+            oxdPzz07ifIX8D64zfToE+qc439l/RYwiMx9XyGscEim0D1GIFPwxOm4DCXT+/5m
+            wlLkOBP7oMwirqSazS7dNF1hE83717QTi1GqC0UqhoMINtxrhQIv1Y6xxREqD1Wd
+            eW3M45p1i8iSZkzF7n0EhIK3J59Wl3vxt9FUX3YRWk1JH0oaqIc1VCH3TJc73DAx
+            9e1jIVQSo4R8BfQc5Y64xRh0eq/87Ud2E2x9JbZmpnw4FN/OHg9QqRMaZ9r6EQ/l
+            VerhJFkfSj3UVAfODzViKXyNTKRak1GOcQBE5lfAXynAW1nfTTx0re0rl6/tvOwC
+            i02a/raksTI8afak1RMclNFqlihsegGU239ZGDRPb4apL32nYY0SMim58vET8rv5
+            eTiQE1udg+1ttIRAGq/PxzHKlc6FUEdyJ6i2Da16c0K76FpF3Gnxxhw+Tleixx3h
+            6+PbhC2qEgt7LS8TNg9J2WTDy4Hlw5YEmzOAM9NA6UYrH9BHsR87sbdriz6pAC55
+            CnFkWptrME4CjUP72qIezRYt/4784ABTw6poQ51jP30641YhgPoYLrWS8hWQYaE3
+            jcrum3JQnLTjsE88OclcreKNvNj+b1t0uxuHa/6UdMnyRCd8osJ22s6JJHLGgB/S
+            UQHvy+Rv0QJ65DjsJ4TfdRBLcKXaF7Ar5SaANqGi8EYwjVbhfImwx5VSEsvQclEU
+            7JihoETtCrRwJM1BkJz3nuBAaYDm1Y+lWHSyVZ6xi8G0eg==
+            =n6cE
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

kustomizations/matrix/synapse/deployment.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: synapse
+spec:
+  template:
+    spec:
+      containers:
+        - name: synapse
+          args:
+            - run
+            - --config-path
+            - /config/homeserver.yaml
+            - --config-path
+            - /config/secrets.yaml
+          env:
+            - name: SYNAPSE_CACHE_FACTOR
+              value: "5.00"
+          ports:
+            - name: http
+              containerPort: 8008
+              protocol: TCP
+            - name: metrics
+              containerPort: 9002
+              protocol: TCP
+          image: matrixdotorg/synapse
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            httpGet:
+              path: /_matrix/client/versions
+              port: 8008
+              scheme: HTTP
+            initialDelaySeconds: 120
+          readinessProbe:
+            httpGet:
+              path: /_matrix/client/versions
+              port: 8008
+              scheme: HTTP
+            initialDelaySeconds: 10
+          resources:
+            # These are just some arbitrary values, will have to be tuned or removed per-deployment
+            requests:
+              memory: 1Gi
+              cpu: 1000m
+            limits:
+              memory: 1Gi
+              cpu: 1
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: keys
+              mountPath: /config/keys
+            - name: config
+              mountPath: /config/homeserver.yaml
+              subPath: homeserver.yaml
+            - name: config
+              mountPath: /usr/local/lib/python3.11/site-packages/shared_secret_authenticator.py
+              subPath: shared_secret_authenticator.py
+            - name: log-config
+              mountPath: /config/log.config
+              subPath: log.config
+            - name: config-secrets
+              mountPath: /config/secrets.yaml
+              subPath: homeserver.yaml
+            - name: config-secrets
+              mountPath: /bridges/mautrix-slack-bridge.yaml
+              subPath: mautrix-slack-bridge.yaml
+            - name: config-secrets
+              mountPath: /bridges/mautrix-telegram-bridge.yaml
+              subPath: mautrix-telegram-bridge.yaml
+            - name: config-secrets
+              mountPath: /bridges/appservice-matrix-bridge.yaml
+              subPath: appservice-matrix-bridge.yaml 
+            - name: config-secrets
+              mountPath: /bridges/doublepuppet.yaml
+              subPath: doublepuppet.yaml
+            - name: tmp
+              mountPath: /tmp
+      restartPolicy: Always
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      volumes:
+        # Will need to be a persistant volume of some kind to support media uploads, unless using matrix-media-repo
+        - name: data
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+        - name: keys
+          secret:
+            secretName: signing-key
+        - name: config-secrets
+          secret:
+            secretName: config
+        - configMap:
+            name: synapse
+          name: config
+        - configMap:
+            name: synapse-log
+          name: log-config

kustomizations/matrix/synapse/federation-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: synapse-federation
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP

kustomizations/matrix/synapse/files/homeserver.yaml

@@ -0,0 +1,98 @@
+# Configuration file for Synapse.
+#
+# This is a YAML file: see [1] for a quick introduction. Note in particular
+# that *indentation is important*: all the elements of a list or dictionary
+# should have the same indentation.
+#
+# [1] https://docs.ansible.com/ansible/latest/reference_appendices/YAMLSyntax.html
+#
+# For more information on how to configure Synapse, including a complete accounting of
+# each option, go to docs/usage/configuration/config_documentation.md or
+# https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html
+server_name: "distrust.co"
+pid_file: /data/homeserver.pid
+use_presense: true
+enable_search: true
+public_baseurl: "https://matrix.distrust.co"
+
+# Homeserver blocking
+# Set to true to globally block access to the homeserver
+hs_disabled: false
+hs_disalbed_message: "Homeserver is not currently accessible"
+
+# Federation
+allow_public_rooms_over_federation: true
+# federation_domain_whitelist: []
+federation_ip_range_blacklist:
+  - '127.0.0.0/8'
+  - '10.0.0.0/8'
+  - '172.16.0.0/12'
+  - '192.168.0.0/16'
+  - '100.64.0.0/10'
+  - '169.254.0.0/16'
+  - '::1/128'
+  - 'fe80::/64'
+  - 'fc00::/7'
+
+# Listeners
+listeners:
+  - port: 8008
+    tls: false
+    type: http
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: false
+  - port: 9002
+    type: metrics
+    resources:
+      - name: [metrics]
+        compress: true
+
+# Rate Limit
+rc_invites:
+  per_room:
+    burst_count: 200
+  per_user:
+    burst_count: 200
+rc_joins:
+  local:
+    burst_count: 200
+  remote:
+    burst_count: 200
+rc_joins_per_user:
+  burst_count: 200 
+
+# Registration
+registration:
+  enabled: false
+  allowGuests: false
+  autoJoinRooms: []
+
+# This is handled by Cert Manager
+acme:
+  enabled: false
+
+# Bridges
+app_service_config_files:
+- /bridges/appservice-matrix-bridge.yaml
+- /bridges/mautrix-telegram-bridge.yaml
+- /bridges/mautrix-slack-bridge.yaml
+- /bridges/doublepuppet.yaml
+
+# Turn
+turn_user_lifetime: 1h
+turn_allow_guests: true
+
+# Metrics/Telemetry
+enable_metrics: true
+report_stats: false
+
+admin_email: "mailto:matrix@distrust.co"
+
+log_config: "/config/log.config"
+media_store_path: /data/media_store
+signing_key_path: "/config/keys/signing.key"
+trusted_key_servers:
+  - server_name: "matrix.org"
+# vim:ft=yaml

kustomizations/matrix/synapse/files/log.config

@@ -0,0 +1,31 @@
+version: 1
+
+formatters:
+  precise:
+    format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+    # This is just here so we can leave `loggers` in the config regardless of whether
+    # we configure other loggers below (avoid empty yaml dict error).
+    _placeholder:
+        level: "INFO"
+
+    shared_secret_authenticator:
+      level: INFO
+
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+root:
+    level: INFO
+    handlers: [console]
+
+
+disable_existing_loggers: false

kustomizations/matrix/synapse/files/shared_secret_authenticator.py

@@ -0,0 +1,123 @@
+# -*- coding: utf-8 -*-
+#
+# Shared Secret Authenticator module for Matrix Synapse
+# Copyright (C) 2018 Slavi Pantaleev
+#
+# https://devture.com/
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+from typing import Awaitable, Callable, Optional, Tuple
+
+import hashlib
+import hmac
+import logging
+
+import synapse
+from synapse import module_api
+
+logger = logging.getLogger(__name__)
+
+class SharedSecretAuthProvider:
+    def __init__(self, config: dict, api: module_api):
+        for k in ('shared_secret',):
+            if k not in config:
+                raise KeyError('Required `{0}` configuration key not found'.format(k))
+
+        m_login_password_support_enabled = bool(config['m_login_password_support_enabled']) if 'm_login_password_support_enabled' in config else False
+        com_devture_shared_secret_auth_support_enabled = bool(config['com_devture_shared_secret_auth_support_enabled']) if 'com_devture_shared_secret_auth_support_enabled' in config else True
+
+        self.api = api
+        self.shared_secret = config['shared_secret']
+
+        auth_checkers: Optional[Dict[Tuple[str, Tuple], CHECK_AUTH_CALLBACK]] = {}
+        if com_devture_shared_secret_auth_support_enabled:
+            auth_checkers[("com.devture.shared_secret_auth", ("token",))] = self.check_com_devture_shared_secret_auth
+        if m_login_password_support_enabled:
+            auth_checkers[("m.login.password", ("password",))] = self.check_m_login_password
+
+        enabled_login_types = [k[0] for k in auth_checkers]
+
+        if len(enabled_login_types) == 0:
+            raise RuntimeError('At least one login type must be enabled')
+
+        logger.info('Enabled login types: %s', enabled_login_types)
+
+        api.register_password_auth_provider_callbacks(
+            auth_checkers=auth_checkers,
+        )
+
+    async def check_com_devture_shared_secret_auth(
+        self,
+        username: str,
+        login_type: str,
+        login_dict: "synapse.module_api.JsonDict",
+    ) -> Optional[
+        Tuple[
+            str,
+            Optional[Callable[["synapse.module_api.LoginResponse"], Awaitable[None]]],
+        ]
+    ]:
+        if login_type != "com.devture.shared_secret_auth":
+            return None
+        return await self._log_in_username_with_token("com.devture.shared_secret_auth", username, login_dict.get("token"))
+
+    async def check_m_login_password(
+        self,
+        username: str,
+        login_type: str,
+        login_dict: "synapse.module_api.JsonDict",
+    ) -> Optional[
+        Tuple[
+            str,
+            Optional[Callable[["synapse.module_api.LoginResponse"], Awaitable[None]]],
+        ]
+    ]:
+        if login_type != "m.login.password":
+            return None
+        return await self._log_in_username_with_token("m.login.password", username, login_dict.get("password"))
+
+    async def _log_in_username_with_token(
+        self,
+        login_type: str,
+        username: str,
+        token: str,
+    ) -> Optional[
+        Tuple[
+            str,
+            Optional[Callable[["synapse.module_api.LoginResponse"], Awaitable[None]]],
+        ]
+    ]:
+        logger.info('Authenticating user `%s` with login type `%s`', username, login_type)
+
+        full_user_id = self.api.get_qualified_user_id(username)
+
+        # The password (token) is supposed to be an HMAC of the full user id, keyed with the shared secret.
+        given_hmac = token.encode('utf-8')
+
+        h = hmac.new(self.shared_secret.encode('utf-8'), full_user_id.encode('utf-8'), hashlib.sha512)
+        computed_hmac = h.hexdigest().encode('utf-8')
+
+        if not hmac.compare_digest(computed_hmac, given_hmac):
+            logger.info('Bad hmac value for user: %s', full_user_id)
+            return None
+
+        user_info = await self.api.get_userinfo_by_id(full_user_id)
+        if user_info is None:
+            logger.info('Refusing to authenticate missing user: %s', full_user_id)
+            return None
+
+        logger.info('Authenticated user: %s', full_user_id)
+
+        return full_user_id, None

kustomizations/matrix/synapse/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+labels:
+- includeSelectors: true
+  pairs:
+    app.kubernetes.io/name: synapse
+    app.kubernetes.io/part-of: matrix
+resources:
+- deployment.yaml
+- federation-service.yaml
+- service.yaml
+configMapGenerator:
+- files:
+  - files/homeserver.yaml
+  - files/shared_secret_authenticator.py
+  name: synapse
+- files:
+  - files/log.config
+  name: synapse-log
+generators:
+- secret-generator.yml

kustomizations/matrix/synapse/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: matrix

kustomizations/matrix/synapse/secret-generator.yml

@@ -0,0 +1,7 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: sydent-ksops-secrets
+files:
+  - config-secrets.enc.yaml
+  - secret-key.enc.yaml

