renovate: deploy renovate on kube

.pre-commit-sops.sh

@@ -1,6 +1,13 @@
 #!/bin/bash
 for filename in "$@"; do
     if [[ "${filename}" =~ values.ya?ml$ ]] || [[ "${filename}" =~ secrets?.ya?ml$ ]] || [[ "${filename}" =~ .env$ ]]; then
+        # Skip files that are already SOPS-encrypted: sops -e -i refuses files
+        # containing a top-level 'sops' metadata block (YAML) or '#sops'
+        # comments (dotenv), and double-encrypting would corrupt them anyway.
+        # Makes the hook idempotent for encrypted-at-rest working trees.
+        if grep -qE '^(sops:|#sops)' "${filename}" 2>/dev/null; then
+            continue
+        fi
         sops -e -i "${filename}"
         git add "${filename}"
     fi

.sops.yaml

@@ -1,6 +1,7 @@
 creation_rules:
   - path_regex: .*values.yaml$
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.yaml
     encrypted_regex: ^(data|stringData|.*key|.*crt)$

infra/kube/manifests/cilium/values.yaml

@@ -40,28 +40,29 @@ ingressController:
 envoy:
     xffNumTrustedHopsL7PolicyIngress: 1
 sops:
-    lastmodified: "2026-08-21T18:35:32Z"
-    mac: ENC[AES256_GCM,data:Ad0t52gfwmsLe1VWx9dsV9zI1k2XFHRpy369T6xqoimcqM19jMcInS/0Rgpg9QTFqOhMMJnf/Qf9H1+bvOvoyk32ykbkRJh7V2QHF/vaBfD/GyvEeJb17swoPehf6JyaLhzpIU8I94el3EEFhwi42xhnW8c/ghtKMqcc5VNwJP0=,iv:ouYUEQhKHMlCVsMEaDyhAndS3y0WRkv+LPX9JGnjtfs=,tag:wXEAZhc6yn47LO/U0PauoA==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:2aioHoSXw5UOFKj5z5PJmtPC4rGl9DYY0gWgevHIxXbKdjLrTfyyoRfBPCl3+NPWAZllieMr4VKsGy53YUqq5xFgRg0BaqG+gqMFX/YjHPqhF0/WT0YI3GdTWhl/YY0wma+CEN0kE5SsljpKh7vBgY8l2WlFhpMdlbAKEeyONRs=,iv:EY7Vdlj/VpqY34KmrVUSQutLiD8DEAB0OqIXnN40ERA=,tag:XOZNdUoeWAV4cD111ciBzw==,type:str]
     pgp:
-        - created_at: "2026-08-21T18:35:32Z"
+        - created_at: "2026-08-26T19:28:02Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//c5xdgliA1tjpUtZlZ0ByB+acwEbEA7Ee2K2ySg3GcQHG
-            2oE2QO2TvRkUzyLE+td7NgRWBqEV/6u/Ozfee2tLiijjCgUg4QtgEPFqQVS9QKZW
-            QXRRsBhG5vxdJqKXn22g2bofNuJZuDSUiGL2MMy85Tm1HAc9Rb65+UcRqtlqrkVU
-            e2GaxcYM+YexWnpBqA+685PSidbYVehH5WSgfTXqbilYmxmZH0wBPdLzSm63dDd2
-            SdtFy3JfsNDg3jYMge57FHd+FANltbdW5tHQaa+6FX9akyQ+3mY/xXt2Ut/KiiuP
-            WFb3SvNxluRXjvyKQXmkUPZDjL8YbY+jdcH9WEuWXFClwa2g3OVOSPotSvJ5eW3A
-            z5kk3tIq+LqIYpCPd/0AjpkAzeijAFATTxVUUsvPJHe6WDrCC0koP/7Vqqk3vvJh
-            5BM4/1pT5v9HfbgirR5ja3EBxgLEGFHRW4IAL5dJnL+JtM/NQwYJuWmzEn9Bdlu8
-            25aqVfVRkeOrjh/dS+2jwJvjPhzWd0KHv58PkCJVT6tJcitgak3eK8yV74HXRrbj
-            dBYr0hxs1oDQt5U6bqVVfzCXg0c/ZP1Or/kcjQQUHNsOyornbxJ6RTqeVTdLENWY
-            RZ6d2WNFVagbH8Kr2ah/L+MzHPQvhNSrLBpj8FjJH3wifZ4AePubSidv+ipJkH3S
-            XgFe9BbrSzN6b684/bBswl6sOK/AiW9pFPrGTuT+0qFvPcKNHLq+faltMS9rz3DW
-            FF+s0h07i4pkf9iED1nfXane+DpuKpDaE6S8UIn7SwrXJ5A67woc28QcaFbxYkw=
-            =lil9
+            hQIMA7uy4qQr71wiARAAp9OoebtSeHrGp/3bQz93JMbp78C9xnHuumz7exhd9Ky6
+            zrJUm+bL8tNMWTL72Q+GUTCo7lEVltYciXZZVYSvD3Uee8stAeOdhCrY6jsH2IxZ
+            yCVZktlnsAbsPDwmEt+/HRoiqwy4hkbIx99J5W18cJD4eSw8MlJYjDVfSh2UWGIi
+            rd+7ameKbHR8PCduWu1T5SY0EFWaVr3WJDW//lD/FUT1KXJDrB0ExVtsuL0l8GgW
+            ue+noYGAn5l9PRgjgqTLSbHoQQDaMO9KalR+Gz6jmYpUdkJEuCT1amQiH+dE8i85
+            Rs0KXHWLnW59xY4pqdNzJzOysKEsM/oPes36JFvuIOIpB0KDSK/hcFKkYogk96Rw
+            VZ131NNOYMbKunORjmKfei7SWE975zzB/OFCWRDkAwGceqm+hdWaKhKV+rZlBSHR
+            ClbWTZt9+EEI3Er1f/J8qsfhvxJswWTDIOs7+I7YgbFgPAHMh/kcNU+xJJmWtDOq
+            Fq3uBi/oowR6mwTvUwswFFkuaDePcjHrvWaQLTzOw/wv5JU59nUTstSr+zMQzm4Y
+            ZTjKoz62hz5gntyjRFG58w7tyLR8D48CFPA6BFGLBkBpsykhyc42F4woCUqEg6YJ
+            5QBuCFsBXxjSeRHTLRyaWdI5BmppmLZ5axzdMVt0X+rXy/7LhGPY40bGuWBbsgPS
+            XgEL/HGgfFafvsfgJU5x71E4n+Ak7EPLCxin1uTW/CM0cJszT1/zdwIdQ+T5JDiY
+            JlZZTK9C49sF3OngtmRTtf1JesnOYdfhdOVCpDO9EgcUiF769X0JPhdFNemkOeY=
+            =8NLP
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/dev/gitea/actions-token-secret.yaml

@@ -6,29 +6,29 @@ metadata:
     namespace: gitea
 type: Opaque
 stringData:
-    token: ENC[AES256_GCM,data:rw08OD2BsIUgZ7eWoYPN4S7LPdbjnE2bPatGrmH2LovCghV8T06OEw==,iv:EDEO3BUMJ3I9ApHYgqtWp91PSzW0tkhVmgSLkeYJ3mk=,tag:jpxIEYFWTrUnZWECFr4Oqw==,type:str]
+    token: ENC[AES256_GCM,data:IOVPnopbQKY7HBT9tlnfuwvakgegLuK+PdTTwg+eRWdMz+dAoIxhug==,iv:QhfgyXNuZnYTXV1X16bdR+Axhfbe7buoRjXV8IdSbZU=,tag:r5By6+E45B04vgZrBoPSsw==,type:str]
 sops:
-    lastmodified: "2026-08-22T10:07:49Z"
-    mac: ENC[AES256_GCM,data:wXXd9sVPoDz8kNPiYnbaAG0f52e3DfSdTPSw8qYmf4C9PVLf4DJ8/xr2tPfoK9hJK+99jt3fqLfKv/PqM673Udn9X5EHiVSBG7o6N9OC6Brq7KfkO0d7bVg3n596xE4VOYi2v1RC+IzR1VNp8nqwTt9sG9hRqwhkYx5awGlzML8=,iv:GB4/aUbajc4qXuZZbT+fAH0HIx+yaADGWKewcPePC5M=,tag:/bfQ0ROsUQ1mO2R/kd9ilA==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:o3gyJNXJIBE1zSV4vWKFQWfmwZvz5Ek8ie/SjU6cF6kOqaLae2y9WBqYCQphCpasgN32qP0RM/bzzV3AZlIYqGEzI6lf0ha7aDPdVJKMy3ieie0F/UW6fJcTfidEFZYFKereRQwCWTzOESIZmsc+fqisyVxW3wL2yyYuh1a1HPs=,iv:RsG3AoqpMqR19DPQdqzfjbKNV5FZPxEsTbIZzzJtXq8=,tag:XzsmRc58Q+cNmBZXtygV3Q==,type:str]
     pgp:
-        - created_at: "2026-08-22T09:53:39Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//SMQVc2JU4VOzEfHh1PhI/oWOTKiZipezvGm3g8F1wik8
-            VU9Miu0zgMpa6o2OqEg4kzsUyrYY1Zl7lO5ALM74i2Wd4ln/ABA7/sc+rfw73c0b
-            PFRVoWqXDdhQMXVrUmY48/sUuv0HRtlVpkMjVwKIWdOU17cG8ueMFrM2GRHM8jTC
-            bxyE2pXMuV04RnQCdXxUkrD2uWxnzqrm6JYa3C7cktU3KGqNgl/m1XBOdm/UBlwW
-            XqYtpCJrCbpagEB5miSVxpWtqtF7Sq1Plabst+xajVdHhBDFD5Uw6F6EkKsNZbJu
-            WbaBENV8mkKNC0UwztECd1yw0JdHaejeOib67g6b4rX8l6W5TRLKfkM/Gev0FjOD
-            uenYUOq+VqlaVhG6lxsAodZ2078kj71JD0tn+DmXYH0le7+IlsqpNmWZyceGtmUJ
-            5iKoRRyjyeKjoLLkZ/vQwBmp9cbAGCt3O5uV9LiatXEfpHU1QBi8ulXo34uAXAu/
-            YqWZxkSry+myV31hALTq6iOAb33VY9ha+X+HOHo11XhLae4fImIpFzBNAFtc2kh7
-            Mbycef0i1C9WsfOIWHzZW6/bkgE8RtpjJmWUhNzvj/pHLbOzUhESC1LjjqbhutTj
-            ydDTkkXunWu1MEfiqJM1vsZ/c/YQH4MG94ZEfOC+iFay+We6Wd5884EIPP/EC4LS
-            XAFkt2IABG1C3D86tbBLKvody2+xGnmquUhYqmOhVCmz2jpt5bm/qnLTQw3nKdBe
-            Y5LyaiJ8wAcRrD5qSK1gzqlCRDPeMSj4+kYFrcInWA24ToBvyYAtBKCzs3Mb
-            =lonh
+            hQIMA7uy4qQr71wiARAAwpBrBeb3ywJTc54HNC7s/3+tqCvlozNym8E13jqHREOY
+            e6bfDO2hN2/JvbdGfMaWspLa8mU9ten6yFfUtoPADfccmbWwRAgS2mJuLyh5tksV
+            p+9m5vjyRQBH35pfTJ4F6Ksf7/2V8M4b2PxzBzTVQseqhOC2notYdvQeWED0gH1S
+            6cQvPClv/X214I9FfaHNig8SB7DV8uJ6ttj+IG9RL+NZ8lkT5GObSrphR6QH25Ne
+            65VMJmjcQLIWfZxR+zYVAxTsSeeDMFUY28WBUfjRei+WZ3ggmFRVERZzG6oSXfoA
+            nlqSQU16TyqadubPV2LcapqR/IwoSKdWO1/RmxH1NAFNvMg9nYLHzffAwPGL5wzT
+            GQZci20IlRQ5CLsaREyI1SNqYfjZ6esjUw8iKr5/bsr9XuI3FnWgqnKoAMs8O7d0
+            ZSGAohsUNrRki+ohhXtZFTelzufM1Hrt3Yz1TYQWtvoD7j87hq45BEZOU1ifiwre
+            Re0IhzcOdiBbCd3Lm9WSNmZzKHZoy9PJR/zaaitzZasIzsCH/7KjLBO0h1Bz+Osf
+            9Yxl5BMrUDFLlCIT0ORKZFtugwvS7Ez0IISMuRnSGjcutVsZGP1a6fN5K7oaSeAv
+            J9+9u5BuqRUs6ZYkC6TVqX7S8tAJkCOFIOFqxzb/oI2SBdRQmPP6Ix3FmN8NFu7S
+            XgGr3gKAnEDyuXwdZY7guYdVIteiLKUpvqk6F0yQD7b/rDGQoBD/g1twbx21ZDcI
+            UJ9aijLLe4JDcP02LNb64y8LaDb8VdFqlAIzV+MsYTwHAY3dB7LQtMGSmVlSZNI=
+            =lc7+
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(data|stringData|.*key|.*crt)$

kubernetes/dev/gitea/values-actions.yaml

@@ -56,11 +56,11 @@ statefulset:
     # Same failover tolerations/affinity as the gitea release, so runners can
     # be scheduled wherever Gitea itself runs (p330 during r740 outage).
     tolerations:
-        - key: ENC[AES256_GCM,data:jC1B3zH0XQ1O,iv:nGWUUNvIB+WBDG4MatKdzXKwWuXjkK2IsaDC8LCakC4=,tag:lp6Uv/aJaUt8XTXXhXQuXA==,type:str]
+        - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
           operator: Equal
           value: failover
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:pmPj2H2dChGATTl5oUJCt6Fq0A64zt/VFxRG6yy0XFKXlUkpgA==,iv:pmNCnZqu4j9TleelYDrtV7u9pjjgDO806lyKXeL3V38=,tag:+MKVAYraGF29PPQlJhQmxg==,type:str]
+        - key: ENC[AES256_GCM,data:1kBsMuUlpluDmpVddyZCI/ylRbluHmQ62F88Q9LEoiZkgdpm5g==,iv:IlggVbY7s/xaSM2ljMkiTDwvIjf12g3SQzfL2fWWf78=,tag:2aNlCFumidKSbnoUV1IBzw==,type:str]
           operator: Exists
           effect: NoSchedule
     affinity:
@@ -69,32 +69,32 @@ statefulset:
                 - weight: 100
                   preference:
                     matchExpressions:
-                        - key: ENC[AES256_GCM,data:zTvzBWPLKcDoRMcNlOB0injDajw=,iv:x4yI3vUBThzKTNHEaxelPmMV1fvArLu/avAAeeBP30c=,tag:uJqnx5qIFVYDONvp7Lu31Q==,type:str]
+                        - key: ENC[AES256_GCM,data:JuejrbDWeF+d/+d2Hq+q4V9vihk=,iv:VPgkBuv2hqJbTNFXpv3SzRGtFA6iVq1kFR8hfANg0cQ=,tag:D/wrkytnO8oZ3/+4yicq7Q==,type:str]
                           operator: NotIn
                           values:
                             - "true"
 sops:
-    lastmodified: "2026-08-22T09:53:39Z"
-    mac: ENC[AES256_GCM,data:dSUMCCs5iobsQtiktm0YepMqHCjXwPpq35jimoS+IUIeBUO6lLuzt4gS6emVJUBUbNB4rptyqyCxX1GMXj+9iBUwKx2SR+FqXa+AzIJ4JMegF60GBIpBc2rSA7I/jSrv+6DC/7Kq1w5EQ9hhTOXAhhzDxkQjgBJF3jMmMrqU2lw=,iv:pu929/yRvhuMZGY6Yt75RpWCcg4Xr2beZZT2NZVPrOI=,tag:6OavMlfiKjH0w4F47ZJXHg==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:srIJjIgWx1OGgGwz71wQgT8c1gg64iV2VHrrb11SYXpaYg0VMp9d0maJHCaKt5rDVtWw/+Ft4WbR0z2FJBLEmr64/cFX8/SgrOR7pAc/vAgPKfxiSHg6iJoVCGHssGHm4NzvSUC2fkMqc8WUiZDR5hztUKSlp9oNPO2bKZmw7Zo=,iv:tgSmO28JZiGK9xO4uIH35zlRzJcW8lKxaggtqXlFq/w=,tag:+mIagmS+Z5RSFdSo/yDhjg==,type:str]
     pgp:
-        - created_at: "2026-08-22T09:53:39Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+OgDT+QcY0FWtbrwMhUKn9Up6fn5yDy6dUnzr/Uvd+u/G
-            +5fBBh2oDsLQXyBNIX/OXj6YLq2dBHlrnxGAPVXyoXQtel3OuPWYVVp3bbxR4hOw
-            XZlqnVU+BYemRHHh/wy1FY/17z2QemKXDieVb51cxYxWXiXc02XVOOH2alglf3M6
-            X4cTz0iDu+tbLw1rBo9zwuCDJBQ6pCiyvTUdQrJOH8QwSpjd/kXS9BewJLv511LU
-            9sv0jWkd3O0JPp5SJ2GsmWLZLDE0QHoKmxmSCVWVQVsq85rod6/Ab2oGMeWNaTRn
-            X96XKyveBRKEbi/d7kCPeTLpKB0qxgAHgxCdQ9yVFucBEibGzHoC8qv0hH68pj46
-            XInzUjMseTnNNm5xvxrosMA3BMOs0ByYiRY85+x6pO4y9KxehhFTdNnq3XPYFD8x
-            y7yrmcgDrNXvj6btMt2QvX33idmi73QMQIDghjq3Sejjvg7dGJZgY1k4wZYqyXCD
-            UMQQ6512utS/RhZ44MUxdD2mhQ9RsCZhmeTXACyYiGW+cBTWkNu6negUIzjA7b4+
-            H0GOmaiZHlv/oDhM6+IHkV7B8kh/pkQ4em8Qhb6F38lohYyu7V3VBvQzK2egCoE3
-            7F6XfHa73DPr6/BWepRUcMr9M1YqyQOigx1RaxkIr+7CZwAO3acEbtEzgMY3GBbS
-            XgHcPOjXwU5N9XZRCzrpLD4iwYbQSSxZdxwKkpME+YRyNJ1edHW4HPNbY+2XC/he
-            Z55AJsoEPLFyoJQn47BMl8x5RzViSliEtIvwGJDYiO4W1QV+R54j9wm7zelJVMQ=
-            =Otyl
+            hQIMA7uy4qQr71wiAQ//X9NxtKUDFkdKDmWQh3wRSriiq25U7gkL0Q7SE45Tz5V6
+            03i6QmzCyBpI81TQQBRRzfdkuuqocBgplTRRRvFsNQNcwc5KCq1zHIDVYE+XlcmI
+            /bwA0GpBZwDN6Mv+G8+6UwhSp+YgsiGFTVAIctfz90cRYPpABX4wRcDYInTlifHk
+            weBq30iS6Nl9TajpgyyAUct6EBQ8u1YmxsII9RYWjdoTS/SAuAxNM2px7fwOPAoL
+            fq6/AxXj1n+uKjxl1calL95768RmLUerdxDmac53/73Pj271hmbwrWqe+JzkSriu
+            YMHYNOVLglf7nS3AQSqAa9PljBv7xHw9jOUqkJH14W7/NpSRvc4PICyIWA3Yfpfq
+            ymMI/OOYosyl3ZYhfLGUIAIYLkA1StgGVfpmeOmUCPEn2FIInBmguzDRMrdnUkoz
+            KYh/06Ug6YsgCTsy8Ffhzy724ITRADzqYlTU060tTwFN7cgFVHiIfZdYIFxDxNSL
+            NELw8Nl7+9jkWjlnmPvtxfrN90L7nBm4s3mZrYeyZ1/ElcxDkJKb4r+PJuc6rCpM
+            tuD9BXxjl5qa/trl/1+fVToDMMm5vws0MLl4DBkbNUNkD7wWko0I4rDSZ+X4SihM
+            /V7XgzeQ41KMnDdZYwTKdIVhCpZOIBwZlLuZSYCn8uhqO0YMkkpB1x1EOb2fy3zS
+            XgFdP2zpsUHWsy/iENHCgnMkQ+l2XwZZ2bgZGqwpRbLO0fDNX0kRZ45NzKl2+t79
+            npggZ12JFTPPbQG+o0hY0p7LjnjbfBsp7m9ykvymizZXlzP9efoOq6kjD/CRBu0=
+            =WgiB
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(data|stringData|.*key|.*crt)$

kubernetes/dev/gitea/values.yaml

@@ -26,11 +26,11 @@ valkey:
                 cpu: 500m
                 memory: 256Mi
         tolerations:
-            - key: ENC[AES256_GCM,data:hYAE1TiCvNmu,iv:1UbfY6+dmo8ZBTA4HmrePwsSlI0ZAXnxxTxPSFmXeJ8=,tag:I3TojzEvwF7+VpIteoLPgA==,type:str]
+            - key: ENC[AES256_GCM,data:fXEKv6sROAEz,iv:ausWhm1zJdx+Mu26pauhi5G+ODZqLZ27SmfkAuMUtYY=,tag:cNYyeG09Hk++uED5M0TBKw==,type:str]
               operator: Equal
-              value: ENC[AES256_GCM,data:NvnKWi5ILYo=,iv:ZOqbGIaM3K/fFeuLSYDmTyYlAN4SJqDEifLQvvJfBMk=,tag:WdUrzaF+sK/4FglVlBWu2Q==,type:str]
+              value: ENC[AES256_GCM,data:7CfH8Lrr7S0=,iv:dv5f/cN1VI2NLQsAYqF2hGEjVjxTnHGXFfNQyCL1KIc=,tag:HTiQN/wZU/mXSHvaz2KqRg==,type:str]
               effect: NoSchedule
-            - key: ENC[AES256_GCM,data:HRboGXp+i1OelfWw6dMe1p4kxGyu66p9kJ1kiX7nCtL84Nc2YA==,iv:gRqCAhIOKAp1JxsC+n1V4B0bpUr6I38tjElfxiUc+T4=,tag:IveoeEyKxRUQM8uTWXa8wA==,type:str]
+            - key: ENC[AES256_GCM,data:2l4bXqCigZWkqfm6zvba/aOwC6zXYd0lufMUrrHA3YZm1/0IXw==,iv:70oryMEsl0nnZz1q4OHHHgjRswmyvLZI9Y6tk0elM5Q=,tag:2/EHDIcaDTSGWl3qRVW8oQ==,type:str]
               operator: Exists
               effect: NoSchedule
         affinity:
@@ -39,7 +39,7 @@ valkey:
                     - weight: 100
                       preference:
                         matchExpressions:
-                            - key: ENC[AES256_GCM,data:sVMARKa7p6m731vY2XqLTQgq5J0=,iv:zKofi+M+NiARpWDhCT1gP8nWg8IfnPgX/gSwy0mtvzw=,tag:saYzCUrICeHmQBblCLOGxg==,type:str]
+                            - key: ENC[AES256_GCM,data:dc00KQOBXn587h22VlooFY5ZjbE=,iv:kX5utMKu8uoUSeameD2R0iH+DU/3YXuwP8DaZs9mGYs=,tag:PM5xBnYaP84zMZ2SWTYV+A==,type:str]
                               operator: NotIn
                               values:
                                 - "true"
@@ -48,10 +48,10 @@ postgresql:
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:F3StYRw2tfW9Sg==,iv:q4cFSPNwbYywzVoqyICtD6BjbVys2vgIJBKBQqcCVpI=,tag:+bNefltDFPSmXSDxWk0MuQ==,type:str]
-                password: ENC[AES256_GCM,data:XZBcmfCL80rc8A==,iv:uuQQCC7Yoi/W29WkOBMLQBR7dGxSNVo0mLcvQ14WPPM=,tag:GgWmz1xNtMGWc8WxdH1GdA==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:3aHXAFDqpYsWeg==,iv:qbrm+izSr+PaAa4fHMVw3Yz0qMuisRMpDxVKdeFSvls=,tag:zVUVALdIUTMhxavsSxlUCw==,type:str]
+                password: ENC[AES256_GCM,data:LCfnttYbxS34WA==,iv:rqU044P/gUmqjhmu+A9B7A64ujnkIhMpKQlYpcmi8MY=,tag:XJws85qfKI+y0BV6S4L1Ig==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:JbRRD4A=,iv:N97mlSjqPKMlY7HKS7OPlSZ2lzAXrawu/XRwolt8CjY=,tag:WYpR5bSkOuaVZtPp9nfxDA==,type:str]
+                username: ENC[AES256_GCM,data:QDo83dk=,iv:RvuuDiiY1XLZbrjcJ/ANxb/wHrSdf1gaBSck+cMaWhY=,tag:UCEAkWZ2Dmr93oBATQdf8g==,type:str]
     volumePermissions:
         enabled: true
     primary:
@@ -63,11 +63,11 @@ postgresql:
                 cpu: 1000m
                 memory: 1Gi
         tolerations:
-            - key: ENC[AES256_GCM,data:9y7Rp0dAIqqY,iv:cEjVNUnuOEiLWAKHagGhLOfTdkMQUbLSAhSEMe3D1t8=,tag:GlORte/m/74L4h4oyta/wg==,type:str]
+            - key: ENC[AES256_GCM,data:NplaOmBekcB+,iv:qzQ+QasVZ2JMG87PgdVDJ/7XHDiDXTp+ogxB1w4tws4=,tag:aPyaqwdxVEjct7D3SuKFqw==,type:str]
               operator: Equal
-              value: ENC[AES256_GCM,data:1Llp+6Z3pw4=,iv:OdsjhjHAF/sRj3JHKbcFVJzWv4N6cQH9mQZsh03GdB8=,tag:9h6lt1CpIkVWxsS1Tw1dDA==,type:str]
+              value: ENC[AES256_GCM,data:vjsM3Li0p/8=,iv:Y+sjLHWpqwsOJV+vygG2f/3ZXQs2ZQRloPrlcOuzoeM=,tag:t+uR2/uM4NiIq6alJjio9g==,type:str]
               effect: NoSchedule
-            - key: ENC[AES256_GCM,data:WGEsa/uJmOx8jvz4QuQWr9IoQLKrs8ic9Mo5c4K8xZTSrP5vdg==,iv:0c0IK7ihVkUWe6S2bPIX8rHbZUvcNl1FKwd0RaZFlPU=,tag:EFRpAgOQnwtm8s0qu5IVdA==,type:str]
+            - key: ENC[AES256_GCM,data:LQvczGKAK2x1BbFr7S8jo0G7YUaX4DJvc+1Z2E+bCjys4PsBHg==,iv:m4Ses50zYxTF7jXTgbf9nY0kT1hrtgVEEQruLZFN8cU=,tag:UidEMRbb0IPb5V31FjWzYg==,type:str]
               operator: Exists
               effect: NoSchedule
         affinity:
@@ -76,7 +76,7 @@ postgresql:
                     - weight: 100
                       preference:
                         matchExpressions:
-                            - key: ENC[AES256_GCM,data:xD1XHWuo6myo8cV4hN4/G3mYWng=,iv:PT+xk8REvOlmmyNjMD59ot3Z1TBAHHXgKh6aYCJhn4U=,tag:kitAObeN3Xw7cwUOSnIj5A==,type:str]
+                            - key: ENC[AES256_GCM,data:D9N+Fd/g24bKikLdx4WE57WvqE4=,iv:+1oYCzAl6kBJliw0woWhhWT7aWcx4rXkGDn7Anho2Pg=,tag:R+cLK75QCIfWeGL8/eqeFA==,type:str]
                               operator: NotIn
                               values:
                                 - "true"
@@ -112,8 +112,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:+U+sp9wg3RoLkJTwSQMYtDaokMl/lP33Pw0cot4Wblqcbe0P51a54w==,iv:X3ggp3GYWV1KPp67i4qhRee0GS+9Gjwg5v5APQllT+A=,tag:kUUhFgQgor8TyRnu5klwAg==,type:str]
-          secret: ENC[AES256_GCM,data:0lvc197OX1Y6vn7/klG2yUAeFXsd8VjWmboOjUZFMbHYw+uetFzPuLWBQefjKBZZdtpdsYLqtIEctZ38uZikTpCKIZjYnitnYpKermcgr9vNpzugVrkW4kuo01saWrhDlbzHlk7t1dqMoVmMgzkDjArD/3RlH/mqRxHDSVP9RY8=,iv:7y9sdpuSQy01Hmk0kZ6pGoAM+3Vj1iC+PB9ZWjuls70=,tag:KxfDrDDfV5ULxbYepPqn9A==,type:str]
+          key: ENC[AES256_GCM,data:cYaRMEtrziMJWIRj3dg1fuMpp6F3t5ZDO/H2ONOQCg/fZ8s0ZsLb6Q==,iv:VskJ+5Rwpnys0nH531FYZIj253lJqDz1l6sgwKWhE1s=,tag:F3Wj1ruwSwlC5XbVKt1aCQ==,type:str]
+          secret: ENC[AES256_GCM,data:Cro9iaXKcv+uP4G6jEX0tPBW9cjxaZUmnLEVyE72j34aeAAmDFgPiTE/VWSbD3WWK8tuErl0RFHMvHiN63f4W5hq38W9VMP31JDCUYcUbkFBmQg2hrt6ePajZZICR1gHB3D7t5av4pl13O490VByGWfr8OxAK8Z/cGojp/Pt4mo=,iv:nRvFSVRSKFvpNjGmJq6uh/JV3acLsipV0nUHAlt+t80=,tag:BZ7eJiSVCM8J+MY+I5Z48g==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -151,11 +151,11 @@ resources:
 replicaCount: 1
 # Failover tolerations + affinity — allow scheduling on p330 during r740 outage
 tolerations:
-    - key: ENC[AES256_GCM,data:D69ZlIyO46sb,iv:q5OSkzj4ZwQTdMWhZX0N+EJ4QEBaxVRO+J5/m7yt3cE=,tag:GhxKaHiqliw9pedhefEM5A==,type:str]
+    - key: ENC[AES256_GCM,data:1O2rrNCMxkGV,iv:dLwAP4NFVRZ0IUNzARm7hPq+ruIshtpXfUVtuuRP3/o=,tag:EmKs8LItQFLoPov8MMjfgw==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:gxtr284O2oU=,iv:wu1SU1I4IfbyyZXDM38CxJDDg78tGNxnz+TyIQWfUVo=,tag:GjJn1DZb0ffXeatTs0/tLQ==,type:str]
+      value: ENC[AES256_GCM,data:l0WXlDcRWaY=,iv:F3AxSbB9t/q3L6yOI4NcHlNzZrDwJqiJ/jjfLrQlNAE=,tag:6s/WqyWjNLHHmExGmgl65g==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:qqmHg21c6p3+xv5TpwhFfAU7d9won10uFZssLur8NEyKTOgHxQ==,iv:TMB+zh/2wNqirXdt3PB6HjTw96iCdWml4oUz8p36zLE=,tag:GpBXiN7efwdQYL+x21j4TQ==,type:str]
+    - key: ENC[AES256_GCM,data:RtKkkyNv0zO/IezcKaBBp5Ir9mCBacgVqjFIGyq13U68sU4z5g==,iv:sFr2v6kFKOm2ID73GpxACTvQttvt7fYwg437N7D2Scg=,tag:aPCpFti/jY/0a1FEWF/g4w==,type:str]
       operator: Exists
       effect: NoSchedule
 affinity:
@@ -164,34 +164,35 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:UIhojeyYAP4BU0b2/kcL7cJeH1w=,iv:58g0oa3Hljy8Pay1lAD3gMfKRv0cwnWqZ5Mjt1N2BPY=,tag:Eclfpi9f1qn8W/+veeoVwg==,type:str]
+                    - key: ENC[AES256_GCM,data:jW8/VevqdIAXrBAMj58udice6HM=,iv:+6nTdgB2io+H6S/jyO4Fc/+VfoyGIY+dqphi6ZNIn3c=,tag:JKJveLWX8pjMN3cnO94UwQ==,type:str]
                       operator: NotIn
                       values:
                         - "true"
 # (postgresql and valkey tolerations are set in their respective blocks above)
 sops:
-    lastmodified: "2026-08-12T22:43:19Z"
-    mac: ENC[AES256_GCM,data:ENuTFAfom5iFNpYNMwBGNmPAbWaQunLQ6IBQMbpGm/uo6Gef6ahJsn8J7nVF/IxaTsdJHl/Lq/Ql7fzj1JRystKqtibJtmHXC9b/wWMGT8xtuLdzLav58tAyxuBcitAIX2t96fyf+x/DkWbiTj1xkTYtKKrviLpxncJIVT0BXN8=,iv:+84jAHZHy4hMg2LCMk9MkH8PIrvteB4eqScUHVtmfF0=,tag:9wtBD36Y6SqrnKmIKPvzZg==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:hb8HlzvsAU+6A2C4MARpF2j+Mv55mQ25SOjJIo6inV822IskVV+0Ml9I6WS8RK6ZNZAdnVcDtQ07JlGx9QRiIwxAE0xxwuhukhSBBjeHGAc39RPhLXhDvwUF5ZeouGixkVrA5lhAvHiu9ILv241G1st0J9qK/ZaIsTazQN4X3iY=,iv:1ehf3avfeV4Ro8rw0rsFQ0qnFXrvF66tUKqqCY+NXSc=,tag:5kXUpLrLGPbwNSBC+aVIwA==,type:str]
     pgp:
-        - created_at: "2026-08-12T22:43:19Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//VE97o+IKlovKEABfrA+z9qDySKAzb2eFvBe+vFgrCdyb
-            MIQaGvWYzYqeBT9V4AIDK32+emf36zDfhTyVT5k5bxVnft4ceXQ6biXdvt7+FVmt
-            k2/2UCD8PvqvxD1fsRsTJSvX73yXi1MsEyGK2HPKoyXky1xxzCsv9isvPvF2nlBG
-            HHqpuF2NzPVFs2gu+sZhGOSagYcxz0VZw0nyZ7n3twQnGLXVl5p/79ffqoJz9CGG
-            6kTcmxQo0v0BYRdtC/6LKuZlkYysVVg43eNluAodIPrPqbvwL51L3Nfwdjo4pNwE
-            P/B8lR6KbRS4DnI0cc9lLv1WPtDhB7WvoTbqcJWfhcK+HzzU8toh00zcYTmhhaf/
-            uckqr+bkDInbH6Fwdtng7HS8d0vfY8WGzPfnUiH0ulE6+iHeHSOC5kID/Gc57Hc3
-            4wO+wciZqPAkXChYCpUVtcjZCMNGPoJhb92Vf+8B7Zp8VatIMDY3jUCaKayjQEZL
-            25LuBLOxtqAiLhmMlFourNmIV2YiDv+6K1d6D1RRfiQhsnpnfJWygjcwy433bwph
-            1Cvx/a6k3C0wMrhociwzYP/gNWLLCxqWBvvNgFf7sWiR23swg4lO/qEjcz+HxD8d
-            U1DeF6nD2dQ629qstg1KJ5zoRKqS/JegXmbMGV6rjPkzhTqodVgaUpnmgvlstXzS
-            XgF5a+gUhNHDwL8ymKTsRejffJO/GV42vOZ66B7X3dkcXO37PuoJRCbNKbBnZAgs
-            O2wWOahTsF1bO7xZTzg0BZx68Ty/HE0ya305/C7gyKUsuOZesrOadpGF8E68xZA=
-            =/gIl
+            hQIMA7uy4qQr71wiAQ/9FF5SJAVg0dLi/+xQreE2yrxMH4GTfdBMHd3GWEVLYger
+            6XwXQ7+Qx3mxf+VprmNGOW7NdKSsC5Re/JHJAjs7p+eWohtieOgKtg7DWEcrTwZA
+            56Rnhtnh0vv2jqmv/pm/Cj49GCLTjQFY+w5azU7g/7eQZpdPezIdrs1ueiSm6LaU
+            T9bMdUzm1pb7/JKQMvzYyPcuw0AfKLlg+x7HHRNI3O434yKuTLC5emVxJEmwQvV4
+            FD6oUAt4gKLqUHvAUuCVo8O5G36MGHO/roHxlWaLbHqjaDPyWh2TGdX0ICKKq1yc
+            fJzw9dYgcwIMXpXilbnsL4gQpv6bKj6VniyCoye6ieMZ2HIoZghd+wL0NoPkS7Nj
+            D+vTcPR8HOEWoZkZ4B01+bFyTmJ5NA8Z0V3peHkuTy+HCTgwxA0Y8PCrHl3YHsCQ
+            C3nANhh+cMqtcJdvqdGrM09X8n3edNc4lf+qg2tk0NbcdVSqcFl9y/MeJOWhOOg3
+            T/bwBrI5O7aRO6gqaCebKuGIrD1PDNURW3LLiKBSU4OTYbMWWXGpdEMCkoSQS56B
+            6Uo9N8KcWhBChCMJG8hbzYRVwYgWGsHsQbfbujkcIiSaoHGy8fklflxBjtLiitLO
+            voawf0zSqyBKbf1YFAmYnrdR0jiasKC5iqtK7c8uc/HyCSvxjK0ygPloWFI8aSPS
+            XgFJiWHT/5gOG64XmDm0VoKdflpojJeTGIC5JU8RAlJgD/oq+uWt23ayJxkjbkMd
+            H7UsqcuzWfbp44MYtmEWbxvI/+Iaui5/7hW7kEzWI60Mh4tVZGIJ64A3WNRL/Xw=
+            =U5nI
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/dev/harbor/values.yaml