kustomizations/matrix/synapse/secret-key.enc.yaml

@@ -0,0 +1,118 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: signing-key
+type: Opaque
+stringData:
+    signing.key: ENC[AES256_GCM,data:yrRjsuapmgDgBNNXGO9YyuZtkZaFPDg80SuJgdYWS3grCnN/hmkQ5x2icAf5i4f6TjAOreYxJYzRwQ==,iv:0ww6IrM9oY47ex1zYRULQx7TdATJ9odkk5k95yDo0ms=,tag:4/MjSSY2SltTuPtMtCRUtw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-01-22T05:45:47Z"
+    mac: ENC[AES256_GCM,data:GitHfIeAeu4g0bf1obvjd0TS6j5AZ0qo00i4mwIL3MKtCVa3dLfGkx4dE9SD0NZqBMpHdZTWnns145uCXnJTVdyLAlz54AuG/bn7eO642SghLpUvhyhH+c+xxQF2c3UJiR7TBdjJBh0BUBSO/yOBB0ondzocW9T1hDg/ExBjeo8=,iv:77yhCNc2cJ7/uuXOEma5LEyU0YIJSQiw4IYLLASli04=,tag:41IvCCKLfQZUNHsv6DvMsA==,type:str]
+    pgp:
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA82rPM2mSf/aARAAkFACzQmqyF9BqaD1qEjIO4e6owS/n4h3U6ee0Y7fhO8y
+            a5RJ4/HvMmfXcYeHm+CZjsFaui4YJkPS93clGTJzV4w15yXJUunIVjAmkvSrVh6P
+            GqRUtNpi1y+JCS3sjlAfvm3h9b08dNxFv7rTwZtDiP8zmcNuB0zbLBFR7G6ixetx
+            ZxL7piPYX75Rqoz8A/+V7VAtsoX8t3xv5xgjHzzfhiM3TeoQUgLnF8aN5huiSptf
+            dMmNMa0GGu5QaUjYJ3iHjv5eMtCJ79KwpuCfv5iX34Q++rTe5VUWoQabNAiE/Frt
+            Rc3JB8o8rfL6WME9qIIa5k654JlVDKqOvTH3mtHkOIWhD2+CEK89Siq3G35Kkct8
+            Ym7UNa6gE8IdSGkCOH81G4ZheU6Z8OKF1Z7dO+o7IdgIURTwLEFeBIC2PtWOKOJP
+            PnzqZNk1w4n4XK6hQg4bmIj8VaZXXgHEXcO/jaGCoRyr36BHCE1Sj1ae5cMUgDje
+            p6WKVO6gXfRg7SRJqQNUh03Lz0YKIjsI/429UPyf9mtXbHfvVyrW3+wyByok86FG
+            cGL1Y/N7thxAxXqHy4OZFCE0NMP2bobMzzGJTtDY9oPsGwTb6xk1g0wE5zg6IoQa
+            9hnObBJhdpvYcD6juz+V0wkeI30essnz7ZTtsLdfCox6mnP5BMTtzxmcRrCpNvHS
+            UQFIZa0XryYoXv3rcw6yUpkqv6aYzD3L4PnqYtGUEtbMoTb8NXa9Cp+1OeypqZ0g
+            7uO5zCKJgL6sBaPnJL5/n+afafzYcIOsQc2O+q0s4O1d5Q==
+            =3E6w
+            -----END PGP MESSAGE-----
+          fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMAw95Vf08z8oUAQ//abo3n5r8YdQ6p+/X031/n8MCvWKw+ERGSvDuT2r7g8m8
+            DqrBQmX578jHVmZkC2B6fYqEBuQAeyEJyQ56MLMuGMNSET8dgNS4Uj/gwvsuEDQf
+            NhU10WLkfQ3g2/o654BVzPC2b3UQTL4mmXqp0+ID79uynn0/WZ0TQQ8xj/uUaDS1
+            h6/uC7mmDGTHaxF3gFuYkvWMghU0bqX5BfrAPdICAr8FIqxUGIvUD6KkBu9hWTYP
+            RLtfwpU/DAcT/7pNtic25WzzQt7W0mok3zUZZq5r2UqO35x2XOrgC5DQ69QYf7JZ
+            a9S236gEpAS0Kl1IWSvY2kDzj/J27T3nonY2kX3a+UqVWX15LEmVmNNUMwjz91/b
+            0G+26vustzinHBs30EHGBqhyELjRW0RjcmlVGNXvZwhgGL5/LNIEcfBi19tIang1
+            dRYE9TasSeRbyTU/A/CXFDeuGtC8K552SzXjv1zP6gkwZFb0/zd0/XHPSyGyOLbM
+            1PC3JhkA8GEYQ7l9y5BdPXxZseuoSHDPHfMRIcnogx6w6rfBdd9+78M1WjnGzhYi
+            /utORBaiwU9Zk+Xm3B+WbkDl5+jio+UIp9nHoYAGfuJ9A6TZYBIavB6K171wALke
+            Kl6hoTxef/VGwdfXB9ikUy0bi0Km1vVpZGVzIjSFXiSlLkaamhxUFSgDPGZN21rS
+            UQHeXKkhgKXTEVvi+kypRbN2/174bElGTWz1C2TWPNJAcvvKmRw66t5g8pahnXbm
+            SYQoB5JaAl0URu6zHWBYhCjQjiyePhnxHV4tgGtEYAdY3g==
+            =xXRR
+            -----END PGP MESSAGE-----
+          fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA0/D4ws+/KPtARAAsxa6N9jRT1AUqfWI7gIfJK6i6g0F5oxRYJ5A2mjhc89k
+            ZAN4/tO9GC+Fg8+lLhPHdiz6v2T1+92AFXET3jm+ax6rYei2woMHNXKzgqxjkQEQ
+            xQ/3LcQ3+FOTrvy7Gir9HQ/DoWSePBF7tx16unxH75hi6AgOiT0nFoEbXP3CJXie
+            lVOO5r5jKgBg9LENj/U+9LHjXB6W0PbVdhxdeStk2TTKcmuDnrGeqKZ3SyZ9V33p
+            DEfydW+T0ac156Eb2tdszzW5e87oPmW78wvLkotboZcPVWBadRtJkzVn3JXoMAda
+            gN+W2+I4/4iQN8ITBQ+2i5GsdbHtnrmPkzSbtSqhujwZ1k/a7uRmHy46ejDK9QnT
+            lQzm2OKyjTlCDhnxnKj0eTE4nN0CDyxGBNlNVG2piKd8i+HpqrjKJ9IUcMj7oO3U
+            8rtQ2A0LHquNvu6ZatP6fUk3tKgLaEslV4ORXMlILdZXlYqgznmvWJaII3XVeu8l
+            G/tHPkOhrcQDIecBeYcTLZYXtPtmY1UNJZfbDazG/9J0rdq/r9NmnB7woy7FSYEp
+            yRNji1i/89nVLsu94ra1D6FHyxgIFTSLkD7s1iCMTsz0UdwfbxqdLIWumYrm04XF
+            wM2eTB8OAGe8mdfi1q4te0FEDMLTpdYBhYDDjHmBv4fXwKPcWkgixvNJtT6xPgLS
+            UQEvOn03hQ8MCQ5kh1R1FoTOw1UpgV0eqJSateC2wkBKbZ/4NWPbnZA7XAW6Jb98
+            JidKJ8TiYiI33hxUhu4nUeZWjNcd7MgHyl1Do2r7SfyICw==
+            =TXST
+            -----END PGP MESSAGE-----
+          fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA5Wf+FyJ+zFJAQ/+I9khYJfqjCHhrAaElVWKgn4c+7C+oilVNE0132pQZfLb
+            u17yv6AYY5zThK6Lg0GZMKaKFn+JuF9wonTyixJQccJ+w2MxsJQRNQZTV/t19HrQ
+            B+6YFLVPNyOglr7jf+o5BnOdIvpR0Cog5JDzn0j4iwpRWRSGW1sWXiABKWUIW0Ks
+            nR7Rm/k3Jm8zYO6LtoyYog5HGUEHRMuOY6Yoj/EEbfDLKFU5WZ+hfKnbGGM9KW31
+            RkXoCtjm2AstZTia5+Y0E3wNb9bbvpbkewyQd5KqaHmHaX3MzuoYKNHGVEgPMfla
+            Y26aED5uSLETv+C1U/jYJyxyVJxNYb2JBrS8a7+p+mo00Cvbs/pbM/cr5Y/Ogu7Q
+            Ed0+Ixst3LzSTOcYAAiEC/LpWztaIp/4h/cAfE7eKnsoFUVcv2lLpLHyI7fS/sJH
+            Ywp8tlqlfx7DaCqYEVjPMSfI9qBbJomoQ77szHL+Gyi4ibyF0iRz0/NnF5lmu5H5
+            sDAYiqnHEIpk1v+gWXoj/CQq7a5jJf044cYylcO+al27cugr+jr5TBQQVv+wDNJV
+            LqpAxmmz8yUJ6RlTSg5JwNlNCCOONv6f+lX0Cjk7V0kPcOMgbVn19Su7zIvhM7wd
+            m9mzuVWWx2SBGzORdK9W4tt7lybU7aCvusT1jP1nwXF/JCz9lyEbb1syaNIAiXHS
+            UQE2Va23CUVgB+cV/ImXBCEuAjZhiSMFVCtWOZrcqPS8EZX9s6WzscpsEmFnDE7t
+            GVR3u1IyjxTsuTxxYU0ldSjHqYFjQrgRD3ZBzwZcgeajqw==
+            =bF9b
+            -----END PGP MESSAGE-----
+          fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:55:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+ARAAoMRyGipvXTgUChfL1Lryej14FI9+8dvWQculBjPQzg6x
+            oxdPzz07ifIX8D64zfToE+qc439l/RYwiMx9XyGscEim0D1GIFPwxOm4DCXT+/5m
+            wlLkOBP7oMwirqSazS7dNF1hE83717QTi1GqC0UqhoMINtxrhQIv1Y6xxREqD1Wd
+            eW3M45p1i8iSZkzF7n0EhIK3J59Wl3vxt9FUX3YRWk1JH0oaqIc1VCH3TJc73DAx
+            9e1jIVQSo4R8BfQc5Y64xRh0eq/87Ud2E2x9JbZmpnw4FN/OHg9QqRMaZ9r6EQ/l
+            VerhJFkfSj3UVAfODzViKXyNTKRak1GOcQBE5lfAXynAW1nfTTx0re0rl6/tvOwC
+            i02a/raksTI8afak1RMclNFqlihsegGU239ZGDRPb4apL32nYY0SMim58vET8rv5
+            eTiQE1udg+1ttIRAGq/PxzHKlc6FUEdyJ6i2Da16c0K76FpF3Gnxxhw+Tleixx3h
+            6+PbhC2qEgt7LS8TNg9J2WTDy4Hlw5YEmzOAM9NA6UYrH9BHsR87sbdriz6pAC55
+            CnFkWptrME4CjUP72qIezRYt/4784ABTw6poQ51jP30641YhgPoYLrWS8hWQYaE3
+            jcrum3JQnLTjsE88OclcreKNvNj+b1t0uxuHa/6UdMnyRCd8osJ22s6JJHLGgB/S
+            UQHvy+Rv0QJ65DjsJ4TfdRBLcKXaF7Ar5SaANqGi8EYwjVbhfImwx5VSEsvQclEU
+            7JihoETtCrRwJM1BkJz3nuBAaYDm1Y+lWHSyVZ6xi8G0eg==
+            =n6cE
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

kustomizations/matrix/synapse/service.yaml

@@ -0,0 +1,16 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: synapse
+spec:
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8008
+      targetPort: 8008
+    - name: https
+      protocol: TCP
+      port: 8448
+      targetPort: 8448
+  selector: {}
+  type: ClusterIP