@@ -6,32 +6,32 @@ expose:
             core: harbor.lan
 core:
     extraEnvVars:
-        - name: ENC[AES256_GCM,data:Y1D+lAT57F4HpiwnKJuhN3cqr/17,iv:ZARBNcGuiD5U7TnlBuQJLaWCMkQIELpj195aeKaBGZU=,tag:exBNWO/o2CXyNMLr2Y6bTw==,type:str]
-          value: ENC[AES256_GCM,data:EDMjB9DVCG3FiXdWrQmE4LhXTtTPLebKkBaQZ05tooakENXWQ2jm4YNRgBKWibHSM2gAL/z9POEi5BkiD0zK+NQV8DJKFLa8sxg9HR2OfeCqk3gMbq1uwurqrl6+OVX75E0Vqd9xN2CUtvfNVvPktMYn8UBU1nKuiRaHm3Tbt4QpcSQ6Oh1q2t7uqLDxt6DcAVb71gjpUXCZ96gg8/XsWlZXyzwJsfOEi33KlkBQhXYPFPEqq4wkXGqE1G+rT9MNOWc+WUdyY8FbP5zko+4F0Fcprj6iKlw8UB8PCtF7yAwFnxO7Bb0QGXxDGdKx93SbmGwxsYKe9muQZFfdp9rNW4R4L7K/O/ymiV+KEmwuwWoIBKZTHEwgOpD/B94MfEsPOlrmD438Ae3aifBQEOo3Ln6qu7I9md8tv2co4rmY4Wt3bBI8xXIPC1dzKI2YyQ540QtN5L22UZpabLLez0wNiVuDtCG2vg0ncI0flouQ1KjQp8DJ0Wz5i2WABwNg5X4sLU66nquD5hlf2YoNPw8EuY+E5lM0T0xBiv9AJHtQK5rN4AUopQWsi1FTSdFtCOlykBxnoYsLDyEa/73LA8e7m5Hi82IUl/5xR6LOEblEm+6jgcxY5UGaB7hsgh4K2qizmC+TWg0ua8YD4SIJZxqsNk4yz1l9DQAhZBnt/j2/I8K8PObD/7+6ObOfLM8A9UiwyIGUeQ/SCaN5DNMAHwFyELuXgTzdbdTgguJcJDgypCLUgvuVfx8dAOoj6cvHm7c=,iv:PEenzkk4lUyFBPx6e8Ah9LW7M5N7o93aueSE+pQozuU=,tag:rUeeXqEtHUQ3RYn1Pt4rBA==,type:str]
+        - name: ENC[AES256_GCM,data:lr90LLYoAKXh8PqT0QEmELOWBxKm,iv:y9mIMG3ND6l4rBnhW6f5FoU5BX5m4vi4WW87bv1XOB8=,tag:gtoyqreaGqG50Of69Pfqlg==,type:str]
+          value: ENC[AES256_GCM,data:qSCBq39+RSf1KGLyZ9TUKgVXtrXhvOhtR791n1hWKSUWho3YxM2LfTRJwcmAcLyIu8numioNlKEWQKDvOEefURzFy05RXkUYWa+ZebRp9c2y0d5ZrSiRDHM2cuxHRjeg/g4QKoX6IVhIcAEIqfHIs1NGxoqeaopAZcB6lGqspZZhzduUYJUWZGULylYdTpyF41F3RKv3xMnNBAQX2FCP3wOeb0DM8s4JMcgJ2eZwRDYecjotTC0pWL7LAZiZaLJR97O8/4cjofc9cGKEcyy0Yf05kSMxeZDWqrEplXNu2y30szafzC0SqkRwDPlifRUanNU2FaT/TIz4Ixklws7iaY0Db9yW+a+SvaWpNTY3pecbo01+4RG0eIDW4sRJFBp3/70vZ2FjCDDzaw6OEJYxrDf1fJ/UGGur2/rzDwLMhQgiRzIKoqq4n87hg1zwZ9ki63tKc+2Mp9oZ8GlvaCuNLMoG8QjXrxCkz/rcEL5Gkb11XwVAnsFdCCZVNfLstqQKpdnO8d4vvLHyRlw7lkf3ggX/b2l7Va/EkpHYONrwIdigd9ambMlHDRRhox3onZsgVaNqDdf5E8oeZJABqKV/1BT7oQn5Jx06kQhN7KvI07y21bQM2Gtvbv8LyhJHPdU3gZwtKEglp9+bU1UvFbQv9lEFm+1crQKBcgySCD8iLS+D2Tp4Y45qWjwD9Nsa2U9eGiHA1o3JZ5s3ltc2ZZVUvTpswRAfok66YqmL+XdbUkk6OtkSLS8FZVARHYbZ4bU=,iv:uxPwCWlMTEgtfGB93ywnMZLEBdNan+K7Bm0xuprYsPk=,tag:oLVwtUcrbERt9GExKo3tLg==,type:str]
 sops:
-    lastmodified: "2025-08-27T10:07:49Z"
-    mac: ENC[AES256_GCM,data:tp6aHDIfLuBDRBYPmNDn1ZWEq0ZT/WH7GYCJNp52tO1tNldi+kK2avluY0QBbC6/5V8LfxpokN3Je6uBveRVzleituxlK7dvsZ4piITTmR0T79PtUqxa4Jh+7PYp0uTofjme1M2L2MU1sOWrCdRdiKWEpDVIJCCCsZ2oDCCoMTs=,iv:O65a/alrwX4cNJH1tYh4kQPaprmulyAitg9jFhOJqnE=,tag:ewAqx7h1e12bMYGrFC9PTQ==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:UVtitK0Ct6M7scvv1qsP+QeQL7S89+856IozBcQgnLZJzeZ5cquzKvrYZ+q7DeL1rk6EWvsxxFAFnSUDLfqCItEAMs4QQhORqplv6ot6BeW0LYUf5i1646Kl7x7Mg0RkJJ4OLsfqCwNPDT0opBQBhbYwTl3HCta8McCjSg96xNs=,iv:ebt36qndBjaThOJfAVJ7ACN06NrRSJnFlFmXIH2l4gM=,tag:TArRCiiM0xdMvOcZDqBrCQ==,type:str]
     pgp:
-        - created_at: "2025-08-27T10:07:49Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//VDjjaWIsqY0nUFINvzxnt+dullI/+lHYQTfWvZ7LqH4d
-            TN2p2VZRGRkupYUYxt4iucYl6qViGey4iaQopsYrV19kJ+eEJuI+depXYsKBAccs
-            24rNJuTLHYi7r353u48qUVoQcE6uK0mYB8/4+w5J6uANvwmjXUtDMEHUoiBCh56+
-            F7olPPSPUjXv7BpTNq5EC8YjGRjUjQNf1NOyHHz1eTsyDbPszIs6eT1q98AMo3GZ
-            boh7T6Z2yLI7Bj5guEn5OfwyFtB9DzcpaHajDgF309CsUsxfvhoVH85rx58vce3h
-            QW2zy7KPvNEr84ZsTBQwLqi318JiSD1egx4m+CPvbFvV1s7DFDgQQifLRzlqR9/d
-            PZc3DAZ81QzXhZV9Wh4nxG26SQtsbVxAjdfLrpvpDLV3l0wIU8bzP/UsskjGa8zR
-            VBriJ6qGeeDeXVVuxcLMlAhd8R8ipEvLrId3TzvAPRClk4+fU7wzTfqR8Cl9hu29
-            csLtPW4Fu6iZshf3UJJ8KEhjYo6060TlfEZX9hzypJFf+kwJopSrS7KCPFheNBkN
-            P2cuyBgpG8OANQ0vYx68mgkDqqWVWNXAjUHxcp98IjZxwcSfMR+HwZi6xbK97GKS
-            ltqUSxYixLQUelHJX9YHkheXDwfH+q+CaG76IznvMrFi+bB4laU+DmmVnfPZT1LU
-            aAEJAhDJ8KQkP2yRHCV2qycNpY0qBHN6pk6FXQq7O7dl3Z1oQXkS88KopCwan36k
-            Hf4vvXRGLR4fm0uFYhN9aApnDFQuWm4NjEGiNyg6p6WN0XMBNARWfmTyDNc8xceA
-            Q5I2AHdBk7Nu
-            =+11i
+            hQIMA7uy4qQr71wiAQ/+JkaqlVRJtypgMHl1jg9Dv1XqgeEW/5tv52YgxvNYk5kS
+            MJBeuku6/tVGb7i3eArj19My4hQLTXPWv/SK2cBiq3dKnjEs77Nfc1ffRJF/J03W
+            Ur/zy3o9lhVaWOTYVPTH1QIOehJS749ApadN7zB30g4RiOwJfTWiivEx67TzalDv
+            nvRMaotbAWxyD0PNpWV27i93FK8SIUy9HufpZucoN0BQ0moAj9BhbneumB+dUwRe
+            gh+C6LzbRuehFvegIh8DlWIKeMH1L0xW100cwuXyf6FOK/FM/pSsWX1IdlXD5Hfv
+            OSt4QHJESepTmEukfEgyywBMxk1iKdhW9/xa5lkEGxfGv6LnomzFWuKKOqiOF8GG
+            ZTt3NIj3Hr0S0USehbyQwQNOB/EvWTSWcoeaEVUmdphil8rZySZ6B2kkHWaj60YQ
+            cxb+vv9wgrjJitAhwds/xI5HYk0VSXdwtxZPTB4wqzNak5jHFKEY6/s0meQHk3Y4
+            UF9JIZsxLgPGGpAxzYka+Rlibv1FlPpyWQJZet6NGD/VbinhosIVv9vSZA3PqbyB
+            1x31PxGbKac/b7yeo2AfncpKPm0A33VENv1btRbbBGc2LRkYyLnlTDGmHbBrFE0s
+            HNnh4Gfc5EU6+GQo9UO7WIex5AQLvje91js895StVeh52ziyCBdjUwy6hhlSERPS
+            XAHgjHq0JXu8+cZrgjWyPlLcDYbMelW8RWsiGvvyZqUJn5YfVLBkMpSYVRanC0ib
+            3jBdLOaHKZvi9na0Tuf6QcWHep8J4hj1u80yUmIIzk0Xyv5WFYcypJ+g7KqC
+            =MmP5
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/dev/renovate/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: renovate
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  - token-secret.yaml
+secretGenerator:
+  - name: renovate-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/dev/renovate/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/dev/renovate/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: renovate

kubernetes/dev/renovate/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: renovate
+        namespace: renovate
+      chart: renovate
+      version: "46.260.4"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: renovate-values

kubernetes/dev/renovate/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1h
+  url: https://docs.renovatebot.com/helm-charts

kubernetes/dev/renovate/token-secret.yaml

@@ -0,0 +1,43 @@
+# GitHub Personal Access Token used by the Renovate CronJob.
+# The chart injects this Secret's keys as container env vars (envFrom), and
+# Renovate picks up RENOVATE_TOKEN automatically.
+#
+# Required scopes (fine-grained PAT, restricted to vhaudiquet/homeprod):
+#   - Contents: Read & write   (push update branches)
+#   - Pull requests: Read & write
+#   - Workflows: Read & write  (repo has .github/, lets Renovate manage
+#                               action-related files if configured later)
+apiVersion: v1
+kind: Secret
+metadata:
+    name: renovate-token
+    namespace: renovate
+type: Opaque
+stringData:
+    RENOVATE_TOKEN: ENC[AES256_GCM,data:XgCD6ppqguo6MMv0OScXUkqhn07Mo31F8o4yf9Hd51wHjpmh/DHBSREqBzYpETrB4vDjec9AVyylOTz5qEITFdme+K8qg4L6Ti/JPIm5WOPNsXD84k3ZFIr6PWvQ,iv:ovQhFt2XlyHYzadYlQnQQ/X/NFV+9CeacZ40B1WYjqw=,tag:NTWOBN0ceJ7evKGq+y+cFg==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:1EsEQ1JmB0pTgoA062k48hKAa4IUNKm55E/9bbmHPRcI5CUC7IBC2npT2yn0+6eQ7gTSqdrbqZw+xu0LAF5IrEjIIscKE7yZizkFAIy5VuCdZdAOBlvLtc1GXg7PE6ACXn8wHDcWBcAoq12HEAtpdXS1dNhdZBFxkB27RD7UvYw=,iv:hPeTFZlrqXyVNuy3D00VeLqecKDEKKGe/AhuFwSxPYs=,tag:O6+OYfJU3QeL58f5/tUQkg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAvkrhQ3QLbfF4xTCjmLnY4BzudBMrx4j1+zjG7S8MZ/oL
+            Vx4ji8gAxRIvv6DZ/eSwybeTijtY4ROUQRAm+2Ut5r2yKVGZiokTUE3js/SgQ4Nx
+            uSMcEdn5GOilgM/c30GXsWzCo3yiGWWCNISwxOLvdRC2FEw0OYxTRSEvtBnck22q
+            FExVE6fvH/ks7nak3ry9Bo4OEVZZrLmr8MR/RL/l6Z8AyOLCp7yss+a0OvTb+NRq
+            PVQXmoLlRYqEdbkW8lbyt32oJ451ukMH3l6yscC0ZxHIC6XvKUwUa9uhcUPLZq97
+            o73fmYqCSKmfLc8CMTDX97d9yuApOepZZtVaJGxLhxd/pNIZNwbojoo6pCKh8bdY
+            2CdSf/FA+EqjG1B6CtzHCE35FgiYuDxFsOM7WbPROvT8n7QYVnZGI/QoFawWAFsw
+            heFi9sDGBcqM+bZDo7NTV0Nd25Q/+GfCHpK1BAug4n3K61OuJhJfHw1kadbH81y0
+            vWN9AAQTYfu5FjqMjSbyASbTYNX28a776ojYrR6HGgD2A5PyC1vBAR+VZwSernfm
+            N+wJ8YAK/2hPKVReEhYFcJiSm/MuNW9QD49/gbj7Y/NFs5NEJlV33cAEo6hyduR+
+            Z+Aw2M9xOsz+qFop86oRGSXNCZh/TG/G5/7rjS2zNG0vQAsgQ+xVXmDJPsmZnPnS
+            XgFuPLMkIN+DFl3PaX9LwkqgROXA3KGG4jZsZ4qzQ0+fZOCAvoU7FNXKnyQ/i2qv
+            NPSRW2WLDAAbqwjj3jNxdd3JFRbDq6XQ+V175fYN8sTFuOYLq59d8YD7Z8e9+aU=
+            =xVRA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/dev/renovate/values.yaml

@@ -0,0 +1,70 @@
+# Official Renovate chart (https://github.com/renovatebot/helm-charts).
+# Runs Renovate as a CronJob against github.com/vhaudiquet/homeprod.
+#
+# The GitHub token is NOT stored here: it lives in token-secret.yaml and is
+# injected as env (top-level existingSecret -> envFrom), picked up by Renovate
+# as RENOVATE_TOKEN.
+cronjob:
+    # Aligns with the "every weekend" schedule in the repo's renovate.json:
+    # one run every Saturday morning is enough to open the weekly PRs.
+    schedule: 0 6 * * 6
+    timeZone: Europe/Paris
+    concurrencyPolicy: Forbid
+    successfulJobsHistoryLimit: 1
+    failedJobsHistoryLimit: 2
+# Top-level chart key: wires the `renovate-token` Secret's keys as container
+# env vars via envFrom.
+existingSecret: ENC[AES256_GCM,data:tt9OJ41wHayCWgQYd+Y=,iv:jBqe+K1hL36ViFntV4cU3qh9jdnG6W8e4LiE99rIFIA=,tag:Kj8/qKd689iIatQgUc+9iA==,type:str]
+renovate:
+    # Self-hosted config (https://docs.renovatebot.com/self-hosted-configuration).
+    # Repo-level update policy lives in renovate.json at the repo root; this only
+    # tells the bot WHERE to run and WHO to authenticate as.
+    config: |
+        {
+          "platform": "github",
+          "repositories": ["vhaudiquet/homeprod"],
+          "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
+          "onboarding": false,
+          "persistRepoData": true
+        }
+    persistence:
+        cache:
+            # Persist the repo cache + SQLite between runs: much faster clones and
+            # fewer GitHub API calls on a weekly schedule.
+            enabled: true
+            storageClass: longhorn
+            storageSize: 1Gi
+resources:
+    requests:
+        cpu: 50m
+        memory: 256Mi
+    limits:
+        cpu: "1"
+        memory: 1Gi
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:fA2nukiGOWK5UVQRbBagOLdqSBjYYG2VysxXfQ3TuRtFYhN8bd16j5xIfy2aDrlLEVw19uhInggQMu2vJg7xT6V6Z9w5YsHwcSQWSGCMjTk764/ChT3QGA0nhVG2ktgsZgaiU/MrCAPN/XQP3dG6Y25vkcptFcXnn7Ig5D+V2eQ=,iv:3fKfVaDJ7RjjAI0n4I+6na9pKLB07yGgjvRXjh7I3Iw=,tag:cyclZ/i2rfKeAof15J4ufA==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAi9efDDL8A1RFxx50RBFjLi3G2OG8XQfo/UF3O7gd65vH
+            tu+3b9KtiRvWurOVqapAxUwapiiwx4Gsem5F1Q9FoX+5HfQ3APQ91kxfGjQTjx00
+            2lt+pl4JyeKj0+ilGMP5xaUyOvZGNB33v4ls14Uljzg3tqQQPGUvYMJ6f5svXXOo
+            ugagStCSx9jh0j++Y9gCFZXYSn3C1IblGeUxkh7fUJQjveqp8R5Ofntdg7sbV5Au
+            Xeah95zdQxdJ/zb6GW7t0dWY5KEYi4Tg1gNybvMIKDdWZ8NND7kaFOSx5Bg8aGJa
+            +6nh21MHs7oNmzpxLXNa9rTk1ncE2HcLcTIXl+NHf10dPcR6R32w8Bc5e1UtBKI9
+            mUeHgH2zphG4Xihcchbeeb6RAxBvl2EWLglxB/HKKw8ouC3EmlOj63QS7o8ES8CZ
+            z+/uq4uOP65Q9k0xa9YHl4nGVXlOYqxFkiB71UYIqwUxyw/Th0IEZhBrd2GFf2wl
+            CUj9DDDejWBvGyIwp1MIRLhQkMrL4KczHLAdMEC/OcvylZHxESOpMEIq+CUXi0wr
+            GyjnwLS3F1ZPB0+Xbpy8OfTKAT1jI6Z65G6138p6c8xJsh+lBwBd4QFTJ0VfR+fd
+            /edCwMKalySDK0Li9OIphj1or90l/ZURdlZpIrgnYrYeBg7HibuN2E0u0cMur/DS
+            XgExhwYtGznQThvIySwqAa2YMLm5tz5PJ1mUGkJ2AUaJuQX9SfhFYJSCGjpv8Fbf
+            04FCKZ7B8eG9j9ae0Wfn07SeN9xSZEMuCtE0KLjAR0v5ACAF5Lb6Ee5tc+5K2sk=
+            =zZdk
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/home/home-assistant/values.yaml

@@ -16,11 +16,11 @@ configurations:
         - 127.0.0.0/8
 # Failover tolerations + affinity — allow scheduling on p330 during r740 outage
 tolerations:
-    - key: ENC[AES256_GCM,data:SMOTaAtzpNtv,iv:rsMiAMaugnRKQjtp67nU0pW+MWXgolluiE5qoIWJkRA=,tag:RLUTotQG3XUQfDiA7CE7vA==,type:str]
+    - key: ENC[AES256_GCM,data:5+QTI95qM5mc,iv:FS4FVgDoOOpaDSArV8o/RkpkpJxx+VHJhuExKZn1Vgo=,tag:f/7b4p2Yzc2fQpZrJNB0EA==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:DhbXHMsUJ7E=,iv:lQQTpWpDGi7JEQV24jdICHMnC8yV0EsNQ/nauBsqk/8=,tag:RKripNRdBwqnt1sCY72eYA==,type:str]
+      value: ENC[AES256_GCM,data:p9l+vJ81qoA=,iv:x44SAzdRxMGCGdnS1EQxU5rG/7BQ0gWJAqZHohii8W4=,tag:wzVAvTzbcJFD0Rl+8uS4Sw==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:YApCSh00O5YoRqzHUNSoPbYWOsNVwFKOlln0C2+mYpDfKqLU5g==,iv:eOv/Yri400RHpm6Bnxqw4IYp2IiYAKXTd06sduW3Ku0=,tag:9GR1Q8lWHG7Uplevd1hbYg==,type:str]
+    - key: ENC[AES256_GCM,data:2RIXb5x6dsNEV241NTXFGYL030lRupkjWcPUHsueK4a6bn8DBg==,iv:2RVpm3L1RXXc6nN3L4UqkBxuNe/pfeNBzprwLDp6ank=,tag:jgyvyNdcurQVuih3YvaBiQ==,type:str]
       operator: Exists
       effect: NoSchedule
 affinity:
@@ -29,33 +29,34 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:0rESi0B+l5uEwmPQPuFzMylc6JE=,iv:dGx39YEojvQ/J2y6SlP54I5L7Zr+yecwJwNQQ53RV9k=,tag:icAw2r/q4+UcHzYClfOBSg==,type:str]
+                    - key: ENC[AES256_GCM,data:I6Z6SR2x8z6grjUUv3PBHLDc58E=,iv:smfPq81TGWdkPyao+pJCoZidgUFhPTdFdXBRMPeJ+p0=,tag:035Zf3xHRZL0wmbt9e7pUw==,type:str]
                       operator: NotIn
                       values:
                         - "true"
 sops:
-    lastmodified: "2026-07-25T12:44:32Z"
-    mac: ENC[AES256_GCM,data:cNqULRYPz0Es3az9v9HWlEf1pvPFWfZ67OofRWaDgFx3KVKVj6VUY6HQgN589xbbCoBKLSKXUoag2zOku1P3yBkb39WrdUtfSJw2t7BvZIo0l9VG0bRAYZgJYgnQA1NrjxixzgZZ7AHst1ljB+ZC6qq5DgEJcuCiue9zkfySTMY=,iv:rNDmiWS1U01xgRHty/sp/RJ5iz78sOdBGP0mdjUX7TA=,tag:BVKsb/HQchTaLo+2Tlrn+A==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:qQWuHn260xF3a0+H06TZD5fdVkj7/yff2W+klPjFFPTq9x+roBXQsHaulnSVO966djEvprPJQHIHUN5pgx2Re1rgyQ6MSI8J8H+iO010Gw+k7w6Ya/gMN157qxusY9gwyKG56eciE/4FTocfAsjxcOkTuk+nX+N/MkSjbv1mAIM=,iv:ddhMEsQIHNqWJB2gMOMd6N5WZneeeFNOAnFoPfVUE/s=,tag:QziO35kTfqj7JOFPqC431A==,type:str]
     pgp:
-        - created_at: "2026-07-25T12:44:32Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAgxstgt71NySIfZBgF0Nb78qkkFV7xOEfv+VWO3EaSp7Q
-            8jhARPxkAVMwl1MQIdCxB6UuUeQi8fOrLwjYzTN1tWG/VV1P3KV3klm6jNcZ4Zxv
-            OdYt6kRLNfI4J7KWFhZg8A7/FfXSOtZEWLjD60hb4ie02ALEC9o2rUcdxWH2ZdHU
-            69GhP3VU9uiChOxEk6eLyQr22IF9IfQ7BVUckVzU13neZ2PEYXCV3QaHMBrvutMz
-            IFUGpi+drrXxXq9KmJQ4Yr4L0+mHwXYrFVi5rHK/ibgRDNT7T9nK56WCsgRd0MiK
-            7+1vK/q73p5ZdozmalYB2lKuehRapf/xdXbn1SrWGXbsHubdrE2AQgRxBHVy3k8I
-            spN2ZTPzl29mUsVIWKE/CdF1GsUGYrKwKL7S6aHZBtRXncbKBEFLbrloAjs+j83+
-            aU5ybyQWnZxh7f4+nQyDerSJXZJ17eEJRjqMDhJ6VmA8iOBWxgudM57d4Umt53cf
-            s4vOikRSO0cd+/OMvQQBW1IPMkwRSi4/jD8BZTXisWVUQ3/98NQPXQE5EYk2w7aM
-            5T1orWWWMz5EdQNptqz5GL6qPoH4UpVSGCNuCf/oyLR6MCt24JDR9KobOgXKUrfM
-            Qig6/+4WbvxBJ9zevi14FL+K00MeWd3pQT2Bsg8l3fWPIRe+p9lSB6yrsf6xHu/S
-            XgFWycRMj+U+y7B1kyXT5W6WshFHHTOlyAVgk9lnB+kKEVno4pAQBNuNlW4gwOvr
-            iuc9EaiuHat+CW+WdxLdH3i/jcNmvXfXRXdE3449aXv+haNBjxz93nRo1vbAFuw=
-            =O+AO
+            hQIMA7uy4qQr71wiARAAmUXgE37uXgmjh0BbCsX+hqX0yLGtzWm0LfAF72lhU74X
+            899VsY3OsCGAOndSH0T4vH27/ayoNE5wTZMahfxa02IdWZXMo3nD6F4k6nai6Dkn
+            7m52RRBqNM66NhF4TAaTKg/j60XJKw0aoVSlgkUq/JVvs4JSyZPpwCp2TVz4/TwD
+            Dn8jC6Wfs9YQKWa7FWKW8d4vz9SNOpPSsiT5hIF93XVs9GdcsCtCsPB4Cr71whZj
+            q0RYWi21dnFzf5qCEH/5Mmz235JudMYESwJ79yrIM9r1Cj3QPPc1oEy2qjbBpN78
+            ulobKXMdclkCpNNgqaNr86v6weT0HpjqR/lleUO1EMzyTOKaIZ1uGS5xPYHlqF4M
+            8u6Gj8S6kGCLDsAQlnUbt+cycg1NOPNPJq5E/htio+sdoUeEmO+Y3+y54ccqR622
+            eyIZhp4RJukNLnq1y+6LiIUmimTSRlApwLbBouY24D/JPaO1oWL+Q2dcvm2qpZ9w
+            /o2bdXyr0vNUnpq4Yc1uU8rBSeElOIRHcTZVdtsUZuJp72tXo7/oJqJmsnrAih4i
+            /7+rsOpRRQDQPIyEveBXcwEp/baSVsYdeINufmXiM57ie+B135+5tsYYucF3pXzc
+            elJLdKSif1Kt8w6Ch+O2M3NqsCp+yp6IihUOt9vyZ7pYLZvWLo/e5JUmvy9S5snS
+            XAFFVhnrgNL+dBuzZXa6vfglwvBNl9iEogYWtcX4/Sr7X30Dv2RfkcNYi55sq7ji
+            A9Y8/cyL7d0m/ksgpcFcmRQvPCOpM/KPKZ2KbLLdeuXOhP/WXG+2auhJtwzF
+            =BS4A
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/home/zigbee2mqtt/values.yaml

@@ -35,8 +35,8 @@ zigbee2mqtt:
     external_converters: []
     mqtt:
         server: mqtt://mqtt.lan:1883
-        user: ENC[AES256_GCM,data:8chGUA==,iv:SOAuBYShpWbza3idtyqFoVIFstZFM34OPDN4uhAer0Y=,tag:WPoH80VcUGLy5Uq/z8EtaQ==,type:str]
-        password: ENC[AES256_GCM,data:XVcTzQ3pDvPKbw==,iv:TK5qHq2yMTWgzcOPvj0GO7tOOD4PHvKMWfd3p4T8LuM=,tag:GJpKQWpVhwrewX4+9NITfQ==,type:str]
+        user: ENC[AES256_GCM,data:Sl/k+A==,iv:d1LIy5ny5jS5yEWtWfVntN4R8uQCoRwSiYkUb1JG/yo=,tag:dkNv+GqyD8geimnuJHgAFg==,type:str]
+        password: ENC[AES256_GCM,data:vwap+JwtgOpLAA==,iv:PC2f6Lg0EpmaJKd9M2yeQGejvXTNmhRPjAkFw1M4zwc=,tag:zp0sgA2uzLmOBNNH6yY95Q==,type:str]
         base_topic: z2m
     serial:
         port: tcp://10.1.1.159:6638
@@ -44,28 +44,29 @@ zigbee2mqtt:
         rtscts: false
         adapter: ember
 sops:
-    lastmodified: "2026-05-02T10:26:20Z"
-    mac: ENC[AES256_GCM,data:32zZ0bYrgn+zTz8DEOU1N8MgDrihzWyMsV9q2m5RhFHRvXFuq3Z2GTORlUTeuK5qZIUrZt22VskigGAQiKC2CdzsJTcO3cGPshu5E6gWGBRNob02bXXsMu3TfCKxic/Ek7jE2p9R++a5AKczFZY8SxL7Sv1BZDxozkginDdYR4Q=,iv:VcDKwoPgYxZc8KXYv9oEH2GBqDRAJJxphj6MFLLI8ok=,tag:vPWqcEHoBVvfCoKoN5UiLA==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:RUcA16mUHxIwToAQBR5UCbi/cEcDXms5r1cXYS7drYfvcPI1r84oX9/PHsXrRHcMsqIwyQbiK72CDLhQFXDW/YIugpy9OEFPAP88oqkfXrZFA5NfoU/9U0bfI5U8GmJEHx56DJtsqfSy1VMotC8sd0wj21YBcnmRhYIMoXLl/G8=,iv:tcjXHh0DvXheMlQIifVVY2TJryFmgZchbVfLKFpnLf8=,tag:KjpEK92QTFtzl6ml/Yw/VA==,type:str]
     pgp:
-        - created_at: "2026-05-02T10:26:20Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//fl1m3T6TnQvQ+yG0plOZaRXIGRI/YHiyP9KsK6I6l4c9
-            Y7lUjVcgADbjZYAMv08LFOEyN0/dtTFx2kV1vC5sF4CjxXKfddazKrQFjZQygc56
-            Yn3wiYX2ZMTsc3AnOoUF/evXyDHYMu0l8FwZEupi0cjmgKjVZZsLYScMjLi6h9oO
-            agDUxqZX8d3ikj3LPF1dk/XGP75fHBg7Jfim1RMMrOcpAbRi0H3XU82cr2s9fTS8
-            UtylTk1x3F253YTC0JdvU0UskvzCvVl0Sf8TlkVb2tTJgwf/XnXMTmMeCvbhIj5u
-            bgqIs0y6F0xm8NjhPGV2CtsQuQtLMLb5SxVFj7P4ad/Ekf9TizAJlcPt2u1/25zu
-            x9v/kFnI5XMDIr3eWBJlFUwtImQJ+bO3GTauqwpULIHSa+y3Ux2XMNarKfN1jH3Y
-            RG86rLQSioSA+HdZuZdEvo2ACc5DotC835cnMGMeIuO1Ad/RjvUaptN/p5hvTFMf
-            5t6SoE8gLXH7FZF7IomY0Xs/feztPOvPK76zpKV1Tqqgb7i0GaTFcKKBUxMPklZw
-            XwqOQl36HWz1BSvtYtYYX6/HyuknH4T6tk//J6MrNttnTQ/ZqjrBvl4FEVxTgf1h
-            pFc8fTzNak+VB4MSdALg6Eo5xR57eGHhKgdUMgDAv1JMEP9ikk4/p8/1WHKhpTvS
-            XAG3QSahHWoc9L5A73xFmD66TRUhm8CVKRCAQebB7rXjsxaqgEOl70taQpucrckD
-            624SYxJwG9Uuk4odCQJ6g7T2KCKxsS/NKy6jOqgprkerR6pCfuXg8LDxBkHP
-            =cZ3t
+            hQIMA7uy4qQr71wiARAAptsMCNyzKNo3EtUeF1rdkRPPPg3yfjd4UjZD6ZkIFExw
+            IhqPSUqQl9tdjqNQaY3Amyo5rwvk62Reep6Zqz3+ig2DulwQN1lyJj+CPdNNAZ7O
+            81n1E1NcIoQWjVkDoh5MN9UEZkCfsr+2zE7fTiR2Zt5WOQm/p6eGB/WxFytirN6N
+            cgOt7ZNDZi2UW4ffyqt9ayU1s5C8o9epQecfhtGWxchM1GeBz/vyT/FHJsh6Jq3I
+            K2a/wz5vQAq1GMMAybzB2xNnM882YuclyfTLOJaAAYBovY9bzEV5SXOxpyUq5gXk
+            hJVN1xtzjBJOHySY2Nk8blX4md49W0CTmQptsKsIBQZ2+RtZg6MK5R4UeCrO8u1X
+            UkBYS4tbfBQtijoUMAlqUpSdvYGWEHg72dX1u7LQRW5adKCB+JHtIXYHQ4f5DSjA
+            HBHwZmMjf4yEMOmbV/E8cvGCCDHX3pOPx3F2I5RYcp+mES5SvkX/6SQUMVmypeyf
+            wp2zcx1JMh44HDd63vIEntQ4FALNHB7INqSytZjiV2DBphUimPMAOKSz6GLQ8Ye8
+            NLTkZOFVmyCLNRj/Z8iy1m74LHL4a58arZ+D5OrXlhRlE6SyK95QzRs0xyvPS58A
+            PudcPKf0BrXCKWJfd87Kqurf7r64F22UYge7nyM2U/jhRLWtcBmG+tIy5U+U65vS
+            UQFbkLECKQZUbk9FJW9nR6dXbFuK0dhZFsR2c0lsEGSsl9N5exosNbuH/43jjzXo
+            LEn+CGVci15x7+2yBtA59ZMzohu78K8riLGbtlDUaeouSQ==
+            =Zbi6
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/authentik/values.yaml

@@ -1,14 +1,14 @@
 authentik:
-    secret_key: ENC[AES256_GCM,data:P5e7cSOa0Uw0NEmWuDzIv1QxIkbvLE9vjzULmS8yS8b62fS5jHuFWUF/8VkW+pXiJo51mZ9b3QWDBdD732hpSrR7hUpK19WdZvFfXMKsqVc=,iv:AuuvJtXdlQ2SzeiFdxv96cEVyeMTNW/fG8bPS4ItFtY=,tag:AJC/T+eXGwOdQ/U7rebIdQ==,type:str]
+    secret_key: ENC[AES256_GCM,data:QjhY+442U44K3EJuXqSb42eyWt2znf1KAG0DeQ7JQw2qGA4tMaZKVaBKP9jHkF0yR2G8gZpYIofxBJFfl82kYsqvrixcxgH11H+ctZxVI6Q=,iv:HjPjBzFkmBYahpKjSXA8qUS1a6c4/solENAB7noaIxE=,tag:qpW50kV2bVoduM92UNKVxA==,type:str]
     postgresql:
-        password: ENC[AES256_GCM,data:wmidNe0ODeH8FQ==,iv:zh38F/lIKdFBBIQufjLORtfusPWwDnsDIh61b6ltbQE=,tag:SSMCicRKoPBXwPLFoh+uoQ==,type:str]
+        password: ENC[AES256_GCM,data:Prv+e2pcLAyVyA==,iv:y36fhvpI2qm4nRnJzPXvLi1Sopn1g4YhdFVs+5fVeaI=,tag:z+HhXLN57qryvLdqtByO9g==,type:str]
     email:
         from: webbot@vhaudiquet.fr
         host: mail.vhaudiquet.fr
         port: 587
-        username: ENC[AES256_GCM,data:VV9x5UWZ2F/p/l4pOVdDB3ZeK98=,iv:H7YXijpo2oJEO96LJOERL4lyQtV7QJq86H33wDpKObU=,tag:q+KiivjpV3kXY0AYGKhzFQ==,type:str]
+        username: ENC[AES256_GCM,data:iZeZ2IgJH0iJWLYWCh22ogOuEzE=,iv:Un1P3ra/ziVZdPJFVnHBGs6zZwTA1elODRuKHaMEHYA=,tag:KdFfmfF553e9BeG4Ypt0tA==,type:str]
         use_tls: true
-        password: ENC[AES256_GCM,data:pco+hLWairs2UFNFTSY=,iv:OMrxrzKDo91UIMgEhPdN4dTpRxl5A1LKHYk5h4eFD/A=,tag:ecjAP9lv6FPxPppyurJ5cA==,type:str]
+        password: ENC[AES256_GCM,data:Vvs0ibOmTCo5f5P8JQ8=,iv:uiT2+qK+KxS0TQqw4Tda+CA2h9mlhcf62WjKH61LP4U=,tag:6tRDtEWmHpiSjZz1xchHxQ==,type:str]
 postgresql:
     enabled: true
     volumePermissions:
@@ -17,18 +17,18 @@ postgresql:
             repository: bitnamilegacy/os-shell
             tag: 12-debian-12-r51
     auth:
-        password: ENC[AES256_GCM,data:cRaZ23HWjZ41ig==,iv:HABmXhmHvMhjUJ989xJOFPWW+EnLTCot1is80vMTBUE=,tag:r+/iRkQIlXvALv/JQbGFRg==,type:str]
+        password: ENC[AES256_GCM,data:eQj7A0VNaObUag==,iv:19JuGpdcwc+aJRiINaIu8015gODcDZO4pMO/uc3n+Yk=,tag:WUJAw2X6NLLDmqlIydyuoA==,type:str]
     image:
         repository: bitnamilegacy/postgresql
         tag: 15.9.0
     primary:
         args: []
         tolerations:
-            - key: ENC[AES256_GCM,data:M14eAjMj2w2+,iv:5vIosyFtwVgqs07CT2UcL1KL2hqg+rvKS5PWRvWRlPQ=,tag:OJ4RwlLAhGDN4JGPX8gypw==,type:str]
+            - key: ENC[AES256_GCM,data:NZUuKYSOkot6,iv:wwDpZ18Q2OAj6Va5nWWKyrYK6/DqxjMKnvTRNMDkLCA=,tag:I8Na3EpJfAgCzUVSxFn8JQ==,type:str]
               operator: Equal
-              value: ENC[AES256_GCM,data:KKZ1Kd5yRa8=,iv:adSUcfmjnDAc9QZ14NDfFz4oATpcBhtn8iHTF2xXpcw=,tag:G//QEbSKXiGP7nD5oAfNSA==,type:str]
+              value: ENC[AES256_GCM,data:XJw93s+tOis=,iv:svIxr795xD/Hz3yaHc4aiZ14hExVgmEDGfCOJoAK7Do=,tag:jdb0UgIOyXVmegHq3TvOJA==,type:str]
               effect: NoSchedule
-            - key: ENC[AES256_GCM,data:KtJS0g+/3y6VZb9VNKv1IWMwIi8FBURPGT6W6qvBAV1CHW4UMg==,iv:1I8o3SNljujN4FqByFC9uHpImJhHjj4Us0QEpHpDHZ4=,tag:FIpRW9I4OSVFVx4ejmau5w==,type:str]
+            - key: ENC[AES256_GCM,data:kzg1pA8p8cBUgcKw6VfQuVPPmUmXR8uMAgxklAcJB/hVjGuxHQ==,iv:sFvOylmUNsfC9+XwwGPsFiua+/OMEDXlb/ICSQ6KNVk=,tag:ybJIKFMS3wtk/ESidcbEeA==,type:str]
               operator: Exists
               effect: NoSchedule
         affinity:
@@ -37,7 +37,7 @@ postgresql:
                     - weight: 100
                       preference:
                         matchExpressions:
-                            - key: ENC[AES256_GCM,data:IkWdKkS/XlGw0u7I+Q2wYhXL+CU=,iv:2k9d0Jo4Vw5gA4tGeIq1Dw0IiZKQykfV8YAt2lYk7GE=,tag:Xnz58VP61Ew/J8hvIClOVg==,type:str]
+                            - key: ENC[AES256_GCM,data:A7lJZoDqSfcwF+W3aweIxGmiVIE=,iv:ZFC9gAM0wVhGpFsfzHfBI3fUPNwGo2/stpZk9FTlu4k=,tag:8HzGLiqZ/Fp8AvGjDLeBVQ==,type:str]
                               operator: NotIn
                               values:
                                 - "true"
@@ -67,45 +67,46 @@ server:
 # and global.affinity.nodeAffinity (preset system with type + matchExpressions).
 global:
     tolerations:
-        - key: ENC[AES256_GCM,data:yy3LVikckQ4y,iv:PlWRKZVoR6g/RtQdGBoIKbnwjX887xZY7ZhciTa0nps=,tag:yRMuJW3yjBV2C3LDWVdEHg==,type:str]
+        - key: ENC[AES256_GCM,data:FR3QHEd6FFk9,iv:fmWDfiL122FdaZT9SpwqCCiJDXtFRLR31+SjbI7+HbI=,tag:++WE+3RwdDbXTyV2xu2UIA==,type:str]
           operator: Equal
-          value: ENC[AES256_GCM,data:IqKHhgroaK0=,iv:bvg7kLaVQEsH31xHH1rCW29dWlWDlDsAMAmR1cX2nS4=,tag:B77eeEjVnRwk/feuPyi2Kw==,type:str]
+          value: ENC[AES256_GCM,data:/BSFTcoWqMk=,iv:gNvCYESHtDwF/2ZeUwFj2h3LjpHbCaO97YK/HvYl9t0=,tag:HAZPhDedb5E0D5SlHEoZwg==,type:str]
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:QYGmJBgxhqC2L3UvGYyJKKWDfzSFq91w1ifwNn9rofPnBqL0Ug==,iv:+tI3xw51LqinZnEOi7Lgao9liOD8KT8rOGNtn10qkFg=,tag:fJhk0PifHEyFlX4j75Sklg==,type:str]
+        - key: ENC[AES256_GCM,data:/Qrec35ekNu97Vt5uezNfI+siytofle4uTm/YXt5KihmcTerPQ==,iv:/+hLpM20CFSVjG4KEpjv7vvem4XlAYt5RM2mAykaG1g=,tag:GfXvuHlBsWGAlpvSjaHMWQ==,type:str]
           operator: Exists
           effect: NoSchedule
     affinity:
         nodeAffinity:
             type: soft
             matchExpressions:
-                - key: ENC[AES256_GCM,data:qRInCqtomABFKcUFHzDQe2qmzJY=,iv:9cMrKqqpIMtNCUqkIWaCr5YGNoK6zsID3xAKp34q1kM=,tag:Zf1ZjGwCgnaOqTq8Hr++Fg==,type:str]
+                - key: ENC[AES256_GCM,data:8IL59mlYJP3mmE7F9MoKdztW/Vo=,iv:e6rBLp5lXnktdY9wHN7sMTteDQcUZoPuKW2rx7fuSlM=,tag:u7McVTzQIfW6oXILHuhFvw==,type:str]
                   operator: NotIn
                   values:
                     - "true"
 # (postgresql tolerations are set in the postgresql block above)
 sops:
-    lastmodified: "2026-07-25T12:48:03Z"
-    mac: ENC[AES256_GCM,data:noPba/BIxyoUo3sFfwXuMaZwwSMNADgWcwGaIoQchdzu3KodtWRHk5xJ9wy4VGelOuy3gS79j9ErDnsn8I1v05Bqqlrig99Sch5Jlu1UQpeUQtUjq9S7d5BQ0f3QdeU4iP2v28JovI3gBNHEIlZiueV6xYUrpeoKzS9ukrBtJsM=,iv:XRmbI5hX0OCh4I+7MmnI9LyBLJhf2CsfHgvsNaEUWgc=,tag:Ym5JeVRqTWHWl8qSQAFh0w==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:XucjlNYeRTBXcSqA8Tmnl/Oy7MtdVM6ZrYnv50S5nytSx2wjKxdoJtGzvVIrRTNPdt86J+jNhIJKRAlBoEamDWy2+qh38suXx0JSzpoePuqd6mGxvXLXtVje7OynAq742q7rrHiJqffpD8ck+U3xN8Y1rNrAwnEoucFTlreCN/c=,iv:DBY6fMt6cSfvoOrOmFoYWN5DUUMV+I+3zCltZPcGF44=,tag:iz9TMhxLLBsTmwgDYfnIvA==,type:str]
     pgp:
-        - created_at: "2026-07-25T12:48:03Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//Sa5nJk6vXXFdf4C5XwsCeRmkSYKSdxJZ2auRzRi+2znv
-            IqicZh0YENwEX++2NQNtt/jaPFCqWUMEVfncvYceutHzZxDZihkbIL/jKs0h/Hjr
-            gL/JNRPQbVD4HXLTQ5dOuAfixJXcN9DfYQGyBg1vOtvpKxR4cD4JirA3KyYjtSWf
-            cYw5fMSalPJ0D3B5pObFZoVJhu8emO3FegSu/tqnZseJuT4mqZqdhpuej17FtkQB
-            il0tNwBdy9pDFXMxiZoGFtVb5Bii7ZU19MPleBBTFO9nNLXE8rCZ/1tJBtR+XUXE
-            acglYoZHt3aHAqe1+8iLWAOmE1KkElUMU6/G5yZCpLNNwwgx1jXqGsvITMQQVptJ
-            RMMKfdNGZSC4mcVXT+Ux/uwvw09DO9Mrbf0tjiTTjLProNxUmY4pPMShwCmGsfTa
-            si/bZbCui/Jryy02dYWuzA4bpReY+ySMwUGZ9C/0Gn/SBEAdeGQKDhJwgmE6BM1n
-            hMZOh9YPcGSc0n4a9q/CzFqcQ7T8m1uHgqciFG/zW8A+l8bC1H5uxsUwcYPALLxY
-            adAZ6XMPZAZ1L/zp3NO/SpdHp7hQVqx+TZOWvmlZ4XiDrICp4AVK8oZAXKw/nrAu
-            k4ZYVsrBKrkLBIMNmM1mxuhi248ELB7V+kN9zDxQZh87J+F2WXk8D4dMwBfRfYzS
-            XAGiurXdFcCH3i8O5mmE8QY+ZgdKzyAj7hVw8BvXlOIne8pPe3YuZsp68zwdz8MQ
-            Gr5oDPaZWhEwFEg+4H+ub5xSIZewY7Ib7FM8bzzfd23vODtZ+0sBoRH+Tq4R
-            =m933
+            hQIMA7uy4qQr71wiAQ/9GZ0NMlA2Vyh4RtFbvJvZBZkSHg0L5w7K9txYAcyKr017
+            uZm/UCgp9ohQK5DKg472EzevniIdGmA907ypV5BAtsXJt6KIkmA7RLTdIw8FwTeL
+            kJaN0jvijShaV5c1Wt5HlRHl/zVjil7Hokq6Q8fp4iz+MJ7H3U+5c6ElT2xE7YWf
+            H2FYKsQlgHAjd3KlQvECsn4fOO7wKhIs9qNhvA5c503gyOtRq2cR5IiFQiwzKJLq
+            5tzN4SROfWUrO7FfqXlkqsFNSn51SAOtkzqc2osbXmZH6s84ZJzgAow3SVZ7/ZQb
+            NqK1CfLauhL/RBb3sgKZBOX8zhC0gdRb0NKlothMx4sjo0Ao1fMlzgc/FpDlnf8U
+            CSVbE2u3K2Q4tUKEKCmIOdLzT+uthnQSvumXbt5d7Hj73wBM56P2sZGs244+SF11
+            SStk9yiYkQSwoCDS/0MHS9cP7p2Jx0dtcqrM1g94ACGJFLbplOuqQh/UYDofi7XA
+            8UOePz6KRevU7tJZ0bV44j3BMPiSHLwJA8Xlld38pTVxx4hbWeffW3DcjZpLXJqW
+            Dyz3EtGv9mHB0MoGzj1Djlhb01wNj1g/VHqDonugp0h8DDx4uwZHXiiF8c5qOdTy
+            z/q7lljNT3FxiwYEmAs3yo+RmxbVSLMzSUu/p37VtCOJigB0+1WPbg1wFWwd67HS
+            XAF1CpLZiCr1ZaCRbNBT6CXuyUwjYeSd+OXq3MTOGZD81xvYKxbs4mRdzSlpxCQ9
+            tObUsjTWMf/0q3zPU0mN74hNLrz7Z5ywol/j1IMKpy1B4Q8CuQmfL0zjyMY6
+            =3su6
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/caddy/values.yaml

@@ -36,25 +36,25 @@ health:
 volumes:
     - name: vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:91g6xGYke1FlteHJX17r6w4=,iv:uquY66VZIAPnFse/maIQUcdRVFXUfb/M9tFvNqdgSfE=,tag:P4/D7jpUgEhcOnoxk+QO9A==,type:str]
-        optional: ENC[AES256_GCM,data:KgTxuQ==,iv:KIxXxFGKVA07qMVYZIcBE2BnYTtLl9tFrOZE57xIHXk=,tag:lCyA/TXsxTUZSZDveQSDdg==,type:bool]
+        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
+        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
     - name: wildcard-vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:cZlwLn0jjz4GGX2z/w4ooeWBbyOAMZ9UHgc=,iv:Yh4wuMcyDekHzGUxCLldnAOaqLPS45YvybwhdZd5kGo=,tag:Z/jti3YF0/wdsrC9PxHVgw==,type:str]
-        optional: ENC[AES256_GCM,data:ZULOMg==,iv:qjb4nvvineVsTEp35JxPcMRDS5Ij4zIsc7PI+d6/M60=,tag:LcOjEqypcQLrBpXBrpRvOw==,type:bool]
+        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
+        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
     # semery.fr certs from cert-manager (OVH DNS-01)
     - name: semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:rxGGzrGRZPfzNjFIIQ==,iv:wvgWZIbAoBeJ/7/F4WeBuCHi1I4xHxwLtJZD7/SwV4Y=,tag:n8Zr+hwkD/Vm0LI/Se2TvQ==,type:str]
-        optional: ENC[AES256_GCM,data:5M+93g==,iv:KEMghZxEKvH+3vM/mtuVCIvzb2X19quX8Kd+oVJp+y4=,tag:mRqR+Fj86AWfGnvlTzRh2w==,type:bool]
+        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
+        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
     - name: wildcard-semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:L6rjVVVtpOne6oog+Ru07ryaS2aVzg==,iv:Qg8wv1LUeaKKGzHpe2HHGR5GzJXYYog9HPJrcPhrMq4=,tag:8Z2yVeFv0mLZlQ9Yn3oRVg==,type:str]
-        optional: ENC[AES256_GCM,data:Na+sDg==,iv:3r1+mX+APihx5w5sU3/Rnyl4/ZjO8lO3jAcaBuG4B/8=,tag:WKYxuFraq8+659StfI79FA==,type:bool]
+        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
+        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
     - name: buildpath-win-tls
       secret:
-        secretName: ENC[AES256_GCM,data:cHgBMV3iWihTRS2h4Gu9CZY=,iv:IttOh8Ra68dwxlkT8hZ4vhg8uEwDvByjFv/pT5ae9jM=,tag:+7xH89jLUMfJB/mJzyuE3Q==,type:str]
-        optional: ENC[AES256_GCM,data:QVSy/Q==,iv:25ldKY94OaF5IMSHtCzNacsBKA3MHTOHQtGVe0fY9g4=,tag:3fl1RCkfEjF86fMsYv8W4g==,type:bool]
+        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
+        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
     - name: routes
       configMap:
         name: caddy-routes
@@ -99,7 +99,7 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:U5edeFnG3Eu+7hhCmkUZXTf1wrU=,iv:hczbYIbQAq1XSCughZdVa9ChQ7nv62elsMtrUzCVV6Y=,tag:/Uh3rsO43oSfyX4fFCEujQ==,type:str]
+                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
                       operator: NotIn
                       values:
                         - "true"
@@ -113,36 +113,37 @@ affinity:
                 topologyKey: kubernetes.io/hostname
 tolerations:
     # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:wGARNk8BSuSn,iv:K1uKmlmQYv0/Y2lXP6JvIi1kbx1VwIb2m3XK1o+OHSI=,tag:PETfq6sO58vkFZmJBWJvDA==,type:str]
+    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:2Z/x7/cf6CQ=,iv:yuFeoo3LvfTL2yDpCbOEb994lGao7B/mQnFKrdxEtlk=,tag:xN7t4jD6wZV8e92959BFoQ==,type:str]
+      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:4mk1b0YQAmUOZ+0k7PsilvYd/oXlCjS4HT8QzfyZpUNSjla5vA==,iv:GhJGcDRX25UsKH3B8ZKPLUJOoo4+EqnzlNuBfy8ggeU=,tag:pzY8xT1m++02YD8YRPFpog==,type:str]
+    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
       operator: Exists
       effect: NoSchedule
 sops:
-    lastmodified: "2026-07-25T12:06:27Z"
-    mac: ENC[AES256_GCM,data:uIOoHpLdiuIOF82w84PsziKyAglkY02OrGU0sigjnhyt+6S9ryy74oiJivzxtniTevsv2PKecN0uXABKzabp+ysY7/uDix/lE0KzoUs6sYA5kVfUj1JPoDQ6bQxoi0y8zKeOqMoqHwIAs+2N2VEriqtRxn+4L3kbTrbe9CFtxIg=,iv:5ZIt9yXKJo5pF9ghi+uVs7zxsdLtQ+pTlc37FKVz2iU=,tag:sTOq1pJh0KQ06soBcmcWRA==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
     pgp:
-        - created_at: "2026-07-25T12:06:27Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAvv+DByIWPPLBdqAB39jdZPkrWzVN/7TJ3DU8q380NNMI
-            2w2I28Ee3iXl4e/Qj66fx8U8NGwdYo/j+mUjIddBjiJB5xzu97k+nT4toDocutGT
-            bOI4KZP/J7vh+spb6TMJvH39IGLOYH6N2NagRD6r15kd37ddoRbV8OFTZXvXf524
-            d3+PbqQz9FoulLy+Yt8tWWXD1MpqRbIHL65dAhLF0vZRxUVcnRmg77ZX2Q1yD7Wq
-            i8c0Pe1dhqg6ig+njshiC7HkWOQoINYzk012hz+Cid5JZAIyxsqxkdoFUWHeWI0h
-            u3XUpjjxj+eg0YlnAqrnK16B6+pscZWjEgHJEmrGQo8AGFMdALoubv+8nGiywNZP
-            tqM9oT1ePa0pIJNzhNgFWGkwwuyH4jPXrRji9fpLASAihsM1WQIh3smd373C0Z/W
-            sQYFTS9B6FUCCdDPA/St0Rd/RHFW+eJPC6Jh4728Pqa67FjnuIVB5VJ33Dgpl8OE
-            kEyY3WvtoYOaw+6VqWetg79sCruibmlenDWSrT8VQ8ksk/YIj+iicPnI/BY5S2Wz
-            j2s1Lpvvhr/gZvF7z+vfhX1Fn28xIg5/gkcoYSKgFhqxG69IlPbZsr/D2oWyeygd
-            tIp/D1yHGFJ1Cb56qr400t9xF5BD605rf/Aczg8mdvI41jGvmECQrSKHsxI25xLS
-            XgEVhCAm6HDAKEhjnm1wAZG8DJRhcrSLqLq7SPKJaTPJpjeQwXOb6OIs9ugQx9ON
-            w96InR1VMsEUlh1EWBXUqBgQgyDIIEAa+wHBnY7U06fkazN6lcLkAp17yTitTEk=
-            =gULt
+            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
+            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
+            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
+            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
+            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
+            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
+            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
+            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
+            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
+            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
+            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
+            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
+            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
+            =wlYf
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/cert-manager-issuer/ovh-credentials-secret.yaml

@@ -19,32 +19,32 @@ metadata:
         app.kubernetes.io/component: ovh-credentials
 type: Opaque
 stringData:
-    applicationKey: ENC[AES256_GCM,data:0+y+m8n/eup5lY/vGW5ASQ==,iv:VSIhfNAvSNOLq92TVcaW54ygU1wgAv+u35HZ0cbP6UU=,tag:KD+cyIesTQgqEzGMro8xyA==,type:str]
-    applicationSecret: ENC[AES256_GCM,data:sP0febHRFF/atAFlRM6sYXoM+Lp6Rnf7d0IQKcsa0vY=,iv:nHYMHSsOclkZmQJSjcz2oXMHsDTct5hTmJz1L7xgvpA=,tag:oCGoRP7R0W+PTNRCeLFvyg==,type:str]
-    consumerKey: ENC[AES256_GCM,data:vw/Q39CpSc5o1ntPDMT3844aLbTHQrSYH8RhoZFFZrQ=,iv:6B0F9Zq56inpW7AS8okbpqJkRK3WkBjX6sIqclOP9Hs=,tag:nnbgwBMBM4JZg/IEYzRvVw==,type:str]
+    applicationKey: ENC[AES256_GCM,data:qOGxuFHguxe7e7pVfd1eiw==,iv:CC5CMc+VTL8aW4injRN2GxQvWf4nobGuQYhuUytHDfQ=,tag:3l8srdCgAtnz/fWqn+VrdA==,type:str]
+    applicationSecret: ENC[AES256_GCM,data:tvj/Km80zHBLA+gLqjCA0wKh9y/+g20O+kE2zZzEDVM=,iv:SKfeoThkwFbNGjNdQQByqAk/+dbyCLyzft1eXVh3a3o=,tag:qHoR2ZqEkfulKzdE/GvZrw==,type:str]
+    consumerKey: ENC[AES256_GCM,data:gGTsvDEy0DZvTiHP2mdghBrDbwE5hmkNDJtDf4CJEPc=,iv:EgvG8TmZuY4hWs3YD4y9zpJv/Ndu5tnGLs+hIMWvZU4=,tag:R4tSbVvJjkyXe/N93CRSSw==,type:str]
 sops:
-    lastmodified: "2026-07-10T05:06:52Z"
-    mac: ENC[AES256_GCM,data:0/VEDE1ZuIyzkaleosS/KHYX44762TbScrJGJylwV21d7U6YgpwRMOXvU9xn3rHsDXnh5IAmAtrXQTYJFN1vcF1DNw5O9+TQKVoO6B5rsel/YyKRU4s7aYcfDgbW9dO1wn33K65KFtM+0Qv187DzEn1by449TgWIWP/M5U40PE4=,iv:hIGzMwsas8VxC4941ABeoocYWSlVSz9KW7a5tTAoRXI=,tag:n/EJEkEBL20carqVesMBsw==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:xNUZ8stxMx7Y2ggmjBaF5FX0NtC18JJcaDgU52V4b+pnG72t8+P83DkYY3Xr6gWJfmS9wFNs3vZ8TJ+nvVP0C62zoN9cmC0BolJrTOyQ2rpoUu/0Xj+Tbfiwnmbm76yZ+SdQJLYg3n7fNG/g6fh88/BUERi0NAVil228ExFFliE=,iv:2Nu2LaqVYqM5WchoPqoHkCJcXypGHskDjLHFYRC4eTk=,tag:2H9FSAQ3UNGSxSx3WhUD1Q==,type:str]
     pgp:
-        - created_at: "2026-07-10T05:06:52Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAu0va03SPYOU23iUjoTMiXJ6+nMhIX8lsurvmCvi+wIqk
-            c7qu0lTfXv62IjkY6fIKtOE7TN9TiipjzXG2QJaK94QeiFpe9M90qNo09qEIje9m
-            DepTrLfyINFT0SY2eihl+nXhBXuEDSiD5K60OsXGPN92hJMwCad5jJuB7xpmrX0m
-            X0A1Bl9orce/do/YJoy5hq0persB/VSeCKlptNzqpmpRIA3J6AdCDKXQOMqAymXN
-            FXAxbjEQNcXhfU12Y/cVpa1hS7ap5OJCnWOPkFEA8y1ESVnPpryuTIfVlFUhW3/Z
-            Dhpb9OXKdi2IVYdbaY8+3UfSsXxTVOge7jCMbJq3aa7ZvGt5fTjXG4zc9A6RqSGh
-            ASOPSkRRSZB0d97NhUQJGgfcaWFvsfkaTAUVB2Ip/+Udnt/tGIE99RGJizxSVO9N
-            2aVJIukqng8aNPfth8mgWYJpCETMb4piLmVg2ptDqelCqXlUAskxWzMWtAhyzOgw
-            lZ2dcAn7aj9YtLaKAW9rjV8EqHEqQg0ychRNMeyRiN/CnNJp6Q2wl1/EyQUpzb0a
-            1I/ifFAW8FbWTVIbZv6njkl1XNaoav54qEn1qSABcljM0h1Ulb9WKMJiXH4368jf
-            Yhl38JDAn5NZBEzxpuaih1XK5yVri0/1ascpuMvfOxLKniUR9tla8+WEL97+aejS
-            XgGsrH+/uzRVSAT+44rExi43MWCAwNRUaVrX8UiGjA/z8qPVdwBVih4CMKgfQ8VW
-            1KewStOY217BXuVrDbvHEAkuOotEP0Jnan0epoWs47DSasNgzAcWrBgom0l/avI=
-            =Gdou
+            hQIMA7uy4qQr71wiAQ//XxGw3gzr7UtuMakZqWGp6uZ5mZ42KscvHpQCZchh0wZb
+            01Dq6HLl6EMwu+fpnfkOU05SxozkaKvLw+xzTX4TExbfE3GBTjpJ5R4e/aj5B24M
+            iw32oy+y2jCIzMS0PKxIkhIJrClv5hRSZt5dVDzln5sOapXapE5iLpM/glerIwXk
+            i4EfntjzNhOUFCbwnH2F/s1ZKmwZWw88GNff26aAIDOhNiEyB7kz0s6Gr575cKvw
+            CdZrHDtfl7ZoP4JiozNXzXF65+YnIiG5kli1A0GVF/9XUeqgXTUHYJKvdGcHFAqs
+            NysLbdsoppDJUUpqWvU1gS0X6PifZWkd3Sv0LDaoV7TIa8UWHZMbyV9W/1NiGSjt
+            VVBO+ezQgpSFbEVixz1WEDyD9MPBAvWq+PS2QQcUc0aep8xRqoWAe1pojjs2k0DJ
+            2vcFkWmdj0RVngNvw3rBAxrYY8DtqrNOjc0B9s+2ZqIN9TT+9IWaS65Xh0wRMZoy
+            Ntxr7oyG3wicA8YFRH3WxLJiTqOOeYYgc+Qltds7fb79hJScdXNxbC8mFjo9zOUV
+            bnHSQrjj/Se6tzSpZt7yF/+3aBTAUsOfOXHO1md/ydjCBpO6eUYU+T6m+buIJ6F8
+            M7kov+/x5on8k9dcNjkwdVuOztIuIXGUaJ41idrGKOSvtAjW0CGO3VU67e76NwnS
+            XgGVAwNds2Bfs8mQfmKdhvCrJnPxqtN29z5fguTMGTPqMncsx62mhdwI6tgAgEdD
+            qEX+tRkjpgoa8yO3gkvu7J3+oQ2HQ5mOZaSyl/Xz4ALP4+MOEHEiMNWcDmotq/Q=
+            =BT71
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
     version: 3.10.2

kubernetes/infrastructure/cert-manager-webhook-ovh/values.yaml

@@ -18,28 +18,29 @@ pod:
             cpu: 100m
             memory: 128Mi
 sops:
-    lastmodified: "2026-07-09T22:31:08Z"
-    mac: ENC[AES256_GCM,data:QjrNj355tJVZRsYQdkM73Ld7X8EvMM7O/1vF3QnTYJ9vWbh78irLocbtnyBeaR9o3g0mxO6Ugjlukj+S0HhIX/WS1XHEfs/3n3rE0zS/fxGJ0D3Alam/n/WPOsYHUiCBD86JtU83AjgncISY4yp/VheV3kRgSdl+ye4AGAjhq7A=,iv:p8yqNCcskTfDfEGbM5Qyb60C4pFv4BOuLpEApEzHLFY=,tag:KntExeQwJbBREaz2nY+1uQ==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:jzaxMCQB6eTssTai71HIAzLwCktDSllQagk6dnz6KI509kZeM1mUyL/Mti25R1XpsTZv2aGWzG968CivR2q35wiP7CoRptHx2xPku63ljLihojp2Z2aklcM5uwcZRJIkSsZeVk2m2rWHE1hz6SiLIGbtmY8HMz7fBeLryni8SgI=,iv:yglyVdWx6Zy+GiD/guAWexolRwQXTAkKslI6zn0RUcA=,tag:6XvZb4RJCY+UtZGvOPxzNw==,type:str]
     pgp:
-        - created_at: "2026-07-09T22:31:08Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/8Dn4nEIbQXuETxE6RUBkNTO/eN5pHh47lqSwBBbYDSi8C
-            8rcJmdq8P+v00geLdMlM35OcjHFb9UCVeHFsAEYt6Q2jL4QNa2aOEDOqGnhKP+zx
-            KKtW2Ngx76Ow9N2C5JN9DXk9n+PC/qWdPLNJY+GiW/KbPmVxAulJpmYlJHfs1EOh
-            0mSRSS+7sgGLHWmgU362zC508lkKxh8HKxmq1+1lf+fWIe8N7Sl0fx55kq168hae
-            NcdogRpoVT555hRils7eqzj0C/KTVOi7CR4pS7VJyiNy2fu2OASmmcM6UEqCyJfV
-            NTUdMpnjb05UwfbuUnIg6j/FoqS49ufGxKPrM9t7JrFSuyGqduF7P/ifv5zwMuIZ
-            SNeR/X8xUksK6R4/uTmUx5sgF+Jv7tCRvcp+DhsDe1mMmO8czXC5Mt3cR+uwYoms
-            hN+9/oYEZr13qn5Ek0dy9NESkZIzYPCXYXZrx8GLqaHCJEQbpIZCAN+llOyQaQzU
-            jcvPAYbTewBw4ewKUS0KcvLd1pfzvYyvtzwHuMIVJwrf7x5bzhzxAgVOGkEVlVq/
-            7pGO9TYXGl3kD7tf25oCGzAerVC+EVcL11sq4zawvL4PovEZFP9mzhR7EfY3t/3C
-            vGVu6vPmCJOwdis9+Kdr3PKubnMqWGn5KCCX1x13qhsHc239N7cVKkyx3dTBaArS
-            XAG6KxKe/cQicIVC8/N1Cna9uQnTF5ZnFVfJNW1nkYyF1E+ofW6kKDr3ITotKLDP
-            hXXPT+vsB2fL3faBG4xb6owrMuQ1S0DmB3mqjSCXtpS7q0FDg22Tq9BtaEni
-            =x1th
+            hQIMA7uy4qQr71wiARAAl7HETp1m0KX0RwxpIW1kBIjhWCpDp2ynTTC1+Q/95A8t
+            JHYNTaeymQQLubEl1lB3EzgAnrvFIOlOW6aX9Vbrv9UPhnoEabVH0W6VWF7JFFcf
+            ZvKnkYJrPtlAu5dyN606ifXlZw5ZE1wP7hASgano96H8Irfxi+8JE5k0gwTNFlUu
+            cLDhjhwcnlxCIxf/akQpw4ic+aHvj2bp2ilaxBuo8YtVZUX21My55rjZpWxf4ekn
+            oq7kh7UD/dt3lZ8qWi9Lk7aGXrzjdErqIt3ESefKUQtqQEGVrOeZ4mnkU4KONa6R
+            FcLGTjuXl5Mily4U6cQJwkkyxJZyZLAVp2Phw86LeytZtFgtj/YsEk5NiTSl2a+3
+            qzbMySigD8q6lVAu/WO6r+KXitZaMNodekJh54xgxer2ZUBekOpzafHawbAXO47e
+            ZVKnNW/aYs51Vt8NeDGqF0KiUIGPqLN2ffT1t0SfNqZF9MYPc5rKX18/cfom0Lo2
+            80Qwb1l47DiZbht6AQ0oMzFdK3SJp1jnXPMd6ZNOSMj3TfRq9WZydNlEeBPiFG+i
+            0ASkPHuERyiogaZlsGgi8gKA4iM55wULCBXIsPdVc4cIbU7MpNpP0icsQN5WRV8L
+            vOUKjAntXik2ZHY4bhHd3Ty7/FVVIgi2M0Wi5/6mTn4ftb2DMyoqVKBYHwm5iqfS
+            XgEt7iRIfcYwAy9WKnHayTfk3Is/dnBTaMp/PKSCUwEELqnAgmpbLcZ/8lNm6wEi
+            Azo8CgLer0P7YHU+GbbONeQV29VrkjqHkA0imPFCHaAWxfSNE+55IctMgk+oclk=
+            =Ko1N
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/cert-manager/cloudflare-api-token-secret.yaml

@@ -18,30 +18,30 @@ metadata:
         app.kubernetes.io/component: cloudflare-api-token
 type: Opaque
 data:
-    api-token: ENC[AES256_GCM,data:QZEgQdatWsC/vpboMlPDPyY5nVK/bKkBZ9Mjtt4VOfao8uN5zi0Bdu/OPtLKQarKGTR2srMmiRuuH1BGQunBwXAb4beDIT41,iv:sHoJ86a9qNsyIJ83YgPGWerxcvp3okbXE3pX+OYTbwk=,tag:lV8OWepMdI4foSlwXnb5Ng==,type:str]
+    api-token: ENC[AES256_GCM,data:YdjAxeCqpOuRapujdleSZ4mcqWtnIDOiT4ttohorOX4/pzI1DdytmXSYpISiTpnh73i/+CEr5OpWXeHr5yOZ5lJMf0gN9usR,iv:pNZNxVnWvvMfcOxo0fXyefiI6vW6nIjdFsP/0+el0p0=,tag:V4Zc6zW0PGP5YX8Edd407g==,type:str]
 sops:
-    lastmodified: "2026-06-16T10:24:36Z"
-    mac: ENC[AES256_GCM,data:vDjNGtGfQgNBJKxIYloBd/eAkx6U+Xh/4laJ31qyAyy8/2R+0NTL/2g6yc6vqf7m47qflfSOYmU4kC7IpNlUbl/WHznaWJky8d/MU2zCmcsqmt44XOf1ppD7wkoiIyTjVh+QDNFLmmg9SDquVDvmMYYGAUypCY/Rh9QAVp/Cwtk=,iv:EMS6tgMml6bMGO3qoPkf71ROjeu/WXR1fLTki/672xw=,tag:jP89nlDi8wNV9f0DJQZljA==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:ovnp+gcpIuMHG3MC4Y9SWpZtj4ilWM3XvJOyuyoecm4DIytQgSAW+lUrqREeOh6MleKF1dT2u3cO8pnqjqn4YaMeHD8dXAV57iBM1d070ySDP8EG+O/eLEjzd/NINglf3PEaBSK9yzemhPkTUlUqVdBn+kHNLX1y+WC+GU0tcaI=,iv:RQUcZ7RU75itmhuZW1NmpH17MHhtd0HI8isSRIKqzCA=,tag:qEm0euMGQOvRjtBS9Sra1A==,type:str]
     pgp:
-        - created_at: "2026-06-16T10:24:36Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAgJ19fZrQeD25vjz9wWx+3MYjWj2vq4HWGJ9nG06zc/Rl
-            PeR/LbdMSowAyjvTAdnsqaFnofpz9P7fGbzbIPFiulcsoqC2UQtBO833XWc8RoyY
-            7nP/+fc0UyriIudoblgHV+aEoHuSuJGn7y3lAZWx4fj98Rat1Ip7/gyfN8SgmYM0
-            dS68s2WdXMtV3w6vFcSr/HpQFdwFAvzB4+cEjwJo35axIWKAp4wzLlckv+MG7lLS
-            dqZzYeGjaUyJuIc3GxBNw8ixTcEvIKdxGcRPVCCH2KLphCd+sL2b3qRUHfJXPmNb
-            8Eq3iiLTbh3DZ+MB4UCkVHCNf9wwVERdpjvv1hBBGxckfmgqqB9Jo1MpuQNHJdXY
-            gLATxuR6FSwuNNw4FslBSW0TkjMHhsP1Skfl/R4usTCsIPkN+ogC0QPCwAyH6Jir
-            RoQQLRGnCKgFhSgRyAO+fEOcxHeJIcphcF4RtUDU1rtYIaCRRxjTJrSx9Niz02Sc
-            hC2BsG0gvCMYxC7hV6EE+4Ck/93AD+4ah5nsZBQ0R9OY75RnnHs9qbZDTjnI71OO
-            G6bTLE1rE5KZfvN9tUKfZ8edeUDQEgY4u5IeXZgXtTEE/DqkkKnIg5nNzCs9saWU
-            8/+irtiX3GiXbZsXrsRR37jXzpQu+QoEDydDIZdgEg3P/97R40db6yjh/tmh0pjS
-            XgEZOOAjGdL742K8kMfG4JhFfRw506JH6LLE080VX8yqU3IHQTovILwXtgzcNTyj
-            EF+FIAvT8RR+g0VtbSMPLwCiBFeknxxvKBNmhyzvov7dFnp0zE27/VHN0ZGY6to=
-            =YUJS
+            hQIMA7uy4qQr71wiARAAi83x7L6cxjIV0HETlf3e9oXOQErINQ+VQPJ8Q3VrdoLR
+            Q5t2CVMRRKz6dF+D2NvV4+dxCi4NNNf8qRteSmUeQpfhsonSlOW4ArpgzgFjc5M+
+            HO1jD61C++8ISSTssd6HaifLUeCmvIBJyAtr8BWuXDFuVyRCB2EEQ2wcs9X+HGLz
+            5ertIJQe/rvn3HQVojNwpjVmHR68hiFrF4b4yxNHz7kTY9JRKBzeqflQ4OCz5mdD
+            uXOxR2RukPoxTwjWLcxm791J3iTo9TQxMjI3JaJcmNXiPCy161a3ZDUGVBA1bY+w
+            apa7K8wKobjhVYjZ9ScxA6qS4dQ2Iktchxw/BUZLI8Vv2LT8UrJcUqQS2MoRZCa6
+            XpN7gKAnSDE0RoPJxHlX/2kV3bsVABLlaTS0Fx399iYvHJt3MyNLBIQfr2nMUzLJ
+            0pP/3nBqEo1iUMGfKJhOWIQK8lG0dieVkxInXrM8K75dNqm/gBsPGLwJIdT4GVaX
+            +vkzud5uZNExq1ajXHi1JMG4oCRdXDINoUVLsU2RWHzm41M1vU1UQDUGxPuc4lkb
+            OUl/4yCJ9UQ0wqLdw0O/q2ooay48sH08nNRMsfVIKL+us+ymrBC55VoHIDBwluUd
+            ztVPDJ6He1oNTcKnF2cxaCTrbWPODVTYnAy58DprjXxSRF+3bcb2Ky8loG3ESzDS
+            XAGUpWuWTvFtdvfTe1fmM5jeCtjZNpw6B79akcQuCbnQkKsqg9JRGwIfV048pYTR
+            BWN6UY+oFVUp4arpHbVdi283VsNtFIKr8ibs9t089Q0Yd/K4F9GPU5vTI6q4
+            =emCy
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
     version: 3.10.2

kubernetes/infrastructure/cert-manager/values.yaml

@@ -5,7 +5,7 @@ crds:
     keep: true
 # Enable DNS01 challenge providers
 extraArgs:
-    - ENC[AES256_GCM,data:RcKzGzDSFXAw32vBKyvMTzMx5u0AmXKpXEY9/YRxUI0SNVy68/uUSpFhdmcB0RvmzG7y,iv:AraIcgoVYO1IVAmN3dd6pXr3v2BXaizbK8HefwsDRqE=,tag:QlOBuyxbddyk++nYLhMl6Q==,type:str]
+    - ENC[AES256_GCM,data:WklAooZiEmMv0a4HuSkzUryQQcZxBMw+EQ5CohnkZVcLOs0e0yTSDA1ZWMzzcFN8+lJv,iv:dCML/TDEhl5iUfF4wHlpsdBiAxUETyvDAsQl3G+45Gc=,tag:tARyDDKB5sNuLOYcWfxEkQ==,type:str]
 # Resource settings
 resources:
     requests:
@@ -16,11 +16,11 @@ resources:
         memory: 128Mi
 # Tolerate failover nodes
 tolerations:
-    - key: ENC[AES256_GCM,data:WXIPFO1nBe+6,iv:t8RP3KL6niOVe84Qqu9+JKp2qNR87qnMzJOh7pUsudg=,tag:uT7gWSdOz86PPi2NZIxZeA==,type:str]
+    - key: ENC[AES256_GCM,data:SCjKoTipNgof,iv:nvp9VrxZsJWbunDoIzExh40P9e/FIQqBsbPbH8LkooI=,tag:/zF3Vf42U5Pdg4d3akd0xg==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:N1IHrGvrobA=,iv:QiKeIiSBFThw05b5gkU41koci4CDZ0ZxdLX1r1DD7Dc=,tag:QGWcNIYqUdEy0f0bEYC91Q==,type:str]
+      value: ENC[AES256_GCM,data:hkez1UBYhjA=,iv:KIko5RclWRZHxRG3Er3u7IflHX5ybrcOgBpOTCEGw2M=,tag:Ms7+y3q7Pjawo6L3N3PvlA==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:QMtUDj9EDXWbsUBLlQJ5yFEsQ3fksIRUqIk7tKyts1aHqNQ56A==,iv:GVEl1AcWNLAqdXqyJTMoYBPRqqvhSHGBN7fuMLWtjoY=,tag:bmCK8yCiVCXci2JJFvw/GA==,type:str]
+    - key: ENC[AES256_GCM,data:jwng5gCK5pG/bVnybci4V6pWxhegwclLt6jFv5hAP5AonwYeTQ==,iv:E55c6dKHf3ixsBjJhRaz2lqpFRuI3CqjYKSJ0baMIDs=,tag:kE+hKUtHG9T3rgeU/aCbcQ==,type:str]
       operator: Exists
       effect: NoSchedule
 webhook:
@@ -32,11 +32,11 @@ webhook:
             cpu: 100m
             memory: 128Mi
     tolerations:
-        - key: ENC[AES256_GCM,data:QZjbo0u9rqht,iv:H3mZnC4a2abmOiW0RhoFAiAvVfaRFpGU2+XKYy8uBUQ=,tag:xwp+rkiYrSo1q+CsLdup7Q==,type:str]
+        - key: ENC[AES256_GCM,data:T6EcMGNo6uJB,iv:slnPrxrfTn2NDZ4nd3bpKl+G3aQEmPIq0/FtcHsy6iE=,tag:8GkbKn2ZA0zKOiDvo/X7FQ==,type:str]
           operator: Equal
-          value: ENC[AES256_GCM,data:UsVMCFtyl0c=,iv:ImpKIQtC1jX2NLNTSDhq4a9nq3I2HlpSr7QLUOw5gd0=,tag:xM/vf2MhasBNWbLqxkUrQg==,type:str]
+          value: ENC[AES256_GCM,data:ARfB33JtZvw=,iv:BLlUEDenivmTr/dFddReGwCDZp9yyVRMln68F+AqGyo=,tag:Q7aJUz9TIzntGJhN6KG32g==,type:str]
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:31pC3NOA0AH2d0V/N10xX1U8E1OD4YL/27+xFLxElfYb1xWSDA==,iv:aaaci0Eu3Mb9og3Za0beB9js3wSjcNE7BOS5iAko3aU=,tag:h40mrm+gPTf9jCP7ax1ihQ==,type:str]
+        - key: ENC[AES256_GCM,data:pXbWnDdllf4mhbc9E1FpG9SmI2iXjszjTdOm56K4QMkpHlZbcw==,iv:UNVYfOnIu0LeDKq9etRTwn3nCa8u9GdZ40etEYMICMc=,tag:mFRkt3YtmMwF1bRo0SWuLQ==,type:str]
           operator: Exists
           effect: NoSchedule
 cainjector:
@@ -48,11 +48,11 @@ cainjector:
             cpu: 100m
             memory: 128Mi
     tolerations:
-        - key: ENC[AES256_GCM,data:rqZTE8j9xDAy,iv:EvztWg01VbvJhdhkrVz7M0mA0EUhVW2Ty/de0D3pgmw=,tag:rGUZky1bUhewhKDp3Vo8Eg==,type:str]
+        - key: ENC[AES256_GCM,data:nENalnOT52oI,iv:Q//78lGQhi74smaqzPLD5rQoIo3/1UaoSHhaenym4do=,tag:keej4Md40ilDQw/ogZ8VXA==,type:str]
           operator: Equal
-          value: ENC[AES256_GCM,data:fPt+n+ftbGI=,iv:xHy9IUIBgkHDQcVZ4MyA3tXPvMAy14gHhkxe2AYthR0=,tag:szam+dyODZSjfX6oxsFdSg==,type:str]
+          value: ENC[AES256_GCM,data:P87X+3Q4pIs=,iv:HvJ0o/rvCeEzEunH7cYKSQwrVhE4g6mk3JVifZff6Hs=,tag:UzbzzoK1LIx6Thuw65zLlw==,type:str]
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:As98cp+6SvVwxRtdxx7TT+HGzejgWiacf0TYm2JU9kPqEA7ljA==,iv:dd+TS9T57NrpgyZjYgPi/aCiInfnVxh3VbO7gddkw8k=,tag:KQMA0Kn0YgE/HpAJk83pTw==,type:str]
+        - key: ENC[AES256_GCM,data:2QkmTBIHIoKZ9E2paPOE9xjm84QkEhj7at+yV3muPALoiKDVWg==,iv:T1YgyxogBbf2k3GBsQ8Zax3kUtqnmk1aqIjoWz2yC74=,tag:aVri3xZ8PZeFBaG7+YQCXw==,type:str]
           operator: Exists
           effect: NoSchedule
 startupapicheck:
@@ -64,28 +64,29 @@ startupapicheck:
             cpu: 100m
             memory: 128Mi
 sops:
-    lastmodified: "2026-07-25T08:12:52Z"
-    mac: ENC[AES256_GCM,data:yFXZxbhJi5PPVXl4j73FfOO5hurvD7ZXgWr5eZS8poE7IEg6IgZKBjwq1ITMUP5DyS6K2onR/mgZVzgj5X5I7hEwj13DAPW7wWthZql+De7oGxe5Nv74fDFEwCoqh2sTbdrQS2KyPY+rrb0ZMZD5qpdZzyw1AVGzVKeJJj9DdBY=,iv:SW7sb6mmJulekZn1Eh2pfYml1PwJ5v6z/PBdV3TL29A=,tag:5HzpRnH2G8J//J2fZhrxrQ==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:+wrZiehApZjOfmDBophPBkMy6BXaOspsLeWbGDJ4cde20QrLrM1CkPfNM+1E4Wg0+gRw2M8nPOP5HVzAPEkdDSn+RLZQwshCPMjQJweEQz4c/8bIy2KCsKAKbwDKRYaHkgGY344QVASsY9mKgeoYssKmKQ+BxE+vSeHhTqAIOjo=,iv:vsQhlx+g6B9lkDfPiCWNdZb3/zN2vh9C5tICdmMSpq4=,tag:f8Q8tReFgmqlKR8FlOZTcQ==,type:str]
     pgp:
-        - created_at: "2026-07-25T08:12:52Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAArV5QxST5xu2jG+X9Fo6F4o3uxMS/Kw56ey1MMTfgkTlM
-            HdV1n6lityMGXB278GiYhmZYRdZl0kAT+Dj9Y0RdaiI8BszocD7IbBKmE1tVseCr
-            Xa4y7nWE58xz2Ca26KVf/I64QPHsKKus4wECGOgZrh7Hzb+KdeTJBpuMMIgnJe3l
-            1C6VdfTgNlYPW+zAmX3i39ZwYO7wcz5UZ1aXozAtoOjWyjdcArEdoCH9iD2GXTOe
-            0EsvgdUD1U2n4ffy+Z8mga6V8URkJQ86XTuFD6PhFF1bhBwa36MCUXAdlD9ONB6d
-            jaKSAPAeia4C+0vCXTv9OYEHizSe11iwsUyPq+bmMrYCUslaiOCC+QfGtJEcCJj/
-            ZeAjXMoyi5Fnmwj+y5ED+O1DKp/sDyUdvix83L1UWVfTrgNVfXFCGzHJUkcZhfUk
-            Ye9KcbH+7+mj3p/lAgbQjBjVemnW6GFzGJYcL/rWwRBxw2ElLxKPnR9NQK9VY5w/
-            wCmWzG4Cjr2gfLlR05A72/i68fRM9eAy4CFL5y4xTN1eYe+MCz2ZedZDd3uYTKUC
-            TMPGXfjhy64W/cV8MWa/aYCyNguVlKbmUl7kZwb+8DAxrSyPqQal11DJtcsv3zFO
-            BUf8GQFn4jXXYqd1LojLM7bUjAkXWZUIUbg1+jWfPGsgsTGn4R0tshtY9JOfQpfS
-            XAGL6+0+DQf8wY7yzbds4DSDMNTlOH7iWoX77okayY3L5Jqc3jB0glMJbRwdmgnj
-            d5JzAoqDhi1F+MQdTYGu7RQpawKr6ndWqwkT5ef5BQ86TQq3/+jZ5uuC3qnE
-            =uS2O
+            hQIMA7uy4qQr71wiAQ//cnoE4ALPvnSzdhSweCbII9A/D8HeP+AM0Pd6AbXxTCOZ
+            ZOwpBmFUDmA5+RaUheJYbYYEiy31JTjUTlIi3/r5A/42DtmN9EZlUh0B41nMVtwV
+            w9xX937BdPSBEPqpYkA24kBuk4N2p2zHfylCS50z0LH08w5+M9lFAce5GIlHzitn
+            QoBwCvTCV/D9X2hbQ1aqPmGKl739TOSO1QYfwEhWjfZj/fOr0FCwvrSPssL0v2l6
+            1M6KssKp0CaV4JOOPVCeeNYRDroo2KqmGaHbsKTUNWtMoN8fx1w+GiEwPd90UBMM
+            uk/etwdDbUw0QMXuPaRucyTVOjXuGmIDFZsCPkwL2xDEppZUVuY+hnbIw6Mfih11
+            gI+IlQiSByWAICSdJa2usSTtx10Ck01hoOKblE84rq9xzyf/JgnakpPNsS2iJtFr
+            8AJLsLyCLdov6th8O3bCvTYvpYGBBREEz5xlFdohhpWMNd9YXjZ/PglyAyUBhsUi
+            eMvPFguwH7UQc2sZLmXbgrN6vyvnYdqPVhNXZvJqpXbsw/v2evlvZX06J3Tv4xjp
+            XA8+MRrHKnznSgtgZM37fM8KfJRA7u8AWD7rbBeow/hXBF8CaplLhbiTSy0vSnYq
+            bXoxw7x1LfzE3WPm5CcBeENFbVi8f2Hjxd1Vz26E2yaFqD0afFpB9bDjisXzK6vS
+            XgG+x5v87myoWx/uC9hXfEAsmB2Oe7EI+04qCpZIDo7ZGfDO+dj23oU/c6K7P3aU
+            JjkNYSpVlHVvzSqbkFVgYV/+8XhVvDVCC16cFA3VoGYk3EvZqMXT52dP77EyW/U=
+            =io2w
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/mail/stalwart/recovery-admin-secret.yaml