secrets/production.controlplane.yaml

@@ -483,76 +483,105 @@ sops:
     lastmodified: "2023-05-17T02:28:38Z"
     mac: ENC[AES256_GCM,data:hzkKZTGZX43cRKPfC28fYcvk8DJQDBuJf1XJ9jwebkN5hf9yumHcxyMSdip2da03jlWGpn+QuDtTUkauGHXbRY8DnE02PjT3ZIdNCi3YILEXVtfuRmEneb8CzeJeERg3z6TGeedYev/a2VlbyeX0RjVq9ne4L5KooJ7HXlLS2l8=,iv:pW2gRegsq63pDmdaDUG9M5RnDBJ9jL+QoQZtGIDtG90=,tag:juFfw579JsSO6YUZqwXkuQ==,type:str]
     pgp:
-        - created_at: "2023-10-17T19:10:55Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:58Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA82rPM2mSf/aAQ/8CzTMbNSr4OvkfHQ5ihXSZJOx8F+61V+DRD/WoeTcy4zR
-            KQVp3WcxJSEr5AyzldV1T6yZNrJTMlcK4RI1/Q1cJBhdq4CzN3nvLk+L9KLe/p2/
-            usnilSoe/yMf3+mMkZ8/wRab3P3BTLqwdCHlfJHFsroplr579lWHRYETU9GoD1jR
-            pUXiAAZSZxrfyd0tA4bxc/uIhzTPa+LXZyAmdqKHlzZE7zePzUCgGH83hDJW6hiA
-            RKwboUXYjvxftQ6xHMenyC/fOeTWHwltoNnlJUkuNXlPcD46ZXONHoICHB12te4Y
-            za7pDeRYBkMLiEaIm23uHQD/ig/bmJTV/fnnsYOU+hEENwz0OipB+evgEXjKD023
-            u0GBftZLk0fzeB8gU3EIDgLkTCq+nsOBn2doqbnvarfO7g2zGaaDg2gHYXvehgoF
-            ME+jOBOqw/ki5e8955jtbsQ5PaIEQ7o5STXLJgFl+5iwD/amIt3KvIIyHRQNpNdQ
-            4WdsiI27k+goZtfnbTkSisv4lENaCduPnlODeSWcXYN+7IDhEA0a7KgkVAHK2frk
-            OWAPQI1+SbqcvGfC8tQB5di5ZMkoQu1WAfKr8bb74kqZ0b4TwHYZLNXC7UkeyXBq
-            yZbgcbqn1Q7GgcVb0WFxHdUfLCAmLFPE24K+55dBbbgMCGXY/U4BW194+q7kztrS
-            XAFbI1vHiS1Lddbc0EePPeG8SGE/0W172M9q1nDD5AeXBaS22qscXAuFvUN6WOcU
-            614bOtlESqpxF1W3qz981bQF35tcjUxEkn2S8DyZOmScHZKLBkuR+XJawRLB
-            =u4gR
+            wcFMA82rPM2mSf/aARAAqGaMLBmMcQPF7wmrE43tFZWGGoYSQ5Ud68s29M7n2MZN
+            VGy2m04CPerlbE+gTEhkDfL9DUeyHnKAWPF5a36Z4rFs/lexelF16p9yexO0V3xZ
+            IfzbWSDEZ+PKaM1YGlPEEep5mgVWVCnG9ePrhD2Cv5BISzjSVUbSQ+0s8I6Io0vg
+            T2v7ARQx2fO98hyr+fBj2sh0pfEgMfQDk2FkNyc1BJPXLlHlLJGP52oxi1wllmTL
+            AcimUZZ8cJtgeMXhapQuHRy7UU2KbXoQ3IKhJIcVzCv+2F5+n32SYrqeWI6G7A7D
+            deGZKgXJa8tMLE3GHi8UWUiu0sgMU34Qire1Q2f6QSX2MsZalP3m1IkqWnqvtIP8
+            ivg8PHiayrRgEoC3QNQV/HFX6ldw4tA/box2NH/MFC4jgC1bhEXytdELnxPLcE6j
+            TNiTDcltHvh/JN/g3+cFFZ5kSMn57dtnIFnNFamWtOSqHT9wQBAb0Ezg8gx0ikiP
+            rdYsxHhwzr1sJT/KpFIc0n0PcBDlcHCz6+3qC2BfByN/2fHMh4f404QEsiwlYBHa
+            vvu1wIsPtKtfMv9t4uTK7l0ifl5s0DxPT3ddEE8AB/VWuGAMMf6Jfy/yT/kR5W1X
+            9kHW6D13l551LvfoMoQ02kHslUIK8Gthsmr+Ri+k6iBqwaSszUowlQy7jfV8i/LS
+            UQGPOtwH3Sb42mNjmK8KTR6A9NOqPv/Og34IZgY+yPAq2OXL0TmH8X52QCueLj2s
+            3akysLulh63o+xkthREu6Cd+OYs98UJxtez7QJzdqbeBMQ==
+            =vJj3
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-10-17T19:10:55Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:58Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMAw95Vf08z8oUARAAp1y1fX4c4JTa3I/WwdKFnQKpceXLr7JAsE/a5iNmqTYY
-            lZZQAnXEDbtpZgiePSc0ZjY5MaCRVa9NCoxOSwvM0Ut/T/tl1B8duy9xhMN476zd
-            7bnMu8472smrCFtSJk/XPQ2WrGJXMxyHV7JaD23isWVieYGlSvZRlklAQB8x5pOB
-            lEd55cJSYLEncvYP9qHkEVw7x/hwURLsbY3Fl6+whA6PS8c8JCRQTixq2nlff51/
-            j/qnbS2bPwjgCKgc85Ake6Ttk1taSAYym7+h3FcpPmZa3FFDKCBqhWO3CWj5kPuh
-            UxFb5ybPvRtrvAtur966mKP71/MiS5H7oQz9zl0lCpsjOMlBAz72KOGTRyQ+/Dns
-            tbTGW4tHVPjht9dtJsReCO0azSHMGlAsUAx6+Hl+V6ynW0yqoW+JzHx/jI2iEhfn
-            8jqGon7/Xwmpm6UTSFTc31pZi7IbZEeQbjqrpwk3Gvp0NCQB3e/pGeqAmM+XY2Il
-            NxxDCUpeKyNg7iAOAPu34e4f1pfYReu/Me2Xy7T1yNJyxH/Nxpe0fQSOJEH5/uiB
-            Id8VmRipUQWlW5hL0bLHzKxLHTWwvPaikyIT7kabklooR6STJe+JTgu285o1FgtS
-            Z8hfU/tXYMbaMleSopGCeRnUbz1fiOpWpWCKEZohqhZr5SYr/b97ipUWXi1GNzbS
-            XAGMtgRcVZ76LChfQcQwMtRydMy9pwJN0U6Zg5tCKcmGM+jovfAylsG0/tUfcrO8
-            qG7UcgERW6/rK8N/OwLuBDhShTMaoZy+VgNNcI5CZjUYJwvrhbVZsR6N75BO
-            =0nxs
+            wcFMAw95Vf08z8oUAQ/+MMf4plI7OLoCzi3G6nDBXjhBTY5Ua414dV/MJ5EPXFQQ
+            3JxUFTZquFs2pN4PFTYADGpTfXJ3h5BF64JYULybEOrbj2NoNSbUmYtJpS+h1VEq
+            yc3PUwte9ZN1aL+tNTWrJlJYuxerHglX8iBHN7+ttD03hhAYSfegceRwPvlA0/p+
+            PvkKdLZglYwPcgxqEvY0R1tKrLrDXS0HljQ4cptkQpthvHzm5spm5NK+aYIRZdbM
+            elqhDfVe7weNzeQR9DqcOJx9R7YH2aRjH3HC1f9lm1Tt0gdv+zQcP5lRq1LSZX6H
+            V/wVvSdtsXiLzM9GX7RoOv3jM6TZZoFYZRPtcaLtufx1NSOhrs72YrXrQ5/3UyWG
+            DS6b5S3WqjEe6gOIWDuOghQoKWmwFtvsFKp0xYiel+emF2nbX3FgeRZ8ACbepJRM
+            cXCb34ohiyPxc9mtoFPUr01OzAePwVo/eBwXnlxuY5f3+itSd0HmohQWRNumh3VI
+            M77wtaIa3MCAhJ0Z2WH+j9asuKXxxTJixi7cdm68WuvwxpU1on/bdMWIR06YRXDX
+            C2K/nVzeUoOSJmT9/8Nj5EFWaIk5VVGcGpx1YacAJNeu6YsIYYNghv70WsDw+fQG
+            tAx9sXu4Tiz4ePR4RHP54cwhVf/FvP7F0r4sN+zd3fsYKZiKbnKSRpsD2VW0w2nS
+            UQGDWpIf4pMiWlcS/pLVd60+wUc+HFqUka811G1ob5IfubnnVNvOZ07nnVTkY82S
+            k+KQcKQyKzr9LOY9BDcxs0lD3uQ4RwwsJMvhI0fmX1FAdg==
+            =9sB1
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-10-17T19:10:55Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:58Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hF4Dr/MjkOzuuRESAQdAJtpLnwA4eyK/qHOYFwwZf6mOlUWn1KPj1r4S9W2kDxMw
-            5JOoCX+3OsdD0FFGlhi3H464gaBXo5bwmn7GrDjlndKTnIYjIPJ8Ibw9nxjL8x49
-            0lwBcfDXFV7sq3dQM6jA4cPPAVkyYuZUW912RdZ856iksv2m0SOs+evgjlgaIano
-            +lLoiRmkuj+FKGoUxUvWblgXpp/966EPnN5EXAN5eh0ppTbd+9zBr3Yk9Pk7AQ==
-            =jf70
+            wcFMA0/D4ws+/KPtAQ/+KIbH3z+4OPHS9uxY8FMSfKIUbpquYP+7Aaozg1JYmpzl
+            NsBHIHd500AVvD70aGfVNPoC1djnykfkr4w5JazfHABul4L6LJd4CDd43t4RSXRr
+            IP3MxOebkGKl47sZah98rHZygIXBPBpfl4IYMUB5640zzLLy62mD/M+z/EiSTgE+
+            2h+fG3SaW/aJwAYNAYEWwonVa1kSIryDB0f14EOjnfnpLxvUGSylVuXmC6KmjAMV
+            PeYolZLk8VB/vnJLwrJZCe3W6rzforPxALJfzkkOn3erY2D8UCCLlIDAtphWzYZT
+            UYusTjZ51x7OHsGDwzBCTf6XdqjCx50epB9sszKeIClTFjO9P1vZVfWkupLq8W3n
+            0N7AYm9F7iCiSorlymRR9s9DT0YmoNSV9Ft9hH44PY4AQdt7Xx4j8Fz4zav3Jf3I
+            u/O9dnhq2UBS+gbamY2kHVVJ1BsfzGxIPQu2h753hTUUyaGBk9AiWEZPOJ/3hzFD
+            aKWf0/LyF2SRrUsEf9cu1AFbK043xjxWfTBCcp1gXCbVxCH0oRphjryPRLH46O5B
+            tGPCzUxjMVZZgBwCaxbt/U/ui/bYAxYuDUpz9+XjfpqNIQ4rEe3+jxMJ2mwE/DG3
+            YVFk+1a2vhsj4R2/dFhXhQlhesN+ux9jL1XIMtAx+Gd4w1zQNMf4UGKi71XI/4nS
+            UQGyvJjIM1SR+62hQkKdKnkSRSV7l8LAEUswNwvX9+sXxh0x7bvMxvo6ZdctCX8s
+            QVT+NzCG+Ifty+M/cI6/oZjuz2RDz8Cue3M68OI0YWsEPg==
+            =4Fss
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-10-17T19:10:55Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:58Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA5Wf+FyJ+zFJAQ//bddpVK4CiXVnDYcbppDqq3EWiDNciBaXrM6uoQ71YWlz
-            c3wTr181Ky78MKSDAnx83XVp3b7OGgHZh9PTg3ouJ+bHxPZqlgAsPbLkCaD3pJhW
-            nA4q1r1eJLqZNZBVBfnF5X3fENyGcX4buMrIYcXNolexMk7AUYzvK1Z+5p7dbRwA
-            coifS1nE4KJfAxrBQQN1K7iXPSV6+f9SZy2GV0OV0MLnJjvcBX/BY0ko6VSCT8rB
-            w/7mljQUggGfO/KvhzW2Le/7afXxryKwXJFVfOwCWD/bMmuHma8KnWaaOI1ja2fH
-            GyjzPTfyCUz4lhR1W9R5MuqW14GAJUhDpgnJBsrA1V+4UBVFXHfTc95B8ZrSDY70
-            ZC37NV2hK7PxiZ2DEvO/5FmThqXJm/Ydq6ZBCv3SwWstfvwD1bNr0RAVOO6XsWsR
-            wr9OisaA2Q7gw8vtqOjP6IHY1aykhXNDM0S6ajNtf/CFEOdQCtHqXQ8/63uhfLtE
-            AWdJ5PFVy1O9t6qBPS3xpmearm22j3RVM42dipddDc9vqhAONjKD1YFxBIMeKA6o
-            jA4Um9Odyjyjnk4T/mHgeYLKUE5k3BmIar0LR6TWTylnTdH6tEd0abA9rKtlkUjf
-            9BQITsO9OxGlPxWMg68K2F9EKCctcS4vgEA3sqyTBTp1XizFY653cvm3YomrwO/S
-            XAHlxLxJq6tvftZ0/ZTOrV6QGAy1JQ+YLpQ9gXEwB+v5Vspoab0I2fS74MiZ8PMr
-            4XBFUuvC3BuNl3cDoALtRsmTVPG3WLy2buoQJp7+1PGCUDp3R9YkjkCxcpMS
-            =ZR/h
+            wcFMA5Wf+FyJ+zFJAQ/9GMgzLnXSIn69jRoFGuOup2ggI4kYk804OFk9ea5fhwqu
+            qAEMADU02PTf1DZXl2+C4cbY1eXMgMrQZzk6TslelE2Sdl/cgtCCOUe4vjzs7FUG
+            tyjqyy4qmbMlt1ThOg8woQOxWZpt6x1R5EOttRmdXPt2AwLpWSEWR0lkSVPJwT1L
+            GHatapzqkgR0lTbapOW0kOuv/gjug4Qr/a0a5v549ZpT/yec6xRgmhK2k0RWCkIc
+            Wzfl0w2XjqIqJzoyhvuda0MoJpjH/NIPyyqoLzs0G/2E54T71IWcsjulfILmS2jA
+            ikDFcnawWwUjgfLeQD4uG7FOU1oqV3wg33XGsaUbFd+Ljh/pu2RKwUGm3+Y3T00K
+            XSbg5YaltMhP+PBcLsB/UVntRUzLCU/tvqFuKqMeCdHYEkuZlodS+sL9A1ghipq8
+            fIUCDuBVmyLWjKLxQrw2AECnIapqIpx0Vz6Lc4+2a6v467tag0MAqHyassbMGSpc
+            TMeFqpNbX8z3/5U8X2EK8PEU3lzTKbQrLxUGn9r5YJfEroEAH31QkNOjTI82fSbf
+            kSSHMEb1xA7UhkczpH93EuGi++8YOpZU0cOTd12vizNcK7FxvKbpaqtbCUdN3ewj
+            Z6y4VSMAi+u045p6nWNtqeDGcIALfObKr2u7g4u7Ky4V9jQQpGJM6Wi78tC/QqrS
+            UQHGEMBCQm6v9rGxw44MUQenHcTjO8CbQ1fDTUFf/0NBtemw19lhtiF2duN2VeTY
+            vfA8kAYaAPTeKallX3v4v+HGZiMpR0oXueTFdunGL+mQgA==
+            =jJKQ
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:53:58Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+AQ//RhN54nvP8NV52/jlHBnLryGhegovTmWszqKNLWo43qhB
+            xOLdmEYENXDw1ApoVE17gFTwTW38d5HQN+PUyrQmLENkUWQmZ7WanS2F/SuXg2fs
+            dd7f60pE6H3+49GQDAu7dae84IpYQDffRUlYh/AskajPMWM9pyx63RU512Wpe3AC
+            mQ7QB0fQdVhWdvkkDD9gPwX4RzFubWNwA0kXrGTx2efQWGJqOHF3usHv5RGlMIkb
+            NipXvELa1zYpXHT+gSOTRD8reT6NTybDA4aXlBuaF+YZbPQkR6f2FnJI6Ua2Bkgt
+            hIhx/7yrbtlMNYnOm2cMjQHewyjpU/ssA5l4rK0+XzCnvmNtfY7qRwtLhdbIluM+
+            0jRtgIHzBj6jUUr7zKNy9tQHiFeQvtT1FqLkB9KtT/G4Hslp9k0rdL4Py0RkwVD9
+            0QHAdgzEBGKHH4gjhdMWLOhuaayaDLLIZYj2uuARDWriQphvSCUNs0rG6ExC+xRk
+            GtLkqBtrt/pTy2LmGBHNEw7Sc0E3U9u8JJOFIF1X93uqvW3eAREIohM7QdhA5ewn
+            r+cMmZ5K56OFimMfnXaXaWpnEf4FVZ20Wfektuz3SmEjLDtBK1+qQKlJJlUtsKo2
+            QsT8pJptDExDYBtZmZ4AhgPR1OnuzYy3qxF1Ulr6N5Xk7xt6ApmEDqeuo2bE9uXS
+            UQEFqBDj7qG5CrF7uN6+jWxtX1KyGMsHaxP8xje5z2R/kiECOh/SMoKIVzt3eyfG
+            Fo6qtl2IaRw8IdYZKE9IPr+jKvTxNJip1lDZguiLIzOg3A==
+            =YfmG
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     unencrypted_suffix: _unencrypted
     version: 3.7.3