@@ -17,31 +17,31 @@ metadata:
         app.kubernetes.io/component: recovery-admin
 type: Opaque
 stringData:
-    username: ENC[AES256_GCM,data:CYm0+Kw=,iv:UdgReqdb8GdoOfv1ZEW/7BAvY3vV88httj3W976eV0Y=,tag:PPrDQY/mo0RcJiz/cmxFSA==,type:str]
-    password: ENC[AES256_GCM,data:r0mPJ4qKIhAWDw==,iv:L5+OKTznQgDUgqttHwdW0X66vz+JPTqWdwYPGklCuj0=,tag:WNOj7ZjC6Lx76UlPsgSDhg==,type:str]
+    username: ENC[AES256_GCM,data:AB2zGZo=,iv:DShjxCtBagfnqm3oXLj3EVkV/bNEqnYXGJVSN4Jwd+M=,tag:++ig5p1ec7WZU3G6SvOnsg==,type:str]
+    password: ENC[AES256_GCM,data:v0HBWQEiGkpslw==,iv:OUEKmtKJVnXuJwMTyST8ycz6cZ6qvipWPfmxDyCQ+cw=,tag:whNSOquceAh0LxzH77cQdw==,type:str]
 sops:
-    lastmodified: "2026-07-02T20:57:39Z"
-    mac: ENC[AES256_GCM,data:lIVOaMsFV9F1/yLvykA3LH5ukn9PIba6N8cE9RGdcFepM56tBYlY6fbkcKTtojyAkoYov6OCjgTsOkMtUzRdGES4Zti6zHB3cTPal8bJCf5cAfYnGFRcQaASIkVjNZkQSJ2pDRP4rZqioCHuj2/a6uJZ4hhtSpxrECYbpzD2Gk8=,iv:31fXHsWH1ZP00Od5DSxgYPuw87NqQNfWl4vFtoouIHk=,tag:u5cJn231VT2ZTmlcdpBz0g==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:4ts11OGRul28LVfQT6g6tnLmpSaMchaO06j3iYecak7yRqXnzsYyWu/LYweybCgQ20zeyZOnFU7rM/VUpkafueu+KmVrw+HsE1WOzjI4g911BGNEz6DOK8MliFtaYitFwRzJfZE4Fh/M8Wos+aGEs59IR1FsiB0DHbdd57pUYT0=,iv:XkiIh3vRCkKzQ3LNYsTa6HkBYOhblK6hWqiw0O9ufVc=,tag:QMS69yIJDfvM/BnMFvUk4g==,type:str]
     pgp:
-        - created_at: "2026-07-02T20:57:39Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//fYBIypexVfQJn5BxVCRgZKRBcYw78XSoPjFYWFyk5F7I
-            UFRQKtdZOVVhgNHtFJOVyBvl1sAmmzAt3xq3L+Z5bvtrUfZ33tTp7ty+MmSmuutS
-            wquSh4NOHUYENGvo5pWsgVwQDj5bI2qUq4L92aedpB2XJycb7/Df7BWFKNMNgWdt
-            l+Hj9HEJWxmFjrz1MQJEL2r5WOx9/hK7uatbDTXVFPqyyW1aCM5XOkKErTuc3Avn
-            8tNNlvP1aqhI/2dHfOSZ1l0/PHhdi3RBmGa3BfAZUXEseBEesIK/EaJZXMjQYhF2
-            5tAPQ1irqg8LLv9mhrUD2mWaUigcuZ1EeyfZFvNtY/noF8fyZny1jra0sDe4CmQP
-            7uyP6CNRWPCikutUw45oxtw+/Us5Ld8xzJxhDEm0e+8FFiAK/SFSOx57JbjNzoCj
-            dqHU3UIzyp9VVZohqW7xdHOW64fgDI41BDKBsEiKraLnZUoXL2Lx0lnjxayJqVsD
-            2pX9D5YXzmtwFvUU5ZpcCzUWFu9MVxSfp6HdKvocGdtpSz7J23PQvHtkv20GxJYd
-            J45RYGgekuJ2EXc9kPaCuSex/0BKtYybOk5ANRv2yGeUZlc6EoW8/GZ4sHXPY6um
-            tt1DdIsMNMjAU68EgRkhmQnFAkZixJVdDR3u4MNXFUr0WdVIqzjFBavyrkcK6HjS
-            XAGhFNWdk5DNZ1ChGrMKEnYCZEB6XNkofa7S2xAomEoxyuCq7X2vbfBfqDQ/Rtcf
-            kSx0TpIOSHxefSFMduPz90rDqdZgUW0D3GND0PD5XRFFiJxxdrRYPux9MDMd
-            =Ef8e
+            hQIMA7uy4qQr71wiAQ//VOfCE4MQxdlmnzN8BYlmlouOePL7E51T4ERhLpTrCpZF
+            5rLhni/YdGDyKtPOm/9nIeF6zr5FCateZdArJx9QVT7xXIs0Tvl2xZpRvDRxHwyt
+            o+zFTUUaUUj8b0V6ZR0jnjPJmhK/iwpTbG4aCBe1rWl+bUwHt25KWtgAfyMtdJ0j
+            SUcuOyjcc/hEUuZeoDNEwxbbWsInA54/hfUjCJU9iLUzC3zc7k+5PpsZfKh4ABIA
+            qSj/+p98a3VrcZLc5VG89z9T0SunBfCX0AmIf2O/xUhUT08IBfGti9XyE2TC7vMQ
+            WxX+sYB4cK+tIDcWAMWipq46iRVhWNS2qjdRS8tUpwoVsVLZSrQiUdIxBtzlJqrm
+            toN36T1b8Vl3XS+LD53oWDJ54YnnSV9oxmBjwNaZ5dGVkz+FoBNqLab8FZ8GZQS4
+            bFJLjbuq4hxvgD6U74PG/feLnxWXjJ6w7t66VqJndo+yqTMSzedM31iNqqp1norm
+            LGjT5QhFkR5NwHdAN1S9AlmMm9tGxIE2GAHKHzPyrvus47PfgaidtA7KyiNtC88X
+            SnSIF9uT0VYR0MjD9nGlW+VAP08KU+9+vqpVDoqE0CbI8hCl7lMOg5Eyzh44Zp42
+            YyRLDqib/IeUKxob3/L4Ia+TWXOp/dEFbfOoKw+CreYUrP8ltrVk5qozlMy9TZfS
+            XgEJztLQbB1pqJEoBL7bA0HOU4VXEyOddAj9BW7hZcV/xk2DwUJjDhcozAjVY0dQ
+            W68Oc/Fm8/c/UHwpBRSfmxofR2kDIygYS3AQavyXfogLWfdulEbDpulqsmu0VLM=
+            =oe+v
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
     version: 3.10.2

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -19,9 +19,9 @@ pushShard: ""
 # with these credentials on every cert-manager renewal.
 recoveryAdmin:
     enabled: true
-    username: ENC[AES256_GCM,data:W7aZNhA=,iv:d0DosYNdnmJEc3pMIEgTSl3YyUGUvdSFUxty7oGj0s8=,tag:N4U5dbxg2gU/8bDsZKHaCQ==,type:str]
+    username: ENC[AES256_GCM,data:/BGEPaI=,iv:QTV3fDckhrdxI0k43vUY/6Hr15pCcEQostuxcAHEF+g=,tag:nSGTlZJuclizN2AKtfGG0A==,type:str]
     password: ""
-    existingSecret: ENC[AES256_GCM,data:UrgIv36m86twJhcccQFl5+yDc7+8vYQ=,iv:RekqnmgiD7nmwc1PPdEjX4hBAom9dckvjfIPEFniESc=,tag:NwpbBZcG/FU4K8gRDLmESQ==,type:str]
+    existingSecret: ENC[AES256_GCM,data:P/5gC7128OrelglEo5iTGTva45BOI3E=,iv:W0QngumMdOo/LFXdUrMN236CIHaOh8N9cj1wMEtfr3Q=,tag:5QLyu1Yd31YCZfRRYyK+2g==,type:str]
     usernameKey: username
     passwordKey: password
 # Recovery mode suspends mail services and exposes only the management listener.
@@ -40,7 +40,7 @@ bootstrap:
 # certificate.yaml (letsencrypt-production, Cloudflare DNS-01).
 mailTls:
     enabled: true
-    existingSecret: ENC[AES256_GCM,data:mYuo+xDaQyYhAE/3iiSj+2HEcZF1/w==,iv:8Pauul2cBj6Hu4QoSJS/LGMpofkaZOJJqJJLDjkQ8QE=,tag:yf3216LoI8DfqQDQplhlDQ==,type:str]
+    existingSecret: ENC[AES256_GCM,data:Mi40TeV+sRmZaEBMsOI0qgXWkMyNmQ==,iv:ExlgVMe+CONDWLmZY4uze+jhVvXN92zb2ptcLCor3Dw=,tag:4VQ38SxY28yR7kp1u69auw==,type:str]
     certKey: tls.crt
     privateKeyKey: tls.key
     mountPath: /etc/stalwart/tls/ingress
@@ -120,28 +120,29 @@ podSecurityContext:
         type: RuntimeDefault
 containerSecurityContext: {}
 sops:
-    lastmodified: "2026-08-20T21:26:03Z"
-    mac: ENC[AES256_GCM,data:/Csupnf8vdHopaEP3+MOjv+99hs1muhP5mIZCNObOoEI3oxgJMNWHhi98YzSf4d/hpubTIkirryXrtK+bvdBJYydcdxd2BKPeFnVQwGdWG8VTZoW/8xWSufKOxGsJtjKtaLh5Q1b1WYsTKsfB0WF1QlEig4CWXtDTuCTncQktvo=,iv:v79M2+gzuMPE0epOCKuFs7VXnzdkeautJFp7K6PP7f0=,tag:ew9yozsxReJgyrapnQxmrg==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:Fh5vxhnPiSRaC/xMV06GwoNAqfiZYJHFj3xKrWzMwau2aC62JTDkEpmm/UN7w4ILQk05xjUkcoSJF5IcKT6+gjkLRVt8qwiarJDZ3SbwM11x7rm4m0wBTJIMeytq1h68l5mQ9i5yW5bxnBNDpUqaAAmq/Ev0/+6lspXw/kfJTUw=,iv:Tg5ZYPd2bpTN/gu99oJEcl0aKiNtX5xca0MUfzCXILo=,tag:2IKyAEuTjp8QhhUaNb1+5A==,type:str]
     pgp:
-        - created_at: "2026-08-20T21:26:03Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAvURAKFHR8V4cEhWqXh2hhTklHH4ob4lUC5nbIQQepSlm
-            MgVKyOVtOb1fcyK6nIFpAFEkiUQrg3pffxv/jCKpkL+C+UecUemuL51CgD/zGGkk
-            LAWqpSyicSG81yx1DVNvbTOGozwbl3YvLKl2mQz4gvfHe/Lf69EHdPPPVdoJS9in
-            DlZ/jwSkyXX6D4l9op4fKCW3uqTXlRWUSY2aK+sYsbINeQD9u6pdfF0Tig+Gxx2u
-            0B+UxknMthkPEgWAjX3KQTahlu8Nbp419BRg9TTIu8frkNvo9tGXJ0cd912yBrrV
-            iSGq3GZ8ZLpHJoGRK/yfL1gsNRTLAFed1HPQ0P/5N19zJojf8bnm6HpMbb+2zT4X
-            4KugSImWtczsXPKvtysUgboXJYJCXwCVaIwQQ6Husz2W2fjwLT4aj6GoRn6hi8pL
-            TTDi57iMfKmbHOZsxFM47odM95u/fPfZZjZmk/51OkJD1hndrm1QrNdLR2/ZXSTk
-            kgblBHzPUMkkQHkGhk4HjQ82OCfKEi7S2syWtEqHQD0FKrJsZHpF8JJcO4ntyYCr
-            SWzFK6LHi1l4LkswrCFv+/HfQGGU3g9zYUT9c8ys0taNkHXUS0sDgLgC9esWxTuk
-            I0K7TEE6HhfD8CTnBiiqz2OqPyCs2ukUqK0DLrJvuQZnbL3s5Z8p4ISUYJdmecvS
-            XAGtE+9OR+2fHlR9DEa1oryNl/IHpm+ERSHs5PTSjsh2yyPpILln20DZxx8ry23A
-            ILyBwxcGVH9cSd2vH1doK8IyvNwh4bMFFbj3OOUsWBZaqqDQjJxOprumHA7P
-            =1Bee
+            hQIMA7uy4qQr71wiAQ/9FX7SR8uKEyIvQYbNb8JdhsMCjbioQc/JMvx9EWjqhIwE
+            WTsntkuZ0874eXO4c/WicYNHtxNmeqHfyt6ByVq7F8qIsHb19u33qkc67tjGG7rh
+            svebMITMYgfqdHOmblLMCAHVoB0tI21nyPbf4POUHUtsP0IogUogY70x2a1wefdS
+            RpH28+VIcKQjK2l7JKIkQ81+CHy4RV50/CzVUOojSOeNPDGtsT+5I3sf7dHuj2jF
+            Ab5MhqXICRDlTj5AXLNfGuymILVjKWytRe5dR02EpuvlLUkHH1hztZQN9TaV92sj
+            kcEz6Qfft/PudcG4iZj6yqbjAoZjoSGEOwH/gRONa5dAamG/QGXFpaf7z6pPKHal
+            TQPidrFADuI7upnb+1xK0rF87FQON+p4py57/H5E+0FueSqXs0MiHgc4mL06IdqR
+            uoOODfpp4G66uxAqBxs6YvEPYxT9yib/keUQli7gFPwRjsZixm2hiwCnDPNR11gZ
+            HjgH3XN9Ba+uELuNIRtU96uWc6HZACrq0PmCvLKgvamDd0LbK7yD1cX7OiD4XCP4
+            G7dllNeAgEUY2ha3xE93cMBDirSlN0LbV+NYFm2MR2IluI1DkaVDqLa3ajoP/7Qp
+            2zop6Mp3QEKWjZrS27eEjHHIcjGqbfvaOI1qXCHGw3elM0XkbKtaMmqV4rwjwjLS
+            XgG9T3aqe9VCK1wyHAdsHsSgjVz+44YgoOXT2HnC4nSNej5xRZBEIfF8YNnCBiY8
+            sLfjNlnSVe6+x1H8VZn4NrXGOz/kwiWpMEMEQuCIbqPJt45GM+GtC1f/gj8eMyo=
+            =IbSO
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/network/blocky/values.yaml

@@ -69,28 +69,29 @@ resources:
 # Full list of options https://github.com/0xERR0R/blocky/blob/main/docs/config.yml
 config: "upstreams:\n    groups:\n        default:\n            - 1.1.1.1\n            - 1.0.0.1\n        lan:\n            - 10.99.121.92\n\nconditional:\n    mapping:\n        lan: 10.99.121.92\n        cluster.local: 10.96.0.10\n\nblocking:\n    allowlists:\n        ads:\n            - |\n                dealabs.digidip.net\n                s.click.aliexpress.com\n                fonts.googleapis.com\n                fonts.gstatic.com\n                wl.spotify.com\n                www.googleadservices.com\n    \n    denylists:\n        ads:\n            - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n            - https://adaway.org/hosts.txt\n    \n    clientGroupsBlock:\n        default:\n            - ads\n    \n    blockType: zeroIp\n    blockTTL: 1m\n    loading:\n        refreshPeriod: 4h\n        downloads:\n            timeout: 60s\n\ncaching:\n    minTime: 5m\n    maxTime: 30m\n    # Disable negative caching (NXDOMAIN responses) for dynamic DNS\n    cacheTimeNegative: 0\n    prefetching: true\n    prefetchExpires: 2h\n    prefetchThreshold: 5\n\nprometheus:\n    enable: true\n    path: /metrics\n\nports:\n    dns: 53\n    http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n    level: info\n    format: text\n    timestamp: true\n"
 sops:
-    lastmodified: "2026-08-21T16:53:47Z"
-    mac: ENC[AES256_GCM,data:UurGQEnmn0HR8d6e7I6+TvNTGDkp+4z2qxA3qR6s2ckhSrri40Dbhl2zYMHPzkch50HLbLmgDmkLPuvwVvvtRA++46IWCvPsLyirRgHfLCF8rvvJ2ydbUyRKspQi0+HiWhoQzsmC7Qn442iUXoB1IoSNR1Y8n94uVvgUyqTalkA=,iv:XnNYtp6mFWILZqP5JqjmZMp26PQnefZQK7UJCgPMYnY=,tag:hexfIqW/+tKvVY8OT5pmag==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:AHNehC5esPLPfdA7IzXLEs2j/W58mSEd4KrTHEYE7aquR6TNScLpYcpGby6Aeq8q2Xy2Q0y3fRSiUbYYwdiN/jjToI2QpolhPs/OUI6I1ygTtRlXxWdes12va3N4K5unV3XA+9skaJvowYPm3uyuIVcBXLRvagVpTKEvwQp7zdA=,iv:7Y2aflGaabRYvXXFMF+L6tmVcjBbGPl+AEs9O1fWPMg=,tag:Od7rKT14x9UfwxRwtcUgFg==,type:str]
     pgp:
-        - created_at: "2026-08-21T16:53:47Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//TuHosCarvDdeJK4Fo062JDb9KBUxlmSoSRuGFik/97wA
-            9xBDzqoMqptnDgd0J9FY4an9ie5M3aWyzFvV+LAgE104vD4jT0Zi35N5nKhTJLcX
-            KTLs61jgNnOo7NYww0zikzIXY0rqk+tIPFkuiQQRn6f5s5TB/FH1NAe4VNisenYF
-            6NhgFIZDyt10y1i75bLehG3s4c1OSvAQ2W0+Tti3kFGpJUqmf9+5jdC0sHQfpzFR
-            QOifTKaSp8zHuRx05/8DzRQrVohBjeIQRJzmgzQ8oynZTGTt3q0sP9+Eo9MZoPD+
-            Oe6cEoM8fPN2EO0BpeHWrEPsbF4V8KW/fd6sCUyGeGVxTIssupxeRVrN3jbANkXW
-            awz35sGhUBN2hloK7imy8tcw+FAZHZIFZhzMfEWGpg0rJSb8bZF8LEgmnEY7gq4C
-            x02lJSKHvnKpc2oKlyK3IrPnwqfr8ilZJn6Svh4IW59tyhJB/2eRjKT+S/laey4P
-            PEr9t/DC+kpndOPxkS2gxD7ENljdh6IfOLTQu9lQT3tA1mRM7HZUb0TVS5ZRL0VJ
-            zady8YZiKZCGTGl44pDdbG5d6r/h9lcmP6QeKnCU4KCPJrCUBWVYHxDz2fFQ5810
-            49FdWloWEGk2rM/7xW2wz5PD2XXLuiPyRhAz9nJ6iTMT0FkvxIseJ8uYgStQCnDS
-            XAEIZAmMcySSzP93SeevQTPPeTC3WrYcwfUVV5871+09M0eKURZqaWmnvZiaR1fs
-            fMPynVu7uwW65LDFdH2aMgp5NY77NZTDN4wgZkYQ7CG/IMA0GOvYS2J2XTFi
-            =7N0d
+            hQIMA7uy4qQr71wiARAAsHoc6hRIlKt/qGyDLRLyJzXFtgfkmgVLIQzRWS/kTsaz
+            ouBD8r8wSQfRxtZhEGkSU6XME/8tk0dy3P9Pcy/97MA69euXaJwcmtQSirO4kEmz
+            VuJzJ/pyH8aEstgle4yb0iX/xe2rKA4NgKJFvAOqPyBZlGe7+V4zM1m54LLGCYKk
+            QrfBzmFPiAZ8p7lzoeFepzQz0pHjCP4Lmk1NzMP1ZJcdR03Sb5xhq/ACjued8vlV
+            zb87VAPnacvsIqVzVi+pq5WmVpFNEJkudD+hSv76YytI8Or2OoQI3CGkey1lAcZS
+            M7x2K+kKSkq4uTTUdsiRKEAtAIsNzYFZJqURklCP+ED2m8B8fP5IK/TaDhHxvHn2
+            Avi8sjAxlk5HZA+vPIv/oDJgnMiSpiROS2YWSr2By6De/uGfVwWC28y6qffUmxnU
+            hxH/170L1o1QkfDZZtjDT9Xp4pIya+Db+ERNVlZ4g28yHw1ONtHWBRanDODw7dfJ
+            rubjN6BTbk7zWMgAGjUpc+9TR3LiFAsRUEwYOA1OIlkcf6ue5ZwLxOS4Coy/rTBU
+            eUuKwvcBKbuCJz8BnE+3kYeKDA/DnoD22p4/aygaekO5DyF54f37D7cejrdBc7Hy
+            cQ+zfa3Gix55kRX18Kbed1fHn7KA16/91jpYG0AkkY70cLniLj3jmlfir7am1GXS
+            XgGkye2YsBusF3Tol0a7t1iLSCOpqyVAfEADB36VCvD+BW7wNJWAHz7J3THPtZTz
+            /MkKrMn5EUU9k11dSmy2vrSQFRsHEG2lhwpY7AerQcpeXL3h+il1H959dMEvISA=
+            =KsPm
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/observability/alloy-values.yaml

@@ -8,18 +8,18 @@ alloy:
     configMap:
         create: false
         name: alloy-config
-        key: ENC[AES256_GCM,data:aevkZsfe4c4H34BJ,iv:4vrNZWwYWaxJUKGbNlnZfk0NM182nBQZuwvqUPslKNA=,tag:lh1iILM3uQAt0An6kN6EHg==,type:str]
+        key: ENC[AES256_GCM,data:RlUaIarJ9nfEU4ou,iv:Fu/T7W9gWVLUQ+/Ts4Lc1VLkmQapRiLyrKp1ph+P8mA=,tag:OFroKnEFq/Q6gXhbU/Bw0w==,type:str]
     # Mount host log paths so the DaemonSet can tail pod/container logs.
     mounts:
         varlog: true
         dockercontainers: false
     stabilityLevel: generally-available
     tolerations:
-        - key: ENC[AES256_GCM,data:zOMWiA9dG+8o,iv:yHp9aBczV8nVRGlJmsBaKs9WdmE3+ii8gWOaj5Xok6M=,tag:8c5ZqBT+vvC0WCW8mi0c9g==,type:str]
-          value: ENC[AES256_GCM,data:2Q04VR9xLbQ=,iv:6+tQXx3IGUIcrse+poG4X/4pS5dN2dKvhb79sCy+nfA=,tag:jb/TZmGpvdsWnKoC5NdCow==,type:str]
+        - key: ENC[AES256_GCM,data:M3Vyi8mZ9N/V,iv:SScQdHgTcTKZN7Wq3pGFHU3UE0zO3hIG8dKpRtsj6iY=,tag:QpJjorykGH4i6PCuH/XGRg==,type:str]
+          value: ENC[AES256_GCM,data:BBn840i3iUU=,iv:t3dSOH7Z5DenpqFVbtWZZvjt9sRcff1HiRlRyGKXs2E=,tag:N5VsZN2ZFE9jTqIZ1rYtDA==,type:str]
           operator: Equal
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:aVq8GU1ZDg5m9XDEI3PoVbbykU36SnKpEgrohvZ0IBmH47qDKg==,iv:eMcHRO5mGp9hhY4KnuBmdPTjd/9lqtesjA/RRSu4QMw=,tag:2jaGuogkLcIuye2meJQMDQ==,type:str]
+        - key: ENC[AES256_GCM,data:jMLashg6LfKAhJBTNbkoGHJhn7okuyHu/itGSOc7z3fBzS+u1g==,iv:pGMyTOP/h6p90mcjYLIHYvZdPdyknWeh8+FlHzd405w=,tag:54qWJeB2qsjnlDqh9iKBOA==,type:str]
           operator: Exists
           effect: NoSchedule
     resources:
@@ -30,28 +30,29 @@ alloy:
             cpu: 200m
             memory: 256Mi
 sops:
-    lastmodified: "2026-07-28T13:46:53Z"
-    mac: ENC[AES256_GCM,data:u6J/EIP5aFtOi8ZtT8BPn978wJAEL1E3r0WcmG5WIsWKJBZMMQHUYRmHgkS6n0/UMtczWoCdXlxObS73ZQMSSkdtagQHE/HPh69dDdGkjxyM4mlP+YMwcnIQkxpJBAQTERXA+SVoWCZb7ztKbiJS+zPjOCfA95ixQINmBCdUgEc=,iv:WOXngWu3uNWYp18/xWghGJyONBrq3SSnPDwbjHBDozU=,tag:1fasTfuLBGXBCo9JPytsJw==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:9sMkdDmbNDssQ5kqiRrx+rWCHQx4ZdwTFuA7fvUgKpuIGN39Lg+fCunfRXeZ3uRQRq9gnwOvS3lET9/NyXjRZtv89Il1XZX66AXn3+jlp3L/t420qdGt/jb/m+lAWoB4sFKO2G+y85WVW3lKOerciOS/8uknuTX3Zdo6Z1rsJew=,iv:pHEK9Wj6NRkJaMBvc2/cgUnKT3oBvXAux2OLTFbhT6w=,tag:ww01aBQiNqlTRbwaQr+A/g==,type:str]
     pgp:
-        - created_at: "2026-07-28T13:46:53Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/8DSD0jEn3YE7XHTm4DWdfLHPs1IVg9hyiWSHe5/xH0siD
-            zWonfjcuytw8EHDzv6pQMNYmIpyAmJ92Al4ROJmBV8gZ59+U9goHmw5HgaQAupBJ
-            /gy8iFBteGOHJT+XJPoVb/bu449f7Vle4L3DrOAl6mwxE0WT/7ERoQBeSxL+2OTZ
-            iDPdq24Zy+crDHpoM0GcSnFRLX5UpmL2QXGB8PHyctwSQoDW+sbAY2ME6buOw8HI
-            AremKTRtFm6Pu1Ksdh6ZicaHpLSvLyByPPt2zYhlBQsG3s/SjJDlnakUZHhm7T4o
-            oHzSpKqV7NQbE09ZMyGJrEkl+rfCPeu6jHplW2EX3xjqLWNUF8GHcsDWljogZxXF
-            irBPkyKASEDdkHZgiZobU6BmvQlxILj104xNtUYTTChcKu3s0d5BrkIOGe+Y7rJd
-            fNvMfkmO8/URBgtsXy2xPKo0Jzu/0pZsPEp2lxNeyElwxQqo1CFwhKZPkeQ2eLpu
-            4X7/CMN8KJr6jLX8HhX9AivlCj+2CoT8SB5GAPw4p00eD0GIMWSNyOXjyW/qQZi3
-            82EyX9KIpHjALoOI4/3YgFpUO12AEsjirYKWkUM+IoDp5l+YX59QdM7zUVVyzsTG
-            2EXEdQqYVA7DIcMJb0tHqxDGMGxNayaUsikV7e/kcRVUyDSH+xOfaSUrDTqqv+XS
-            XAFro6848HF5uMIP4pfM+dxzkc9rFF4il0CuGWlscbz5q+Aw9LImGbpNzrWk3Lpi
-            beuwWKFTZ8zab5TH9UF/xqsQeg/nyzQnb3fFPk+owvY7fH6XiYbN5WjKjXGW
-            =kBpp
+            hQIMA7uy4qQr71wiARAAvcjaDA3Rf0PYKELD1RJx5PwfZUdLpLDlGML66GsJGtYg
+            GlnhjSHxAmvJOhvCkrSpD2EGSCzAOHzkLdd2pEmhm5sDIpLl82bJm3vEMGCI6iWs
+            pKJmHFlxxVoswnuvHdj5pymvz5sv3m+Z7QtjX50IsTUiSkMA8kLb+KaeEs9/509g
+            Ond815msz4rfv4FmfjFluzxn19IdPSHB9+S2vMUuZ8iccvJ472RQGTzsOcstSk76
+            Do50+pNBV9TAsHT0j09fasSAHEEjU/xvQvFkgctqIfN0L5NiZu5MuJkEtqFUf0DA
+            ccZCmadZRlwsbF3AZw4026ZvHGpg01MNAhBYQyJsZ97U0/droaTbLSgrrkatShcy
+            rGIdn8WamYflzyr/5yAXYotmUroS1K9bWk7lcLsjD5IFKYTJH7k82AwxYETbOb2p
+            k0WxHZ0utfVm6BlKgJkl3NCtyKExXPnpMFXG8yX0PwHLVhtJoKnoRo+J7DYzrT3n
+            YCVF0xm+y5tZc9Uw9986GoctqAslR0SY3UNU+pJefAXIBLo+nw4VTqLDwB5uzPQ8
+            U4cqx6P48pBaP+wGem9Tem+sh+M4z/71hagPFOOLvD2FxLgY5rRYZxzx9yPi2lCl
+            5wU98CFB76r12lcnlreGyGYrQvLM6ZYHbsai8NxP9X3OKeTb36jC3iNpQktGVqTS
+            XgGj/hGBQZb9GfIS7ll+TRVWvDrHsNpymuPCyz56WRc7ZwhPzllSDZqFUCcG3Axz
+            +9lkm0CozmxBgL4GW/UJBv0xftdWyoT0T3PjrNfhnU8Zz+uyyhNnK/ztThZmwr8=
+            =9sVv
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/observability/loki-values.yaml

@@ -71,28 +71,29 @@ gateway:
 minio:
     enabled: false
 sops:
-    lastmodified: "2026-08-10T20:52:47Z"
-    mac: ENC[AES256_GCM,data:sT6EiERjNR2hOgsogpkCM3cKRctkGbcxcIrrJB7jb8KJZ2HxGdRGP7+U6uNF3ugxzPcT0O4/80qlEFQ3b+Sf6N+vSAXaBsab+oh7uKt+9En7lgd5V9zkbQtQSS+cr+dlUhU6SOVMCJ2weGyfL59TvIPpxVLy2RRfauAA5W0fl/U=,iv:Bcx4gaBUKZ3GBEKCs4KQMaySuT+Fb7SC7URRrMWRRU8=,tag:byEDzUiP2zdTjPyBO2j1sQ==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:evTELz9bIobCkZDF9+yXXPBjI2Ua95iFEJN2b1mr2pzaei7sYMbseygjtn2RWz33bEMF3q18MSX5XmcqLBs0T2O0RO11yu1KG1QaG2+SudGhCv9+D5DggIsDlHH7PM32n9mX6brA58gD4DS4BKTSHm4MiWQFVxi2GjIdYnNwwww=,iv:KFFXx3MBq0VzAyUvRK//VEHzLVTVd1Zxwwjq/QHqPZ0=,tag:2EAvsPnPnt6dVBF3uXmjfQ==,type:str]
     pgp:
-        - created_at: "2026-08-10T20:52:47Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//YxPGeiBdLh1nQ6BiV8hWCne5bJA0PcvafsB3caBLcVu2
-            wg7mk+MlcHolXLOpS3DSsdYVlfXr1+qIDToXmFeuWMgeGiSUL5mQghIiZfHlBzwT
-            7aZUcKClYsWg5EGUN9kLkEpqcakrKN/GKE2uBS1Rh0fZUzDbrtugacWfNHmCymQ6
-            TkExLX0nylb4TJgQ77qLk0iAFKwyJ1xw6x/mcc1z8fbUKhyhs9e9pErhCH8f5myl
-            /mAxx3rRu/bEtfn9IRO+XVLLw3l4b0KK21koFi5ZVB05+sz91c4+UNLSHsHaymtP
-            IAcRnaMa1KyOZ9iZ9iVTbFgFfTZy+4N2dm4tYAyvR9Nphj0+XhVfjeoljEh4HdXY
-            SdtSXh/aC9H45Q6wwT7PvBHywRMLYLj0iAoY++SO6/cHF2HGtZJ3MzjrjcUyUZHL
-            oCK7Qmp64bHdYXJQIIprT+cB5CwUPOgW9lE/LbRwIEPbFzCn6q2LMrbZ1Cna9Dd1
-            +/AELxscykqatnuRYP+zNEl4y9Foxux4usXMDCl0piNnVWU1b2T4tBRitD65KUnG
-            yR64Dk9E9+OT/v6xaHKxIxBkfrhOj3K1Tb3tyEhgfvan3x6JRMN1bt4wrD0+Q1s6
-            nY1B/ya63Qo3JHm0461S5oK7Ncv2Op4y1yr//LJ8ueFEOB6zRYoPn4O11WV/29zS
-            XAHMOHZFr7tUXOV222SQ17jIFL/5vrJ0F5WAWrVla4hGRYFUe/Zt/9RABDcKZRWL
-            qzgLvXkfXAiNMqJd1CrOSXBG5MyHoVUYSZef4HXABf2sOxYsGqIgFqUciOa1
-            =OE2y
+            hQIMA7uy4qQr71wiAQ/8CEL9TX06JlyWb79yvro2icKUtd4KCpeD/tBnAnn2ZNbc
+            zAL5xcMIk0FfJS4Rpi3isUimawVoLMBEFhdbNGSq6O/7Za+mmG95eodBalGEe9d0
+            vx0yZQHNNhVZVssMwixApcB4H9bss2qOZJ2An3iIak2dkCG+c+3r+RyeVvOlLF0N
+            Q/b4TEzVlnlHt3gAti77mku0rTbFfGNiKjC08jVtyqxXxSCiDCl97X6d7KHVXyEc
+            /F7WtoYUI14GyKZd5BX/XDuyEOMmGd+ZmM73oIIwrwlcrFnkzHyk45aqrruSpXns
+            xim9CO1Z3t8/wCc3udRmY9KnbKBV1vX3SjGecUi+tBwrchhJ9AqHRMQgOuDMEDx0
+            K2fCAAuww7ZdHCI8R7nBYOj+mbfgy+4vJ6Gtoeee/z7NITGAIZFbggHp8Tyv73AV
+            hxdaFj+//SzHTCu1VAeUTo3idFByAjPqFyIcXJwOhjhUuMhTGG4w6ZolbwNdt2jd
+            1OAxC2q3iECF2sCHDIk0ZhAitnulnilr6YtJ3tdevwVUfQOsuV0efRjkdKoeBHMp
+            FghsUcbItQuZ36+axCrsLk7d/K6fvetPx14wCX2xWma25S6+E4mRbvOlcUKfc6WE
+            /IaM8kObsRYxbhW7gfyBr/4qpGAUcQOJX2psYEXZVZJ0IwrFC9RAbIXYFf1Zv2/S
+            XAGypKSrEQxTBv+0zAi/cPVNZsx5mJR2bYGj4X56z4VVuLQRxVq9X4hLUxkLhoGh
+            0mmlW17YMU2+eVx9f5yTDyHlfRbS0UuVhmLEYtWfAYOWlXvuBB3mA+14ZoIB
+            =LgDs
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/observability/vmstack-values.yaml

@@ -33,11 +33,11 @@ vmagent:
         selectAllByDefault: true
         scrapeInterval: 20s
         tolerations:
-            - key: ENC[AES256_GCM,data:u/hZlRGlQsjm,iv:EIP1fb4hFx22j2pBmlmtLpUWcCqP1mZgLdgtG0UHnD0=,tag:ZDc67BaFIOzgobSOxzwoSg==,type:str]
-              value: ENC[AES256_GCM,data:37vtp0nJ+e0=,iv:v0Sch84ysia+ka9foooh+lqAQTc4mYhDxMRiiimIWy4=,tag:sNEHQI89QvMGj60dgoJy4g==,type:str]
+            - key: ENC[AES256_GCM,data:ObyzBcZsnqG5,iv:2YZGA40pHj1LwUxSI6iS6i+YajmXdOrzsdg5FfpsfbA=,tag:AKfrwE+qN9usqW/KwRdnvA==,type:str]
+              value: ENC[AES256_GCM,data:5QZSm1cB9r4=,iv:a6iv6SEvHegPNEyTtyXel5nCFWsVsqQSb6x0NFEMJAU=,tag:hVZcZqqsYfeausuGgWf2RA==,type:str]
               operator: Equal
               effect: NoSchedule
-            - key: ENC[AES256_GCM,data:xBpooUuWDs5ji8gvswL9dBc4hOsqlGpfYtsjGj0t8k8ott/Hdg==,iv:vXQyiFjim3d6qUsgl+lyVaolpvkY0OC6S0JraGuyWaM=,tag:dM6H8evZAw9BTa5UmETmxA==,type:str]
+            - key: ENC[AES256_GCM,data:pe9O4WDtS2wKj+kBMyvK46W1JXELB7P+0sC12OoHWDifeHbbHg==,iv:NNIxYquZCHtwwQOn+GLPRVqP5Bm1+tkJddJximPiGs4=,tag:KGdbdUdT5Pz48X1dY2PfOA==,type:str]
               operator: Exists
               effect: NoSchedule
 # ---------------------------------------------------------------------------
@@ -110,20 +110,20 @@ grafana:
         size: 5Gi
     adminUser: admin
     # SOPS encrypts this when the file is processed.
-    adminPassword: ENC[AES256_GCM,data:ufl2eX7Q7cyIhXUeZxWgVeHa+5Fj9g==,iv:FxaR2v2PhfF+zR7+ScAsEzPQhpVsGly55ByXw6/q2jc=,tag:5w2M3TjMkN7LUHcHezpGhw==,type:str]
+    adminPassword: ENC[AES256_GCM,data:Caz9+0gCg9tGW937xMdDj6yJAKaz4g==,iv:5BAt1p1zpdaabizJDfGzCymb+QESq9lqHCT8cdVqs3E=,tag:NksoLtm5QRN7kO8mTgjFvQ==,type:str]
     # Provision a Loki datasource alongside the chart's default VictoriaMetrics
     # datasource so metric/log correlation works in one UI.
     datasources:
         datasources.yaml:
-            apiVersion: ENC[AES256_GCM,data:1w==,iv:XkLdUqFlwufQBD7ThJ+kPlhsWcY+0cqWkK1Mk9XOK6o=,tag:xk+jVn82cmPqTBqYarzfZg==,type:int]
+            apiVersion: ENC[AES256_GCM,data:hg==,iv:3t/7j0toxZ31JhpOZoOz3WjjoWGhutg5Ga5WGJjnRZo=,tag:bSDD3h0xoQcffslmuBPOUw==,type:int]
             datasources:
-                - name: ENC[AES256_GCM,data:v8Ub8A==,iv:PETLfpJPxLv9UcYAqWb+gaJTIcNixXRd7rztjhNnH+o=,tag:sdNcDdf7/g0x1P0X7u7egw==,type:str]
-                  type: ENC[AES256_GCM,data:mYW4yQ==,iv:003u1YybknNt3pGVLtZNLfCWqi/gcq1cXjzgHa0wVnM=,tag:5B7Zo3KDgTmGrytpMll+Gg==,type:str]
-                  url: ENC[AES256_GCM,data:5+SeDxRQk6qTV3YZ6H5Lw7qgvjHNU2riXfnxXYkx/MVi3DBmm5ugL9PpEprYYt9S,iv:cD/G0SUhuwxX5pjWuyQ9eUdTLekRbzEVo/0AgtN99xs=,tag:0K2BS4IGBNHcTWLUFYaw2Q==,type:str]
-                  access: ENC[AES256_GCM,data:MrPS+4o=,iv:AZ0Jo0jhUhqETZnD1PhkZuQN/GqlHmI7nwv+ket5KOY=,tag:edCTNtS+fsjpN67fiAuoMA==,type:str]
-                  isDefault: ENC[AES256_GCM,data:tL41ZSg=,iv:FSfXJumXRrUJeOdupCRuii/aNY3bbb9tjkMA8JUcV8o=,tag:s/FOwc6s2C7X9KKJo+CKng==,type:bool]
+                - name: ENC[AES256_GCM,data:w0CKrw==,iv:sJJWcnHqVGWQg70DEOtO8U8NdIKqxNux8T3N9y6xn0E=,tag:MuozFD6M3n/6Gua+c6ASMA==,type:str]
+                  type: ENC[AES256_GCM,data:oPo9vA==,iv:l5itcQZ79LA5n7RYQ+mF5ZKlFHdF+3w+bC/4cDnaWkU=,tag:q7avCfUl6DmqBZe5VHQCTw==,type:str]
+                  url: ENC[AES256_GCM,data:PjGswrAD+Y3aqWHmuV60ppWrY+pmnVeezfI8BiD0h2CeAh0Yt0LxvMIIqPnvYbQT,iv:oEavqV6YMYI+iZ+tGs70N2moVRuBrSYDlruS2YjeyZg=,tag:nEJOneNf321DnnwW/y5DQQ==,type:str]
+                  access: ENC[AES256_GCM,data:QC4cUVs=,iv:TGlJgdVlvsnLO4AlinMJ5pX8LLSz7E1XmFZRyvo/RAc=,tag:vAEwvlTdHWfitJO/E/86fw==,type:str]
+                  isDefault: ENC[AES256_GCM,data:kmIxwOE=,iv:3aUjEF/CNF48xnV4/ZLLMI6XQ6N9sSW7lD8ndeJOf4M=,tag:8eqVGpyu0vtxubRFyJNspg==,type:bool]
                   jsonData:
-                    maxLines: ENC[AES256_GCM,data:NKwyqg==,iv:t2Rsefq9jsXpH92b/SiF4mh1Sy/bQ9SQBhg6xqc8nbU=,tag:w4o2v9s2BkK+T0PlEyBwBw==,type:int]
+                    maxLines: ENC[AES256_GCM,data:oVIHOg==,iv:0Pqr6QHMuChLx0fW3BDo6F4DjD+Db8KfaRG0d5FVpiM=,tag:p9R7APLX6jrqlpfziFe1jg==,type:int]
     ingress:
         enabled: true
         ingressClassName: traefik
@@ -222,28 +222,29 @@ extraRules:
                     summary: Low disk space on {{ $labels.instance }} {{ $labels.mountpoint }}
                     description: Disk usage above 85% for 10 minutes.
 sops:
-    lastmodified: "2026-08-10T20:52:47Z"
-    mac: ENC[AES256_GCM,data:9R6bXpoKxowWpkoSOcjxkVI1EkKaoCiy7/c3/LYE81j50ThgPUXlcAnf024D0tXHv0LYCJm54qXNDwkg1Jzb3SYOt15Xbw9wPHyxtUFHKDb12BWGtyrE7TRw6VYdXs1P+TzZDJZPJJjSyTOW+hdB2WxNu7QG1M27Bg3DE28iOdg=,iv:OQisyRio+fqzdSU16whSJ26rvGibqP4FardJ0p3Ubeo=,tag:fHPd1TnzsmBWKLb6QTP7Fg==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:duINkuCjZUjD8uoC38wXH7j3QbFLw1fM9R4BA5ZDSsR+yh/YU463co5RbqSMOWNz3vzLAvwrx5oIT+mkFvq9WlhqDFBNqTRaSZUtXeBrX9DDng83fG2lRn91HmcnjcdNsq+JuPL/tITvWOZj4B35SCMU4qDN/RNRZ7lLN8aM4Qg=,iv:oH+WXVyya0+UPzZp65EShapOwVKylP23oSl8o8BQSFU=,tag:HVY3fh22qjyHDrnTyf2dHg==,type:str]
     pgp:
-        - created_at: "2026-08-10T20:52:47Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+Kc8P/t7IZ4shbHhrh25wdm8mI27QZ/h3uujubjgoWooD
-            oh+6zF7sqP36hOxyFjGBnmyHCp1Qqk4lxt3mBT0f5TR/q8DkBTbUDm8PTouZTG8/
-            dbEt29r7dzVrH+O7vMf2QWGt7wpvv5iOJsOXBJXvdaiKJCM0noaLryHPnzTbt1BQ
-            tAN5vk1wlDMZ3lPekKBRQe8W5dWAcfo5WSf5dPH0cVcXtDvO86uCPN+hN9dSp0KZ
-            LeC1WPRrNCLoHYxF4uFl/DYlnDbS0mg9DJqRqSvLdMqTkAIZUHEv/5Qwg1nsNGjk
-            5K2OWdbBz2vU/8hoN/9Qmw3gfZHfA4NW+DFzW6bv+5siATSNTObkLCBOHhgWd1oY
-            hRRhJeD6o6KXZhwai5OnTH3VMH8+OYp9wxYVhVDQ4y3+JOtbgCuDI18q7dkU7mAy
-            9nJMn0IgmqkRw7v8hfzjV8T7Ktv/b+HlJq+PB6/UXGaUutgrPFa70RLLAkFfFKUj
-            2oV3yhRHvPTTDXx6bw5knBDRh/XvtX2JJVgp9x7hnKbHr905qithP+tABNAloX3V
-            zOeEBV4EnIZk/sMB5CQcR0A8gznGpskYtowEVVr9pouNaC8o8D2qfCRIYvcaDCFU
-            t5N4te0vg6uLbW9PNokO6rzhJ+7lweC4Ou2zRAxRhSgzmi81ylIdNMKGle+5sn7S
-            XAHRSz9TKJf061m2kk+Ku/yxnzN2CoH4z+x65VvuK4qpVy2dSC00xyXdR4HxGzVO
-            jpRlAuWFlMu32gTa9cCXQjVPkYE0NbniGtlZkdsCUhydnVtNqqdm0JXTNvPS
-            =U+mY
+            hQIMA7uy4qQr71wiARAAnQ8Ybjm7BCJ8yF5dQXsGRNcz62xxLl0hZy09Ovmp8ofD
+            rUpypx85jEbqVSuBK2dXaDrFNnF47Pk5PG1J1XK74K6CZh54SbtDBDmkfi2wXJBN
+            GPZB0dE5g9H6BQwhuv5KpiuwGYHWHpOPeauYImfEoLoVzO9hw7kawDQLGWylSf3Z
+            JpXFSdSMXW/Q3OVcmnN6e7KumceOzmwjbCK5aDoBHEMX8PrG23rGaBe1Y4dMuZT8
+            5dDVO5vaS1SYC81Piak7ekWTeEP6Lw+kGUdJyrHqyCzrSeGxWisBcqZkbSqSgKqQ
+            OllJ2aPwTA6PUNp3P5aTZBkflS4aKGF92gmIAZSsWDcqu31O5gWJ4+aBHzb8KbRX
+            7eMY8oLy5YFndX3zD2dBpLomtGXNxXwD+R2QRMR5hS+CAVEGPm7nF0N5o624OG19
+            vNUNHxaSLoKamhlgPPky0PxqArNrXfZ0p4Cvm8hj9zAMDex9vggXb7f1YE/aXGyc
+            iul3yMEb6Dk/n/91GAE62SsojHer1UyE5JptRdLDrkBiVLoAeV91LZHjqUSDe61q
+            8K6zrZL1wj0fJz+EljExhN2ZfDk+c+UKe2vTm39HDGltDjNbCnFUAUDsYmn7lcf+
+            cKEYliPFfyG+WJfwk33+2Pa8t0AITCBf4D9XFQyjmUJDsVDH07AjUjxl09Za54fS
+            XAFWX2hR+jYN5S2JM07HLwtlyr3/K3I8dlGrNwvqXomFof/U/EBA3e94FKHt5Rnn
+            9uM9de/8j6L18A6hI6FI1P58pcAzO2y67JegarsDgiGqcDnvtNghOzBKRWMP
+            =Oel8
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/traefik/values.yaml

@@ -11,11 +11,11 @@ ports:
                 - 10.0.0.0/8
 # Tolerate failover node
 tolerations:
-    - key: ENC[AES256_GCM,data:w8yu1KXjy/RS,iv:qRmAOxd8jHYZ37VpJ6krTnq66ts6dJkUqHBq1vI8yQk=,tag:BvkZNScyZ+DKm8kTD+xtug==,type:str]
+    - key: ENC[AES256_GCM,data:r4uAu1ni9/Z8,iv:aKgn6DgT9XnjzmotnaEIL+WzUiQ34CazfervJwrYsdM=,tag:EeOY1YZwNCOPgHwXpas3ew==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:sHIzXSsWolY=,iv:xOUgObHD9mAOMDo+4Fr+tP7m/6YW/C0j9EXE4uBoIDA=,tag:OKLki2KMl6Udh9bSFvCxJw==,type:str]
+      value: ENC[AES256_GCM,data:b7AuKuC8Dug=,iv:dmkEkx9fnzPBOizJ+3xCQsmqSwU7wUrfG5oF9FSCCE4=,tag:vZA1OWI+W5On6bGqrZNfGQ==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:3OzBuyLCWw7oFhTab5NVbQFMm0UwxjT+4jT07WtSB3TRD4Wpjg==,iv:w9xLvn+bVXSvJFF5EWe25TmYd6Yd+FneT/VRWbfljbc=,tag:Ehdk3FQ4cWwNzCUvZw9KGA==,type:str]
+    - key: ENC[AES256_GCM,data:qNeG+KkohEaTXocYL95TPDvvhhH5yTa5FEWJ3UHe3bw9F+XGew==,iv:PTnlxh9E9FKpNcdJ0kF+D6dB1MuMRq9b+wZ7zjqch8Y=,tag:UWhOdWwbYpN+fRTFVKiG3w==,type:str]
       operator: Exists
       effect: NoSchedule
 # Prefer non-failover nodes in normal operation
@@ -25,33 +25,34 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:lwunCYcoIshDdjXlLFhCHeKR+CQ=,iv:b/J9Hd8Nl82TrIu1WyShHfNSZCIvsVXhQ2QHrMT3Lto=,tag:fGHxhXjTJ2oGpwH+dkEr2Q==,type:str]
+                    - key: ENC[AES256_GCM,data:bXQphRUpcEmBAh8AjIpA+ZHvdw4=,iv:EgGe9ZS4evXzp5A8+LelSWKRI09e/BzLzlVEHVk9w0k=,tag:qbOp/ziUVmvpEEaZ43nTlg==,type:str]
                       operator: NotIn
                       values:
                         - "true"
 sops:
-    lastmodified: "2026-08-20T21:32:23Z"
-    mac: ENC[AES256_GCM,data:9IRRRPEZoUcfS4Ot6III4+lnsbYqWI/pIrK7BoUnocTWu9ALk+3z32k6euC1AJ+DgIUgQa2fnh2JnRy5L6JHSstQlyTVCiVPEtRy9MyDQi5E0o0GcSzS1ZyJ93nZ9L0SnZ8pal75H7/zvVMiRfhGalcCrGvi4JX92TJ1Z9I24V0=,iv:V6aKblubxqyPlZnHvLvSduKWj7qLZ4D+9W7f8AVSjrE=,tag:Y77HJXq0+sRBIuHB/YvJ1Q==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:0Vf6cvpxBOvs64aA9ldsnbgZyba1cTKd6zyFsTsLzMa9l9OLfpiNS8OmSjOlybUz1T6DgZxpDFPaLd7XbLxwaMMsCYz7pRRYA0+BEXM9B6PM0BlK3jUWKrxWPaV5KxN452BUndf5KpsD1f3n6ZvBMQos+H8fipTxnYr9S/RUmmc=,iv:FssseDQUfUfpikIy38WqCL083KZnIAIW09mntdyIImM=,tag:hly79N865OUxLOCBx+zK7g==,type:str]
     pgp:
-        - created_at: "2026-08-20T21:32:23Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/9EeBVTgJ3xGHB9Gr4glxiFQlLDnpRlWApyMD9Gup319jA
-            N96+dnleON4lnRs7kQmojqUG9+LzhTA887E2kI/e9QBH0f0ZWvkYhCR7I5f8w+64
-            y9MKLTL8TLP18p/xgwoAID9EqXTTO5NMi8yN1xHpWtGeY9nIaaNUWLF2nG6CgtPy
-            +YtIpGzQj5nkr4oRyTbHIWDJlODEjMguTSCoatr02dWYeeTiEm3yiI8LpEiFcPPm
-            60Ou1o2eCyP4jfaqKtEoyIqDSMyFjXnhULyJYrRdozvgsdIA8O/GBCAs7bDOwXTe
-            2xoCNuhbb0WM4mo8U1d7o+mVYcLutRJfsOUAj44CUa3fFvyTVK2jXdMLtWGlEUg5
-            VxyUkouao8YhgTttu2RIfLMMTLRDNaFujCCQBcARVltvqMpfr0Cwceyqf4ix1XP6
-            dQt3fRo44jU0cJTPtgKR9BkmRFFc5RmUzRskETxKHYH0/gABy74fwv2+hm+s7vbV
-            Unv2B6++K/SwAYjBRNQLh5BOGXdz29d89QyOlvrZUmfkLuYnyFpWf3k8S4wlNgHr
-            16V3KKDoDZlb9K+wLQ/o6Viag59HcbWHoc8A/6QExe4CMjYVycwinq8jT7OdQeqE
-            b46pmeeWgN8xq5z4vdNmNfRttqr3+oyQ1GWLboHhanPYkZ/muWz4JPDjau8V6iDS
-            XAHIRQ8+raEddWA6iRPpJRAufQYSJTSNB2kF0DX5NL2ViD3ouBqzEEOQ/9qmd9zx
-            Q8O4GCb850YrPp456JDrpllQlVHD2+lPEdKVA0TRzFD1DujRLf06n2wIMHdK
-            =uA7R
+            hQIMA7uy4qQr71wiAQ//XMQdSw3SGlu3PUrzo0xjaaGipUQgbioAJ8lCf1SP9HDm
+            ghSOmLBBunRB1MfAor/F+YimAGCOlZfeObXKIxydvOPlwgrLNs58Pl/d6xBO2fs8
+            ZGLrv4OEV5loII+UGAoxfOTgkP9ZXRitKceDfOLzkDhhshq1Ew6PlBaiAaMI6s2I
+            CCRqKLrD7tLJ+Ax5X7Nndlrv9g4UgK1xPwsH+h+27U3z9NYrRH42nEdUqtenePUq
+            tT0XhdjwcKo5g1qqZS2zptnf1WfZF4swSZPIsNV34tyOOKIQQmw0+ABVpi8GA88X
+            guiJya4xgoriIHa5pNcpUnrrgOFsqc7ShCLVRep8JteJA0oKlt2i306NlT/PbsTy
+            tQXQEga+IgFyis/ECa1odhKZhK5olRE0upCkzj+QHKSqJkBaeoliMSEUq9YLdwEk
+            CruGUwjs39esVhaFIAv6EEbw7XtZYCx6Bn5fDlh3IQUKpd5BeoSuQgy24OBXj/xa
+            CdOIRhVdTSlYSzVWoA330+F3D846/DZX/pRgueItUEXcC5F+nbS8yWLwg7+ytnGL
+            DOSW88c+y9B0rnpe6YTkEXtXZkyW0LJogVjPbchCyopATy++IQhLNSIwBMpXI3Rp
+            DpyHwG0CMAlSGOzVJgm7XQKI0Sd7iriVqTJYNfrkLYt4ATWZxq+Wqbi/k0OmSyfS
+            XgEAJRybXAmH6KcV7W1CzKXtay/2a5LE/M8gw8BungpTMM0VY5T89OPQ1yYC0hGx
+            YY/pWNt36nwoeG47lJ/HL538sq8QQWyXGrpLae4A3zyXMitdXb0pAW0OFqzBd3I=
+            =z9GH
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/kustomization.yaml

@@ -28,6 +28,7 @@ resources:
   # Dev (developer platform)
   - dev/gitea
   - dev/harbor
+  - dev/renovate
   # Home (home automation)
   - home/home-assistant
   - home/zigbee2mqtt

kubernetes/personal/media/photoprism/values.yaml

@@ -46,28 +46,29 @@ mariadb:
         repository: bitnamilegacy/mariadb
         tag: 12.0.2-debian-12-r0
 sops:
-    lastmodified: "2026-08-11T09:25:09Z"
-    mac: ENC[AES256_GCM,data:Gjvc44UTfro130jSfI5Ceryzl1KHMmMOawmuosAqacSa4y9FfnXgmirDJkqXXYcLYeUplP12TP1v05euwcGPB12L81l2EZN2mxPbDYgoOAuoGtYqTlN3IZ1cVW5ASFWrCPEdClr0DNvtnIWctzhdue/NKV2ebZpw1wrgTwOWF7k=,iv:Hdu2l60/2VEhlNQPrWKMXV96rwkRgn8E1sHM8W7BL5Q=,tag:pwG9n9n69sIe+6fPxKgiyg==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:adk4q933eJVfmG5NA0j6jrpC4n96mtrE0d21HQ3UpVwiGAyTyzZd7Mk2MGS6oESih6Z5a3CpNeZoiFaiU+QERdLA09Blye6379eNLukW8B4FJSaPhVngXHTHsuzM4AKabuB1uZaSbyS9D0HDo85E+PTP5nlouEsqKzqksst6AHE=,iv:Bl+Leocrbx2xwYlfDRoenV1u2GCJrKaApL4N3iOo5lw=,tag:v4lookjjCJiF8wSs3oXQMQ==,type:str]
     pgp:
-        - created_at: "2026-08-11T09:25:09Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//S/qbQ9OuFPkoxYkoh1r6q16kDt0A/W2DsK+mz0uPsupF
-            ybzXWRkWKt0rXoKADx3jOnWicJNjVgcX4+3OISeNc29f2uOglXeXBFrp7/Kxsl34
-            KKK4YeKnFLXsCcb0HIAZ9QNuk5m3qFqPDvgYlbszF9D0CgzitdAltpiNT7ckwaPq
-            0/78byG3kMttTLW1Uj3Rlwm9SAdLcsUjeHSLVpFWaRXndV4TVL7QnqL1OPdIxJkc
-            2/ecyPgkx4Iaonnwz+8iRAv19rQOw33cZtNjF3kTjk4xGahSc4sUf+kX69JJqrXC
-            KNflyyV0K5nVye6EbfftpUSqAUfpAFNdmUK6PEVSGCi1AK9oJjb8TDuYGJDZlNDG
-            +P5/WFcZ3uwcwM8syXm6M/ZoWJRvtjwV+IVV+pbeAAGzpsMzUwqikKnrjotEfPOg
-            teCyTDHCyDHwr6eNclP1YptwrPPdwRbhQ1UTOPZ0spVjqWOO/V/UFYjwx4M8ENYV
-            uwtRsI9fJN3K2eKZXOhtSLpkBNPkKNBKqgLn2Kx+TWA79HEWUTPaO2bpY88A7ep5
-            CnDJ7PqjDYCijcNcILwmQPCYCjaQl3yIw/K2ESGDWJOOs/TZFksoDptjZ4/4Hg7l
-            Hz5SMbY0/6hIVwLCpT8nIAe9fWGsu61ALJjz/pdNjRbcXJlrCtfv8lawGTJeC3/S
-            XgE3i1O4BZ6syvZh4x7ROcEXuxnynZ4wbJpGOLr0fjKm/Sxp39BgkT2BxmqPGXvk
-            n4pSoqI5fCVlRTkVO5Mr6SdiC4A4S31hREQycIWN1spQcJSe2s3gz3ZRDq/1izM=
-            =67H6
+            hQIMA7uy4qQr71wiAQ//WzVHXsFFjzPmzCb9i6k6nG1kG1EtWqMdr+U9axyLdeks
+            fZ+CPL/b8vZ5Y+vTmuHZJttGDjk79ii7if3yhzVB1FKbn5wnhwHJ/qfvhAv6G4SE
+            5NKTj4jnhozLXfxV2BbhS1dPaeMJYoFhufBRpYxq7J9APrIgveL8iuAyEbqNcGNw
+            lZxxB6RW9dBaUohgar7A2YPIp5dOGdspKiz8gGwqycDCcvKh11TiqRPGxxdwh1jz
+            MJ9t9Y71c2wgwdVPWlc3Lu+Wpb+nXrZVi8cB4PjWWmswFJfsE1HHjmaLd8cX+FKa
+            Y3ivbUzv6bubVW8ms2jWfNBrUYyLb3a9xGjpYwUOuCqi5uh0xAKL4BH9U8jY9pib
+            /DlWWQc9MDaFq2GDQls6yh6AFOHuGDaUwxYaBdgo1OlzZGa5fLqfFraEMgS/3fYe
+            HT4y25xhOdbgzPWNe4AAwSXDbciXkFQlUsK8I3WbNzuena3AyucZFKBw8gR6JNg1
+            LhepaLVkYtGzKp/iAECF6xgPqi4r6GQnHPnMvLdJGIlWJQ4L/gBzn/Sx7AOwNDtL
+            +14U+jvPlI4OiupKBdFI54tsDUQOA26ww1y0317x1jCrRkQ3cbQYPJhxuUnKpx1x
+            yVbCPlkxZDZMUKBsRV4KGwvVcbVT9DYCuT7BJXDuNdfhqujf/BolK2kRlYNz56HS
+            XAHhRDxgICV+G48GkXDObUOUaxpqDdXomizYmqZfn+tUiLOrqRVJw6g7JjFmi5DQ
+            hIIfV8iKh65e0zwPkRqECh2d6oGhChUYvDLOQFUGu1Bbm9ej3V3hQUMiKPAX
+            =B28Y
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/personal/notes/notesnook/values.yaml

@@ -1,7 +1,7 @@
 instance:
     name: vhaudiquet-notesnook
 api:
-    secret: ENC[AES256_GCM,data:u/CPTHtdxNIZXadpbFfDDoLEoWI4eYG5oBG3R1BiZXoEJqDa1FjBLF9HOE0b9GVc,iv:5WWXVEWPUdvwqYpXSbOqAQ7Tr2ySEVC9E9g17b0BmOI=,tag:C00oGk+cFPm6RH/JjW8KJQ==,type:str]
+    secret: ENC[AES256_GCM,data:dnQM9XEnpWzZlvMxgB2dSvGclfKuZEe3HskH3PbczTOfNJ7GNF4dwg+mKPmpyqHl,iv:ytJPlLR1rsOf25JxKqo8jqnAlsZg7YwYv9JaAEmbh1M=,tag:botHVzQE3XhXbJxHH/FWfg==,type:str]
     disableSignups: true
 publicUrls:
     app: https://app.notesnook.com
@@ -9,8 +9,8 @@ publicUrls:
     monograph: https://n.vhaudiquet.fr
     attachments: http://localhost:9000
 smtp:
-    username: ENC[AES256_GCM,data:Rp4GgRimW3LQ4xeVvZWq6AH2IxQ=,iv:F41IKMt/gYKxzjr97esOpdpUUIfbWgH2ZW2haiVkrhk=,tag:9/GlCfw44/U7QHScSTHWvg==,type:str]
-    password: ENC[AES256_GCM,data:WqJnxPFO4HwmRgB876w=,iv:lN8e1PLzoHVW3kMs4LSyLoE6PnblMRlIpJJeknXOqB4=,tag:3VDHxlMtE4F87bBQkcGodA==,type:str]
+    username: ENC[AES256_GCM,data:i8M3noHu0CJ08RwypBn9h5liAkQ=,iv:znRqbQojmQyoDbyisv9axjjBj4V81Kp57/XovvmRaCc=,tag:iS91+lTTuZ70VXLO6XTEqw==,type:str]
+    password: ENC[AES256_GCM,data:NQ6r2DqoHw5B8523HYw=,iv:cYzXDQExlRtExl1z8wpdJ+i9CDdhceBIOgzu1Ak+flk=,tag:0/2wjdMDlWx8X0kr7TM++w==,type:str]
     host: mail.vhaudiquet.fr
     port: 465
 ingress:
@@ -51,11 +51,11 @@ inboxApi:
 # Failover tolerations + affinity — allow scheduling on p330 during r740 outage
 # Applied to all notesnook components (identity, notesnook, sse, monograph, minio)
 tolerations:
-    - key: ENC[AES256_GCM,data:hgAaI70y97aU,iv:xQuozvywEcCR3Rve3fVurb2z8HwHD015/+hhsgHQy0w=,tag:Y1aCHrMA663i4kZpFLKfWw==,type:str]
+    - key: ENC[AES256_GCM,data:wldwW6mx5HbX,iv:9udc0ZhxCNppTSvzubYTA+Z09lClmeY6OcK6wQ07TeU=,tag:EWTcPAzDXH4DsO8WgQhIzg==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:E2drc2LJZWM=,iv:FjN3ZcyH96LF6TMhlxydrVBG9MOam/eYVL+46kVil40=,tag:Rtxr+FnyH8C6w/2wQQ40lQ==,type:str]
+      value: ENC[AES256_GCM,data:Neyp+5Xww/A=,iv:w4jRsuTb1Nw7BqOTuVL+ZbLw8oGSS1l6C6VEmL68PXQ=,tag:Xb7cX15t7sUXUwdIPesR2Q==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:bSV/pYHT8sjR8v0owQQw4AKNQYl5Wdh3opBpIrjnfEOWslbvLg==,iv:ltHsiSPU8c9BOx/s8zTh+Kxqc8tRqW6HKf9pl5HOIOE=,tag:u/jT88Pbt044aj8uY0A8Jw==,type:str]
+    - key: ENC[AES256_GCM,data:ZX5pg78QqhoRaOv7Q0chYdKVRyGFXjDmdfwvbVpbjZn/a90R8w==,iv:1AzH/Ho0cVorHlV9Qmj5W/r5H9fuW1HtcosjBJDyIxo=,tag:qU4dQtewVr1QuKPMpEe7cg==,type:str]
       operator: Exists
       effect: NoSchedule
 affinity:
@@ -64,18 +64,18 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:A1YE285YhLTcp4LeudiMc0MUp2w=,iv:Kqyfv95PdUuF7p3nG6PIxs2kuvWv2HeAVPU0AeoneYM=,tag:+adSH6fElXw8vIGB0WMs1w==,type:str]
+                    - key: ENC[AES256_GCM,data:GTjhxF6YvV/x5Lw1OM3TwvpBrm4=,iv:whhLf3Kpa3GbQNfjjW6LCO4cShQZVFJ/FRNRI56hZ+s=,tag:K2I9HPSBUfHFxGOU6UhhNQ==,type:str]
                       operator: NotIn
                       values:
                         - "true"
 # Subchart tolerations — mongodb must also tolerate p330
 mongodb:
     tolerations:
-        - key: ENC[AES256_GCM,data:av7I9aCD4B6y,iv:x6eA3iP82Sp85nVXcRIjNAc6JX3LNziVFlT6B6IrokQ=,tag:2yvVWccKokQscKbAD9w38Q==,type:str]
+        - key: ENC[AES256_GCM,data:mzVAVxpHcnq6,iv:81VOdlIyQIdVB8uNuV1JsQKC2tpTlFVPhLFoFqwJ05s=,tag:bh56/58UQMWwOTGIqin/IQ==,type:str]
           operator: Equal
-          value: ENC[AES256_GCM,data:WN9Bpkvqpkg=,iv:BNQglVdoQjCAE2CObO/19O0GcsfcVAGAv7e6JwSEa7M=,tag:5pu4aosrPlLQ16ZanEFmyw==,type:str]
+          value: ENC[AES256_GCM,data:AU51GRhOXqQ=,iv:XlZrHPkzrn8q+S86VpDggrZITIDWOnX+0pOlgmCH8fE=,tag:eyacewWQOevfU+8bNDQtLA==,type:str]
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:iI4qIoeJ6iyCVi2+V3OvaU0b0bMDsbVL1RfR29BuoEo1q3un7Q==,iv:oT1YrAcLhPj6YerV0rJvb8v8Jq4dwjSEyFd5TPXySpo=,tag:ILNxnGw5PnOPNMXYmhs+rQ==,type:str]
+        - key: ENC[AES256_GCM,data:jpfWPim/wZarapIpwmhrgVQVKlJjKL4bRHYAKNiv56OGr/szTQ==,iv:h5ddBHAkERT/qRtNEk05lVk4+25c0cg82DHnFTKqA0Q=,tag:XTcbIcdL0koJ7TtQ1lq7TQ==,type:str]
           operator: Exists
           effect: NoSchedule
     affinity:
@@ -84,33 +84,34 @@ mongodb:
                 - weight: 100
                   preference:
                     matchExpressions:
-                        - key: ENC[AES256_GCM,data:0y3r8t8Q+mGlS83GQmoA0x1X77E=,iv:P59+eZuWkbBLVWIg1axsPbRT+dShoEVqVYDBQgwUnFA=,tag:iDPY9K+eh9hdXtcD/BS+eg==,type:str]
+                        - key: ENC[AES256_GCM,data:N6BxudigJCJ4sbwAl1UU4AfqHi0=,iv:cSSRzSvKFg92PfxIHn2KfcJ65r6isXrB1MW00JVaGBI=,tag:rGWzaXJAjhOXHYscAkptYg==,type:str]
                           operator: NotIn
                           values:
                             - "true"
 sops:
-    lastmodified: "2026-08-13T17:31:25Z"
-    mac: ENC[AES256_GCM,data:Jm/lzo3ODn39+fMsmLiOc7Fo4RyzR6C7eqBc/pCDBu5XDlqQehghlwJ99rNm7Ed+x0axmLMwxMiLvPqiZeSJgDlB3h8/pfyU5gnA+mnz2x3e/kv+7HWWjYqFEDNj05Apkn5Fho3eCsLMWWQ495bfL/BWA7c0hB+FKZ30XvwiUII=,iv:XEEFBROIY621NuXUqvJP34w+KB9y38YIRd45D/N9lXw=,tag:R7hr6I6UCWScWx/oFEUbKA==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:E+JIPaHx+C0aJhvnuc/LwzEH84GfQVgaSHSM4GQw4h9tnPRsD4Zlmi8R5UBr9BOqw0PhigI+imVRSWSN9rLhzXtM60GLprCa5TwM9ufaAsX8Ti0u/HBpmKWNZWAVhQwbhn2VhYsz8BStszzxDWOAiY+ogZCy7wWU+lohyk0Myx8=,iv:tQhQn1Gh9icwIfdIgWu6bmrPaVtRcpSKrEL0LHGpbq8=,tag:bZBrS2SqrZtZejWmt2/obg==,type:str]
     pgp:
-        - created_at: "2026-08-13T17:31:25Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAqdxsBrPIXKAsp0aTK7d8Hz1cdL0UIvudo5Bzq+oH9Yl5
-            TM1YWsNCmiUGfIgr/zhZzMoU0c6Zh4AV4VxMU9ZHvW4/W+Hh1pky0XE2rEtkdrb6
-            1c7b9THnknk8BvrHpY5RGZRzl0TuENu0xWsyjFNbZvlWpPkY32gz9vkyjDso2ToP
-            m31ErKKPMaxFCJVi6bJKYQhc2Q2ggwC+XRw2x3tFbSq1sCu35/WnkCc8+MfHSaS7
-            ZJNZEvxcbvg5+s3aI18DrEn34IOBkRRIeoLXO0IgTR8gNrKtJRx3KfFRwbkKoBnr
-            rufTfGt75RDzL8vVbbL6wLabuTfsCU28XvVgjrCVdLUdbWIhf8oPvFKRZHnDvytn
-            pqT/u32fLM/DkUyXmKhB8GE7tlO2Zy6WtzmEYwkgd8A8rw1fyGrPu70APq1i7n9R
-            PPh7ldtSaxJwhoJ6nOINg+4oOosWywrp/SVxbxqbLY8xdOuvPITtlmtaT5mdi3Pi
-            0VRyt6HUMl2PEqLsEbhelc1mcT6rc7Nm3mnkyENjPa1GiGCbm9lkAgn5iCFQpXKc
-            GGWN2XPoXOtXu9iDdkZkQz8z5/dSdbE84Ve/o8pHzsJO2piapntESxHDZl43Q4re
-            08w0uDVMIwXuRm+dTzhJIwu4B1uhDAp6GPKJmLdX8UHRhbXHpKZt6lbg3DTVCSDS
-            XgFEdNzPSQnhTR8bfS9+CX6j3wVCrcNhHwu60KWOQp/qn6Ak74yR2+LLC57+NFua
-            OwSBoEZgflQrMYAkkU3QdTWBTLGiSl31ardx26XvLzSvMnb1U5tSxrZvw8dZA0I=
-            =/8gD
+            hQIMA7uy4qQr71wiARAAqx7RtTLhCdR3P3xNH3/BVBD/i09b8jBNkznlBe31tUjZ
+            Re9sPCD3bkiryTUPgMIMOVBRyDpSEa3TuAk5T5/O8zrhR2bqxk7Nqp8ZI4c2kRdT
+            TxELspBzK7gcYZURarJ94f8YhMX8XXPYu6yA36velm7kVO7tc+GWUPbSgNzDc8eN
+            vOzGqQhn4ZZJ773fsjqzTp8aYmC6YKXboNjmEw6GYPlhD8OwO45/zNG2Yj9BOsaK
+            r9L87gm3ZSYw5C/U58eaknpgLSl4ZAITIgt7cbUaJrv5XsSJk4ogeJknRbB3sZSl
+            L87X2XC9iAhZYpm7Pe9IKPfEjb8oculFIXqoF6eo++0QMahALKT49aNTnWlWO4OZ
+            hGUYqM8qzKNv+20XEo+82YENvNuTBpMXjgTpd8BZOCjyvYdkI8+5kfhaQP9O/kYJ
+            L15nyG2/HZaJ1Hv9myFNqkyAi2fTndCBT58Dk3UqWveM0QAtOgFeRDnELNP/Y7WT
+            FwolNY6YkbZZpxUfMlxpU1HqH2jjHD7Ashr1o+sM1GFiCsF1/FSKd6tgEsC2RZ0w
+            5PCaFygvus1MHMX1g8h298SHgLNGfy+0lMLIuZuvEfbySfvg6JZPKQdp7jo1T79V
+            sj92v24FpGUGgHghXXk0ZzLeoMBS0pqlscdPftzwV3WgybMKkZiTfBfaQ0m7utjS
+            XgHCvGBVOfF8rfYZT2lD8ws6dd8hsDz2hZScO5wFPNfC6NNhTu9MgKkp7CvyXw01
+            pY04UDXm4b86giw4DOiL4fi1aFEaV/cjq+zF7Z+z+otaYV4yO96lsZmrtQzFYfo=
+            =E/8A
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/personal/notes/obsidian-livesync/values.yaml

@@ -2,11 +2,11 @@
 # Single-node deployment with CORS configured for Obsidian plugin compatibility
 clusterSize: 1
 allowAdminParty: false
-createAdminSecret: ENC[AES256_GCM,data:qCS2Aw==,iv:krKXRZ/w5sXAdb6LQqqKm2bABA68QGxV/x0zalpwFgs=,tag:j4apfBIYrPrgZGBp5vIH0g==,type:bool]
+createAdminSecret: ENC[AES256_GCM,data:tq55XA==,iv:jNb8l50LZyGleKH/6gMge4NcVB/QI7DYvfjFzi0hXBk=,tag:UAdyYHVSxx8pVRoq2eB6tg==,type:bool]
 autoSetup:
     enabled: true
 adminUsername: obsidian
-adminPassword: ENC[AES256_GCM,data:jKwtIOt0yvxfoS7JhXs=,iv:j3KMCBjl4mtg+Tkbt4ooZnqvd8tGKkUf2psJlws31Ag=,tag:AjJkxLbOKx1kBlOfPRS68w==,type:str]
+adminPassword: ENC[AES256_GCM,data:HhKrquaOqxB3BkhC3MM=,iv:WADwvJbfNWNfHipSy3prQO6+Xo5haL7XTxANMdb/lbQ=,tag:dInMwg2yBubwFIAtt+rW8Q==,type:str]
 image:
     repository: couchdb
     tag: 3.5.2
@@ -50,28 +50,29 @@ resources:
         cpu: 500m
         memory: 512Mi
 sops:
-    lastmodified: "2026-08-16T21:48:44Z"
-    mac: ENC[AES256_GCM,data:he/K5j1OtA9jwaVkjI7fRMzBjsXpTAwtxlzfKObix9U5FT3eZR/BUFiugACufOLxzltY4HYlGK0mSKID+Jp9bMz1F/QmdGv5+HRRPRIGphNiG7aZWaJJTlJ4/0JjLJtONxLqASeoTap89Q/yuphb3+6ZNCcCsZQLMJbz7gEZ+cE=,iv:Pf0IlT9wdnwO/H2ABiTHsOc7DuBZjBy25y8SW9nC0wU=,tag:6ub3N8LDu6Y2lpsC/iLiaA==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:dVVKNsyOx9q89vnvPvMNuDCW7Ge/7ZB/pEG+ixqJVzIlHoyetmsYywolAO33Gc5iy6f5qhQKjmj9G53+eN7qa0qJMFiJR/cqr08RVp0oo80E1Dm9z4KsTv+oRd7vI9JFygk0Q2mk2vb3wVrqaPywU+2bOtFEZ6j2ZwtuWYTosXc=,iv:SsyFIrX0P10x73fRJaju0/QKlStzLGP9TE9sptIa0MA=,tag:vnqsKfk/Zs4M4O1R9hdmsg==,type:str]
     pgp:
-        - created_at: "2026-08-16T21:48:44Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/8Dc+KANhQYaPDLXEw5hJO0zHVfKjvh7KXH6s20b132DZh
-            7G5xRs1srollgxKPL4VYI0g1TQvIIP5+54wlCGxVow3ly93qV2FCTxxeGampb5VN
-            LiPaPam/6www/JCxuqEcWbib6T8qzdfrGeS0CiXxNEW0GMZsOj/1QGpIfEr2TdTN
-            O5Wf+qVHoUb51dTdO29BAREKCO953DAI+BmsvHsQgMtxmngrq6ufCyh0Els7U4HK
-            E1B03E7tEgsWPkZNJqULUF4Ux9nqK3xFbWFu6BJlSbB45mYjouWbT4XF+9HpL59V
-            55e0X7OWcMJ8YTL4cbAnXopDkFmVAkoDOKdQEcbc528hmcJOvv1acLG5wkeuiEjw
-            G7Cp8M5t76LCvfnetFs9C8GZIPjyP+PHfsxYNlZIK3Qt8QTvOtt95ZWK6ijCJzUN
-            CrLPXHRAvyWglzqT0s32JveNAfEr4CI8EcNSJ84S71FOhvmk5w6Kx9U19FHnMeHw
-            Yt2Rr1h8OXi4NMkzmBU/XUj400mpzU3vmmdAYLGbXO1w8DjM5Qibt5ZK7DkZTtm5
-            B2qVq1TVZEL0hg1nonTGt1LA/RzPvUs8wIfrzqW230qI+1DnKo/AOWZFt3z46aMu
-            FZx40RpVif3ckv+JoVV6SS6pYQNXbjNPl4NupTdC9bwcbRwsX5fU6uEqkdJAqpXS
-            XgE4u1kcJaDjlS+SX70HmjadjpCBgoiHIf9xU+oPBLh3t+fDiauzHl5iszGzayeV
-            B7fSbNDm54Paum0cXPUB+FOWzh8lwkbLkE65Ld+nMeJ9C7PbX2cmMKkPKBO/rzs=
-            =tlZW
+            hQIMA7uy4qQr71wiAQ//eZdPLQ1KBMwbCMIZ76qP9hOZ9/tKnFmtZqkFnoyqpshZ
+            kRCeITaLhJJE9TQNj0VW/Ng+RW5kDA1OvTWOdz6lfjdepiyu87ZkrHBpr7F64prJ
+            /wr2eiXQvz4p927kTw6cmiy9wWpHH+PPoJsoEJVIXzWNBxIBfGtW0DqpkCUhePwX
+            CT1LBdpa/Wz/t3JIoOTIq4MmU9q3SKMJJUsADKI9NuaGfkcyYoLG1/k0bZcbbCpe
+            /Tb+ynOPNIo07WjCQ5whYDFUlxW48zcvcH4tp0NaDcHDBNFgrPwxU9hwkK2p3I3c
+            hPKlMOYqk2cM9zksx9zBvsRSTNCraBJj0tooJk6RxOo3sWUQISVJ8IuRremSEagP
+            drnp9Hz8V08UgGGjlg8tG+yccNS37sFBUzDCKspCCRPkiRW5mYO+5HyMTE8L4lUm
+            tBhVbEvavYK2S1UXB1xg/X9AVtA05N75ggeB4D3yJnGnY4pXH4D8vAhgpTecsqkb
+            5BzCo2R/HTzj07bYw/k4PlGdbAGNJuwzo48GfLqPQy0qEpx5BS3NTzM6QlD8C45q
+            WQ4HxMEg5AcrArprwdPQjATIXqbcfDtQA+rxMtckjySOxYvxnfJeEzBH1crjDq//
+            18wmvQJFGKba6ztvC5Jou+3OaJnFSaDiVqhRBGlzcsre4aOrZusYY9ilRpY/a3PS
+            XgGgfHBTfP5IYruR5jbEi21aqJKxAh5gnnjMtrWnL/ObCabccfpyZer5xrnljV1d
+            nE9PQrCmefxMcUHbAoNYZPqI+JPd9TAvR33rVCfFd8uzCOGwIJq2rct3eXH7Xyg=
+            =fYOk
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/personal/openclaw/openclaw-secrets.yaml