secrets/production.enc.env

@@ -3,19 +3,22 @@ SPACES_ACCESS_KEY_ID=ENC[AES256_GCM,data:XWbMVgfsw53lrt8n7xVV7N21JrM=,iv:ixIFlfb
 SPACES_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:ZlaVEP1aLPwExen8oNGopPvDMEAEH4dRAlXfc4X+UjB9nHbK9GLmByjkYA==,iv:KXvkAliD7fpdlqRPAiVlugFZiOnjs5EcHhSMGJ/EWLI=,tag:uxU9aejIFjzX4d7mAQP7tA==,type:str]
 AWS_ACCESS_KEY_ID=ENC[AES256_GCM,data:ybxNIT8vIOnmMuWA1OXUKsQO+AA=,iv:ccKucwel6s3Kttmw/c/3n5adWZV7+KOoRq/3w5IQUQU=,tag:wgK/+O9PcngtasX4UNi0tA==,type:str]
 AWS_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:DSLjIaOMvNTh4MhBylu2aBtdBz4r8t7jRhUAgq5tjDJdJaW9bqy72FhXLA==,iv:3c69ee8EjPjcFBTW17zPzO5qFosn925W2BMe97d0wxU=,tag:43vbnMuvCakc79CXgc+yiw==,type:str]
-sops_pgp__list_2__map_enc=-----BEGIN PGP MESSAGE-----\n\nhF4Dr/MjkOzuuRESAQdAr0CIZAFmNzIKMY540R7yrVN7L+N2b0Qv6mixtsaGX3Iw\nyGt6z+8AzcNbmk2w3uLmdPcApVBOfxFhwTV0gRGTAgiqR4wgJxoewCbqMA45l3Bn\n0lwBSBU96ijQDk4rWfmNRU9Ck4+lQlgkZY4gxD2bWCabd2yYTb51Eoul2Jhcd5e7\nVxb9vSaL4IIQQPH/X3pCrzcWq90C35Xt4nYtzFTbAGf+PYVTRv78i+3UmYYFaA==\n=JkIU\n-----END PGP MESSAGE-----\n
-sops_pgp__list_2__map_created_at=2023-10-17T19:11:00Z
-sops_lastmodified=2023-05-05T04:52:38Z
-sops_version=3.7.2
-sops_pgp__list_2__map_fp=3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-sops_pgp__list_3__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA5Wf+FyJ+zFJAQ//SI10uAoWrr0gxKiTfFIHISWdOjWq5NsiBr7reOgZ7b3G\nmAW6LIFkfeOnoiNDC64jrKfw7sM4SMt/Vft5/mJUjmOKYSSVt9k+3H5eKtV9QDPE\na8T9lCoIkaOY8uoAxuQSSmESFi7CncH9MmJuXqRhr2HXY7NNq/qiMIEUlM/5llUj\nNJeY16bONpmNNjJq0YUqXJUV9z6GUZ30c+fpJV22y9y8RYYTfPLlmrU6k69H7nRh\nlQDzUpDouVkF9pNBaHXtmK8delxU7g69MqANaFg90hVF/2aGwFzCDGo9r60h/mtD\nZ2NV7YteT8BZ+AE9KIoKB5uK4hFK+Ya7Rc5z7D+sYiqXzZT+rNzBxUQtasJ1m2cB\nesOIU0VPTBeHRj/a0r5YbzRXCmMCsdDi4WNZTSBQSoRdxtpy2O+bSTX32wekUn/J\nLGcaxbnx+n2pmghIzHCEaUT13uDTn8fJcNn5PH9rDlDmTy1izSLp/KXgRBx7xSc/\nUbMJ34BdHSWbHpM0JGPAb+mp8SJNm0x7mdrnPEZW248FsMXH0VS5fx6n1LNCNRpE\nnicyFvVlTdeKvYuOTyjP/fkFLDvof66Gy20ugTFf+13Tels8OMTBSLYjrHI8kaGB\ngeUFEkW4a7fOB/8+J+XbzZsJZnnRevlIyQJluAB39Nl+55PowH999MN/jKk0QhTS\nXAHtIbu67ip52go3SJLF36VMH62SUHO9qEvE0LzK9Pzn6+uQIfp2OqNyiZ6w+xZt\ndz9GPAvX3IEyltDbdcDn99tA90/V3pPrd/Yx/y7BRYS78FnOV0ZSuzCX3ulH\n=Ob2s\n-----END PGP MESSAGE-----\n
-sops_pgp__list_3__map_created_at=2023-10-17T19:11:00Z
-sops_pgp__list_0__map_created_at=2023-10-17T19:11:00Z
-sops_pgp__list_1__map_created_at=2023-10-17T19:11:00Z
-sops_pgp__list_1__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMAw95Vf08z8oUAQ//WLTVBo0LIVYHoUqh6HA8SiVV3KaiKq91z86F9PAiTHGJ\ne7IJu2WH/vDA9vhsC2f5ZsyTh3mCH+d78+NQgz1RmPomJm2O0RM8iuWFp0XI1PgS\n7vE5WX8KD2HAlHH9lI2xyTviLm65fa5x6P7SI/1uBtcqK9dtLEhNQpmkk0Bjwe7O\nXM59KanJRXrp6aNa3quWOA5WjUMIXJnPCNyFOLmZ13SoyaB0/w5wH1VvT1N0SlbO\nsvXtE5/dWBw8GlJgOoM/WifePnra7z158GifS7IJ8eK1tf/VOUPL8M4C2RYZVRpL\ngerfrSSrgskedR3Dn3vLUs+5bYj0zcu2kbIN8yBAl0aqfVwI7DdOPLNdebaCzoJj\naw4sp9MF1dgIGYxsmsc4sWoQHcm/u5OMQBuEiuNEEL8FBkDIUjkTLYrq+8YCgadR\n5op3OtwXITskW26xWHZM7+YXz8f1nMbarUDM4x4gnBDE4jMDAbM2yo4nAELmInWB\n2TvU+5R/okZIVwUzJFfMqBWTHpvHxQmn0cBC3D0lz86obGSufdcRUqLNQSpie0KG\nVMcp2UiepBr6xl7LUJhQCP2u9E4ephfqqnIpkOpU0invacpZnV66ArvzJ8KtJ2DD\nKPMMR0Iljsmnx+mgjGJ9Isn2/5WTrFctMxDkzXNu/XcsUfitZ61ZNXsJxWRnweHS\nXAF8ie3/VLsrMfkxmslvab2+CNV/+7wvbhJlCGcJUPizRX9fHYh3ujQj0LFFaPpf\n+mBDvVpfRJC3zZ9Y7EdM8A+VZhxqhLGKp6cbeXoRgMW0gGotnRBHV1AfsqS/\n=n3/B\n-----END PGP MESSAGE-----\n
 sops_mac=ENC[AES256_GCM,data:2pvRhmNz7F/Ge/rPHz9WjHxmpx83TNT4ohBJiRVmjex27E1WEj+GGoAi+ESyGq/J+snQOE5GeVaq6osrGGkYHpX5WvuNBEzfBsVv8q7dy+i+OmDXtZTQ8AFqM/UjdKiSg63YvGqz3f6X4jqCp1N6TyDThLWNJR2OSghgcWwV1kg=,iv:XubIj6mwdpgTHCdabroQo7vatgW3KmK1woQMK6cjiG4=,tag:wlyEzJ6TbZfl8DDb7njQsg==,type:str]
-sops_pgp__list_0__map_fp=6B61ECD76088748C70590D55E90A401336C8AAA9
-sops_pgp__list_1__map_fp=88823A75ECAA786B0FF38B148E401478A3FBEF72
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA82rPM2mSf/aARAAnsofYRaxPSdepXXeFJraNIQx9qGODru0L0jbWHya0h5J\nrSjFKWWQ02QA1r6NBsrEtmpo2ySL2T7WyrifSQzJegtBXAyjZMtulLWRpZsnUca5\n9kFBlcq52Qn3KElJpWI5wjbLb/+m3v5k3sU3rtnAEwX2uYvIEEiN4wkaTQ70KsQN\nX3sWPkC5qYhpUUQYr67i3CMYOB5/Xym4sO8enVV6wFdBG0iD4pO+sn3Ku5WHb7d5\nFssdGTGl4jfYVnTr5AVnHSDjxQwVZmfY3UlwVkIz5OhjPOxOx0AjJb0ldA2f9RDv\nviDwK0lh4z9jmPgo8k692d+LVyyNXeEiIZEjE0nVOdFBUfZSJV7xkBxTm7sqhcVl\n/KoDbjLVGmhfFUR7vXVGxRL40yog/bChOBQWKqpik0zyFKVSRi+md1P8zxHNi7Gs\nlUH0t7YaEeF4lMcgrRdYhiQqOCnRaEo85OsXSQgQf7I5OGKFIBRTQKCXzSK2RaOn\naa6Vy/o/4S+wnqjfln7b6dSDSks58JaTXlHcIzoYumhUaceVS2T7fstmq593/DPo\nhnerJ1sswD+yjgsBVkkQi4J0+IATTcBH7qoq3tAn18OuNlezPEW3AQulbUVvwXrN\n+fqqlwLQ7DRSQCx/lXFqBpbi4hKoZNFLr6FEvC4xKfNS3ojGZ9Te1MiQ8x5V1UfS\nXAEa4EqPLrEevbEEmquQIOvnibZza06h+AhBKqFlfR/e9Nw5f90WklLto6euRFKY\nPC4MUHLslHsVfqPRGp2/aRy5aa6Z8GtmprzcCBwn7proPvHgdlAKcCoBz2Jl\n=hnrl\n-----END PGP MESSAGE-----\n