@@ -6,32 +6,32 @@ metadata:
     namespace: openclaw
 type: Opaque
 stringData:
-    CHUTES_API_KEY: ENC[AES256_GCM,data:Q+rolk3ZLF3lIEcGUcQYrJe0G0Eq7o+aafqK3wZfKnNxi4UiB5NM6+KcKbKi7FL4UeoMC2MQ+HuszJWfC+X5i4ADGzW5y3CAqMoOblgmjvN1qDWRc7zog1bKBqeHuDfiJn3KjUXf,iv:KCwxCRZqjO9qz4mI7NvEiY44Evk2mPB2aiDwzhcV+PI=,tag:C4EyScSpzFIpTIYPt7nBgQ==,type:str]
-    #ENC[AES256_GCM,data:dMUyQ2WCohbYG03WYtOu7ifCobP/HacAO3ag+TWFYYTe9j3stuZb54MwfA==,iv:R4nhUGdCaWZOizJY8ggMNhQWi9f8p+KCqqSBUn8+yRY=,tag:hT6jS5kDLyBlat/LunpePQ==,type:comment]
-    EMAIL_ADDRESS: ENC[AES256_GCM,data:bW8Gn7DVlbWlouZWyhAsMsUc0Zk=,iv:PGY3U+wsMuy0yF51c6SpreDEGTismFZnmankuzXqMhM=,tag:9iD1Svx3ls6nw7cThojclg==,type:str]
-    EMAIL_PASSWORD: ENC[AES256_GCM,data:ssLNISDNPEdpHqKsutc=,iv:bETkOG2yKtm9PrSCh7VgUfjPXzeIW/yIdPEsrzT76yE=,tag:AdRW8jnr/+Nh1RoqbBHRAQ==,type:str]
+    CHUTES_API_KEY: ENC[AES256_GCM,data:oTKKBNoJK9y9W6a7j8BYlorsaxiW+6a5ZUXAQvkCo17QV6XSyk6JTSyD+2q3RrdJ6M1oU1EYfz187boW0NxipAV6emyg0W8KTgaoz7g5bczh8i1tkSbtQFR2yXemnYZRanFXAcll,iv:kT/t1rL03b8XpxBuyqULkb8NQS9EHDq1HCFUXsJeyFw=,tag:VUicjcv8UDV4Ar7JZBiZcw==,type:str]
+    #ENC[AES256_GCM,data:zrcd7oMQVkQvN9o5Uuez51+nOY2f/pk2i4tU0Vptl4RLN2m3UiO2gli5pA==,iv:wb8SqVcYbRABqow+vZnzhEXv9m6Fa/mEDYz+dj+COmo=,tag:B8ms+oHlqWxiKwUe2vT+NA==,type:comment]
+    EMAIL_ADDRESS: ENC[AES256_GCM,data:T1S3nBNjvF2wY0S48DaGhStPUC0=,iv:uYFPix9QfYR3mdJO98pdnKRUACe3NP6YjU+7GOxWNV0=,tag:ifimYZeItSWGNthcDlLbAQ==,type:str]
+    EMAIL_PASSWORD: ENC[AES256_GCM,data:ny6xflUytsTgmNEBIFw=,iv:rOyJ+o8Fs9pdyH8pfC8hTw1mdf+pcPgrrOZSGNv7igY=,tag:3xw+p29WwiP7KTg05J9xYQ==,type:str]
 sops:
-    lastmodified: "2026-08-24T12:01:23Z"
-    mac: ENC[AES256_GCM,data:Rl1yVrIdYsBTaMMz0a9jEYQ7uVxvDBrmWCmFvGcyUQKr4Yfq56gaRMHItabgu2Vsch0o2X7ljeeTD75WoWeBhV51ne1TZo/E3x4fRl05Oz54bDF/59VUbP184ZqI9pw/WEVyumUtOyIwvBpsmkutryuE1aTzPMIz45YiwMctDrE=,iv:wwIVKBmxQiEauSeyUQ4F+oQHVKhcDDQDW4Kaxy0eVVA=,tag:Y4EmW0KjtGZsZ7vfDLCoWg==,type:str]
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:cNPNGuGkXRFm6uvie1cXLc+d6KhywAcg44ShjXWXSLlZOjKw6qu3nyin3Soe4/bHOy0SRj1E4p+aCGL/5l80Q9rDC6LSTTRMcJIn4l6fjq5+4y3nxmgiOVTELSD5+xOahpbXHTHugl4vEW0SV3ASqkE5NNmtsMYhJqKI/74oKWc=,iv:6LrsmFoheDMXLEjrsSc2b9Ns/7cU/IUqPHyTl+T5Vys=,tag:eazTmu1t4Xvc9+B9+f/P8g==,type:str]
     pgp:
-        - created_at: "2026-08-24T12:01:23Z"
+        - created_at: "2026-08-26T19:31:53Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//UJlw8rwq1mw4f6ePa3uCpVxTiCFFFjOdgOj0wsn1WXv6
-            k2fpGPV1JwIFj4Wj5AL7EqWH4iII5uxqft6XykjyhmXL2FHqO8ZN4Q/PIDpgakuF
-            le256k8KbhuVjUWjtZ73pGYUkB3X9ZBBIkh6XtHVtMaOpJc2mtekuZ5PWv3YhRGd
-            v/jswjzuVtjFoG4n4yimOXTQgN3HtiL08eznurRf9dz9X9s7pGI8pKqQk7cGiBv9
-            EnczRcXnTvJKVfjKAQeEsr4KGvhhrJMxtH4laSUu0xBabV8UEzuqC0q71gSBtmXr
-            5eHg5iFXjmcn1uXHYkKreEPkNTdh7hz3gW3qFJpRTtwYjTZzDjytoP6XVSq+avpS
-            kd4iqWeS4YFTFyMfPVRLZg9TJTTAXhSlhvx7qXUPOuKtuGaoEJY67F/tnIB2WEE+
-            WCgiWqsPGoXKEFI6Le7NrjsRnhJ3FLCnkd+kal8pypJOjgmJMEn8Jd1mfVxHY5gR
-            jk5wgRu38zUwnOSPiee2N1LsxphQCFazP3iNn3VXUyQ8hqAxilyD6gCUz2TNBEls
-            pZLFNrTdPb4Wz+hHyrXfMXW1zL5+1rUbdj6h1JFxJwg6ZC0togiFwIJrMgTexZE5
-            BLOM5xwqPEaXVe/0EdgHl2borMvhqLQkS1j8gOjMceH8hUPM6FWU/PxjvsfhlMbS
-            XgHJYRd0rrlzvBDh1AbAhzqo2kP01eLXEEnln6u54G70TuBxD752B2EsJRFII+ru
-            b/UgHWJtc+sAESED9bHzFCoTs9QXyMuAuRrMUHtpkSF8T4DyW7j8fFcS+C7FuDs=
-            =2HcA
+            hQIMA7uy4qQr71wiAQ//a+e4JtcGkgG6B5P0OJ01fMbFzJj/PpBhmhUDKOggnjrO
+            aLANNIHjmTnkSRWHAwIQJlsveE4oko/uTkZE4CULeszcAjeGdQHBaGNCxgcoiLJN
+            D38IP8v+4EiWcU7ynXl1tibUkI9JgZmeP6LNErioV0IbRiaWxqYHh5FYZ8D2WAJq
+            kZ4cGtqNjclcsxAhdbjpTLX7IVcJeIDEHoWoffRPW4/v6lIrfapUrA2wlxnm/Hvm
+            LIvYxDiZvRafe4tBu4j9KPzyiwJvAkTnWwBjDTFn8te9OzsigOYQEcMHYWNDMZxv
+            msIYdFyQnaJpsNd92uhRMMR8q7OqXnt6sAM2HURRoau0CIMwincgAHCRD49lPHfS
+            e5qufYjaHHnLMgELu+4G0DUGMhVAisT7R5/QETl2kDSCZEcwFvg5A53cjuzyhJjD
+            4kgddWPIYLrllNW3Jymemnveql+tOYIIMjOP97Vt4LwCFy547tBIsNcRaVI0pBFE
+            FpZIhEUo1IjxJ8nCL7ClaLgm+TeRkHhbZMy4LevTbv1uAauIb7HbhkVJC0+pmLQ8
+            6pQXNeOt2Arzy8cEPRtuZSFhzqeKkkBx5FDi2s1dfAa+yC4ks61hyf3RQ8/kgPzY
+            PcRjP/8CadJKLCm1qylQSUcrYFn3SalOFWzSiNIwmyNH0OyZG9B2UrsxZ0s3+i7S
+            XgENlAQ4vf3sNp+rPLCJIT0QCNjnHXI8A+cJlrjXDL90xUgM+PEu55kayciuHHzb
+            V50YPoy1nczQ6WZwrYu7lRR+cpk54zf2fiQnjQScWF/UFCJ0zKxasovG14lmsds=
+            =884u
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(data|stringData|.*key|.*crt)$

kubernetes/personal/paperless/postgres-values.yaml

@@ -6,8 +6,8 @@ image:
     imagePullPolicy: IfNotPresent
 auth:
     database: paperless
-    username: ENC[AES256_GCM,data:S7uuUdR9Xda5,iv:u70rbg0QT6tIOggzZ8caz3cRCh7DhtxaVj1KGvfgljU=,tag:RvERbQz/9Pr3SJmemm/BlA==,type:str]
-    password: ENC[AES256_GCM,data:n3rP8mKu6wM+WMLCFrQ=,iv:ge9HJkb6Y+WQodFwIC+kLr7MTFJwXwrwEdd4zIffos8=,tag:moiLXtBwnRQyREURuYk/Eg==,type:str]
+    username: ENC[AES256_GCM,data:QJg2amOMjGjl,iv:6voXFyOcS1uX1TgVTDysLpwmZKZGtvQFyEDPpCUpa4c=,tag:vZsCCg/0UnzVFjsQ4XLlHg==,type:str]
+    password: ENC[AES256_GCM,data:bKE4o5FXsaU6J71JCHc=,iv:nxr2YJW6syA2vdkRStbSCh2hUOnzHHh4djYA6YL6h0E=,tag:rT++kewjSd3/p+4c6zRgGA==,type:str]
 persistence:
     enabled: true
     size: 10Gi
@@ -21,28 +21,29 @@ resources:
         cpu: "1"
         memory: 1Gi
 sops:
-    lastmodified: "2026-08-16T09:07:01Z"
-    mac: ENC[AES256_GCM,data:Tv9mLhZqqz8eBYS+IKUV5fgpRf+iGSkHZF4+fcxk7k6AH3XLF5tsN31wx3MLdA8Wnk+zADobJtAHx8onQufyV+pvON5/8IUFGZKOuKv7tB6gQBeaNfrVans+gBSqnufxCsXkIrcAS25QZM9mFEM4ZnbJUNFzNvkoGotRtnwaIkA=,iv:QQVnbx3UL9e1Z7gyBWE8QahtQcC/hQ233sIAv6Zg/W4=,tag:yX/9iCBvJh/GaWIdSydKmA==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:aVqq/OZnLifCx2xO8eqTXlRfZgQ5mZkFnS6qx1yOHfe5UTqWnYKKpSpQaPk0kSh4a56nEDo8Sg8uUGRG8hE4fO5gyux88EWu2S5LQFL51O5g7p21KcsLD2CTf12aKqGIvwYvpRsVTekHpqVEqu0dxAotLaW2f0NSXsuCVwclpc4=,iv:CUjlO3O6z29/DO0JbPrdmu0iw9TwJ5QktN0o0K9eF6A=,tag:+xy9IdL4tJ8N5fux8NGMxg==,type:str]
     pgp:
-        - created_at: "2026-08-16T09:07:01Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//YXRqL71ibLBGFfmNZFEoFYJiPFfl/s7dwmd1hvyCHzY4
-            OA3i3ci7g/XLZYJIh+0xt/aLlgubDNwtgSKULn1T6jPKYec/eErPni4IEQOJYvLX
-            ZhJxrr7cxdm3kQ8sPw3lBzKa/fKfljrt0wsEeEligwHlqpbu8JutgGLW2qmVP7D2
-            58meumXOLZQylZysEbp8oCuRBzfyZ4dMrXMLzBXdv3TFm+PWUAnF+fB9L5UazLnf
-            fLjHXCEfpu73hg7mxuMCIanhvhwUbtBBS8bj+iR0CFrT2gBg4sdJcpEowCAlL1fR
-            kCtqPW44KP3Ho+1T8tSl3e0k0BFTxGCAfYJmv1JCMe2ejw3vr9rPZRZ8Ni/eXdoi
-            0C94eA009E2NCYWOLWnfTxMBjSKuyNpQGtRuLU/PrI3juuGCUY7VhX3EMxuqAdlG
-            zax3aJIBvAwuv1xlIbvvG2SPGnoSyLJ/Fd2mJlp49ZFYGGMtLtBXfgA50w+ng79j
-            hRFVbo2XmxfT6DM7TpfssWeGyNOkOS2khrmnOlej9VzUWMU69S1IxEAyQkZihOKf
-            PjzWzAx7N6r6JH0NUbJwM5wZ9TbqEfN7DqEI99N35Mdc9r51BOUr3BMiRBQQoLwI
-            fnfuauHMsPahsj5ndK5U3m62o7N0ezTzZqm8mDWyLH6NX0P3qnLmTQ6XzSIdsxXS
-            XgG0BHJfl+7I5Bki2b+PILhkIVu/DmJNRmGU+5nI3+2F/NruHEFs8OaQQthOOS7j
-            2QDPFVVAcNjWzHNkvYQOrIIBYGf084WsYlznACAcTyasp0LAamZc/S8sLt0RCas=
-            =qWxv
+            hQIMA7uy4qQr71wiAQ//UKL1JX0nvcucTccreWw1VlpVW5By8mDBr5jKaP7IdJoV
+            J/+gdgPNCQazO3JA+rmFar2rOiEKVL+cHaJvqKbD3XmS6p93FDTpde0KljLNlymj
+            rptGKJpOswPrAcTT1nuWQiDp32n9EOI6s9RmBVttqipWnjisN1/BCL2he4CT0fWr
+            ezqrlr9U2xfqvWSeku5dYUwluYo/x9corTXrsIJO2YVR1VGMLhc6FGvJrGYyJjWh
+            pt5xV7PsX800NVKmQTbcS9/r+jVWzXjQbyGyowk5g/NeS/8Jjv0VKC3wjj7LoTz+
+            5N0jv58seQJWTY8xrRegoWGT/KXTcVPfwZB4ZXKMACDHoJLuSqnpGlMdgY7GY4sV
+            BzDNYCpYgiy/0O6gl+LXHzSHLCPT2+HoR+akJJTvx1hPANg0axe+YcQiO4931ROJ
+            azn9FznfIeWfqIA3qNOi1jGhaAR1j/0M++D8ogW6VB+LDVvc26dN7bCkByYcdes6
+            uvnrulHOknscjwrjAlNfNyXmGm6gY1stoSwmfKR+emOQGaReJjPZl5f02U4yp5AM
+            tYKxB1Zzgzy1xeNNEpdiywKJEKua4D5K1IrRmhz44a0LZaaEKVMjeRnhU/yvt9RX
+            ++r0RbUuKhenL39QUgfatcSUK1YtP88TdYwTV0HX7wtvsPYe5nch5HDbrb0NipTS
+            XgHS2f4xvRYSbTGcxMfTJMXnkewf6O7dOn1sErYUUr4GSxKVBXycw4zFHsYIvvSO
+            g76KJ6Yd2z3xJN/jIPSGnfeWL20sN1VoZPRsDSb6RrAq7YisUSzdPk5j8OEzeJc=
+            =MZEy
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/personal/paperless/redis-values.yaml

@@ -15,28 +15,29 @@ resources:
         cpu: 500m
         memory: 256Mi
 sops:
-    lastmodified: "2026-08-16T09:07:01Z"
-    mac: ENC[AES256_GCM,data:BQ9z3o4+aCrAdQvWJEXRWWcQLggmyoVi3YfqwdZUkYNNcECTZtlQsgK4/g2+ktuzlvUmuBuV0m5gZJ/HqEflVDXbhQiCtnKSSqJ1V/PNVFFCXans92uxzEl6EY++Qm+X07ookJiYv4leqruCm+uNdYlTWESnLe07TZhiTbN+7Z8=,iv:yzq3+U3fjbU8XQejllBynYmb+kexgOEiSMaYRGxvOTw=,tag:Nwn4kpQQXYpw97VTI9NL9Q==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:e9wC+D0aamMPY51uNvegO9qcFjZqjow7uprHYBQxf+iU4PIsKAwPIeLnsqYKd8CWgeAsHmxGkxgiLmbxB86bbmjl8VfwZyRvqXOSfMZZOCUS5w5Gn/upsQFhRttfmq6YNzkOV3KQbLuBTGQPoMtAAnCLmDKjVZlCxYt+8ViMlHY=,iv:qbDyQ3weywhJx3gmveLY7t/R1+5zLPHcOaU51Jh0XWk=,tag:C7LkgjkT6UrFqihDATyl4w==,type:str]
     pgp:
-        - created_at: "2026-08-16T09:07:01Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+JywlDn4kNsVcrVM+bNEImlKvu/leYNRbh+eTKVeBqTdo
-            H+vuBr7+a7EK01CWejH4z6vYrf6H7Q3ey+GjW1GYQGPBMFYVFK8eyNkwOlBej+0B
-            xbqZ17MwDi9ODh6rjtvZ7gz3bCPXM+LAXgaxBo1GBM+MJTmIJ+Wzwgq+h1/YBMBY
-            Q1ksGb2jzD9ZqpIo9uLfiTf2y2Go7n9DQyuvK3ddxL94lM7YAZGx+HHxM9xrKNfJ
-            ITUS9CGR8T/bckzDpGLWEJY2biK1p5bKU48kWItZf7kPQKpVp/d1XKY/I2kL+o8W
-            iBi6vq6nRKhdDP0G3Eml0weUattsQ/dELJPSOps0NXioGI8w4hK2SWASGTdChHwN
-            9ni0CWC41jhRIsmMZ5K25C2nAwyieVPN3gP6jWoUgovho2/CKr8lSJ0AWfapT7Sx
-            2jUXcSF8SUdQlDErDLeN1qTxS/6TWOw0E9baaPRJVc0FNpa5LZZ3uUc+kCih75vz
-            CoqrYX8AP5tiO4OELzfMcWhNkizHGPjcEwjus4f8gXu7iIi7pAD+MRoM04Cz1cFz
-            NQz3fFBT3acPLVyLqa0GEn7EdPNYeyMY0uCm7sOhbGGWlZB5oZ0Gfi2FmJR7birA
-            az8LVvwqUsgQtCf6AdzOoqp9oUugo5smHJZgF1MsQzMhZjLG0REkV2OCg0KqiZ/S
-            XgHul345KCekjoxm4egkjKW81F4FesW9ci5GcROWj1UHtgUq5Y6JwE7Qab31uvjt
-            bHmyW0DqH5daOzRzStCIpx89RAc1xQ6EAalD5Kvrxq7IUMGWkG0WGt1btfXudoM=
-            =Y4Aj
+            hQIMA7uy4qQr71wiAQ/8D7I7gMnDoJLyj371WDayeV2SVos6gEscbIVFd9U+hiYA
+            qMHxRheqVpIzAEmBxhR/OnFMcYhUB+rBO18Hlvu2+dG3DxN5cemeJEwvVRC1v4uJ
+            RZfV0kHCLo3VKLGXJ9Wyc1fnKYYbVy/7qjXBY6Kbl/+1/FYRQ4K8Qh2jBhnkFy1o
+            yZlRWKcdz/JP8bPr6t1Axv00dV8L6jYQ1wVE+0HijVnzromOhVxemp/xpQ2Ftp1q
+            CJQDrdYTPI997zGFiy1TdR21f3ruCIS20mjLuc6tKjwAP8KFSDkXrtcmfrBixnU5
+            rmbDfMDuA0CNTvfYQQeFQPRn1X7gMDFl9p/Uv5hiV3LuQslXx60UjQAN63a8z/ry
+            DwjIAjXIEpE6PKTKols7WD96KmDy7Z730YcZfO/28BYcANxOLaPzGLK3ztQSYpLv
+            Cnk1F6w7Vzab6D2SAmUot6Zgg9va3V2/DQmJ9yv7MgdHhvfd2kkWf8PKNntc0QaG
+            hEs8dwOpKmZjCVVgA8C8enHZ3MmIXqfC/KU8boOeRSaEOG2PXwpuyTwoWvkA5+Ge
+            kDhyBWKV5sOBMvXqGqyDHy8F0K22Dz9kDbP6qtSkGjeJJ02LVik6GcW4V58N7Ebp
+            7k9z19CPDnjF1QGc3ymiGklkDMpLJ3Jwpytq/E7RgqRtMkflya1rAO9Os2ruKqbS
+            XgF+lvlfuoJBtHmSVe1llhfqcCIdQHEdibDSUhTcNG3twoCPGJU9p6clHRTohz6M
+            kitS/B0CRR98eNIjt6lSp03FNQRrVpLAgbAHBMZ9Q74QSdNTAvhR17dYWRelXe8=
+            =SjtQ
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/personal/paperless/values.yaml

@@ -1,5 +1,5 @@
 env:
-    PAPERLESS_SECRET_KEY: ENC[AES256_GCM,data:wFTf9ng/oLUgFUIYAsOMZWLUyqz95zopQlX5KgY9LFk+hsR2xEyOtQ==,iv:w7NPvFRRUsxK+MtDZavaYkVGBN5E8KQD5gwl4YXSA8E=,tag:usuV4LJrlSEMpOu0Tv8HXQ==,type:str]
+    PAPERLESS_SECRET_KEY: ENC[AES256_GCM,data:3Bat50+Yj1UcbAVIHT++aANAMkQR5i+c3+qXcpQTiK41sPHTzI0hlg==,iv:aDTPaN8143XphZ/Bejwrs9vuOvBK9CCMJDM4tSJXnwg=,tag:nWNYp3dxKG4xEHtVaL4yPA==,type:str]
     # -- Redis connection (CloudPirates Redis chart service)
     PAPERLESS_REDIS: redis://paperless-redis:6379
     # -- DBENGINE must be explicit
@@ -9,13 +9,13 @@ env:
     PAPERLESS_DBPORT: "5432"
     PAPERLESS_DBNAME: paperless
     PAPERLESS_DBUSER: paperless
-    PAPERLESS_DBPASS: ENC[AES256_GCM,data:vyY2HtGJ/K0U8EkW8GY=,iv:4nIyQrsvD5chBAvnC7mXXoArRyDYfcYi/Bi1I+kutYU=,tag:JnVMFqNoFh6PyzlfZUY6Zw==,type:str]
+    PAPERLESS_DBPASS: ENC[AES256_GCM,data:na/7pUYyaprcTZzPtZg=,iv:K1043P7KqU/7oZYU8rA2wYyKbuyGEvuI5keepR8YWw0=,tag:MOg/JM4PZQPliF3JoHl97g==,type:str]
     # -- OCR
     PAPERLESS_OCR_LANGUAGE: fra
     PAPERLESS_OCR_LANGUAGES: fra eng
     # -- OIDC integration via Authentik
     PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
-    PAPERLESS_SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:r71MklOTuRljOiBBHXECmj4pnQiqBst8JMasNDSIMENu20TOXPb/qTcwwsLEGsL569tUVplPRTo0/s+ix1CNZPf2HGoz6B9rJ00/Cxf6Ns6k2b1bXr1+7/zfcX9zXklSMfzC1NjiYpwqODr4K2jMcxY6WG8/QUSjvAlVwDO35butKv23oK2kFM5mRIoqeMiuxotmEpqP0xvVlGOWYonu5/F6O1bmBGQxsxRQDK4K4+9k8Gn00j5ZiMGpPetoboSBDMJID4vf9M2LgRP/r/1pwpnmYq2mjOZruJ2r8xZ9d8JYtxQvE/oBvrBtHPFGT8AIa92LyRDpxg6eEb+3lSEHon56rByQcnKSFGGJQiE80UNgmQx/dYDo119gZuRWrWAJp1t5d0tcOuk+64pC6FLj+a9niHSZ2Si6+Jc4AF3GRfQ3qGWNpY3Di4wM8RcNgjKJMWwbN8cYBZD+nyzMFBQsKN7a7cGJXqa4KknJR1GvoRPcPXXtresCasj9znQ5c/bPAjb8RhhNfcfRDRibBu/JOXJz9ulY1UpSONrxvXtbdbLsqExUTMBLfHw=,iv:CDXZXm1+UP2Ctp1/vJpLwWWPm6c+FD/F9FFRuH1GDwU=,tag:PQTYdaheTTu3gKT1CfjCog==,type:str]
+    PAPERLESS_SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:haqI1TF+9/qv++u13rwt1H4ulnqeDOIyTfV20LfZzQ3s4/RrmCM/jqTa/AVNBoXjaMi1XYOd/heR4AmBCQK2S7qZuQMIEVF2RuGbWxmlMziyPwGBPsQilCWUi8cWBROXxYfSnCbhaLlTUszfZekHgjdfRXSFtt0W2QouvWzzlAmOB1BNshxgTWVNnxlMDDzDrYOjTa0qY5SjBKIW2e6v44Tqt5hDaZWNUAVinC46nAYJSm2p77+A2sU7/JRKiIoxpA9N3uXSZgVhseiGCqWoRjGlhbP/UtkWg7NM2g2129vk2N7Jj+gH5wm1XZSzYjBJ4Dw3VO+onp4jNHms2CIaS0zEenzY4vwIBWGrBXByI9yS/oPzgCNGuA++HiRdV/DUPhc7Vos4qIepRzVXmdb4sfCXx211fxHQbfc1U/1vWAwysLdFmcc+4UJ5WG+OLv/tHIt4wvnEYyCzzAwnu6B/RRNnPLVZl6mhfyig9Ybaqn+jKPbepiL9al36uPpbnKLCNOjZ82jkbf2/ShGT/u2swydqd6ATUE8J8K8JJ0nYMaKoPOr1XatigfM=,iv:Az1X+MeQcslqgJOpmR/+6rwilJ6UJijppMvJ5WsxsL0=,tag:wi/aezWzbmu9iZsgN23Bpw==,type:str]
     PAPERLESS_ACCOUNT_DEFAULT_HTTP_PROTOCOL: http
     PAPERLESS_TIME_ZONE: Europe/Paris
     # -- Reject duplicates
@@ -53,28 +53,29 @@ resources:
         cpu: "2"
         memory: 2Gi
 sops:
-    lastmodified: "2026-08-16T09:07:01Z"
-    mac: ENC[AES256_GCM,data:RXzsGHok4t1L8bgCrDGBpbjTXx/ZFPIf+MVmYQTznqTptKAmPqtaruhylEmB0r6lXCUi9HWHvBpjXROhtost4zRzg3d+O240VsVDHcbDEodHISVxD54Dhd18lDyHWVWpyhyMxbHY0RDW0H3Zz0+gAPHA0HDHdVPBK4doCBF+pQE=,iv:nvqLFy+lsXHAd58VGXL7r9qdnlKcyfaznhyRY5E2V8w=,tag:3E3zkbsHy5IdIs5HbtO1+A==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:U4bCrsT7XSlFnQMDT3HHW4XUmE1KHXD3EEaygAhI4AYwMxooxBKBKXGOvYtDOqE237MBhgDpPj5qAGF8Li5Oqxz/2IlNANk/ifZMteFna4TTbBLaGaMj3ptjtDH++aP2WwB2/CDsH0oaLIpFXvgB6/wJDS9zj1fQEpfafQUFbY0=,iv:/DF1bQJKI3MFN7Od2/z30S3yfmuednEb8kML9monMcI=,tag:NC7i+Fvms0hKOjgPnRb4DA==,type:str]
     pgp:
-        - created_at: "2026-08-16T09:07:01Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//VNeqlQFXKPGY/K3AvJLFpI38fD6SROdnEd0O4WHbtSMu
-            Cv15zBpF2bx5+P1bxBHpPCJNetNdltcLv6cV370pkew22VI67o+txfCLImVMhriK
-            zrM/SFGVeZvmXIQRhClegwPTPxjMo58RU229rDghjmlQOfNeitqUWOLkOZb6WkWF
-            uFsIKd9ulmA04V2USrD/IcK6Vcl3P5LZS/gTTqTsw87zXx1yUGn43CBlkJ0NQbjD
-            cWCfcvYJzLS58Jr65kSFZthjeb3k7n891OmoO1x/sW9DBa82ckmk1GBfelATCwpy
-            0Gt/3iR4SU7q2R0bpEPhE8W0pCk6nBv7/gsqSKDe5c1aABoBhBVwBecAE/LKVjrS
-            nIuj40ehPTWuaT1GJYzELy0iPQCNNrbCxBHaYcpY9Jkg1Z0Poun5j+QymTVRS/Qj
-            HOZQXgFzeLrXI6fZE1IeKOuBDxxCSRUiMn/watR2+Lwrpqoz3vvuZmLc5OU41Gw/
-            MHTOuFcLZ3gw3Gdt6umMqNKBrqBxxsbYtHDC8cNNPiKDg0ajXqm3x1Tfq9AiEnmm
-            eRbn2/5dLkMEZMA2QWdOx/1KNytvvzb9FxrwJOE4PBjTCsIyjn7I9X1drduy9xS9
-            z71fwdVkKD8yBdB+IiDf5/J3HPDTH+DYl8hYHQUaZwyV7K/taz1pslFprjJJdojS
-            XgF6lMymEyNvLn+LNGPpbAJizrwN/3IM25G712RpV1H8EjCxbh85nFnfegOZWAmM
-            GsD9dUkm3ose357y1ejh1HKh29HQdOyNP9mfZpybNj8L2/q9isVa3lIQepTJ+r0=
-            =Ok29
+            hQIMA7uy4qQr71wiARAAwIXwCILszqO7HqCMKf4RfogrZ+fLJDGSa2r2FnmAl8Ig
+            MOFX+OKnuiofIkO4gSBF82CWuN4YnNSKU2o2Yk9zClxx+vaAwm3BZIg9cqJcIw89
+            85loMaMFhjfSoA5kFzXMGqC78SJYo1CIQSbrOqNSd73RlTQTqYf0ceHVaoKDbfb1
+            kAb8LcbxIzNq1AXXCMt4yaFfwoEZhCGdYmjftcob3mm4g4wbEKm8cGsesQ/gBcIg
+            KRclhCTo9DIvYbmzvqDpoC111rNWMcuM8HNsN73Yi5b5RbodEWplBa33veJvXYbP
+            zwxEOENCDTjwUKvIPy23MWXVePJ+omTXuzKm68eu1ez8ddvcYxHijmBtZ2Kjudix
+            Tt2SARHIsKIRMZn88j1QpNWyoZXWIWK9Zz5CjAUIwb5Gu3LY9tknuG9HMu+r9t1U
+            YJkSLPKIQaqNknUaPzCNkqufa1BG+WObAWpRXAxJblOC5YI1koMO9Z4DkF048Y3D
+            5pYEgSyOl82E/lLogkjGCi69M/iE0/YmqdVcznc1hNHkYCKh0gK82R0U5okDoYIN
+            gb23yT5SYosUnzss4wEvnm0LMe66yA3vffHEhQzY8lSxg1rM9j9ky7fr8H2HgHra
+            1RcFk3cu3OadfppfFkaQbrL7tZ8xrEc9RSyJDdxtXgmBJ1ynVAulbUQfrdoPfsbS
+            XAGKQIopMAoh9q7Bz+WoxOGTx7FTbOqslnRb4FD4HfjTwLicsQSW7x5WPDZ410MB
+            WD0tRys6zGGkwAmXNdjQlQP51BAPo3aFg9J//LazrZIafJ78/cULvkZ7tJ2A
+            =Pg7l
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/personal/radicale/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 env:
     - name: TZ
-      value: ENC[AES256_GCM,data:aOeUzoi3PC8rjf8A,iv:xJpXljsxr61EhJvy6YiZU5mFXdWij6LCsQE8FIOgGZw=,tag:QMV8RzHlOilzTG45smv0yg==,type:str]
+      value: ENC[AES256_GCM,data:KEcOJfkU2JYAOQv8,iv:DrPCrrhkXja3gst7OJKJ+aWvZiO2+ITw420JBukOR0Q=,tag:uDvIa1XZJGfyoYlikkxJpQ==,type:str]
 config:
     # No authentication, LAN-only exposure behind Traefik. 
     auth:
@@ -33,28 +33,29 @@ resources:
         cpu: 500m
         memory: 256Mi
 sops:
-    lastmodified: "2026-08-24T19:16:53Z"
-    mac: ENC[AES256_GCM,data:o9/Kj3saNHqymzpAgJH+vpA5YiiHxE/XW4QUbG5mdndGgxqsLqTTp2vRdzwE11tj0hGxe3dHKv/DgMhcHllMcvBnJk30JZcj5UqK3LioCfozXNpveL56vsq61ZvjZf71sfgXqQT0CfzMRxqj9DG5WhEUGcKmwTbI4RZFFNWsOSM=,iv:msO8/hPrfzVm3Pp4CJswmTQX6uiAsOBN2hF5JKMxKTs=,tag:0PlvpRQpkXYx+WP+IZwh2w==,type:str]
+    lastmodified: "2026-08-26T19:31:54Z"
+    mac: ENC[AES256_GCM,data:hbhDZjTboKtyFEjKCghRbcNAD1WTdD+IlayaCWPY40zp0tvb+rvjggF7MvdQNjqjOof0yQpp74eVlH8To0CUqTJQT6g5bCxgttv5jT+T0/Myz/U2T1xz28tMczJapQ/fFg9CoCmElc36ucfLEmbrl9dcdYH01p5zKIQbTxssYFE=,iv:4vt3c1wTcws6BCplDm5bKRtie3xSaVjKpyUhldzg93k=,tag:9EdiEkKVtfcfck2RpnlpVw==,type:str]
     pgp:
-        - created_at: "2026-08-24T19:16:53Z"
+        - created_at: "2026-08-26T19:31:54Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAvad1UZD+8o8EnpkOIAEcYMhJPbS0c8rAZHC7vHJdK1gn
-            Q5UZOSmRuGffXeD1oUOADM4ozDmKqq4wRl6doomky4MCXLb5FojgOoaUwzm/Sx+9
-            YeqWob1DQCSnlF/Dksj5wFnm1amAK8XXIJc5nelwoYSMH8Xby2ZnyzTEmfWcPFul
-            8IVrSEv2/JrJfmSU1ogXrKvVe+hrQ+Qixi5JTpmMYtUD8LiZMGCsK4VRVN3N7ie+
-            CgTx+OTb8G53h9DwVbVh8ct1rTlBB4EJBzN7bRDPrgu/mTtw2h/Rb9YfGfJ/tDDH
-            TFfgpVaeYkhTOxZwGosRztaD/qLBoSoiRZc3ZDU/fyD677PtkX6KHyxpNLSZThH6
-            XbSi2n6LTpDXFQbo6OtHtOMdn7B/wXAE+IErWeRx2RbO0MF3bM7p9x/ahXl+0BTm
-            U6q3+bsDmkdNN2TWUXuCPcIhtu9dwNZLewbxVcus3zrOmiEpR8jZWcOzp42QJeE4
-            kcXptlPNzSlGyjB3Oll/uIhaKiKKonIQq7W3w+LHuJi1bO5qDbQjb1L89Rm/hlW4
-            h4OssMz4pkeqsEcDyo2vCXYJ4cyrnUSeOTgiS6NOeVxHe+deVbTsW+ScLh55CGmh
-            ANiG7cJO7Dp8soIvaw6hpj6RiIA5Ifi6mGp2SCoXtOk06JPuskUKzdHFeZejobzS
-            XgEqYjYCIJY+/R2eiC+n8eGrCrGTZ1kQrbCTQnoZjdEJe0vKbIY89o6I/oMvxqSl
-            X+qzUG+vbdTboV3svUqjNBv2vX/hMr1OSvrfyEnncaqc2Gmika5eaDtl0bPYy7k=
-            =TQys
+            hQIMA7uy4qQr71wiAQ/9G5KO5oSV9/JM8c5nbeKYJ3gEYBkgRyVzWDRYuJnq/pjv
+            ryFaMSG9llmIVKEjSkNwrLcnCN0OXRzeeEFKWwm7V5n9qBvLz+wTGaEeFXklpg2Z
+            EvAiaWzgUYRTvhFxSx9QXojjdy62Ym0mK8lu/TFtCf8POzvm5zqH26091NK608lo
+            mc/XLXVNA5l9iRZbHHeRJC6RxSDheQPop/kx6qn5ZxsCgveHWmolIxkX14ixdMkG
+            SHaRmGqJC0jWMhUBXFYvbd/86mEM126XKkQjAzIf54NJNQDoctKMOGbgKfThE5u+
+            i7K7K1syTJe03eHCU6SC4u+90jaEjN1QIWr433A4Bna2zVfT2/HEKcfGKmY6TAuR
+            PgpsBss+LiMKNHfDTENdmGuiRurXNxVNezk0X2PsYEEdDGJ0JbmxFx2vj0Zhgm1L
+            mv4YbqCODcGDwlArRKH72qfnxj0g8ZCjLbZRziGNo/Rbl83T4wQfaWhybE9hXOP7
+            QxlGCYutWWd3llRYdWry14TqZxGABnDv/6yDHWjg5wZC3NPd4KQbMptjnb6u3V5m
+            rFCJZsRMrCD+84D1EaRu0NLtPCRp0trq0oZ9L2F20UKp1W3n9cTXjBdD2AKYYIG4
+            EvhvMmTKiQYjKnD4GQqeiztdIEj3Wwq6eabfjF6lwM8XmWx9OG2Z9jh65jb3xenS
+            XAHH/pgI4LF27j6OAglSu5c3l35OWHWV+mlM0LZUevc7GkEvErVJHVTU8iZFN07Y
+            JdEi5rzz4wpGEjOaQkcvnSNcCIUUOlg2k1SizCFlYlZMBbmtwafuvQKb7MMC
+            =chFT
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/production/buildpath/values.yaml