+sops_pgp__list_4__map_enc=-----BEGIN PGP MESSAGE-----\n\nwcFMA8KRInHl7Vz+ARAAqHc/Lh2t4netWPJ8I0mit6Ll58NFDJclLubLdj30+3Tl\n57aNQg8P5aM3/iOOvuGYJN1t9kTiESkQNthmxR0sYL+4CAJ8SEqd+0kpXm/b6Hcg\nHRM+K/NygCwsEDGSJvSDNlXE/Z7MSna//+JiMUoxKtDjMYaEUSFSbEW7dDGILNPK\ncrDcb96fOnMjKcDDC8mDOqJn/qQ7iPPgfP8u6i8xoRHc55JdshOJMmuXVwhSHMLF\nxdw5q2ZgdkH/1URoJV6UwdmhdtXUopi5QEZo6vnut+pfAlD7Kw8kaglmaAeJj+JX\nuzrb977XytnglxeB+uvblZH4ELwuqM2CElcyaAeubmLHdjRt+4ZNEAxbMJ0C3/KI\nJpeE6LQlrMcwGZnJscxR33z1oxme6RLYuJxcbwa8rf8nnx9zzZw3qowZYzEVA+DH\n+z0tSNgW+AfpnmO1UXtAIRCSsxRGiIgYLsxvacCCpBI0k0m39nPKCD4+bXCZvOyj\nMeNfczXixDnDxIu/y8zarnCHrd5Uus0+YzeiyyEXZfuCjbvMhQYhWJIOXTON7YWh\n1aRha1zm+opuftNS+1QMsQtWiD7uQecajCZxIpOi9TgFReT3i4DCSuTglkSiiwdl\nw5K0Bz49UHfvN8TkgHTmU9dSWFsvbWz5laIexxP2lXbn69cHqXziLKNEHZ/VlR3S\nUQH/1+bdMV7OJwIVWhtsdn7w7d04S77IdnvQLaR7Zv840GySt3ItRaMt0kyQhs3K\nFH6rLb4YFgT4peoE2YQfvKEo+bgWEazVrAWgLeFLFF6Ijw==\n=7QkS\n-----END PGP MESSAGE-----
+sops_pgp__list_3__map_created_at=2024-01-11T20:53:47Z
+sops_pgp__list_3__map_enc=-----BEGIN PGP MESSAGE-----\n\nwcFMA5Wf+FyJ+zFJAQ//X2iGhN6hnrGDlhrItbzgwwsLmgQnzQQll4fqaagBQhuU\nFubPvLBxAdJcdWHGh9j5SQt0t3BFAySuCtkumcCE4EZFpquv7BS0Tyee5+BT/Xo4\nkMtrtambGVtoBBL2ECN2LocRChRuFOMO2pi0U+wD2AlYinX/az37I87lFQtid5nW\nqoHQ/WxryLk/nWMaQf9W9868zUHpmcULfyGQuWTtKMGK8LF81FYLwWZ2kYcG5c7B\nZf2KC95nx+aKeCH7IHtmcJxQNr/xaRutXRsAMtMij5sq++cGhWednn0Ll52/8P1O\n1HyjzgUK7S1JNqUz6oGxQD0Dwqa/qR5jyXxgxbOL29fH+neP9tiICSALH4GiZI/0\nBzVI0XdIxVgnJKZKjAwMfBkvEC47hPTXGAO5smpATFWrMvmMWDjDuWL8khk0442D\n2YtbaKV/b5zoyXZ2cYwpG6qLVgfVnFZTj8+9CJaSaob5/qQIWDgAVF38xy66NDCi\ndJRoXTpFTH/fDgWYAan7uqbYFpv+fa+9kGX638XurFzVhLWs+4PnOfy1tqG0zVOm\nhWXruHS/VsAyp8SMKb4+z7y1DSOA4dflpm3dfQtyldgVxMZiM6IUa68OKPb1JFzs\n/2LUzeofSCiM5xQnGL2uClj4emMKzz8WLjThkt9IVDZ0n99wgmCT7zbbJqd9yLzS\nUQGMaNOlmQc2lpz9IOmkzAeIIU22af27+37KJVLihk4IaXpQhN7RIIbavfktKF6+\nkrcXM5zHyHrAZUQtdDNBxXM+hWcnQ3Y1OuUTQ0RpJMWDNA==\n=ie85\n-----END PGP MESSAGE-----
+sops_pgp__list_1__map_created_at=2024-01-11T20:53:47Z
+sops_pgp__list_4__map_created_at=2024-01-11T20:53:47Z
+sops_version=3.7.2
+sops_lastmodified=2023-05-05T04:52:38Z
+sops_pgp__list_2__map_enc=-----BEGIN PGP MESSAGE-----\n\nwcFMA0/D4ws+/KPtAQ//ZRCpB/pNioek0ZAMrSYE499hP3hacm7usEQqrbfBTE/X\nRKHmNwktd07Hg//n4l73HpVkre1qua31RHfhzfX0njyhdx/kstKvtkcapamkg/A1\nyB0jYU0TPK1NCFxzCrrd1ylFh5hQVCREjBlefDczcellh8Sc/T5CTEwGHCk2sTG1\nUPcaeUwVwzKnX/aX8pJLf97tS5yB0QI068sZ2XRjo4FRk/OtfmdkD1zHEha0kfdk\n4AclYf7YAcJ1ptdeEhdb5cP1TutzBkwJiQWc9VGM2f6MTw6Br7rOuVRwY6T8woXY\nN7lqWjZg4QAMr1gyR6gwPkbBPJ885l0J+/yLm3gjRnaZv6gTQYnQWg6mXyqXU6Xs\njAfdBVpAo9oVGMPy0h4+u7zLkD59j/Vekfav1LOqqVq/u1Pv5bISZi++TVU25a7B\nSE2sU5LH+9zdFMhykzvKJGRJw5Y7xixuDbtME4XRN2lOmoLf7gFfHj5b7ZVagl1N\nZeqrfvo+RiGrXTlPg5UlE4NVpFa8yCmtboBIlrAqZzPs5KW4PYxngGS+KkXgH+nT\nrVrQghRdP0QgkuXYpYsN8ZIqLaMNocm86Z9J2hZ8V0Goh+ECC3OIF3sJ0lg+/dM8\ntfGWOV6T8sRwRjI649FiVZ5sqLw/S1pCX436AqCkh11a1C4mYTezSTWg0pmptJrS\nUQE+760bNnQIWQyxjg93ly9G4vYZtVw0xYn+YbLKooafTE0mEn3t4i7WGXmQ2Q9a\nilSvLxP93FkSKmZbDggTS1Ndg54QTmoojc0AdW1QZNOq4g==\n=uvXq\n-----END PGP MESSAGE-----
+sops_pgp__list_0__map_created_at=2024-01-11T20:53:47Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nwcFMA82rPM2mSf/aAQ/+LXi0fTL6QW2PPVbeY0rDDg/5vjz+4ppeszJocUazVV5Y\nnt1UxN1tlSAzrC/mHe/o6RzVjNR6uu+i6kg88AGdN8qY89UOE/Ve65J0SAOeRzzT\n+jYSk7E06zDD5WeP3RhCuLLpRj31kCgqJLpMtuaLLFhFcEBZzzVX5lNrOxVSJJZJ\n0Ie6WtJrivZ3P/oUx9chGDLWEmgsiMcf33o3+F8X/kM+Xj9YVKafrbzijXcua1Mr\niXxNHmnHbgcrsv3MGaMsT2uoxAABmjG1s9PDU0ax8pXrDPn7J3ZjPslWG/aJo6zf\neTcZRAHvZbHujH6IMem4MfylyrfS3lQ2q1gcBZmsWraj9yRIZrzkuEt437uliXGX\noHaI5t5PlcQ+4vvKRQ3y3MDls1XGoPDzhiUT6GXGDmUoojwknrpTl5P8TNWzLCoq\nqCBCoKgJYqMFKdrZTXxCttMrl8/xL8VI5/d9hQd0Lm5EtuamYb9xZT36ncxYM1To\nKzm54NqgBiDU8Pb8kgHo1nZymjnmEwMA4TmXTKajBcoTsfmj8qjdvfL37G18id4r\nxMrDNLwrs/9k+UZYItXL2XOmCPF6kWBJmX5oCpELF6RGv03ASuzmj0Gwqp2fEkvE\nxs/atrlfdeSc2Xdsa5xHIruhnTL7XvvxJYMnUw7rYLNX/fGsBeuLt4DhuDSdcZrS\nUQFjngAwiG+XYdbzhIQm+73tLIloNIdR3R/9KvuxlQ60DHNN/AgHsIISzLzcShAd\n/aN2ic+Sch/pooSgxB18bXwnAXwgXOZDpUIA4AY3LFLW8w==\n=yDNO\n-----END PGP MESSAGE-----
 sops_unencrypted_suffix=_unencrypted
+sops_pgp__list_2__map_created_at=2024-01-11T20:53:47Z
+sops_pgp__list_1__map_fp=88823A75ECAA786B0FF38B148E401478A3FBEF72
+sops_pgp__list_0__map_fp=6B61ECD76088748C70590D55E90A401336C8AAA9
+sops_pgp__list_1__map_enc=-----BEGIN PGP MESSAGE-----\n\nwcFMAw95Vf08z8oUAQ//cLxk1DK5y+7cIrFyzJuX/76t/bmIa9bcgwH7XkMvyEb9\nc/i1J0QfF19KLMzZ7Nn51Ktci9AMLsbAxJuK3X9BR6a/IQ9u8OvlapnH0SnTXIRg\nQKiPQzW3ZIB29FTtVfpRHAPNn+7lHApiUIsY+6F8Jn07zU4zZdPGqJYHMm6P2HQo\nHI/d0EUiZSSjDKCxSy3huy6tA1LX+NS1VRS8VPlkSg8UeMFQ/3pjDzN+sLlZoaHC\nAHS9mcGc+Rqd4JibI9l2/RGplBdq+a73Ah47l1noYmThgscvTjiLELIixUn3nLpk\nSkm6pEj1/6Wmx2EM59iA08UsEzY+r9YIOq3fi1AbbP4k9aTolqNzO7P1C8lVBAv7\nUy0uWgs1eq5189ZW2mivHzX36uQ0deFKtt82fpwhsTxSigFPgb12NP7EPaTmNyOB\nccTvzeRnJs2vFQVZ444jw0R9EB/9l1IiNJGcSj22FrwaDMwc0svQq2iIeWdGObwJ\n1PWjXrduyrpibE/FAdrhvilmvhWLHZBleLqFMtfofdcgy+1chHVc/uQbBOJsKFrz\nv1CdiL/4mkkRpbFDK01nt4Ky9gHuHfAfCEt1mjMdvfgOZEdJWqziNOyGEOPb3stW\neQ7l0eIZwalsBrM2KKb0mWigSGzNKz+nf7k5V4+XkAIe73X9BVU/AAExA1qlhfHS\nUQFwFw/Tqb5rQAnQBI8g8DYlKdzbqqc7eDfoJpFcEbKCcs1cPcZaPxUDl1apaH7e\nPIsRKA9SYihsP/MX5UlxHJvKjW53tDIalahETgnk4eTOxA==\n=ww9v\n-----END PGP MESSAGE-----
+sops_pgp__list_4__map_fp=C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
 sops_pgp__list_3__map_fp=F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+sops_pgp__list_2__map_fp=3D7C8D39E8C4DF771583D3F0A8A091FD346001CA

secrets/production.kubeconfig

@@ -10,24 +10,29 @@
 		"mac": "ENC[AES256_GCM,data:aL/a8y2g5+maOSWg3QnhbNQPMlQnoI1fg0PKb4o5F9mUMWJdXHoNkXDUGfI3w8J+zgH8lm2M2hsYuVwcyX5Tyllbq+NHYWvDrK+34oRxAkdP6JDK2ZOgn+SofjKtN2y6EVfnU66I1UnAZcmzfoANFVfy2qvbZdw8j2+K3cxBS/I=,iv:8U4CvwSmR5rN2yE+l+idJ/sjUTNgoTgxut70iJU6mD0=,tag:7N5VK1T1JXJLEkeBS6tgfw==,type:str]",
 		"pgp": [
 			{
-				"created_at": "2023-10-17T19:11:06Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA82rPM2mSf/aAQ//QyDXkAU8YY4WAc052Wef584CJVXdSX8yCAT6nlL9xHak\nWWL6UOpZYug9KTbuBByzASRyfn5jJFn3XwHN7wl2rWhwFYzwBCflI3gNsHrMpZC5\nW5zt7++HGh7EVjld338/T2y/ggq7JTqFpdU3pmDKI0Ha6FuA6BntvU7yGO3iolJq\ntoEDhe8QJ6Z+jDWEi54T+b+DcwtnF+iN2HmVujk6pFrk1Vs3y0HIQmaY7M4qW39f\nXmKAKyCPge48c6TJZM4VSamziMf/Gjvi9e3h6I89ywDoCZiLqanrqOEQxloS1hb/\njSCVFer0o7gnxSCUVasOPwOXsKudxFhofWt0EdDrq9WnVeyHiTxTqKiZQZgfsSYi\nQyaEAlBABReT2hw6wwl6B2C6fHx9rDW8PVzihWX2kNfTfi+rr8MgYE1zxjgPkSBB\nQUUVRXCdHIVGjfgGNCD3VBXHTp2wSj/rM6dXObtw3lLbfjc6GtKZjdpPmjtJecNN\nlvdNeSKDsYhAT/OqAQ12BH1RcVLWTFrmUf7UQv+FrXPTvQnjtrwQ/lGUX4K26AyW\n2GCtAMZigmC+xEqqiwNk4M5+SMfRzU9GbSIycI/qMtEgLUHFRjcgRmsmCaayd4xA\n9rJo3FZofjYrQqwkIwZcKYd8f9Erl/cdYmoL3e72gHJnETAm2lPSqz+c/XV5QOLS\nXgE3SqNXyf88SnBLt8Jxr6MA5oVyXUV2rpKAB2e0paccbFlw7a2OEEw7/cv79DDD\nisWvk19SyY8es44a7l8U/2++JP31UwrWfvTiqby8ieaepBKEJ8LY5c4tMNRjpf0=\n=U4b4\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:25Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA82rPM2mSf/aAQ//cL5kWpuvvKmUZDxXfpUQ2+uSA3fS4sPaMNRXd9gEuuaa\n183cTt4/FDXedTSbv6idekbF7vc5sHfuUxdrHO5xy8fIZoK3JpO38N4q40VpoI3K\nNu4yYRlRXeVwq+tzHmW9mjnSmV8VJbb6O58gYMdk/2IOeRCz+EB3cCUgF7P5bsgY\nDfW7Y4CyZ3VlUEBNcx44mKh5jQIZFuvxlyoPYVjVm3r0GUZqLE9on3ubMwv/vUmZ\n4WdbiI1Fh7XeRlXYZuL8xKBB/5eGOfFeOIcKR/lhDN7WXi0lvf0RNa9vobkecnql\njVZ+YuL20OI23gfInnYgVEn9IPAS3feD7RBLmRI8l41akZvtj24MRAs750S6W2wl\n92i6/5Ev3tTTunzYKt4wSl7/0bAMqQWNx4zHrMo7KG9pR1W2y0effS9Jvkv+dFru\nrE9mpnDexbCIVsr/Ml3VmuMjADaeqip2a45awzOi83gndFjayNnG40MMu3JMWblA\nOzfZzMGsu9zHe+J2SeQTWDSdl/VfZCN/AGEtYYv91gmHl8yK1YDG2IR8pzyomcCb\nqPBSRoY9NbkLw3NYwwwWYb+bOdjbAXTLPHl5+aBYnf0+HeLG7YrxAWYlQyl6RXmf\nIKtb5550KqpZY8jZC1Qc8iRFVWB4mijILQEPHV1qsSMuh0QdtvdGpx7Z19crTrLS\nUQEg69Thd6IwT+oe5UU8JjfgK7zvMStgneJayXLdRgD54uDpXqAG2jT0MWotepZF\nXPr9veNqoUSNA6VYhS2iNplaauSdRZua/WbELMRAHiu/NA==\n=XHXK\n-----END PGP MESSAGE-----",
 				"fp": "6B61ECD76088748C70590D55E90A401336C8AAA9"
 			},
 			{
-				"created_at": "2023-10-17T19:11:06Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAw95Vf08z8oUAQ//e5Bda1BFcd4s5RVuS5Ri08ApHx0wp3drvMwJMM+Nzmmv\ny+wjeGNr8hrTBKNA7dNhJbVa3IPIGbwcbailir/dlv9XjM7ft1d6nsjqHP0VL22Q\nuKkULG6J1LpZsKWQNkQZWUWjuBYZWcQg8qwauKkj4+7edj+TNTJ+6RkYmRy17Q6r\nu4JS5vh62Eo7/y2oP9tBrwmHPPk7DV8xXMBSXTdfyqCLgWjPnpsUGJUF1us91jvQ\nAJbKe3L5ss75iohOubxBPNmpia6eqHrNi0OYsxGT3i0NNxVREkuEFbAn/A/KQFys\nFivA8u4ufRYk25yOmyY0QBhuVvcPvoaIrCQwAz6rH1WxNnPdpj/lGktLT4OYNwPV\nfCPUzgiKpm9OfkcGYkgW2ANGNAj+cZLSd3DtqvRY5s02C13oX508C+F9TLmqZysU\nGk4aKFVi7MGHu6Y46TFI7r1H7A/8QjQ6q4666jNp0+ghndieV1sVo4voacIAV557\npJT9cx5yHSJVwP+moDWZf0rqfa1pQmBJqJmkpn3VxDPNWxN5mBLdBTWyWAUM8N39\nXhyqtjGbxAbRZToK95fcOW0kkfG/ZlAwIvo9Xnm+aHY54bibE1K3lWxwiUdhgtdL\nYstKCptJkipg6knLLNJ+CmEUjM4z7iFgXgBkKtbWSG2nd6LToh+aYuqg00YHg9PS\nXgFcGXG6TX1wgOg3qw3C7GpLi92aVo3qLjID0OqLIBxljpDaMzS1mtzNYHkTBR6e\nu+rTdtgzF/dTdwqbATgzvkop/e9Rk5D+IgnnGj5ZJJoHzks5POU9t8TlulsFC7E=\n=VVCn\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:25Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMAw95Vf08z8oUAQ/9E5SRF/GE7OJ3jYi0j1TAqh0heJVBbqXGPDeOclavInxu\nSRZ083aVg4pbuy5F7SM+rWr3VIIOGZO3RJ0iNK/raCRJKDn97vSls6nZG6je5qFJ\nL3n5Lt8hSySBbvQ2Fh6AjoA5o0sJ+PgNVsKCSx+1LRdmytqqzvM8Ux9NrI643Tuj\niVb3n2X6Qovi1PrDO/0L0XCENFNsauSP5V3QtS8dn2jp3grsY5dj4KDLMk4pfJpb\nhnME2Fslf+HOu8G/sacp9+7AapMPLn7Ih2O/ZWBpsjLyyg3Nuc1+Yxi4D+wH8BGb\npqSE/KV8NLhVKdOvomtDn0GlXhn58MgoHx2SnEdOMpgyS14AF0cchtFc/TdRU+Eg\n2AL1nQYWcorwPp/GSgImLOPet5rxnHemlbzqUVS+RJQrf0pgynASl2N4oEONndED\nOV5h95f3CHzIBvrjO6BlhfAJ8BOn4aBXIe9snigu6gIH6qAoKDWdtPjUPzCiLj9B\nUEji39KYGbeIHKMznzIWKbdDYfbtRcToIehGU9kGvNxBMsK15osBtbxJcMpXRrUn\nsEdf7wX5ORVTmnBIBkZxuAS9161BPbKJCe/k+v2hOZ9odmZkdxifZMpGSEW3bRgr\nZ49XnTS5feXHffu4MUbe8LulDCv9YVuwn9otNJIeT4ws8l+YJ/L88uLOZpKLrh/S\nUQElpCXfgP0GWj77I5EsnItd+7hdFA/dGeQEsFzPwdLNCglhevTmc5rVPwc7ha9G\nHUgSjZO1e83gnEs+VPImgXElD68hs5rJa8WUj3YrUYaVEA==\n=No08\n-----END PGP MESSAGE-----",
 				"fp": "88823A75ECAA786B0FF38B148E401478A3FBEF72"
 			},
 			{
-				"created_at": "2023-10-17T19:11:06Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhF4Dr/MjkOzuuRESAQdA0n6wTX2lobVqRS89R+1j0BnybJ+MEqeanCu8gLjvNnsw\nsO4e5Z/zahihwQdb4RkyQB6P0dCHkvQnhDEP4+w7ZIXMJWYX40rnhpjTt6dqaOkf\n0l4BYRWrZb+FBV939erSwsTCMA5GAW5tSllOINOgKStwNFR9mREksEK5wEUjJ7Yx\nOzcJJR/xujrNMByQlRrIydYw23J2s482mx7wRwY1hMEBL1q3B3Znsxyy0w0mKEbS\n=u3ve\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:25Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA0/D4ws+/KPtARAAmRT//kcFnXUhEi/pB2Ie8Dzt0rZrTSe+uiAUdtwa9nIb\nSEWjRW5NVt0Ayg+EA2QdUl5H3J7hz6kIJSnpf1jmJEDc+xUxkfZd+iLJPdcA3r8n\nO9WMFVzpgNiFL86sKLfl+OHQwQbjvNupUtSlP/ZotVaDLCmjjNmxeDHYrBhEJtkU\nKJysynqosqAZDU0bK/gbDwz9CqdYHVLiMBrIpiLnAX1qm3sdHuADQHsYxZTktv6T\naFcRU0V5zVgvgcEEtlG4Rcj6xZkjOs28buihYEcBSip3rrmdInrQyTlOR8prp8Tj\n0+XqT05VxpCEmAbfFyM5v+ntsY0iLQPv2LgNXAU7xJ8Ac5O6sJRdptpKuyYauQm4\nxjNaUTf17uSm4ZmNQzV+8XZcSXqzKw8gcJXv9ZuagQwGCCrwnhrtdo1fJIcl+09l\nzF3llH1qGGN+BaenRaACvNRfDEpl6Sl+xAchN1IOD+84ztvatxd2REomScjtwHRx\n14FUZ8egKLb0M544jBdYcAU18PO2+jawZlbxHTdWDlLj7ZmGRXQxqsnAYVKEqmg7\nU66JmcDXwIqqE9Vn1rc00sH3/O/n3yhpIkbLzTz1KbS2ePvZ1LMKr1SihHpLyFQN\nIPKPJ4Y5bWgsrSs39hRYMAT1/bqIFpJ/EGRBC6kwR1nfkR/QDtgJ+97/cw96ROjS\nUQEJ3rDXixvC3wfGnz3KAiC0Ea9meOxU/2SU7TzXb/MMbpUKfBwSduB9/pl6RgLv\nVZVZB6uz/zhf9omPMCtdLd2RgOFAUe8tyBtr9V54q7Ormg==\n=egrw\n-----END PGP MESSAGE-----",
 				"fp": "3D7C8D39E8C4DF771583D3F0A8A091FD346001CA"
 			},
 			{
-				"created_at": "2023-10-17T19:11:06Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA5Wf+FyJ+zFJAQ//Zlx8Pwn+zmZizSWzCfnzjbhat8QdDWhQ3p3zOqM80fMY\newXfHeNhgQhVAtmZjosrv1XZO/8cESIbLBsCmvhUlboYmTE6J72ZhkJS8teo9fk4\njDe1q6EYCTOawprT+oesJv5EgLUfvukdo0HqrpyW9boFAmgqXj1fSkHwKUghiTg9\nBAbkuMVL/bMKkMe01Q4hV49WIIeX8I56U7uX9r4Fp3K3Ft/OCzjsmd7bbFRO9Rvt\n0sK+HtWqR5eXEq4EFmOp7iMiVWy6CusOQo90FKdXPN5Fz24UddC1rcqecsJ7iTMu\nUTwE6DNI0Gs9oP8+/k+cgG9OYQkISHrU/V5wr+vv6GpziBVXVFH/5q5QThZDh2lD\nAmthw/2N1tC6XgErzW8jESiLTw/8DQE1B/bPigO2lX8cSpWra8ZtAMgqlV5LeYUU\npeJ7qIIEQGgvQ28OobrSLliMaQ0WDyP9mh4otNAONwI1af0KFk0UwrIEU7u6yHLA\nYgYFjz5+t0KrfSdDAnoJHnH4HzsGfnh5xKewVlmtuubzGIOHO36CNsBeOQa/tBvg\nxc8jf4FFlXuQ+lThx7gX9dtJu4+ZLc3L6BKOcXMshebR8u6P90tkLNz2snjHInFu\nxtA3DMdJ/DWmXhCy8gqnVes9Dgj5jgy65FNIqbvk2yHYjW35V62xz1NfU2+Sy9vS\nXgGGEkeSa1Cz2Sa8hzMI7NZQVcLVu+uKgjz41Kwhdp/ylgpcJMN8ieTA6TL3jAO1\n3/mMjEWQzyEZsPY4O3/ptM+gQ0ve1YXpg0QVZpvyFNDJ5KJdyH3d7xqHZoZGMVk=\n=Cycw\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:25Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA5Wf+FyJ+zFJAQ/+MqLW0h1wkXIQaaqYaxD/yUDq/icK4ePF4Gfnh9x+2VLj\nkdZbGal+JMK3ZhlM5F4vA7iIIkg13jfDbft5yxCsAHaUe7IiUjHXqd0vgiQXBJMI\neHaUlPfHmCrDITrs0uSPEjPLQ5YfCPp/eY7YkdVh2Lw9tPJfd4I2BgVCYV8+O1Bi\n9rAR3CaGMwrr8ryJ+Ayyal3lbSo/ptXLNYVSoWyuhKhRExmv7YLrr7PtrlP4vIQ0\nINsEp3dy10oomd4Z2leaH3Nn/TUgbRakTTrqOKzxP3E9sBfEAAgqt78GvADZc8AF\nir5uvFd663ipuHNADH4kk2okgSB9MX8w6TNgU7J+luoZfrs/w7ZbhUnv63RTKcw/\niQZ/vdUjfp9oPYOaYJuU6YTSjU65VXXo7sIembI4JEnypTguziPTWH2afDWMFvDr\nuA+36X2KNyhtkrZp7w+O9YgGnFfnpG6aCek4feDrrrH75m/ba80Yn68Lx74ejHNJ\nz8x9C8I87WMPbEWWxq1/7LHTxJ0CezOR2bcjw0/FbOPWS/jtUFW5Xna3ow7vRogg\ndP2ryQACgKcJqbaxzLIR+5cAMLkm1YsHSUre8bckAS4anfXTAHlpIqu5UH4QdXD9\nMe3C1WsZmiP2nwb1FF27szjAwhia800uHPquGJngPFA7EX72VZeS4pph7xb+aNnS\nUQEldBeGaRAk8L+np7RsaqZYd5NLchGCslHeR7ZnIIpY1clPbsRsOFHFLlm3rLp3\n+usi8XfcF60SYDo61l+pKHK4HsOIdwepDEGPHg6Q+frbMA==\n=rc9f\n-----END PGP MESSAGE-----",
 				"fp": "F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D"
+			},
+			{
+				"created_at": "2024-01-11T20:54:25Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA8KRInHl7Vz+AQ//be6WKvWqCUNYgupIyAzLDRc686xkMWSOC73+N017o/GD\nxKciwGcnjB0Ta8kBCo0DnIOacjWf8rEeyycmQqBqO3JKXNzo4fYCczRQ6V6IGLVW\n6UM5CtJOfD3A2UOGS7iq96tKB8eGUQ2KEXJp4qaxV42jTtfNLOSX7+YLcT6Uuu+8\n+w0i2tYLCpY5FdXYRw3YLVnUi6DBcD8NkA08lKfuKycS96tJrtPpGD/EY33+p3k5\nftVFhAi4WreLRJ+3+BYxXkwvSniNIBdY+iGbIzfygEVBbmTQ/4EGVtax3GIWJHDb\nJmL/ERHkLEPXOalej2zinymWOPgBLN1TZlQAEnLcfHfBI4awIIFJIQPGFR2aAsFS\nFSKWGmaCMFb2sSqswJ62T3v3Axak0h0nLCtkm/5p+SuqbpQU+QOMUAU3JLH3UZM2\nqTI88N8jU5Zuba3DYW0dDJcuhq4bEkCWmygt7625tZpZIt/e+BwKM2rmoljag2bC\nuWELOUXlVqJLvxSGNku2GA+uBzsY8xUw6iVy40JlzVuV2RwANg+fXWBdzdTi1Lid\nq28gqiZypshCfl03LZqjUuXwi93z0sc/N+1qQHVHflgAAIyrA5zUD/1tHaH8N2kR\nINBO084n11n8gMs5lMyf48RhC4BkluCKG9upjhfnciCrnjCgotnHnqQp3SZmUdbS\nUQGfJGcklzJOruaIpK8FUEdBm+sgtUTWO2HAe4UPlkf6r3rQWr92X+jv8ziBrHhl\nQ2+W85Yt69mIxpiqdhWZt24WS7KUEAoeb/LwExG4qA4XlA==\n=a/0D\n-----END PGP MESSAGE-----",
+				"fp": "C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD"
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",