@@ -3,7 +3,7 @@
 mongo:
     auth:
         rootUser: root
-        rootPassword: ENC[AES256_GCM,data:yKSN7sugGhM=,iv:7DM05CopEc6ocTrte5M+YkLT7C7rPJLy+1db2+aevl8=,tag:QXaKXQB11Z2vdgxqcUuITg==,type:str]
+        rootPassword: ENC[AES256_GCM,data:KYOvN1TxMko=,iv:S3MLPsJoSPGwM5oHSmMR5kWaYPvz+daURgVczll0i5g=,tag:pjUS0aZopHu38Faz/REMLA==,type:str]
     wiredTigerCacheSizeGB: "1"
     resources:
         limits:
@@ -62,30 +62,31 @@ matchCollector:
 # --- Secrets ---
 # mongoPass defaults to mongo.auth.rootPassword if empty (chart template)
 secrets:
-    riotApiKey: ENC[AES256_GCM,data:+8pTWeB4+yZQrsKI2TofjfD7UXGR3FM9/0qtRabYzt4uFYtzcWD9I+Cn,iv:QRvhqATwr5d/a5c+j9G3E/+ywe0J8HRl7dEhvBB9G3E=,tag:FEAEFvpxNqLIgkI4oUEthw==,type:str]
+    riotApiKey: ENC[AES256_GCM,data:2tArxsgyeEZoHwgEeL5PxWcBjdd/Wp55pBuqLnDPwSpZtElMcgrWvMaF,iv:sHm3HvoWLY91IkTSukqSqaDFPd9/T52k244BWKSrKeY=,tag:3r8Bd/uqsZeczWeRy9eyRQ==,type:str]
 sops:
-    lastmodified: "2026-08-13T10:55:04Z"
-    mac: ENC[AES256_GCM,data:pfBuIh6+7hFlirOgnKxhb+hOSd5iI99HQdBdreN/fV1tt03nsLh+xgMwddRMjUY0IQ/Z+L9ZM1TklCgAaXPU7D7ZCnMnVvhvRcSVhjOMca4JVXWtCgYm+/JDFEL+tUbuJqcHF1cjCCG6LKxAG1QhPCfrO3VcUxi5xQRRIgPlPRw=,iv:RCu0jtZmH4p+H1CqWSl0ccFyjlB6asj1S8y4d8EYSL8=,tag:ueRgSKiNhpeWpli0xB+dcQ==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:u7XouUyhhpnMGZ67/jCINIMLNnD0O1dyFh6RR3jlV5KqeRZMzoerDlf2MS7TCD1IMcFjVpHnxU3bOEvRH5kKQJqFq74Su1t/2nFZJPtlw7veBTl4JNlew1uf9l+L+Z5WbDda293smj2Q2R5lwdM4+JRVdcMCKfqbo08UKssUfkI=,iv:oWs3m/l6GsNgKDnYgrriuP+lUUyt7rcZ8tzKi4Xl6IA=,tag:ACNUOv0BPTvuiSHYDzdibA==,type:str]
     pgp:
-        - created_at: "2026-08-13T10:55:04Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAtiFXYhTPpb9298IfH+flVwlwUblP8yTIkVK0OTaYabrQ
-            i9Am0gTUIW0bKPaLNZfYIiu1+h1Qi477bDVVERhZa54QuwIJaJSX5qYFbKH0/3FG
-            xohOQNHKXy0SZGCjbgmJvy331JkdFGX24/9bbDyvht14AUlBhhs74zx61IG/POE5
-            EWLV6P74W88XU1xLWchssMUbs/7nQtuP+N0LQ28Ja4i9nc8xwrM80kn/s5PJeil9
-            ccvjFg9maQ7BY5IYyw2nkPiQ1r++4lVPKzGgJmORRnohsD+Ytf/HlTKNy3KMcgJg
-            DxLEQvej0cSV9clN1DhQbot3dPL4eDXnLhzU0VdZGT5uLvnsMjeINSwyJP2GgHPa
-            OSqG6jT3wJKJMLQ+GWIeTXZD2aPpCHfbhAMvUgKba7hUU/gxQ7/xFwQMW5Mgr+AY
-            NRcbmvFEeWOm73oubbBUepJEoZBAAN9kgH02IZHD9lkfVUdMzFb853x73ZTRi4CS
-            HhAKUqiSEg1ZGgMWPY7H59RGn1Vguf9+YTT0MSZ2YntuQ3Zz++zxM7gomUXOmwoH
-            YuOrV8tOFZ7A5Bv8sGc9NXJuH4D6V3eq6A3BvJb5nRX+hA3uyqMDHuhbW1Ei4f9R
-            vvRp4cGTJY8Mq3GxPmPrH0Rf1P2XIHwfe707DioFJkwTaAtl7aQkEKVU+C9RFSXS
-            XgEvV71YV73oUC+wfugCtRjfWkLfup5KA/0iBsTHiHTAX+3i+TIwfVvgYavPvrRf
-            HktjWZk6X9aD7jMTQRQo53URbcYOiEuKFvOOwYO47RjEWvdToGpSxo3hcddM0XU=
-            =hC/0
+            hQIMA7uy4qQr71wiARAApDjG4q+2vm1NoIEsErqtCoQWpWidU/q6yKEIMlAMxG3m
+            T18ToL7N+/cXN7J4AYmV6D9KL3CC/DDWnPSgcQEW16of3SsBBUF/ufYD8Vm+bkwx
+            ua6Ma213lMBI84RIbHjra/OxDBOP5/w0Cwdkv4jZpgQdgtpkrUwwU1LDZ1JImc6Y
+            x9NQ2ud2D3MsqqAeNOM7YBdVi7dKvnstaBqKDYvuhNCgAYMthw/Z6+67avEcKtcC
+            wtXC8cAEklvpmyKkXXRTYJSkhXkujrRXTbfRIrGW6/qsAlpolOiBYSeVmWgV/BeP
+            j/SMAMGmgy7GQAM8QW+UQhU9a4AOxOP0bc+OubRpQ46VjqjJ/sYgJGww8X6ym+iX
+            kilij98VfdQnGTvbuc4xmiXFDylHcce5p5RWk5HQVfJc+4iNqqzKC9bk3Z/lbgOE
+            TY9MHkQoVlaxFYFRPJM+IZnCdMIZvUE49PgwlRu9BeMdDiDb5PTtq87gvc1O8XdB
+            M8lfa8zr3Eb95f0gbUViZQd2zTVPFKVlGFD894gHoePmUDqNFIVXnthghVjo0Oa0
+            AG69N7F/UvDGqchvcYALOtmnc/sISO7+OOCUjyTASq4sDAyHHuZGLwlgpKX743kD
+            Qj6QATEYwYDkgnAx4d6VbvPOvo5zNFXI4TgnzzJIdMa3qnK+rS5I2Hp+KFMPmwPS
+            XgF02056swR92TVWrRMRnsXX7jSj4M9VtwcLrK4ZGlqIp8erChZRgRIvRHWjPkAh
+            sdSS6JC5YfLxMxGvWrskGwuGdMMbpzsRjzyaJKeSVSFqT3rlx5koq6ecBOt1DRg=
+            =m2ZU
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/production/semery-fr/values.yaml

@@ -23,11 +23,11 @@ ingress:
     tls: []
 # Tolerate failover nodes
 tolerations:
-    - key: ENC[AES256_GCM,data:/CMYAKY1KdK9,iv:b+SH9zZtCwROCmMLTa90L+3BiSbLr/keSjRnBTTTWWw=,tag:es0kLEhnri8WZxxl0hEwcQ==,type:str]
+    - key: ENC[AES256_GCM,data:AAvY6dhjiqTC,iv:Wppxrm/iJUNjc/TZvC9mPDAa3toF5BhkLUkuqh77bIg=,tag:p9QKeRskh/y26zjI36freA==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:cFhYWTHVVUU=,iv:7NVK68CshoAzE3SLr80R02Sh2CbH4wLGt4IAS6s2mPA=,tag:1kXlilI3sJDP+nALaS9hmw==,type:str]
+      value: ENC[AES256_GCM,data:m5zWONDhDNw=,iv:ylrQNif/KiQvcyXqIvkCQCiqKaacNElHC90rCGmG9kk=,tag:h+Xm0I9UeEJ33UEq7g1URg==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:oZsPBWoZNGlsdMKsy9a0iVyFoEv3u+QuH7w9nH+LvxMZwcqYKw==,iv:1CXgeE2ulPBvqWuHGy7MMv7YVvylVVUFkhO1C7bWTy0=,tag:YWtEmfF7/2kq7aUPpkIEig==,type:str]
+    - key: ENC[AES256_GCM,data:FdFM3MInrxMTdioB96eLjf1SuZZFNQOxV3/qjFer8wX/cG43OA==,iv:bTi0PaS0gn/FsxyIIjPpq2rN+tnotqZoiGuZyMSOP68=,tag:5V8LogK4UVMsCUS1fgrwDw==,type:str]
       operator: Exists
       effect: NoSchedule
 # Prefer (non-failover nodes) in normal operation
@@ -37,33 +37,34 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:elhdFbnzEc3Hfk2WfXMMM9PJ5ZE=,iv:W+PHxb5PeCbLr7gLrysbedDZcjkQ9j9sGnL15XWhq80=,tag:pmEtrOBVmVIDEhsY0LfwsA==,type:str]
+                    - key: ENC[AES256_GCM,data:jgNJn7jRN+dMELJ63ywucpnXmOw=,iv:M2uNhIywAnHs4IFCfXNyI5HV3Hb5sCjP7pz3/Yl/nTY=,tag:FS+VvTZmzmQILjvJW8Ceiw==,type:str]
                       operator: NotIn
                       values:
                         - "true"
 sops:
-    lastmodified: "2026-08-15T14:43:02Z"
-    mac: ENC[AES256_GCM,data:0WpSxKZk03sP+2RKDWzkb2z56eBkkUG0fOkAafQn9rxGFTNXmo0cwS4HfM0RvUTHcpEygA2ACb8YyQW3btCucMR2DFtbJ0nnks9qRI0cLTQ12rbJbkwy6+jOz2Sb5g4oD+xx+PEWyyZHKj2J+uRzsPbFjUe6+CG1HOT/lRaerR8=,iv:nhIROduhPWMrVN8yQzU2UqGlLcY7HZMR4SBA6EqMWoM=,tag:17zGcnJjQgH+0speBHymHQ==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:0krPSq8UdOyscNONBsWoRXA6qfDrBlDmm7wa4RMRGnkeI0lM3+GM2PiUtlinrqL6MAvIHlzKTkgG/SuWQoD+Uj2aM6PSxHsIfnxoW/chqVLrw+Q2GvIMlehEKNEsDM/dedvZhIryA6Pl7qD/4xKrkQjlj8LEyrq0qC3OqnHk2Uk=,iv:tQvpZPQUFKdFxcv5ucMSGrzFMJDC5TLP2RsYjYOtaK0=,tag:397SQXa1AYTEzI0gaa2JKA==,type:str]
     pgp:
-        - created_at: "2026-08-15T14:43:02Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//WPBdlE9EkPZut4QRwpGyj4oNwnKpQhlUSJ2oKxNk1Wtx
-            GMs7FOm8iSpE34RUoDx1UFA8aB/0bqVy5x7Uu8TLhlW+khmcW1rMkSaIOBOqLpgX
-            8sRTefkDq91dC17OFTYIjg28a+7gjlDauQpF2c8ejA4yfCJGRl2Z6P2EVtzEtGpj
-            wKV6wdXrDlHNv+606VrhNzn0eZ/Z0e+NaL3a80rRKmPfbLQaWiRsXxD14ZpdVJLc
-            Vk2dZDSrLmFx/TLHSqrwr5JLOxaNMUYywIc5gZZSQ8lWLnoxZ9zaugvp0JQ5ldb1
-            qQL2a6lyH4sPDK9ZexMlsd4X7PWKQju7ABE790WoLdF/F3++5jAqWAXVoD3d6esG
-            2L1dJFd/4ZhG4NcHuGPwLIowCJnJzfXh8w3jNHKFeL7JAEzTMjbrlg03PHkLUGvW
-            lYWYkRq6HknWr59S88bbRUm31CXCbO0nXQmt9Gy9P9ActaCLfj4kmfd9zkB9rAnS
-            TW0TirFDpyx/I/h5AKgtltH9cp/r8dh/yT4lWp5dvosJX2aP8ux5/bUXJGIJaU8H
-            bU3EZYQBRsWkV/7CqcSN63uIAP027sDF9o4QsrD7N+qCL+/ED3UVXpnQ2YkEXQlN
-            olTO8uQg+HBg34j89a13dXL3y3uqPow4gD6Z/17+rWA5tCKCUYLaS7MjibDoizXS
-            XgHiv7PzHvxrVy5EmyOx0uWO2gzXyUh1oqVMFTlBqlWc+nokHnepCevYYuIWkZh1
-            ePqibvEJyt8DsAnh+4w51fDD27HuYx1hmeZ0r80tmHAkJnuc1d0LEzD4tulvEJg=
-            =0u4g
+            hQIMA7uy4qQr71wiAQ//fmb1BXRMO8INJV9P2ru3R1wDKNO/YCW/ohYhGeRlcNvS
+            y1vIY+GZ5ClPaWMgqcVAUbDmOKseOOXSPhaDPkVwECDsX2nzKSIKAIX9AihD07pl
+            wnDKY840Iogosf8yVHkJmiTCTCcXmj3yoynGDuwiPbi4+pA92ebCx6igCGdUFaTD
+            nbUhDhEVIfMNq5sqmt4ppYuAk3XHabw/g2aF8Tse+thqLlZOeDNmhFVq+sboR6GC
+            KNa6Zxqo2Pp3OjvAjqOVIE9pVNY61DEErj/LzsBGDzo6Sg4qckv8h41lPxbm+Gq3
+            pm7/ytJ1F1ZEk2dfiMgFvMZ6yKi+urWAklZWdsw7II91kvqZ1HZv2JEWC+61Sh5O
+            KngWeZ2wP+Uu6bnBpWzpOpvyKqNb9NcDniwpdE/2KNpVMuWZ5x+G+eLhIS2R+9Nm
+            AiwGpUTsXZv6aT1oeRHDuW7T9EurZYqfNSuJqSZaDJZhYS+PdwUF25eqxb8Vpxo/
+            pNI0zLOtn7C2kXVgUSQLyD/mGcpNo53Vr7K0myg8RYkuR8l7ucbiczf/4YQguDJS
+            Ntxhi8ChVTAtcerpuCtMwYRVlatISf/4jnx1XJi0Im0kQoTPDN/ybqt5wTK/DtHG
+            gwgJsPO8uLfCmNjtKw2c282e1jlDJGTFgKfH6ls3jBY08Uql8qTjgsFa+fL+eanS
+            XAHUEmqmezCImPSyF7Lu18rlB26o3W16FmglTuy7jwV5NsuZJBJVegu5x+oz7xOa
+            2eE4xIpk6Iq3q1AAvbyiLNsvli5tm8mTFjMAZ275DLWps2QlFLFYPmi0nZ9k
+            =K7AY
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/production/umami/values.yaml

@@ -6,28 +6,29 @@ ingress:
             - path: /
               pathType: ImplementationSpecific
 sops:
-    lastmodified: "2025-12-29T18:15:28Z"
-    mac: ENC[AES256_GCM,data:npCm/Cwhn5wCsf5qIu2rcwVP+OFe8Ph1qRHQriVANMTC9dioFPuS5IMU1RRnJPNt9y0nE5hSscg5LrfGBB5qCPUbqj3Ca9/Iv3raZLYR6SUcAaitFlxhdcFSEXOhLa+PW6yW5RZjjD9uD0IEuOje3+oa+05kIm3HqdL5Qszarns=,iv:LlywSpl9l1iEa9f1KatvLJSGU/jZWvUbK1HI9uRpZT4=,tag:I3L6JD3GeLNlrR8e5Gz3JA==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:IIlN4Eg5FbDJbQADFcU1Rf0kzv3GrvwjjmrdK1oIX2Ae5u2Wu3+iXhhzx4j6CD43R5omnKdvLVjU3RxDS56vPWuyJziBBe1Hzzl1l8AfdjF4ggS9RZqLf+50+EB7en4jVD7CXwgGBLoy+eU8UZKCeqR5Ft1sMEUcLxGMnvwVBhE=,iv:a0gk/m26Z+q1IHKH/Rdum9eCUPlWXN7qeKP0nQmkBus=,tag:F7f7XAksl3I0KAActBP+Vg==,type:str]
     pgp:
-        - created_at: "2025-12-29T18:15:28Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//S5Ormwo6DS8bywMVa3JJLuBbkD1aIvuxItPHzdJFte24
-            1b3xRi/byR3i5pgOg55/VPNfscxZranA0GGayYALAepTpdKwYHkrfeZF4RNZHlwe
-            C/7eQoljncOyGUw4txEcD0gfMkQ9aNYYnSs0GwWYylpc/dxaogzwsmsZOGNVK0Rc
-            oeOFonEABIFs/dW+pGTAyUnexJPZO9cWQyt22dEDzRRiifPOJGcSE9+2RICS5p4A
-            75riaa9jC/ANrDi3d/fTYFffAStggChNUtDQMzSKP/itpqK4rs+xWRcsF/U4LLZM
-            xgDPHzJsw4apZiDT+p4dH43DWmEATPcUH/UftG420cHOJdeU7rMuabVbxRXJeXA2
-            1idQiODRW4pEUNEqPMTtjrmxl+SVvCx2TlJ31idiJL9rM0DXfzEF0dacnTjV4LuW
-            2oo9CiU5n+Vh6PRKPYkBXxc0GF6Vcs9/SZj47X8RQcxxqP9BoEZs4JclIS6OGiY7
-            K8dw/xDmpHhLgQ1JCHEWAVuKDNH+KcnMm0mzmCHetI5yMXDVQpxuTkquhUptV3VA
-            XL5+girkZ5W1XMuQiKYcKzS/r3UOHieKBRLw+MhuN+MRLOLr9FRQ+YbEGQ5Mi57R
-            Qcp+nycwU+59rFRjpJaKauRDNZx3P9GnpTJBL9L/4/uibYtyyWEmMNWQcDtyhPnS
-            XAG3SEsYE0547TKm/fP7q9rnAOfKwV4NwBBzGblAUJa/HIFjsT7uGicRdTexrvkK
-            pbIqbyBn0qr8Y1ipaqEimfyc6OT5JDT8239SYnOwG4QPz4DV5vibjG24kykf
-            =GDKV
+            hQIMA7uy4qQr71wiAQ/+I3nQpvsM+0JUvNM/0Cb0H2eI3xdBXwLONzY2EE5U5Qzr
+            81TyVTcKtjXVNFmo4aGUCdXPt++uzLu8X3iOzzZDJzU0IbOrs1t+/CGaHPJvVxIe
+            vTYSF1A3HLr5vZCZ0y96EWV57cU59iYUEDNvXfMuzGG40JGsBiJK0fTzexqc6AnH
+            8L+nWXzBnbN8rU/SnVGPyUPbqeJfy4woeIHolkFS7Iwm389CPEcPdgGQqMpBDb9Y
+            GKoZEg5ZG7p7iAtwIp3tObxu87IsUQg/q3GkAyAJqDc0GTPIVKHcO+x0kbyyBas8
+            bDLBVkJ3c4vR52KL8aXFnQeoB3AoihhbeLZHHr+WuNCv+9xQbQQ1mh6emehIU9IS
+            YSCcEG5/k5WidzO74NY3JDLXLzYJKHTQ7MhH28YkehJJk01Con+0OM+ySvWsqJ2o
+            V/hmHt/UFljt5fEOo8IFm8MTUpSmihm7HJT1FG4N0SLpSEyr8h87rA9WZpZtWYI3
+            6F+tBOlXjBp5Lrl5MfGHzNS/M7zTohUSwSK/N253jUXB8sB+QKOMC/dHB/388JxW
+            46E1MysidePHaxJk3M7DsXcmz4XvWESu1Xpf0bAzDrRS1VhtIHrbQdLwZ6xb9fz9
+            4DphcE/o6uZjJKHS5DwisMtdmX9ibrmw98VLy4lB+sjC6hQhoPI9Ijd/qBDdSYHS
+            XAFVqj4L3dEqfvOpBagoLGRiUV4f96njkEkSmAvtaenF/Ae6qPIbRjPOQv/RNC5y
+            ksOXeeflYu2gVNZvfzENAU3NBYGkmto1MpPDOj0mnUN8pjNbI1SPwKkuzYdo
+            =DesT
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/production/vhaudiquet-fr/values.yaml

@@ -43,11 +43,11 @@ nfs:
     softFail: true
 # Tolerate failover nodes
 tolerations:
-    - key: ENC[AES256_GCM,data:whCOkQ/xDUyG,iv:MU1iyLWTp21dUA0Ukn7L4Kdmp4DcD2946/1lHrgNJJg=,tag:VdVgjP831+lV9IdabEYvOQ==,type:str]
+    - key: ENC[AES256_GCM,data:ja29UypZ8PY4,iv:OclYLpgX/HfvEBeAXsBvaAA4hB0l2Cg0JR7grR1lTTg=,tag:NdWJQdG7glFCOyDHzvXibQ==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:IXlCv4VONI8=,iv:/7uiSYGVY85/8nGgnQjeO+hClQPqWEJWOMwEZs1VuzI=,tag:gZI49sfALmsfaxjF4mP4WQ==,type:str]
+      value: ENC[AES256_GCM,data:kbW9J1Gq96Y=,iv:TbCK7mPcikPYnDIxMVXqCCdhoVFKdinB7D1OczpAsxU=,tag:MHHTSu4zr+BE3iY2q+l06w==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:7MK/rNoqAhDUJh3O4r0b47PVfT3ItjnnCOKJWZCThzHNIrw0bw==,iv:hUCE6+NwucVw5lwktzOpXRqjG51w4g/AQceyBiduu+E=,tag:DWGdD++4ZptIsSmLpwZAsg==,type:str]
+    - key: ENC[AES256_GCM,data:EmD2g2fExXx1efzKZEBR+gDI0FurCGY7drZeJQ4UWWqWD0WK9w==,iv:g4NEJKZ4VMs4CWjWhV6M3IR1f3iC+1FuoCLnrmWTneA=,tag:0G9psRenOhpP1jF4O/gB2w==,type:str]
       operator: Exists
       effect: NoSchedule
 # Prefer (non-failover nodes) in normal operation
@@ -57,33 +57,34 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:EDr52ZzUZjtJe+oxleIJZZCYCl8=,iv:ZafjjEMMaWYP7JKAhnRkMB9kFghd5LB593mUELzDLwQ=,tag:4EChdzHuvLSxY+fEum1Gzw==,type:str]
+                    - key: ENC[AES256_GCM,data:Awenw5YOeHT4Ox4zmVS1bwOUqEI=,iv:H4Wh8ym80hb7Q+5ZUwFsZi7eJ4PHSLrwV6ug5o6BIzA=,tag:eEXV1rSrhj+h3uLoAPgGxw==,type:str]
                       operator: NotIn
                       values:
                         - "true"
 sops:
-    lastmodified: "2026-07-25T08:12:52Z"
-    mac: ENC[AES256_GCM,data:i7rQRSLbo97jjEksr0NlQzaW27RmYpHwupe+KSAk5Y9yCSN389EKDWGiOlnCbIDAFuvAeIwZOtZah39g1F0f6EW4UWhxP2URqhFtcc9UeDExEi15lbI0/6cgWsv3mHIZb6WPp8dHrfF0JszEPinb154TB3PpUmhyLkY6gghTYBY=,iv:d/pCDDw8itNu9NCkwTxPbr8w+unmSFrjbvaw6KYlrEA=,tag:x+0Us26vvNcvDyn45ilEQQ==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:SykWsjz27MliQeGiof0rYYzo3/qexc+HkYrDW6qTte82+WB4EJN32VeHjU77pPcFHntr6vOJWJuIH+7oP9y6IUp8v2W9L3RF+2s497OLp6s2+rkec7cBNczW7rulTI1ByimcleYuDIDq7X38En1Cy0DLqJfQsgmGZNH4SW0EMQw=,iv:/bQGm0olX0CSlIml6gVFHwXExOhh7IhmGwxkCKesIV8=,tag:RM1BEKHJAxNO+xJSMW6BAA==,type:str]
     pgp:
-        - created_at: "2026-07-25T08:12:52Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAr6IcISfUd787wl46NW/mDOEv+sQCBCvFUSgVUETIVB2W
-            lryFntO+jxYjHYTDoevCimyJpFWai6YzkBvSVb50xXObpyHgjLl3IgQx6B3LZxk7
-            mwIgpa/mEyvlP06GzU4NZy3ac0X9bKpQo5IcU0nwfs5ZedCZ0i8FN76PUp/nIfFJ
-            6AzjxVzcJTDDEPu1ckn1g3sRvLsGsQVzagrLtyEFbYxKxugSE2sswYCMjbnxwMpW
-            NTWGal/6eW7W+oR5iJseYnkFz643ZbkI8BLyEuJtCql14kw5W245FZwbffJQpGpU
-            NbEuRjbVCF0tDwH9zEPNlBOsrmw0FM2HB6sBCMHA9xexuhP3OdIjWuyNHf6oMwS5
-            d2FCOT8xrYBWNOwcoe+xgLam94L2jPcL3SizP7AUEQU1CjXO5q49RvYjPrrgH5zb
-            PvE8yiB1zDPcTqnBf4O+lIUkdEQ0IxkVWuYKljsaJN35yNgFkCoROaGsZD4IcdD6
-            EgtYAllK+NXdzd2/iLHf63J4mJsvRHzLsWcdHZwvJxi3RN5Gi18EB1boCEhFM3Bg
-            KkaNDNwZtWtLl5QLkfO6zTEBx1E49hGRlE1nuDpSbqer7cL5n5Ca5TRAm0BqAC5Z
-            VIjt5CqNcojTVsZLUsYMwq/yI2Lij8/OdM1datuNM8RD33mE+tDB3n8WdNFgN8TS
-            UQG0emw3jDSkHQHVWGc2iPZ033NobqICdv3xvjyjdjngDWEtPj4OoLmriqxi0y7Z
-            LhlZa4RWyBc8TWe9Q8paBUh/NzFGC4v1zt8mfUMSjYfyFA==
-            =ePQy
+            hQIMA7uy4qQr71wiAQ//Te5mPuzpn3t/Tjl48GhLVXX85mm+FmcXLFHD9onv2SS4
+            ojlbXYQcaQyvChWNCHyQ1COubkTWa0JOk43lNDmyrJoTq0fh0avX4oqtJn0eUg7a
+            Ss0xwrUjJ9wQDScyZaqNHH6H3Km2JDll+6ObLkX7qvTvQoi6x8RMxqTpeJ8G8bmS
+            /2sOK5oj9xZlGrA+Bz8u+JE4MguhHwf1WvcJ5dBwaDYgEISUpaTalAKjrLRHFqRL
+            8lyaFqMNBy8VB/zhgJDxy7WhZKv3wGtU4cNmYatJUPWHcjoTSiaNGiu1+7XnjBxY
+            muso76okHjAvf0qiEE1wfDvxuB2VpZyj4QiAgVctcq+hq3yW08FftdMq7xtIiYgw
+            Xsoryrc0reXys4j7V7/GT+g2lIbjOR0EbnY69cLOkidijEIxuqW5F2dSYXv6E1Sn
+            AowT5SH95RyfNV2TghUL7Z9z5a/xzhBz0gQBVvlxcJntpMqkaah+ffwYHHY9nPPm
+            KynAk3zHkRd3MKHHZDrcYwnvhdDAQf/OVrHq34CB0uMIqDY/91EoOE3MiasvzREH
+            8P53YoktNdw/TV7RIhYaHfn6/0J1qw475TiDHEaY/Zy3cXBI1v/BD5Q0qp0ECKr0
+            iYuRtMm7GZNFp6Xj26XbxChPH9MEPvrAkM5iTZ3kXlajjKzNHbMV2ANMI0wxBl3S
+            XgF7I4/pzOC+RzJd5hQFFWOF9aWYFeIxd+IQQWwTDDJ/k+8+Ttd/I6Bq5hdSTJgS
+            OUSnJ4SmnZOK5iIZWVsRvCBCA3ukKUiIsUhFf9UlYxFjkKArOXnReYeaOwzyicQ=
+            =6UoF
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/system/coredns/values.yaml

@@ -82,36 +82,37 @@ extraVolumes:
         name: coredns-lan-zone
 # Tolerate failover nodes
 tolerations:
-    - key: ENC[AES256_GCM,data:jLsxKqX8HEo8NbwtjeGf+8TdVzTgpba8myb09z1FOIoBsplZ9g==,iv:c+rAeZRAL8ZmQwpHDF5xv/l0ZqbWsnsdDlpFDSDfZrA=,tag:u9TfeXzHJ6W0ifaAEoPYFw==,type:str]
+    - key: ENC[AES256_GCM,data:TD6fwhFKP054jWvEGAT4xwhZNT/MP8k0r+Z003ZNxZAAgvA+yQ==,iv:0BoyRY0bMER/w/xhcfyG8rypVwnAX5Mx4GY/uw3EWaw=,tag:Wa+XMBfOZFmozPkkrCC22A==,type:str]
       operator: Exists
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:hPb/xXAmQrH6,iv:xo935JWcl3a3LyQ8YNIgNrjQkdqlP5aN4ZnjTnp4RM4=,tag:/rkpqOI/pHqXP47OGULnOg==,type:str]
+    - key: ENC[AES256_GCM,data:MmpjgvMIVnwY,iv:UczUocGrbKPWtHvqroPSM0fENcFKA1/q5gg897FQ2os=,tag:VjIXXMqFKZpuJLDcCwrihA==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:nblSYUAjuMk=,iv:yu/IToMo3DC9kfI5DcBPvreJE3dkxdFA5x2fy6dUpjE=,tag:NGVTMBXa/STsOCD+g00yaA==,type:str]
+      value: ENC[AES256_GCM,data:wQt4J0CGyvA=,iv:96KUByHzR0rYzUd5SwvD+KADFJLzEq6tp93WkidjqRk=,tag:6cdRiLbkFam2Op9eL2iNkw==,type:str]
       effect: NoSchedule
 sops:
-    lastmodified: "2026-07-25T08:12:52Z"
-    mac: ENC[AES256_GCM,data:fyuCFq0hIVP0P8e8vqF/OKjBway2EzDo8HJhLpTQqhIOhOP6PsMszovi7BzG4FuqT0Hbcqo7YrjcVKY2WPGIlxoMVBuuXcUSvNB8Tdu6jv1jgq9KOoB0HNbnqX/l3TzN9ckC6Hr+QrwzLIpTYNefDlNovMCz+zBP6ALfMwADCYM=,iv:EiXUFcWr9iL1qdfzcTiL6LYLLrsShzwNNhE0eyLVYrU=,tag:JyN9WrQWSE/3wFksooRRFA==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:JeqUi3IuWEHkXOinYmL1zTnRJzngIZ0YnAsEk4/yAly6MpXEjvaQTC+YCutr+rLd3UKENcpeenqVuJiFni4EVpUUunVV+2TCGuK7rMAUaUBHgdscbnJPxg2rvTnmhDmKwFrEcgM0k4bszzRJnRONCnjf3NDZxbNNUuFDiu88ZFE=,iv:+d4VOxM9fCICHvgl9O4Nm9sZUYkzgqhYqiyDjULPfgk=,tag:wvtKkcdgYcbmtFrUD6Ycxg==,type:str]
     pgp:
-        - created_at: "2026-07-25T08:12:52Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//efLh++Dcra+LFtcgz/BRXdLyE+RhWXpQjABE2PzgOJpQ
-            xubJJDmIV7BtUFyJS2lEjuZ2Be8uYxs2WtWILDktz2IwNQ882NVCWNCQTPuzEpoK
-            DWqwi7/L6iQldx1aeE/VUocyIxYsqS8ZUHqOM8Z95xlQ0/fmhB7reTCXvuEOiRy6
-            Aapvb2yW9nm7PwBVhJiWQQLGVGUkgPE7HIK1ar3ODl+b4T0FCYqjUzeB78mG2D5i
-            RI0SRt56w+g9XVWk1tijKL9wx11U9KOBbmbdBuE9fkHuenns5omAzKIK0iwdHQkV
-            cl3rr6m79OAqJglDYLFf8LOgHxuVcnlVxOYgmiHXjG4hlJlt7rGE96+UlRHCemhD
-            bgyc7kDR3h4XMagI0OcLzjyvwsymCtZFiE5PLRVLkSCQuyrp5B3QL7Z5hbRZFiKF
-            UlOziOw8sPOcvjOOJpPYF2IqWAGLSYwo5S0nI0O0bwOiM+T+ehZ5q8p47NzFp04q
-            l6JpHtWdjsxVS38nDb9AWqvoHyf8EtFbJYmKeowmbN1/toPQ1q80at/NtUZIzn/3
-            +VhxDP9u38u+lAAuhaBdIolitOi9CWwHqrnRXFa3V4fpQfJqXUc9You5bw/+EABV
-            jTjMpcN7cPWE7SC9R1ZZjvxrMKK0qxdKO5cvXtP/hBd4zOnBqhsQBzr/QB3DycPS
-            XAExosGRaKVumsUVYqEnh7ACVtMHGDLvupj1mqSa8oxRJLVDXNFLpEllFqLpoxjD
-            qbCMib+JeL9/Aq83Apk3HQ48WX+4hvtkKIJ7gzeIPC/IvIVJHk0shd49kxBN
-            =Xsas
+            hQIMA7uy4qQr71wiAQ/9EkvguGI0a/J6jP6h4c6jbvf5EFkF9qUtWimjMgfB/S3F
+            DZjX1YO8lyQmoyMThK2O5U/ocq5/rdQ1P9I9ZZY9+rIy6Gewcw5xBfwivuLUo0aq
+            JRIC98dGeJN14sGJFwiatmGp4Oq31TE6Z9yOam1Qvxcm6X1kURTAa0FYXo6BlLH4
+            sjfdfRAiGScV6jBKsIDc/fct++3FK2TIvwwHgyyXjoDq6Fp2i4hPT7Q97M+nm1d6
+            0HoRO9RcEZzPjulyhMQCl9J037IMGZsA4dpy85jzvF7wsI/XmhTAj5GkETD1ARtS
+            dYGhgz/CUPG78JsRjbP8oEztsUw6blORlhvooB+8gMVPihnpjiiApzHzjVBxz4gJ
+            nxDIUFTqz6sIoAA8W1/auS8zpw6/+bObSA1A+5Uzqc41B0DuqSQLVqx8fO4Yvnt9
+            a0+J05qgOLvSm3uduXCeKnm8nLSMm8YQSKYV3qYSyrqyp0j7pJJ8I2amm1Lq3wdz
+            roMNO5yj4g085x9+6El1+Oaovz1cQM2OlNjV9nYhhJfqZ/zzjuGE2P0VUWfYK1u0
+            +wFe+9ZEgGmwjD5Y8cd+2EFbuY0L2Uuq1LG0eLJKORL4nUy7Bam+sh+WEZ/+hqSi
+            56lcyY/3btMS/GGYekbJ9KU5nsqnw6CAcXxofdhC+VaX5DKwHLSrMXZ7p/a/H+jS
+            XgH4WbiGrBaFDeWLMXnJW0fmR/kn6bt7dLsigkuCxqZ100sD29Qwx+GriOBuqTHD
+            RCSk+he3rUnvCBlSjCf2842cQRlvwg4m7hWHOKJhpPLSXoW9OTK3Fh0RDP8c2Ew=
+            =UIlP
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/system/csi-driver-nfs/values.yaml

@@ -16,28 +16,29 @@ driver:
 feature:
     enableFSGroupPolicy: true
 sops:
-    lastmodified: "2025-09-23T20:49:33Z"
-    mac: ENC[AES256_GCM,data:PzR0Bd7Zri4gjpaSaeouJxSJbUP8f3dHuzuNlXm7q0B3SgTExHAYWT+YQ4S1QZPibE7LcPMln8Al+ac2TtVaIYD+voISUMt1+w6bqA2RmO0ZbF0mOqMiMTnWtbvCI5b/8g5+lYQRWt+5k6Lwtl5qxbdEeaBKa9qYpNw/DoEDwlM=,iv:T2XcsYVdQUGrjbleoAfcZXmS/m+kh1VcdMpU6TAMnX8=,tag:eWpR8XjOdSujxaz5aeWz2Q==,type:str]
+    lastmodified: "2026-08-26T19:29:16Z"
+    mac: ENC[AES256_GCM,data:NapXtPezjbRh2RVcv8Pi5/jS+TxCsPEVCXhWBLIuvfC4wWuwKelqjX1BjH4B0zTlEVzPzXKkeLyT5Kz0Jh68hwltSPCzF+32BqzpxpP1PD/ErvLvjtagRwnoV7KVN0MuR7RyNusFQUBDVXll9dHp5R7eUIcpe0S2qkVWiqnbx5c=,iv:ynnKQThC7PLua9tNTJLRp1b+V9yp6yUtKtd8fgvkol0=,tag:3r/XZYwK+G4sv+GAHQ2OCQ==,type:str]
     pgp:
-        - created_at: "2025-09-23T20:49:33Z"
+        - created_at: "2026-08-26T19:29:16Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+IMPmEpFfZkMC65azxf/qhbBg6z2rVC5Yjb2x0F9vhiCS
-            nbyrAe1jTi5sLXBFAeB3NSR4NAdmuicJMIVcCTBbIQFOdGgE9zh62ZK3nR32JabJ
-            cPIiQLI0N3Mk3Jgmll2m2Zfj4FoanDYm3rJ2mAaKRhqN+txjHCv6bfTMcWfx09FZ
-            QjZbtU3frO+5dbSv7SAvQGpk2ehZJ/zcbhnwMv/wD8uMj9fjRLdhP4yBqDDapiL5
-            IvHkEZhm0egy6dYx2KsM17j31GbA+b74GU1+2+OiZI8CVym8ZqYjHTwMGYjSQrmF
-            v5DqpNrmmq0iumkRkjwYD1z6VCRJTWaSgUplfUoJnXGx8Grgmh7TqTBzAH2LlkR/
-            lqqOo1+GydP1H292AQ21JMTEUoTjbVSJgYDZo+FgfbWIWQMa3DfPx5byC1cL1iQY
-            kIJHkJ5k6NyPzJAF88Wah0dGlUx7IQ8wVZ8T43hf7VaeU1KoLucQfBiSau068cUn
-            zekMh0apT3PadC3w5t5yia+gl4acy6PdpyqFdqEE1CahsIxr8PzFIa3c9lyzkr+E
-            /naeDLQT0akEnRUnvSFLYEwo9TD+pA63eGAMg0fxNtvBpn0l7T9ygyw70ERqyOGk
-            RixYAOwemlFKm4vsJa8Om3vE8chZ70z9e50/bx+kybGgTWKR6251AWU/yCxQd5HS
-            XgFgCrzXAVInmOTNqpafadWJloLrMh9ukeDS2eNIeTe+rbRL9z1iWnBWnJSJ0RBr
-            RYagnwWcQTdxi13qUQcxFGynYZGa703r2/yvCnE0iDVU44IJvWr2B9PW0wnjOSI=
-            =NHP9
+            hQIMA7uy4qQr71wiARAAoaqSEhJGt0xxhujiIxgrHc0psSFXl9USxXJWYsxFAB5e
+            ypcxbemrGtf4cTQn8Ol/pEF/hd8q7NlUnfggBYua9jX5O2jTUYe6v/l67Jxvux/Y
+            X3nt9BmsizFEpHsm4QicsNfqnxJMEWILKA2A+35SBIfRIgqcEP03JrJKkOIsbAkD
+            taNxfHhJEgJlctqnGgIK8KSXQQhYohZiOLukTpfwY8nys+O4dfz7lPu9jlF3GZHM
+            2BZgbEb3+dNq4MsJIysy8ECUCZVuMuhxYHgogcXmm7iZXDoc+ala3CVjGwi/KBVx
+            aD4UBG06kacMaiM9ddpelmTvkD4/GHl1FFCoiIkVelmNMVjD5aecn4xl6r15CC4J
+            IQRO2Jc72sLPAjQsiq9El6K0hFoWj9v4L7xLDbE/1KozjVK8eUtKT5r5p5t5JOvq
+            wvD2TfjDwxdosJ/hkCj6FwvGZxvUUHAyXIN82Q8nMMldjyqtww0JbSOLEz8sZFds
+            AqbTz95kNYZGSoJRa6OYOdXYQk0wG89sqBm5taFm6V9N0hsgv6y7Od21wEgHKxKX
+            GMR/K/mlZ8lr30Tb3KhCgPQ5JpyDKBIvGuAJLnlVE5//wkj7Qd+xXAiZX7qhNFBq
+            ZNy7FKLSC83l5hFKFyFbELe7VPB7YaBGy2312uZue+WQgchndFgRataROaFcz43S
+            XgHovdD6j4T/AEd7N/l+pd6Za8Xejc25+37F3i2Mstbme2Nh8pEqkogRk0zgpJKS
+            /Y/FtQl8+lpJAwiOAbghZYnflvK9bLnTa4cR5MXb737G4MjMg29sPP7sEJGdhpQ=
+            =Xr/t
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/system/external-dns/values.yaml