secrets/production.talosconfig

@@ -10,24 +10,29 @@
 		"mac": "ENC[AES256_GCM,data:3yKNE+tLIsHJpnWPj1Wtf9jczDZ86lO4iTyPjcKuBzPfQZVaFTH8Hq2qqbD9ACOGxPsJoow2JdZt71uj3E+UUZo9C9ukHcLkasIQGiduc7vp/UIr/PfEVJBPanQqGKhrS1W1XxI6c2htMaUROexOxMynqzsa1Vl0YHabk4Byqos=,iv:H6gZTkIcuCqVpyGqVhty9CA7ta5ZSGVAKtBXvUhKfRU=,tag:AUuV1BUN1mjVkNKI0HJc7g==,type:str]",
 		"pgp": [
 			{
-				"created_at": "2023-10-17T19:11:10Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA82rPM2mSf/aAQ/9E2x2HEL9APL88LNXwmkAYDN+LgnYJGnfqARwYjefESaz\nDP3Y2vAkMVroLeACxCX6AzRRdGAFyqmdQVvsMnWmgFQM61WmqAuPVwuxZedqoab2\naoaM0egyOmB2HXhqqPD0IIvEmVHKkItpkE9vwBepkC0D4eF3pWY9DOpzjwqRZ6rU\nib7b0JpEGbJj7E194YXrrqo+oxeruzy+2xT6s5VlLTsRblOPfYV28XlSB+b9Wh1P\nyOtUtRnRiijZNI62FTsZq0ceJlC1CpcSviO759wTjnzPRdqXRc8C4ZsUAb4Ll7HP\n9vcRS6/dyE2sqKU78mED1Xi9r/CXY2KOmltX4nBjoxDkTZrHofaQGbrN/L5n8sbE\nbTzZu4mVu+RYZblA+7GEkZzLRqcw/FI4Nhu5dgIMdo8F5wTONBK/8eiiHaULwOyt\nfPkOcigc1Bw937qRGhQvakk91965OvLQyqhLZxuSIUxIAKxdJyVWUaScdFaHrv8A\n15qVepXZcsCJmCcL7kLM2M083YXP7+6nVNOvA5ychEGlbAYqLKec+hGI9sisKDmX\nRsgKDn77/+4zPws49V+SMcqNV0psbJU8dALAA0r6vQiDOv3bvzVXeQmFCJYM5jiQ\n+6Nm/oAlw82L3hO9XD866px+5g//37/GPzfwB3Qc48+5V8eeHv8aFlQT0aFmcbLS\nXAFcryIui3eatjaHsEM+vVtKj6V0hxhwJEK/emSeDHOq049b67c/5sN4tWhlin2P\nBPb/Ox1jAuGyq467opnd0wlR9TQnt6rKMaYEWTZOJeaex1CHE5vnIJLcw2zZ\n=RQfa\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:12Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA82rPM2mSf/aAQ/9HUnq2JESz8Oa0+ekY8D4WZrflcO71WdQ5TpXW9fcNyJK\nKUMOOVofvaRw82Z2UVQP1LuYLFYTzYukLjVO1w4SY9PAGlR7+vgF6faIHLGIllVW\nI9o4+pSKBalqmFjX6sH3tv94oXbTkJFx29neWyzPY/UypXrdN0zhv0RrkBOq+iwj\nLfduMzgnX2/WHR1u4Iq/KXq2XeSW/Mx28fdD5rPDmwhi6xMJRk75wCC1DbDaINrU\nmpcRkKaonLQtCX7qLkbQOUjD+qubTrrjvGPgGMLByvngxKISkVXnBP0M/45+iGVt\njdWb6j7i6Ypmvh/4AnNuccFLELV7dxdDzZvHC4/JznNx9PDP6vjRL72a2xl3hLUm\nHBCe15j3zg1gw0Hm8lY/ZJT8WwgNwsJe+Ue+p+GoVh9Bdyi0CWgmMr9mIU0euy82\nrYzahCyB5mpWLEf+Ow5At5ZgbQcyspGBi/V6HIgtAEwUcft4/uW3i7KZFgVHmOBd\nIzfm2TfYU74lxzqDoHxhGRm07rqyvcpJphyNLdohFr6+gz0/SO48pW7PkWmA6SLT\ntbNWgqk1epJJu//t+TJ2eIM1HRXWD5PZKl2RsXlwYxqwvJa6R9rEL6QQ1sPenaE2\nhMvFcEWwhtF0NdjcGtiuO+M1lLkVZZOs8EMwByYxsXFy4cbPLcC9JJM7fc5pmQLS\nUQEnn8mXWX9CGHUZIuA0xwvVghP5Q9RnxwNzggJQr/kqc8HJAkVzbkkiYom6ISxf\n1NhAteo69vyl2ZB3Dg3Lw2yq9yhwSqIIj9Fw+saXHCmt2A==\n=qFaY\n-----END PGP MESSAGE-----",
 				"fp": "6B61ECD76088748C70590D55E90A401336C8AAA9"
 			},
 			{
-				"created_at": "2023-10-17T19:11:10Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMAw95Vf08z8oUAQ//X4cjyhY+kcypCeZKuRDPsEDF///SUH5Q4wsvvnTsR06q\nnYvJqccX9Abj7oJDdqDBvtNxCJKd/nvVw3yF5W6VHt7GR0uIosYLObkn6IwmMGyU\n0x90R/A2CSG3Yfy+b7gxRwBlRLFr42xCOrj7fwsBJijdmYK/TOEOMRoBEA4aG9Xj\njsjELNJHWVr6UfgS3CFJv0Xj6x/u9r0H2bmTxIUBA4siBQaaQy6aZ5PmK3L6aUkw\nB592DaGToF7FfMSAjZxy5RHhR6be71hhaLkJQNIxiTlOg+QsDT+swAkhSu9Y6kJ6\nerQGav+FzqE2RVGoENNAo4/tRrAArCdm2fGuKRNgGVH3chhn1pm3MeNxL2DSCGsB\nS4sEA1H4AC5/vBnog6YS6idlJT+5ZY2dziR35vluGRRDtmkimk8rt+/in5oHNEEq\n13XO03Z85CucoJI6yOoSK5g2XH0UJU0BMkyIFfsfBfIP+nfJMj5KWstc9zZotGL/\nd5ISTqgyCzHFXy1+UNqe4ENNFSH4Tp71z5OTLYvNV5VjvTQCECED2YHjVfBVHhrT\n+4CmkHy8kMl94rEj0QOMmzZBDqkNGxYbGg+iaGNXO0QTH0mHZRJTqkbJ6WQoSbG4\nXHaFen1l52HcJQjtmfXQnbYb3IpPr5p06zbLDNdCDals+wDlXRW8kuSgraKVoX/S\nXAHZN/7be7StdjkD+ceN2QXvnd2HTAWJ0hhXO+w86TTU30nnf+08D7MeTUwnsolL\nTIUWagMfIOkNO340E7RT8n/oXBJp55f37taMwcvhT1p4E5XtV5sz9yKhTclf\n=krsQ\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:12Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMAw95Vf08z8oUARAA0oTzN5Z8d+r0sgLXA6Bj3SLyUGkkyNpduiCHgGTz29s4\nq9qsr/RoEjKo4hRrC7V2+Pz63eYXEAH1tQn7qab9a1i5u3w2lP9IPIIFx0FxGCS6\n8nOykunvS/QhHE6Yzz5VV53/4WNHn8kfgrvxv//9mIGcdyD1qF+s00u9dlqFxOwo\nssGG3qu9L+JNYEOJiE/DnkbsJ4/umdA4Q3PFGf5tZ8AJcBmWpTNELJGVyYqnniCi\nPM/RfM1rzNofgnODFlnzKLjgs0BvQ3a7/ICXIiLLKeeSEVGwXp3GTD3ZNCSpqq0r\nRixiWTMeicQc4J6QCPeSymDn05K7MArgc9m/D1mo50Je9FRt/SN+4F1lLURDgaxR\nMICIdrgwHUqJLFfDG76vZFDf7QzqrveTz2ppD1+c5NVTmfYcFb3lbO5AjCB/v7a0\n0B3Kco3cu6VVEOBKSBJuFRa2bdrTXQsiFYkA/2QE1+AFGQtR/23jXEMkaj+WuHZf\nBbtot/TIY7dCIEsi1+x0aJoJHXU7hLi+uW7uSGq/oZb7dX2T1uZxE+b52QyFERt1\ntk5Oo9kjO7qzaIi2aYyRbQWbIs20bXx7uFqlIPqvO963eGZPVv2mW+MU+O8bMp1m\n3U+3NpU333Z8sVkQ1Zr2iwydlPdWHSjMLnHR6CKTtF7Z1dF4diUhwluahR9rM8/S\nUQE0lhp6B7/oXxEzbAgl5FpQl4Oh4kG10xy2Xknsafm4NhHcUdQP0N5Nkk0tOFXO\nGbYwXkdkLdZGx9w1NTxuoVNrvvSqP/EbBQm85dmwmpfpmw==\n=gtBl\n-----END PGP MESSAGE-----",
 				"fp": "88823A75ECAA786B0FF38B148E401478A3FBEF72"
 			},
 			{
-				"created_at": "2023-10-17T19:11:10Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhF4Dr/MjkOzuuRESAQdA+s5VkV/FSjY03OH03oUnT6mGvz2VPbH8n01d2482f3ww\n++um8DH50n2Uq/pGHO00UT1frDd1bfWwM/Gb+IJiEfNnHxkBWD0SiNpvzIsKTd7k\n0lwBar2QkocdpfbeZ6idHeSYpqAUBEMMA45j0DCSO4z4Z5cRU0SFTrdfAm6/JKIj\nqIT2kFYAoQFaFdWhyhiXub/ey9PXYFZdhZ2oTblkRjsZeAnxI5XUy9M/fiUurA==\n=pzXw\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:12Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA0/D4ws+/KPtAQ//Z1EJIWy6hrD3QnW6P5hrtQWuUS2HCibsfKN/970wm8LB\nivlinvhxUyD+s7Hr+fA4EO9o44F5KQfXCPQGypCnjjC55BMitjuA+/HU7PkL8pQq\nM27KRyIn12jtl7/Kqr5aq2FFALnwUspxMkeW6dULYPLFSf/uEfrZ87MAvBVcP7Zr\nJ5Z4N5rEiqYvTvEPi7xr+5VsqO18VYkDUkA9O0MWreZuoOrKexN+o7YO18O1y46w\nUaNiDwV/WzQT9RymLuMBTn42/xD9+P2BsLY/w8tcGmprg37iLl3ylRiFuy4l9ill\nmg3z70VB7M1cXJRjom2HVaE0LI+KTfX16fmH3O2+VTDUNY3OTzJ8mPJNiwsF37mQ\nRrIUu6KMtdK4CkRKO7MQ+PF3DsI8SAiP4EdlxU4IwfXwR1QegPk7Gan0Rom7QlIs\ngeykr2MgjzCaNk1RE0SmaRr9I5tHDsALN63fxVP4+0b8fTppFJ7oS6TQZM8Uc75R\nMVtKta1ypAOyjlWnRgzxPzoaJrFkru4ts5zmducbu6z6fTtPQ9YunoEk5cpCSevs\na1uG/L1jl3UNXtfsoh5KCh/Q0YrDPUd/GGJfzKi8nuXWDEKrFj2sHYaQV82VidWO\nzbBzk4NEqBxcxC8vab7x68iwgtk25qufB0GEp+yhCLcO++gC3t96iqMoU5iTElbS\nUQGWFFLr/t05VV35RrQhIUBPFXD/GBpdSIppHy4XP3aO9fF/bdQm5UhKNHXYxYw9\nQ7oDrKYfpQNWB4FCrjIQDzxDLCbMm+TUoKsPgUfHmU2MSg==\n=h0tX\n-----END PGP MESSAGE-----",
 				"fp": "3D7C8D39E8C4DF771583D3F0A8A091FD346001CA"
 			},
 			{
-				"created_at": "2023-10-17T19:11:10Z",
-				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA5Wf+FyJ+zFJAQ/+NehYLRl2iHqPZPSFjtrSgCSk5ruvCeL6Wuo6B1vfvQYS\n2npql5aUB1SzD51Mwb818YBvUDqOuKWci4hW7lA4p7DbwT64+TxX0NIjm68ctwQT\nA63Voh1lrujJiO5VpJPHEU/HldvMvoWoj6hdZjxksJzIrmgF/B5UlCtfwECH153M\nE1sxw/0ifGoxgtfXgK7AbD3LyL2rbUK3k3Q7YI40HSLKNBORklQzdTXdkWhGIMm+\nlyQpyAHQTJkKeIAtTzw+WB+RrkJ70+4iuGW3n3MapQlgKCFCg+9ahVT3UhgpXQod\noiFmI88OhaVDfA/9s4dEf2Jd7Vgc6jT2wybLP+JP55kJbycyHW3oRQSYntdd+KJ4\n0CLJv+/j86fpWqb3B1pq77EW0A9eFAXJ7QtKiKn1V/1Jill+n275Navo1JgDnK/h\nU1hsDZvpEFQv5R6ad2IfXJxZIWVN7lbWKNLTQKgEn6MMYa2ocCjpKzzU9p5dgDRW\nT2j3CgU/X2kYtUe5+Di5S6ty/HWkLBJ7mqp24icqWGFM8wZqqAnFrIqB0bAtWtMR\n7GbgiElsXrY7BSSyTAplH5QuwGLEgvGw3td7sIlwWBAW4GIN6wGly+ffj4dYSW6l\n1kveOMDkdSLWo5FQzGAJ6gjpb3F8q6ZW/i7ge7brq777UB/XMbl4ZJhYNjTTKcDS\nXAFyt7r7RZPqkRnQxNZ8Qs9XDNoJV8LjMV2il8AboVOX7+JiVtqQP6VWuKDPFWbn\nniiMboUwqfPr4ax0Vq+2Gpm+UXwlIIh0vfjuQFcCQDpsklc16kQBNJ2bZU5S\n=OXgo\n-----END PGP MESSAGE-----\n",
+				"created_at": "2024-01-11T20:54:12Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA5Wf+FyJ+zFJAQ//VKjp4LUlCaGICQucl09X+FtIupuA5tLBxn9aqH1q2j3o\nGT9mr5NWtPqJgE/w2516txsrgt8UTb0vvoMD1sVC0dv+iDVcgGBsE9vJIhUVYJtf\nRl6A07Ime5HgkLrwbeG/7+/jM26f+iOn2S2MDlQMM/gzg07c3r7SbNS8CqjtAlgp\n7HJVXGhJEPI77om6QsHKMb9s+Whvf4171oQARgjAP0G3NTEX7upIPQZc+mCn3bdg\nW72NxFzNSFoQBm/RgHwu2WZzNomZVyZBoFtbqtXDZEEcA9Ev0zIGptAeBjHfaiFZ\nxsIyDTKzupvBK4ED+ziFviq5ZIYDOKlrNSSEkVrTC8SSuKCgqPUBepkoaCkgfuhG\nenC2h2htsw+WHvVfcglq3qrKjvkE11APngWq2J/wBpXwURJEzdi2n2uNPeW9qoB8\nYcWU+mXXNk8EIbs316ahfMgl6z9UJ0qUHom32lSpzYkpPcPPFaET3WiAj/McRfaX\n+PI/Au6vbfslNlJ3i3lqxOcLGTWsDw/sazbCyXh9Amid3ZIvgxO0mZGwNaI5vf3L\nnHxVPg6vhehc0ZrwRXiz7yJIbwOLB4AzTpG6oRSSS6eYYyNxeef4tLfluveONy6F\nn+mKr9LDgEfNDnbk3KPhNWKg7eyIjvKzTBkxBXyrF7/6EyvXsE9lZL9TQjYnIOPS\nUQEek11sUtGilV8MofHi5fwzYsqaMwrZ1xPHsKaIwB6aRKmGfPbH/SSM9n+X4k7I\n3XBwD0KHDQMh/C+8VMdpqM9lxUZ8tPCUp4O5EDN7XzUTAQ==\n=uvuX\n-----END PGP MESSAGE-----",
 				"fp": "F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D"
+			},
+			{
+				"created_at": "2024-01-11T20:54:12Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nwcFMA8KRInHl7Vz+ARAAkrI3AYc1E/6spJuoNwgg5PkyETqGYWa9gY7fCL1C3ICT\ns0NLs0WOKAdz+RUByhOGKUgr1HV8L1wnejimFKFkarGQKeeZM3ge3LT41PhinHGF\ntLPVHBV0uGGON6xDGDlfg+G2TH0yirj/K5n/6SYorvYDIW+nG5vpJhawtsT/c6S4\nJqfRX9Vr3mrRr6BmPz19mrw5mSq8akJp3qonCMIj3HJnLMluPQYUhuteJAIBqa++\nLmIa9AXk9uCNOnLtdhcOk4aQJgqJqtnj+0S4frS4yunhjtDnSZIfFbLV9I3tkjQt\nR+bOBBAaA9fkbwANCzaM8uuCflOqpkWAQwEiKQCWX6rCzbEg/IVzVNbCWXb/9RQp\ngA/aKI2N/J1LykznxZP6J/u+J65YxFP7uxd1YcAeacKfHd8aEQTKEemKhNHblSXS\nTrzznJqpArOhqtvQeWAbHheetW7iLJNrzG1QaKvulL+BZQo1kDXcA3PsndL+mktp\nyU5xcoo+ifLhu7ZVSZMigiA648PQ9KpTjmYDQFsppSRVjByArbKVqT4ud+xcZnik\nw6eI3fVJiFB0Y/lZHqUrn5CZBmWlzJge6YPGJaF1zYyrjQFGOUbzEg7/Ea527Ruy\nm7MZ0ia6fnpxBn/3iM9ud1GAgF6QGhgCn1/JCjttlJSDZqMLVGrGYHcIYisfKRTS\nUQFNXtUlHc4OBq/FRZ1N10WPzivWKrJPgfS53jr3M08PI6akxArbdv+abEiLC77r\n+EwQqGHdXQLI6MzaUw1RJ3kUW5A7rzTPu61abvPduypwSQ==\n=3yCa\n-----END PGP MESSAGE-----",
+				"fp": "C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD"
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",

secrets/production.worker.yaml

@@ -495,76 +495,105 @@ sops:
     lastmodified: "2023-05-17T02:28:39Z"
     mac: ENC[AES256_GCM,data:G6TXSnABI8iMv0pMUT+eBjvvlQLt4D6NrsRKXbsqrpt+HQpDJykaOaUrFGbUrFr5L46iaoQU0zOuQQFV+BxmZbm8wj1xUzTDxKhQYfytL5D6tEwtgySaTLDffdyHG4KYwWRYlDabTdVCJVUhzQHDSWvn1VUpGEmAoS12breKDsE=,iv:CQoKfpy8wLIg6dOMH7db4MHuCH1aXX7F8zGGYZaUjJI=,tag:m8AnRgiAmhaQNiRRv/1MSA==,type:str]
     pgp:
-        - created_at: "2023-10-17T19:11:15Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:34Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA82rPM2mSf/aAQ/9HVb0AQ+SaWU46FxiXMTlSqTQhPFdfQhSuQjB6w13peXN
-            Ea3Riri5kwjjw6uTXgfDB3OxGaXFFJgcjtnNmrCisuh6X1aycYs1tQnYh5ominot
-            n3nfLuVVp0T2PVTKUTiZmu82S8Y5eZyYORkLVfwApGsFWtDdo3yp1ugWCrkNT/Yt
-            axnc7vzch5S9EJ3EQVkCQYhK4ep3tlQZygVoT1ARwNnQFYQxECxR5Oa17hAskHkk
-            ZTH5OEE/mKTyzIbprzBbRV3//68LnfI8WiO2VbDNoCZa+wARTiT2Ht8R+PDQFJ+c
-            4WvWVVwYwYof9pCYPGyETJ5VZ/lxoIMLHUg0hrcS3Y3D5niaLrsll71Yzpb0E2ss
-            YtO1okikJdxc0qGo6A3GuHpgdsGsNTX8xV/lJJZlstbZlOplBAmhRh4kapob8+IX
-            unzM+bgcHlY5ObaTe0IBtUUPkVZln00OGG4CN6d+DdvM4cYofzN5xn61DTrKJcer
-            d7gKIAKJIX2/RBqmDBBGcaFUJGCO/TJXZuCD36QVTjbEiD5XgUHgWba9sssJyL0Z
-            HGXLlTPEEQoQbWLe3ShXYIApmdqHunIplPORFndiTKsCbx8ZxNmA8DfxP4sQZzhY
-            t0RjPy4kWkTMlDghfMml9ww2kHQte9ddkQpPfRE2f9srKaCnbBnCPEWrFdoFuifS
-            XgHVo43E1FMbCcXEmPOz+uevMWWUfQhmXgiq6JDhFGpuGAI9331HGJ83RFtSVrtQ
-            EQgYbbozxHbMrb28LZ0tXoRbCpsFG9bkI2nmUtmpyJkS1SPPscrbiMm2EhmOWIs=
-            =6xjo
+            wcFMA82rPM2mSf/aAQ/+I4FS/nPgH6mOuIGINs/c3w66pYB00PmJIg1jyeMJ7WBw
+            rk5S/73mAipWOncgsmiC97g2Aof2mt+E4EAOUd5umRVt3AbOINN5/9Wl37tYI2qN
+            /vwZM7lSBPlUSkPM3f7KVm6/RF+6gXcN/V6NBL/iWeipgjMVPHrvsECtcZ9dGdot
+            ZeNdqIrte35UHamJvvcJ9oih3E6YnGik8CiFKy6ZvGhboJF9mIqksRc4e77Ev4Mg
+            ezDcb0DdoZqC0BcRivESq/X9k6kiiBsrW00OZAUjAlFiMnt0xaMtxylILlBW2v0B
+            zdnrYDfnChNml62A6qhuH3SHPqIYxG0mjUz4qKW1XRS6t4QNuVyhKbSPVS97Zwvp
+            Jk3j1sy3sb5rinTrXCyRmllw1sR+iV9eGn1jPn3lZzBdseR2Jv9HS5lXDR4LDtZ7
+            8SlKVrV7aCsj0FRn7yn1/r7vjzRrKckA/vcmYHjuW9kfn1YqwzMA2hLl2bN8XHRi
+            rKIQ2WgBMpd5XP2gvDcBz9BLJxV0ngY4KqU9+4vpXvBrIybKQM5lNa1RfEWx+2DQ
+            wVkKDIzztbvc9ixUPK9ROQkmb4txpdbTFTheylYFJkF9qkm+WtpR/wEtpa8iJl0a
+            hLprfS14lx7EHwBah626hOBeH8OM4O5Yq3e2ZfnhdZzypbixHndExwsmJUpPR7rS
+            UQHur0b8Gw0RzRlZR/l96Jtypwqs0snAeMYa1dKUrhnjIvs2VADp66LJl6o6FMGT
+            1rx5Aed1AHl5KVRmkCKAsz4GSS5AbKbKSiK+mitB4+tCOg==
+            =FIH6
             -----END PGP MESSAGE-----
           fp: 6B61ECD76088748C70590D55E90A401336C8AAA9
-        - created_at: "2023-10-17T19:11:15Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:34Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMAw95Vf08z8oUARAAiS5U7tz/yaEj88r2y7m4iSwgNkrYNPjPMuQLmJ9Wj3Nh
-            QBYvIlrbnmYovTF/rb64aNqUvm/Pzhq/TAKKmIxJgDW+Q/AM4Nenlxb3IMtpNygy
-            U6dPLjBmoQQh/AgFehHcYcE2cT3+tLL+OgRIxFpTfiG6w6S0TgHtef4vP/u09f7a
-            QTKV8zOVSztAI9Dr11+k/V8dS0vdu2fPjrGNl9dFJo7Vzr1/JN5nRDe1Jtq+xGf/
-            CNvDrQ/MEd/63INeoryiaSlbVrT9bSX42YdlDoy4pT01xgUygx0l+a4ojFwM+XHN
-            xBRLLz499vlz0jMilA4mDgyIEb4VP7brAFpAq7TqToI9TmK+55p+cJ73paw76OKS
-            dFpMiUWMaDw8wzybxJxeS7ftAdCLSPLbYixLuMLJrWt3dQrrEs1I7hAHyHMMhJ1P
-            YONHtmwVi0kzU1WvXrb+tNl0KnLZz64ae9qmncw+Fa18TG9nkqpQOlz8AXQoImpI
-            JEAdtnmfvgVoqMOz37uEpeD7+koHoCvsQjXUQYfi4O+EEYz/oSclhMMaJ17YxctN
-            /XkVs2q8ZD1+S6wi5EEDqDAAJK0zyPr90ZwgsKZ8Z0OwFTfn9UWGYRdfaArTDA2S
-            wneIlMGvHcB5T2CUO0pR9/PWqAtkcIHPJx/BvPioKPLTkZ9oOh/Vrsw0a9Tuf6bS
-            XgEnJ+c7A0zcQEMkAtOBahBZwbVpoun9CKih4n7FbnZWktiL4b9josUIqT5ww9qj
-            KmYVsvHo0kOQBSwHOgUtSKC4UDvmKY5VbsB6vty+pwlqY0MBxriHfxxy+CZvcVo=
-            =Sefu
+            wcFMAw95Vf08z8oUARAAkFYU/pACf1w065o/vkeBLNHMLpjemmsvbxmiPeNUpYNr
+            sclFuxGWdYQq1zrzUzHuTh2UHr+lbcLIjoEa1Kkc9aAGOej3BNLF82Ps/JNaNmEF
+            wa5tvFSTW9XWjbxMUkBnO+UFLCsAv7bPGH2txUcDJUk2yIH87m3rUD5FNBKxnqvG
+            WIJ3gbM6gviPtTB0kNDExKsV6S9ScJ5OZcHzdgOGuCDvrWRi7NIrWVJHu5uoeBHt
+            nPdVAmygdmIoTfPTsnRoXxn7sTSt0YqSaiqHvo6XZoPwfBuACTRtW6FdRV9DNpCL
+            UcN1e8n5J4uMVGTZ/ZSj/sKJYyeK/dNkRm7ItLfjbHOO/i85hoItI/mMx+LUKkUj
+            j7an0enKCfKkdLYbs3s+92jNOv+WgHhaqdAz51Gmrk8rTt+oMx79FnLEM41eUfFf
+            aEtmHtohoSHffrdJczrxceNPIaBdof1plmetIsztlg2WGbHUOIEOiAlV1TEUUc32
+            Ej+mXDqey3KYeXsfy/dM2ZBkqbkPTipAk+LRZ0gFODb8bF+IHCMlWwUut3JNNJY9
+            +kgg9uGVMMZ31uZ43xauHVXaHIDmdajpCUTmnZUClx8lZ5/Hsbi8wIL6RI641YCq
+            l+ilhzmysfum0vlDvzGD1CaMZi0jKYAWImNS3SQtSg6/y/hE45ILUptxSRV72YjS
+            UQHXGSq+cTuh4O/ihBYYG1yVAV0u9FgP5t5NvRN6n08jKzt4Y4uIkS21n80SXpU3
+            iDhJJkfAVlFWR2ng933uipZkRjXRRIJNmOWBgPFDya4GaA==
+            =RDeW
             -----END PGP MESSAGE-----
           fp: 88823A75ECAA786B0FF38B148E401478A3FBEF72
-        - created_at: "2023-10-17T19:11:15Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:34Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hF4Dr/MjkOzuuRESAQdAMXOtjHYb/RCcwgvwNLyhcb4XB3tUgbNPqq4EzXITAkAw
-            ZfxJoVKL27tsb2dtGOjAy4UmuGvtZBZcklmoclYvYZpNf9SNI2AgbGLnDmccO876
-            0l4BKLG0hL/KasZa0GIBBD9mnBqQDvdmJ92ylg3E7g/fhcckHHsq4I8jSNEfPGyh
-            bgYKuHZZwcx/zFr4WgAH/nl81vU3NbDID3fY7GAkh3nucxoCPSHZQoQhlIDGc7lj
-            =7Ev5
+            wcFMA0/D4ws+/KPtARAAtbDXd2B1BY1O2vY4VZNo4SfRR6E+USLzsw++yXeMLG6v
+            HL0FsTYe5O6HOlrK3mecFMBWgiVcisKGum1rWpxE55EGaJOzRZNK0y1Swf67jwSy
+            SUgeeh8ONvaUReoZwUbVHTHYc6WclCcx7l+O1jPxAg506aR1RZIp6Sel2xlSjuoJ
+            VObaUPTsCynyheLxVGPychhssC2DUJZUglxf6KJeSAa+PQzESzATPtKUS581i4Hr
+            4Vau4sKnbuafFW+ojO/r8/zRMUYe1evzQb7fCXu7QCh7Gm6agHACLDfN0lRMxOqa
+            85hsmcoHKEpxf/PwCBle2mzxxjOmYNOvk95uMSPy850i+xzzFkl+Q4ciToo6CX7V
+            /vdmWPmVrmHT4ukdYiWiGCVvlXdXxMEvxM2ycO6mWQHbvVLAIt6d3on5g9E1rKYx
+            +sHogw0AxlJJvXz6M1SqP+cjQmAzmvaP0lnvvvTsD8pOiyiHPdw/xACz5fiBe1gS
+            2D39SBJqgkHowEcg68yvexnB7obzWAcRVbxZ713RszquRGrc5pQ7uyiduZ5Ef6tT
+            0cBhEDuGEnCIHP/orTbyOVShNRj1w77cyyusTQnLJPVRnJxuresoPAXLkma0Ss1d
+            GaYVxYH8dFq/nwtmip1lPagLT2Sx8yPikRTa0D2cmBXfe0PmgupslcYpRKhkUSvS
+            UQGo3zOVPxisOutf5i1YmmgZ1df5sr2MPr40bwPdynBcAeONMd/57Ri094OEGF6K
+            VfCK1b/K6CdxEqxLPVE+vpGxLE2LrjeTOLR98FRDFQZ57A==
+            =WVIx
             -----END PGP MESSAGE-----
           fp: 3D7C8D39E8C4DF771583D3F0A8A091FD346001CA
-        - created_at: "2023-10-17T19:11:15Z"
-          enc: |
+        - created_at: "2024-01-11T20:53:34Z"
+          enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA5Wf+FyJ+zFJARAAis+AJ7xVU4SLl5xmOj6sWFRXuQq8CZ/AjVjGBhhGPeE0
-            xvOj1p/A/pn3eG1N+OIhN21aj1GoHQqfzIQ9+63OPQ389Lk0EIt6KOrJVIuozkya
-            AxQPzEHA0Apm+IomYmuuuzDFP+SimUWxfDxTylErH4w39AKW7RiIOmwgGuiu7B/r
-            mJx877f0pTTvaMQnAR2xyd26Up/xwshtg11co2U251zgWES78Js1t82OqyIIA4+p
-            CohKxwFRJaCcr7/NOd6xmtvsEdeZqtPY5X6xyJyzRLMHRJ4eiURCdqYxDmqV7e0Z
-            OU7I3HqEy9VgvLHCEpbEBC/bOEC9Ggh/EA8+srCNGIktTnYGXWlq+tACYnzMvxpV
-            oBIBR6T8FWa2AaP8SRFbtbSkcnC050STdG1go1ZUj7FxzjtBzPMkfI/cxcuv8FHb
-            GwxL0l77ysILGryqACKT1Ql/i6vcDuGjjrpd11aAOCq1W4rGfEtDUrEePDNlmTSE
-            WjPPNTOmGhSHwzAtMx+1HsgnxS1+Vnsywu5KQA+ytWx9KUViynDUd5O28wSkwhyf
-            M59I5m/oQuS0HzqykNe/mqWCoIGVzYfvO0LaZ63LuTol1kXmX73dFXt9PCwluzOA
-            DAIzK0NvSl5JlX6bVScxTzveFPtOYUJdCQ4W+A4iRVnuz+Yago38S8x4HkyntSrS
-            XgF/VnrOwOrbv5h1aKPNpP1jQADD1XikI4MVK9Yv0xVNsR/B11EBfl7Hy62iIq+b
-            AKHXMG+gIF/AtYN5D3keqveI3RySJRELW/cvFufNzjyy6B5p/WU92opwbHpkxOw=
-            =G2ux
+            wcFMA5Wf+FyJ+zFJAQ//XrTor5n6BEKqbMuO607sw811d+dBOdpxnCgUUa5Vs5cp
+            8dSmBqKmpQpIlaiydn5zg8AY+v6coI8Mygq9H3ICIA1WZ7n2Yv2atCsMS7gR60hE
+            d1yGfWxMtRhN88GozRzaLuuIVCsUlkwdskbH8BytchYSJkhw+UXGI3R8ZYBKWg45
+            4eC5bijbdV53G7/jg7XYGYtDcn+UR6QFneK79GJATTUNqwBXW2FAROOcsjfcj2r1
+            iw1ulW7e278d2ND5KryE/huH8D4Kfj6cad2nKowUmlxoxEf2PM+wiOwSptVhKmWF
+            JKXm6KPjQlUbmuYBF5QHq3bFkvOk9HnqX8rGffmiZG0yCg2U0nnad2ZTaIFztq1Y
+            6tgmpnAL3NB6BMibCQjOrXeob7Hsx8HXJvKDQRauxVEreBzhHn9rgskIUvxM/wAo
+            kEABRm9VYxUH7Evcn/NFwGxYq1mjQ8OmLu2fboFkcBsaZHRTuoEIDmQTFOIT/kbT
+            HkaWPPgA3s6h8RGwa9wCfhGw1VuFBR2jRiQWwU8jais+Lm+GxhA5QKgH/dQCRyaZ
+            Wyfn0USHNJ0I4v8swBJJ/Yl50kjM0B77MysUKQuR5FErbTsKh6ckzwnfRCwCHkYq
+            S10JrjjGtt5tps7i+AcHnqhf6knoH1SBdQ140K48CnCtIbP0Xl+Ne/pc7pB1+bbS
+            UQG1v1aAI9mh/aNnbUNwvWX9+/430RKQ45L8UezrKgNY2/5sSoaOvk5LOJw0Xw24
+            NyAGA17ANXjmvvwMAeaY3NvsUYhiud7+MmqbYJAZKpCwSg==
+            =hnwx
             -----END PGP MESSAGE-----
           fp: F4BF5C81EC78A5DD341C91EEDC4B7D1F52E0BA4D
+        - created_at: "2024-01-11T20:53:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA8KRInHl7Vz+ARAAoXa/urBfQSgCHWLehn3Z0PHPQCnT7HyX2RIdnACisfN0
+            xwI33X2Ru9Wkxvb3nLNetI5wJD0d38zr9mcGJofYprdYSBmce3JX0oicqDgvOkqc
+            i2FYfzoro8E46vgZT3YLSRguOblp0pdcMMfLSqD/n9bSciFGOkJdpcaGo9i6jmHr
+            TCHpGUWxMOlFgO4oM0f+aDg640y9sEucRcKXH+KwUPNU2WU/bXSFvo8lScOdn5O4
+            lwv+q41ErUalPEXUlrNLW9PASEaIESCd30VR6BD9F5WpNYEGM4io8WsjjFPB+KoI
+            eSOu4S8xtM+Kx58DzSLY2UulfPBmsZe16snwERwUQxEwl1rOefhWJ07QcYReR/bD
+            pFeYJwV8W8G+MyEdHwTx4iWm9V/1JudAXElg6bynGx1b0hqhZlVyw5yoESsb9HHh
+            YOAS5g8W0Bjsh/ypdCl+7eRbLUifO3J5Jr2PM8wl2abqUmv6k6dfTZzTnYiszCNE
+            k9yV/4X5gqFv6/yXJcYFmD/HiSbI29+tojllKP4lfH5EcCf7qRwjFPPvY8a8Xh5f
+            LupFq0lgiWVoqAfJAZ1iPzWSWU0k0oBwRwPHz0DYEG6EEAjv5WTnVaM1/QTbIEjQ
+            +/zWKVDMyy09DkOqHP+Y24nCQ+E8jAy2xuarFW5kWPCYVEZcHzH15Pup2IL2qqLS
+            UQE70BabOwppTDTmUVimGv6N4xcqaJfVC+2IxySZ4MI5oHtmPG3fFBe6oeZn8O+y
+            oW/kGGM3Hmw+0WdW7YKkqmK7v3p/kiY9jKdoYTQ8eky/xg==
+            =RIL4
+            -----END PGP MESSAGE-----
+          fp: C92FE5A3FBD58DD3EC5AA26BB10116B8193F2DBD
     unencrypted_suffix: _unencrypted
     version: 3.7.3

src/toolchain

@@ -1 +1 @@
-Subproject commit 23fc267a9dfdda30ba4287f8234879961722bafb
+Subproject commit a2315fdbc8cd0e4a654d1aa4623a53d5292b3574

terraform_modules/digitalocean_database_cluster/main.tf

@@ -39,23 +39,34 @@ resource "digitalocean_database_user" "default_users" {
   name = each.key
 
   provisioner "local-exec" {
-    command = "GRANT ALL ON DATABASE ${each.key} TO ${each.key};"
-    interpreter = [
-      "psql",
-      "-v", "ON_ERROR_STOP=1",
+    command = var.dbcli_name == "psql" ? "GRANT ALL ON DATABASE ${each.key} TO ${each.key};" : "GRANT ALL PRIVILEGES ON ${each.key} TO '${each.key}'@'%';"
+    interpreter = var.dbcli_name == "psql" ? [
+      "${var.dbcli_name}",
       "${local.base_connection_string}/${each.key}",
       "-c"
+    ] : [
+      "${var.dbcli_name}",
+      "-u",
+      "${digitalocean_database_cluster.main.user}",
+      "-p",
+      "-h",
+      "${digitalocean_database_cluster.main.host}",
+      "-P",
+      "25060",
+      "-D",
+      "${each.key}",
+      "-e"
     ]
   }
 
   provisioner "local-exec" {
-    command = "GRANT ALL ON SCHEMA public TO ${each.key}"
-    interpreter = [
-      "psql",
+    command = var.dbcli_name == "psql" ? "GRANT ALL ON SCHEMA public TO ${each.key}" : "true"
+    interpreter = var.dbcli_name == "psql" ? [
+      "${var.dbcli_name}",
       "-v", "ON_ERROR_STOP=1",
       "${local.base_connection_string}/${each.key}",
       "-c"
-    ]
+    ] : ["true"]
   }
 
   # Note: provisioners depend on databases existing

terraform_modules/digitalocean_database_cluster/variables.tf

@@ -33,3 +33,8 @@ variable "vpc_id" {
   type = string
   nullable = true
 }
+
+variable "dbcli_name" {
+  type    = string
+  default = "psql"
+}