@@ -8,33 +8,34 @@ provider:
 domainFilters:
     - lan
 extraArgs:
-    - ENC[AES256_GCM,data:pWoRZNy0bqOOC/KNOy5u6yVpqJv29cJIgQ==,iv:gWQc3vdCwT7V67D0tyrPASAUNhVKjc2SIBLcQutIWG8=,tag:q6C1CLTMiGv0ZJ4jrPYOGg==,type:str]
+    - ENC[AES256_GCM,data:6iKGrY+uwK8bF3mpw2TrzLzJkNcPg5gLLg==,iv:0NuYOmgVUGKZkncT01li1G814YHMhgz2MbdfNBewRqw=,tag:evLAb6LzulILrr9bQaeWDA==,type:str]
 env:
     - name: ETCD_URLS
-      value: ENC[AES256_GCM,data:w4cTglu/bE5AkzdHdXhC8B0IazuxfQECVdPB3S2kUSJ8L4Q21oUQOs8I,iv:p560+9a3EqNcnA83Ahx/91w0PfzqWlAY8KRhbaCO5t4=,tag:ajc0Al6wZTOVrkLDXG90+w==,type:str]
+      value: ENC[AES256_GCM,data:Y9osquaMjUJa/irZR3cM+wmhtaIIhQYwVkLVoc1mvK3NOkCX9T0xtCYX,iv:5RkDFNaBi6rpa+JXmwjhZ/DIDtEcCyQ+nY6b/bdZa/c=,tag:EbLcsqneJud6ZQaWOLqZlQ==,type:str]
 sops:
-    lastmodified: "2026-05-02T14:07:20Z"
-    mac: ENC[AES256_GCM,data:unn1TyPyIJZZZl3rB07iCjBJLP5dACsEowaHG2kPD7ItcLeZhz8gjy0Mz0lPgZXizBLtxdPxlH9W4DPZM6tIudghKovOg7ivoUlA78We87wOxACzAlLwG02vw4f5CKwopqEpdcl9aprLbg815IzcDdsKqSLHIw+Xdm0nW4rP+T0=,iv:YCoJhgO4hlcCcvVx/dxrIBR1677U9UREX26QPB8G/WY=,tag:PguKaLKr6wm93OgYgzEENQ==,type:str]
+    lastmodified: "2026-08-26T19:28:04Z"
+    mac: ENC[AES256_GCM,data:GfjlnBdScJU8n8IErBE3mQ2aUpDjrnq6VJmc1Jj+g1ZWVXnfWP2VdN+mn2UHEkZTSzbKLyOI90aDJJYAz3xyR/Tku4GPfz9GFirb+ihz/VkxELtGKUWKOuGKvijieMbzSO/BkdZnkUc4iaxpmIhwxT5CLcqmfjuZmUKHyZLa+gA=,iv:HJH6Kt2cHjjfaPkkQNNsni7r6YNW+uqa0kF9+Am0dO4=,tag:ixBoBrexlvkMvwuHVDzw1Q==,type:str]
     pgp:
-        - created_at: "2026-05-02T14:07:18Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+OD3xMKWh/zrmSAzeha7eBUQqxV4Md+Sk5ZaZZpJwXm0F
-            Icb4N7rMRZiUL/BXaH7dDyLNKFbqTGTtLhBtp8IbW6Y6pijQDa3lgX2aC2LjZYP2
-            GTILWOVYMo18h/idESrj9RBpODDCLUwDUipmNNDrNmeq+aotWEBGZgum2mE/lIdY
-            Xx+gK9y6vE4IRnDp0AMBahYenO1QrzmzEJphBocw9H9RBwrXx3a4Ke4NY56/0cn+
-            Q0+pBZdN4T+tmsplwT55I/2UIyyuLWLzfiXqgzP9PHj2qasP/0txDr3cL1bdMnLU
-            U3ubRFbWHwstjKvsc7sHEZscaSE6CXzpxMCQs98q0I119+l5K4cm/n7ch3b7JDFB
-            vRuYVdNXBllKMbSdvl++zhh9eYD/gofkZhx9cpJTrku8u6IlKuZkuTjNPp4QtkY6
-            pPbC42znQ1xhEw5y4YtCxCfynhjCIko31P0uraMu5Ni8nPwt+nWANKLXn6T0VzlM
-            lFuU2FiPm9/p/4vNd3WlN73ShEf+QCUR6fZqJDEWY82lbdxMX5+p3JKbWtiY+rbH
-            scKh6hH1PAEYxNQosOabQWnt095niHXseWRAAYaRkm86jB500noYZw9sASmARFT6
-            ojrl+hKzUqZa7Y5QIG3VFEiLJKIMDDoT8ojeKkuq5jCznInMdqQ/LlRX68IPI53S
-            XgGNlbkKDLJx2r8ImRTXDkXIJT0d7iBnWksUHYgNnMnFgd8cR5Kud2NU2Hfh5zbQ
-            2q3dcJiO58H3CK6fZQhLkyTbodvD8+4z6E9rblWeAZR03qf8UPW2UmmWPlRgUPc=
-            =SbhF
+            hQIMA7uy4qQr71wiAQ//bmKIj9YnLfdbA0FGxeve0/LggMedHktqWamjHy00TCls
+            +sVFYjJ5LY4d5i8yQQMP3PbTv6TL5PChDJ0oLXuVevuszDpTrCxJCbpQgIhzNdpH
+            DnSh0nvn/N4dr0vyiZ0i3HOqVn0BxPm8YpllsU6yXzoHdOtDVf2iboYe/ePL9XAX
+            PB7ZYOeAKjPcCPrb5lUaBKn9j8WmMz3XmGcQpYS7kIfJ5BZlcuXROV7UCLo8V3pD
+            6NvyXWBhbmBJVWjofcrLQxIdGgc1WKpIOjAWs7cmroZ3Qpyh6r3EFd8GkahVFruK
+            y79BELZjZIg7texNN+oseqv/KXWVC7ZU+fRbUJCSF/z0zWINzTyrbIbMi3MxDzUf
+            A6e8HGij0PRmkzij4BkFbkbRbvoYYdl0pThtoHlZCvKuVSa8g4IPorukK3HD9ows
+            9W1KzUOBMGmhiQLivg0k9OUkZcCtGdgu70a502paW+KieFngfcEkQG3CzA6crRw7
+            uWAC6UJCGtD++kiIloaqFlur3ElihesbrP/KD2XvDzoKXoTKHQQtbus+RupHJdLV
+            gxEzftWABs/4CVirQ4PwV765egsn33nXoHsqTu99bbA61d30T2x/EetOuxVGJqdj
+            L1c9OKXB5SF7/9QxPmmAGGQvm1k9R8Ii7LxOUX+HKlk8bEys6L565KYPz8lhxYrS
+            XgFGgKB+m98+t0UKtYTuc7N9JXiKjCKuahm3sjWHN61C50W4UZIe6/1h/mVpQrcM
+            DjOv4pDbXvVRFXoKEA5W4WimyRcvkICDloI2Q71F4nT3Bv+3MkjN6KC+wdzJBo8=
+            =+bui
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/system/longhorn/values.yaml

@@ -34,23 +34,23 @@ persistence:
 # R740, but keeps things correct if that ever changes).
 longhornManager:
     tolerations:
-        - key: ENC[AES256_GCM,data:DDNTXJiwP2LQiOmqgf/L6tLIZiFgqh42dLDXj8xomGv7rlUP9A==,iv:eu6vnl3EiLu1DWWDWlxkQNcN6/uEhSkpufw7L9Ikr14=,tag:DJOMo8LDGmzkqvIEkfCTHg==,type:str]
+        - key: ENC[AES256_GCM,data:/lEcTm3XFvlmSSJwYhG0CeYXmDHOfUa+yHXfQFxt9WgHN/EBGQ==,iv:h2ZUX6s/lrhjp6yC+PFYACR10uxH7D86vAESbQ9H/9s=,tag:F5xBv+YpjHeErRKTRzNM6g==,type:str]
           operator: Exists
           effect: NoSchedule
         # Tolerate the failover taint so longhorn-manager runs on the P330
-        - key: ENC[AES256_GCM,data:rbWq0sruC6zC,iv:Eq5izQ4LXZ90Bhf1BJ7V9/Xo7HVMULeDHZ6NgItZfGQ=,tag:ixJt7YD4cBy+SrG2WVn0ng==,type:str]
-          value: ENC[AES256_GCM,data:wxGNkS97rg8=,iv:bBGGqcwibhXE0zkH+ZJEVgr20ogu7JwQxxDXqJcMdsQ=,tag:VLBQh8vRl1SiYB9S/vwLeg==,type:str]
+        - key: ENC[AES256_GCM,data:dBRTGlRjjGCR,iv:AcPEXMinsw6ow0izpIXFntwZUMAvMOA1P65mJDBwhmw=,tag:0w24kf8BfryNs07RpWme9w==,type:str]
+          value: ENC[AES256_GCM,data:7XvkPrpko5A=,iv:J8qgVcveMb17rgzYN6WgmE5NpsaKDKMU/2EEctaQL5I=,tag:T9ofKbtlEiVPBqX/xEpnFA==,type:str]
           operator: Equal
           effect: NoSchedule
 # longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
 # taints so CSI operations work from the failover node.
 longhornDriver:
     tolerations:
-        - key: ENC[AES256_GCM,data:1EBSG4hL4heCnLFJYzTNaQWtFU3v6xwTlG+Y9/H4p5d0TZdFog==,iv:9ILcNXXzxzG5CYA4Ny7bKHBI581B1qJC3OBUObScxbQ=,tag:4B4JaFO0tfyVA6w7ypCY6g==,type:str]
+        - key: ENC[AES256_GCM,data:LuvHfPv9JRofL9cOJe/kvfs01+9F3d1hiCjr+WCTzMrxlneCBw==,iv:aC8TMpygwEio0Y6zau5QGTRNMDoxajuBLwVrFF+7fjg=,tag:nSJB+PBouekJkX23ar46kA==,type:str]
           operator: Exists
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:ZSC5qg+ChOkI,iv:rIq8j7L7F641kWDzcSV9lrYxhHggT1FTZ8WF53vxvV0=,tag:Hj4RlF3usdIQi0G6Ecmdbg==,type:str]
-          value: ENC[AES256_GCM,data:YfiuCv2EKec=,iv:+6i5CT1ToCKy1gFtVVIFv5FLQaJaKHx4vQk8b0IBy3U=,tag:zHgzNuijbwI1QbvuLnZNvw==,type:str]
+        - key: ENC[AES256_GCM,data:P+XEpfaaKMkr,iv:SY0hvYXfF6MyJYbzKcCEMaNhzoTWAbK1dYgusgTfsWM=,tag:U9M9+EeSylFKaOqmWUW6bg==,type:str]
+          value: ENC[AES256_GCM,data:A7XxyClHSCQ=,iv:cw9fzGcxDcSrELJlWmqxGuzTvZy5aYe/y43Xq0a1xdc=,tag:sj0ZQPBXJQURZ6A3QPJENg==,type:str]
           operator: Equal
           effect: NoSchedule
 # longhorn-ui — tolerate the same taints so the UI is reachable even if it
@@ -58,11 +58,11 @@ longhornDriver:
 longhornUI:
     replicas: 1
     tolerations:
-        - key: ENC[AES256_GCM,data:n4UdwssGYhHQgDTpCpu+WgIPsdNc8uAaZtnURZt0/C3VfeLR4w==,iv:mqy0GqHN0KxtkETS7psu61Mr1oGmtPDhg2vQhVDas6c=,tag:uUd+NY90XK3i0aigc5ndCg==,type:str]
+        - key: ENC[AES256_GCM,data:k8A6ubFAYnPbFLVraOLB80iJctQEV4ffH21UceeYlMG0khgfkg==,iv:YIz/8wC36BkA6n2qKyBEp+jJhfI0mTvXz57oQC527s4=,tag:kA2c9nmLkKJMANrv6KXXPA==,type:str]
           operator: Exists
           effect: NoSchedule
-        - key: ENC[AES256_GCM,data:isSkUNqax+AU,iv:jWgZyZL9VMmzYqoLCUkIiUuy1iBeOm2RE5CjZGCcXxQ=,tag:714V0YGb7jqebC4IRX/phw==,type:str]
-          value: ENC[AES256_GCM,data:Qbtu1wgV1oI=,iv:RihD43IA1+C3m9OkXACGgd5lY9lDWCyzIcw/MCoSMvg=,tag:WzQtC4rT+uovS6s36DJWUw==,type:str]
+        - key: ENC[AES256_GCM,data:38V7JVb5lLNy,iv:gCB4vmb9dDlOvYg2BBJyg4qzFKz6rfCNiiPZF77t2JI=,tag:rPQtsPyoVSo1CuRnB/jVGw==,type:str]
+          value: ENC[AES256_GCM,data:1X3YImQC2Js=,iv:G/y3Gn1NVPoIqtezDGEahPdv8G4kepSDGipnh+kd5Xk=,tag:HgUm6SNMLp7ELXhpUwWDbw==,type:str]
           operator: Equal
           effect: NoSchedule
 # Disable ingress for now
@@ -77,28 +77,29 @@ defaultBackupStore:
     # Poll the backup target every 5 minutes for new/removed backups.
     pollInterval: 300
 sops:
-    lastmodified: "2026-07-26T08:44:08Z"
-    mac: ENC[AES256_GCM,data:4shHlVWcVol/Z8b+5+tz6shT8x6gCZz2xhYv1VT7dHlgcYWWgq2V5mbGUtsVmWFzkGPC5rYvU3dUEiEkl0zb6Q1rP/fD6xQmlyIgH/ioHrfCvjorY5Rv8t4OFH/TyBK9hMwC+iFdAUJOdE9vYQoDmUMTGz6XwWiDY3PxRv1X9D4=,iv:DDDiStImg5qH2QP9lcSyW5+b+1P1mk6F0TWkt9p2syo=,tag:zJnZ455gsXPkE4Lfup2Rcg==,type:str]
+    lastmodified: "2026-08-26T19:28:05Z"
+    mac: ENC[AES256_GCM,data:afotIAcIgyM9YUDnvMJEVQqG2GG5+x14vbBdzg1wb2nYvJEQmLF6QRXhi7xhU59xIk7aPC+EuZmaXITc7jRJdgmr+4ovyEA0ajaRhLh22Zvhwg/WwtSOTx21PLQ8TqnKyCT+Qg/XfHimefkJM5LN09ZcmlBfAn6ycUo2rjTafho=,iv:+2UW9Ozwaezz8U/WnmcDFkKnl5HWePnWrgM++fqup1A=,tag:OlJi69lRHdWMyZXDqKUU9g==,type:str]
     pgp:
-        - created_at: "2026-07-26T08:44:08Z"
+        - created_at: "2026-08-26T19:28:04Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/9FsBtkggrKwHfh5FFRUFkyqCU596d/R7ZEvsMP7zzCH9H
-            VAAYJxl8D6/KY5EavpeZH4s2ZnlzZjlb/qS2CKpSzXuN7ADPnK10cBxxAOQLp6KF
-            pqdkv6x5MyWbfv87IzM8cI0D/jlG2/iZPfBZy/YU4Rg8cefIl82vNgNADW2O68bK
-            w1VS75AYKmUfXZ2vqz+wX46YcjdXkrvRwzM9lzfIm2Q2dKMqBKSYzxMICZ/hWGRj
-            t33KbZLKC1Kg0NmYOY4GCt8hi6Ck4TjKvzxktsEpXYFDhWzXe9nr+axtrfypLrAn
-            fcLCQV1FSovMK+P4JxB/dd0u+F3RR500F3tBJPQ1xs1Rc1f8Cd2Ynr/3LWtTstkq
-            JyOfLFAj4/LG8o7ub/FSvLZZI052iRLZqlIIe0cFTqCz31yVEJOnLJWmME36hDEm
-            rfd3X9IvixfwWVTa3K0TxZta7u0Q0DsqHIt3eLdeTJC3wY4J+A/vUvPFv137YEqp
-            O+/ALTbwK7ViSQIupjr4kEcklBtiu9myNi3u8JNg67/XHwahCh0tfGk4jCevve5S
-            dDk4Ud7469LuDwYSZw0RdwuU89jQivvsp8/mZpQIoSVzl//iEQ2EOAff1gMfiPoj
-            1MrwGtrrMAo+2Uoxacd7LfFn/l1zRNiGw1rX21NzswmzIU84US4Grv9LGealQ8TS
-            XgH+datMRHIAPKcYY0u/B/PfyoKArlPUzQsIQOm02+s1zuvK/dArKxgObKTAr/u4
-            uNuVH3ObUVMb6VX4iwlxfS+VKpjotTbgY2TJfV46kGC3JJ0w1LdjEyJbpYlIz/k=
-            =HWEp
+            hQIMA7uy4qQr71wiAQ/+N+McZCHhik9SUyO4Dk2O2/9Lu06X81x+VCgjBP99Sa4V
+            bix8t+QUfkhtUhzkxWtX9NMRa8r/61xMFs6RWIfCT1pAUKerbSBuTUb6kJSaDEfW
+            WvJqfAp6SHGLAi5brvcargnRXBon2uuWCMIifB5dAQWrZxSyh3Y+6QBD4bKUJAkD
+            9oEJv0edWoDbVbwPxYGJTZWARXONo5wAOXJJPP8EGPmt84XK/u+s4jMDfEzeo1cA
+            Uhg4+1E6IXjFCAokMgk+vPwq6YhWpUt3kjY6xUaOpF4M4z4nxAUusJrAdJ55W5Hr
+            kffOrQv4h9rb9+XQDh83jdbUN+PToq81mzY2S/CutdyRDYIokFosocBay/bSRV8N
+            jg/yKXzuh6NDHRgYHmIIWwxLenG2ig/JMwRCqK32NJaSAFa/aghdkLqjjNrzGFca
+            DAH4xxT5g4kfER7R3TX//V+vQGOmlS/Ft3p8uuBHiKhTwTf18tKLvyqFQEqYA7D0
+            eyXcsQr5P/mnWKaTrau86aYMbaBjP4DtT4hHYr2yVkY4e5IyCW7IIYjxmg0zqJoO
+            oZeLk14Y+v++vCzGhglSkyiQEqCVrEhgj/JJbb2mPh/F+Ck9NSu7z54qQK7HpUx0
+            fmgW0+szkfnSlzWSa8m9cSpSgIqFeH6/yuGkgrOm+e/t0pTlE8w2Sgf3KwC2qk3S
+            XAGwOmmBn2FUjN/dBcjfhlJjxJS6Cb3ggJ6YnracJzJVjx+YkkIdpFYYsYs6HY98
+            Fhlt9FPDs0IfH/wXQdGRF4o4e7n+YXrgPXcHEebDgQq5C+e0p3OawnvnROQQ
+            =JRl3
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/utilities/dashy/values.yaml

@@ -11,28 +11,29 @@ persistence:
         enabled: true
         storageClass: longhorn
 sops:
-    lastmodified: "2026-07-18T14:22:16Z"
-    mac: ENC[AES256_GCM,data:Svz0vne+sbEj5wlL4FHUrTPMHlprWnZqR/X3tEmpDIxKBD0C/C9G1LgPYBiHviHEiiD/XbxxgH9nGcJIo4blbWc6xRNyUjnhGoLPIPJlG9LclXVh7dm4w4bETq4VfQZjLpY6bhv0q2d5GgxI6i+Hp16FSk8Y4kReErmQdg/Vh9I=,iv:zt3Rjt9KapI7LMMlpA/MPWK8EgGVFRpLJ4d2r4P74eY=,tag:fo2CgvaoT6bz1xmYA9DvGg==,type:str]
+    lastmodified: "2026-08-26T19:28:05Z"
+    mac: ENC[AES256_GCM,data:0I235NGdQcPUCqUZxsJPm0M4IKoHx5pHBnVW9ICHWAOKSRuJLKZmK2lkCKWEKbWhE1xwY8cQLZ1SXkSdyZWp4ha5uIqnB1zHQ+Cr7Brqnd2pfumN2owJf5rfOLwwGIxk9hDFm4L2PiH9P3PZLQv8/gJKEArQwjXZn+pCqD8WDSo=,iv:UDUqjOLja20AobZItocywtqixFM31HjjtlE4qjHzktU=,tag:dZkiUsjQcIKjLhJnJDSrSA==,type:str]
     pgp:
-        - created_at: "2026-07-18T14:22:16Z"
+        - created_at: "2026-08-26T19:28:05Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//RB59ULu3tagTsLKGU+2azz+yTgnRKUsauEhC2trzbpRO
-            Au0RYwQMyDmYwTAvIIRM5gWUGlIFpsiftpK6rZbvJiwb8npYVSF7/shqKzlqYiSi
-            +BHJCSqfk+emN9ULivxmq3i+t4YZ97Ap7uo+pUyBmpz4jis0vdiIDIszLwtJ3U0J
-            t6s2gVl4KE2STyVH+ShERG3yjSBuzvFpJVwSdAfGKeA8K6Umr1LQH/2JSlq8/2fV
-            Zubfu6aGXg564rsbZNs+P9/b5M4FmpSlSOlp6OLWnIosl9CfRVDynnRyLImvQ/8p
-            2Asf6vrAQZJVXHraGMfePNNA9sRxhMa8f1qgHDWGfHh8D8/7JwK5xoFWrNoO7Gb6
-            aex15qielE0N4jpiEC3t+jjRUQLdjMuSlRET/0RVrZRhZ4lUTOOINnw8eUic0vRz
-            OjPj/ffVI4+zqfq7GnopISWBtfMdc23Y+7IhL/8LWRJGLRSqB0fNQxWeS7dtze2o
-            2BWk+DsHiG/1bz2hdezuR+KTRoj7qPDI/eKPc1BpyHfVm8k1y3pFmwWY3rwGAGA0
-            6bB1VSBriE3pcvUiJw4N+Ja/C7gLcUVAtNKGLqxuWr+2bm/ExWItAbnZ/3cZzKtC
-            bULu5ic/zN3O3rRWCS5nFU+nD37pq1Iq3eHXOWygwNOJJcGGHl9+3j01y2iXUl3S
-            XgGKWMKthF+9AD1bASp8tZ1lfNuqyxjbdVyWb7xqRGa2jzWgAcVUaCWWaJU6yASF
-            LdXY6xVKr1DgBs666nv4xAESsgvZ9xP6e+YaxAr3piRuDhzoNFeveOD99tsgZOg=
-            =zi2x
+            hQIMA7uy4qQr71wiAQ//TYx3b89AnwFM7UTOFjFM79JP7C+zpXEvVR8Mcra1eUSD
+            ytVSl37LZR7Jxr6ocgIh45onW78v/kVsxeaYRx5iIDUuz7HY7SZmdVKpAkcxwQ3X
+            WzKQ3kccxAlpRkgYII6bjF68hY2zr3AAWxYD1m8Ta8KmcWkfKZz8ZXAI0qJBvKqo
+            4YR8hPRF0iJNj+IqUpGSx8ghRL8BjLMfKcgNP31ggfEs4QAyfTajPLmm6TJY355E
+            +D1ooB5NDxbUFz3UslctIM3aw45qfb2MRL/vo8OCfDONj/277CQZFmfmTw79/159
+            pu9+cyT6u2KR1TR0AbfHv4RrMeyNPpo4PZpU6MvGy0GpmawT2zDaKypIbfR9b2/0
+            ORcRl7IoNWqEjj+ZQVsnWs7J3hpHoo8xj6xLj/ACHHksBbHFfDff0O2cyoBRGaEZ
+            /lH3OJGbrRQE/DEkiJytdBLgvIe1wVj02uKywzRIHTfzBNWkblBsndku3z7xlMI8
+            +lYSQTS7mHtdTX4/9rdsCJda8hTSKlZV5rXHpGeo9upDFSnGnNSS8Dat41ecc6Co
+            kepvctT6jO5UlfNdIFz2T+kb5qgOcl46fYfa6WSKDl07N+tXNzjWuG74Q7t7e9DH
+            oLmEdlzj/KiA6+SronmSwpvaMQOLzOFSpkQpPPV0XJveQ7nBoklMWWOONeenZuTS
+            XgEMQ+cQm2wQKcadjF6Z5Uf5E8JY1UKbdJh2/SXom/iMgaE5ppSCD+l49V+DEjIg
+            /ZrbcpRZWtEuQY/rKf/aTlrgmzdDuBb8Tka1JnIm0nqXoyJv+ywrUbnUwu9Up44=
+            =IVK5
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/utilities/glance/values.yaml

@@ -13,31 +13,31 @@ common:
               mountPath: /mnt
               data:
                 - content:
-                    glance.yml: ENC[AES256_GCM,data:pRB+cswlQ1BTLH9TiARoSjT94snbLJYzg/2d0lR3uwmctvGxW1OA/a0fZOG54KwznBN2aQwT23d4G2kwGU4iFFMwmLKJKSrRwWYAGUxSSd1Zi5ntnOEiiL0uW4D+MZ3QkMK/jEPLd+223+OZ7OeJTRQirGkkwq8H31kaUSP7BHbUdY8DClGB4fiCx3NT36BjSer3natL2SwBBkYbnImL7Aq5KenFe7qnoyosjKPTHnUHJuuJHfuxTVfCXSOP5L2rtBCROqyqB/yZ+0MDsIVwIkz52uPkoDwiNCW7W+vO/4KTflYd3vewKJcKKe1LDJTdDgfSLUgyBdGVMakAff0Xi3KemfZNBP7PhezK6JUQUFopJaN9WrX+DabQL8ErdMHDt4BTSbgaTsNW24aAc5YIY/fowLKaVyXi9uwUv0tYKTWL15E+HDWflGrNdFtZLwigWyXcRVIjTbOpZ1YlbPSkP+617rjGBw/ujxN2bPZmqSUr4uAE3qOKu0oJUX+oBS+LQC37BX5uz87Jdo1FIspHdFJ1QzrxbxnDWmNFjzUNwWHzBWj6CnAQySVWASVd688ybikMEVK3Uqoi/hPOiP0GQu7UpJYLsMLPyQqaOcgZgLCHtDxNz22F/0srVh+DUFDgxLD1ur0bIMfmhE800nizzG/vBl//gqwKH+DGkK+gTzR5iwOO0EMtZ73LO+6klc5k3f8O0FqeBgAkjw+/LJE+k2HBksoF/TRRYkhi3um8EBeLeYbu+RmrrxGH576TSFuI1Ay58J4mkLXq13ql1mThUNjZK/r8xlzbcfvXFOsTdctys9a6LshJ42yJGfweq++zUswax9LnK4dCSULZhlP4TCx83444KrqEcfWtAwCNK0lC+60Vr1J1qJqOF7RVHdqW6n6rMKTiccgPy3P2BWKAknWazJDpeB1AAOFbZqqqkFTM4xaSDRGCo7SH1V7CTwarbF9dDPDPl0L0F5PROmvLXQm1lgh0wAmfw/rW4+/GTdTXU/6AUQSQNw3FwVLQuo+TVogPmyJd4OVMlMnIgsZ16LPNGWQppjFWsfKxIEkiWBT/w0SDIACc7Hn3l2gzoO/LbJt1PuhgtTNdz4z6EptUaN+/xn/+Z8lQzzpUJmzdnupinva7mKzZo3SWzNJ5bl4TIQjZG+5l5ncwNkiSTWPabZLmno5Tpp+bYMsHAg2zzjvCrNove7aGRF0tcfAyozGJMMScniqULO96kQQZ3uE0rbEtvoEmikSsA0PNmWBE6wbkmSTvtXiBUWLyR2XkETfLlmQegW1Ca68hcb7ZK1CGG7x7ThDOOfsYlCSEiLO0XWDzV8tumRM5XbiRI5IJnM645ASSPM6G8ZSsx98h+THXK7BzRHv9WyIxnIXs5NU00LWWXp+IUva6Bkhr51emYFovFD7PNe8qoXBBamv5sHIV3qRPn1AVp5Bs1qLAwswG9XRVNqNRz/g8WdFAZYlM3Pk8Tw/TRK7xMQH5056H9mAxmD8B4fwe8piiIQEnPUsOzP0MNyIz3s+oxrNOcUnnDygvtRrLZHCRA4m+J+T1P38fjJC1bgY8OkkuyWs0YfAre03RbjIjtWbz2vPxoslOvkedgeWvrXjhuJS88sX6FIpmrvYCMz8WtQ5lbbY9tsglnqC7OVAtSrptS9oGYgT5Ltngv0OMHs6pfudA2frdz1Zl7mRtZ9p4ULT9Ke5qxvaYRvA0VGwzr+FhCBGIFTc=,iv:N80F1dRs1pxv1sahXH2x/thaXU0CKxYxn5jC65Ao/M4=,tag:A4jlYLZU27G/MIzH5XlxRg==,type:str]
+                    glance.yml: ENC[AES256_GCM,data:/7Dc+Lx6sucJkVz7mpbleNWLShKTq6EnDJ1du6IOCJmkYFkA5xQxaUHLIHeSiPNaxO1c40hdFb2lsyKIPqxd4lY7/VmRLyXUoUj/KFjsgRxADc57N7oOrjUObXrxClN/Pwl7+RatQd1uK7MxKcWgr+8sxgSpGn/N7HQp3gPkCKCQQpZr9yqWtMEROyWoXhOJikxa25jksky+QmZmmihNM0F8IDMRcfH521x9wRaj/LqaHX2mtpeMO3/opkeWhOjI6ZLjMc86SZb25E8z8qk1VLpFPYC3X7fEjRA++bIvQwITFk5xj7G7EatDhAfm096aGZ0wBgK+VyxeKgENswbCBZ4mz8t10ncm9yafAls+gUFV2WexiBFZGPudQP19C8W2f5uk3Q6Fl4JdaGenV9GGOPZpv6xTuhZMzdMQDP2BXsEFQqZSk+AvoKdBLCzki+/5rFMnNlGb9ApY/nTmCGHXcc/QQZ7GlRaup66jy1C3LnzhbAeJqW40ICwxqS1+rNzWJolsrdORMougxK2c8hVJVGjRgLIRKIAiQIx56mRA2phPejmTlZBBF+8uVyDCoSaXLuBddQoGcqUXyhBqT+eHmTBTEzYzr5M94nJxoa5VabSL8x1a0Q29yPTLiJ03/p98GyXewe1GsH0xbmR/BDFnwGgoP6QwA3WywF679JTEOqsYmo9P1eUv4BEDU0OJ0OslgJBLjN29MGbfeAh85hhlQg+atn0PSZl/xHcY1Jr3HV8+qGQF7r3+hpx3eTrN+CY56eBWzHb9ldGYCGYw4mU6qIGB7flJSkeTFiExtwDGmdcEs0XND3PiIqSa/trcUwOrZEklEziN24iJ0dfRV1g0yrH3/9cuEVh1ik31TDW3OmocqqWYMFnp+2dfwtee+TyGMUWNvg1FQxDUhwUg03UkuHWl9kO+ErgpXrteQRnPHl19VbhkmHlH/Ev9r/fYduPIADEHsosHPayfEDpLEl/wTRhIAOHY0EELfyZdS0LDrfuoizEseKbT9CltvTzu3dWGHFiuEXujGVwZv8efAZJiRS9Vpt6yPU43ppykazMPquP8BvDSopBmI9itVpWJka9euJPuyAISoxhuDjRZYp7PDhIMyn0tdLsZ35Msfi2pHjq6tUhgA+RuRuDN5ZdE27vSOfQ9KbtVCP3zc3fP9nKOKfV8YB+UX2DMnfoqa8RDCtndtENZElpXcunNY7UdMM3umfHv6fpUbCFXpwNFAg9uYR4C0SoqmmguIV2xlOepEjmpmBFdMdCX5x/Zqp1hBwdC5JIdkYUfT6YmWwkwCxk2g+8BboskuM0NLS+LV8kpC7ZYW5/8a8+LdGedlffqQOozeL/Kdh8DJvwbAYBnTH+4fsq8fc1MdfFfEf/2XzaSkM5pIb0TLaez1B4H3xW0m6x1IYexzb9xRQQvXbiP8BeRycQb9eIQhcYMAxVXVh20Tqahhb7TVWko5wQJ1rfKbY3f4HTCPedzi4fENsZjFnd8pm0q1AQNNn8zQFQP/rQhInNKbE6JodjSJYLKpUI1ShOOtU7unRRo73/4goBRg9j1gWxygu5rt/93pqaw78D+Sky9dU1i4IFDLt5Ffd+aJ6wAl1WexrVB7XKSNuJhjawytWpy9ImEVEjxptABhrK0e53dJRtuUlN6c9h/+4x7iK7ep2SN1uC7OdiB45jwJSipJo42l2MAqxMNP9n3av87GFRsFrpleyh8P6hXy6o=,iv:7ULM0DYOMNWucjMWQCtHeaWRS1NKNDjJr86dAG7GqeM=,tag:4aQRymG6R9zsGyNwhhatZw==,type:str]
 sops:
-    lastmodified: "2025-08-27T10:07:49Z"
-    mac: ENC[AES256_GCM,data:6UAgykg/hSlAraVHpGwAG4Zmj3iru8d9CzdZ89XLAa8ioXsVcPGKhdNIz19G0i8aio0PG3/cyogxy1eWyukI5Z3EloXDjbbHvl78s/5BftRW0MMwMKVHH8Mo956E/I2CAIanJaW4SEx2jI6WZzV6xtpYM3f4FFmagXK5a1hXaNE=,iv:3tlMm0QI46CE+C/7n+8PuX+SUjJ7THzAGCEN9naObFQ=,tag:drJly4BlBgSRvMfSHgzuXA==,type:str]
+    lastmodified: "2026-08-26T19:28:05Z"
+    mac: ENC[AES256_GCM,data:NMSh4BgANc9rg24NjwMWiS1saxhqjnNNEpSYu1RryZyws+nKExn8sl7+hG8TBPtj3SAMbT4C2M/XJd57xpbEhrW0HfIXVgfW3hc7qcdsbKTCpJ3sTW4+NQDQ9n7J2pKIIOKQORnJnbr2HU+6Cff/vxFoDdkOED/9MylldHV3sOI=,iv:L2m+w2flfc4nIhUYtd8Gl8MPu2lCVx7VvR9+3kC1bUY=,tag:QDcVNCVTce0FfuUKdKLqaQ==,type:str]
     pgp:
-        - created_at: "2025-08-27T10:07:49Z"
+        - created_at: "2026-08-26T19:28:05Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//exDQRsuuBPlA3EiB2VzoWdtKXcp0Kqief7eM+39uWj7K
-            qf8cU2978vlS1dXyJfBFejFMMWut53xE6Jgcff1qICRjhYjF+BVNNHdyeR0yyyJh
-            wHurlx61XxT2CM/OH911JCxA1e2aXz81zRpuj/F7p4/9G6m5cFEoPxy8KTkfLa6d
-            nxXpNvDHQwfpC0arDUQZf5gzQRSmmOUOQdJ/0BdOWqH8SoF3TF2rnBSE9bhFfYYI
-            BToxu3WIYX5AlI/izHc9JBbb/CZx18yNP6EghTEJLuumd77bP15A/S+edfzhWhRq
-            2lDXnE+hRzWdR/8wDdW7MOKK41vnoNjKKqGbAbRuqnRNBOPLCXcscAI4UtpKCkGL
-            BZF7q5kCUsSwjcyCDrvJa+4ctM1oHmBURGGoANJi31bOJK41xk4A9LanHEu0JHTs
-            RNOxb7aKoBamt0sK1/5MDn5AHzUEbGRyUmEi3Ec8ZDY13XVCPWW4JE2SnOfWe//N
-            ZdseGKoEBkw/xGoef+X7oHpN4Qd9q7mEH7R6qkL/inpFypGF6BOYq/PmdPbcqqMk
-            /Xhm6SqsNQ7fWv7pD0C2xyw1RVp1erwaAjL9LYQL7aI75HO0KyowYCmffOW1sWns
-            y+Bx4JLzwFXnb02EWkcbBNWyLJU4DXokD7SkU9y8upXcsH856KCnOsz4jOg3OlLU
-            aAEJAhA/1qrWt0kUlADE4uueHl6OwOyn4wJ7jJnl5DU0Q4ge3TbEMzN7g52bhN9r
-            p4CZUXaEyj9ZeW6XLj015FaYDKJmqbiELa+QEJXCP3LNl+Wv3WvX1D9TV1sPN9CS
-            E5IHS2V3b0eO
-            =Mdbm
+            hQIMA7uy4qQr71wiAQ//b/Zd4NDQp+q/69SarfsYcUat2m6V/WW52Qp+DCmBMZDV
+            zsuMVtsyALqU3O6DqWTwk7SSyTiaqyu7F7LdIUWb3kWvwJJ9akk25i1UhZtNjZBr
+            ENOT30NdvPtJdvlgQzJiLJSMMQglxLgwqR2DiKcxEETqNm1H1+Aw9/QBJloTbFxv
+            4OXDinbLX5hhHDwZGgX33FWI0lvO3s+j9PfLa8wD6RQtACrQogOlcs1VgjbcSj3M
+            ifEuujHPvFsfuV3afzBR4v/qKQ1uTHJv95WXuMjuQ/2qVSPUHVk6zclJ9xVbPP67
+            FUvsC3dxGzbxuXu1Ya3uMIiSfvsZAcwWr4pzr1KCg4Fr1IRfi7NNiJ4xqOWzULZK
+            EiGYbiCGvT5MFL4StKXVEpIC5xp1IWJB2/ZVY4JI3+fofeCtV+OzXekmygja0BEE
+            eJqZxrTmCACVG7Tu7OHHQSVK4M7cLyDwz6sUKyOlrtNzuds2oTVbi7jUYMUDDLmo
+            htSQQNlnJnN0YbHKyVy8I8xrz7qUfB2vTqEqZIAinEDZiVWCz2r4SBvTFNAWCFYV
+            u5xEIwMiz44FJ3Er8NqUlyXuRvfU6HmDoE4FrIV8NWuQ+lMWdW6wQsLxxwkb51Yf
+            xAtbh6pn1mup+48iKG7F17PJYku2nJXEk0MeJKBbrLClCM/ZR3180+os8273NgHS
+            XgExP0QBEpEG9OR7dKk+AZMx1sHIqC4o9L/YXPYpPXEmlxQt9laZXwZrOOL6Z2Lv
+            ZA3zBVyb2ENkGkeKY8rzVJKs3pfh5MSDF6BQNW+nJMf5jlgGnBsBTAGFRMlRugA=
+            =AQJC
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/utilities/open-webui/values.yaml

@@ -29,28 +29,29 @@ persistence:
     storageClass: longhorn
     size: 5Gi
 sops:
-    lastmodified: "2026-08-09T19:23:15Z"
-    mac: ENC[AES256_GCM,data:BS74SS60MGeihujGUxn9SyiLftwQfqQ25wonJGy8r/ojV9uL5ICfHzwD0Z7ryjB5cALLgD2QIkEtT8w6pJsrGanRbPeHfAozhE0gGoh+Y3EPNZvBiadJPQaNQUYlIxfX/dZ8fXk0zyAclAsf/ScTDmgpPCZ1wtn7d7Cffz4TUtg=,iv:4UDFBjSwnDinRHb2O+8SCVMPnNjmgh4pJifnckugnFk=,tag:hHvh7z220GO9E9v540wKEg==,type:str]
+    lastmodified: "2026-08-26T19:28:05Z"
+    mac: ENC[AES256_GCM,data:L6Jbt3c7BEPNGyAGDUWnyFfNnhXHfMgcE4hAV+aiZ5GJ0kk2B3H6o+dfvGAaPISkdKHQp1xyZJ9HlmC0aLHU+pSJ6ktnS2iepOrxLqWi1G/9E/vibIGh6ztSU6nxwOfT9tRdn0fpoi3dRf3ly9tnUW8eN2V+1WSNE0XgLR9WkKo=,iv:RwrZPS4Aiq2/2CIYDngcwQOX2d8FKRb/FqNSSeeUQ0w=,tag:KC4wiTUEwf0LfGcj25OAQg==,type:str]
     pgp:
-        - created_at: "2026-08-09T19:23:15Z"
+        - created_at: "2026-08-26T19:28:05Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//ZbFtyc+ajynBfOcHWOx3I9glq/nuYJEHoXI7zlbwthMk
-            1BEjpn4bkowWf+B/HiRGMPjQoXixwvvsEXoU/EnYduTN7sMJQV8mTjXIvwQTGx55
-            S2f0Mcn2066hLQ4Bi+zSTOrZECxB46LUU57Ij5xo9u1blT5mSLnKoTORDUgmhSB8
-            OrR51Wk3vdaLPjljQTXBMNytNFpSkAotrswP5S5nBQCNvhmU9gmMBCW/Pg1NWXt8
-            S2FkAxJmopLAg7qkZP1aAmdbSs+CQjlNluK7J+umpXKT5Nf4/6oyz8fZCOFA50BQ
-            JI+wVEJBpHD1v+x3IpYEWPuEBZgBZD89j2i51hbR4AOQesxFIcpNKdCItftPgS7f
-            MeTDZylBUNO/3hsl8nq9/DwtMeck5CqS09V1ifbSiXZn55vCdv3mSQWrVvhoXXXU
-            Eu0eD2qVxNPVlZYWNyk51p/uV6gcP8lqimldEmao7Lk/Z8xcSWD0yDXZeTBxT1Fs
-            KBEGkGPptwkvh1JtVeV2DsOzwwhJmv+HomSdeZqeJWtRwDLMW+fuEczxuXdYfxYe
-            5VSKkjqMcZAdvvbpmTKyfmbm2dI7eOURdoFJx9nLieQ8+nUMNgSYLZvBGBvGil8w
-            hsmH68rbdowhZyAtH+XF+3llG8M+zk9IxlqbOR2CW3v1O6N9aMG2oUFS+shPNMnS
-            UQFxPD8cZj8HrkoG2zxtw+UhlIAC5qlm3XAGHFLggsVGmv7VS1NupI971W+CxS6L
-            wXHr5epll9/3J+Ch9XbMsh34YJS7SVJYDbOWyp0AR4npDw==
-            =mf5/
+            hQIMA7uy4qQr71wiAQ//Tc5LOYZjqIZKUPLSUNt6tJ+1HOFfzAHx7m1T4OlBK7xa
+            AxG3Wes/L7p/84dpHmSlW0kzoJfKurogzGsafzIt1JZF9cn2Yi+ya92keyYZTDiH
+            m0xYBZBXcmW3+QTekKywGENcnqmbxXDlRnx4t/K9Rs0b7EQ3ZeWW75hr52+17U0C
+            lAGucvenrP4Ul03OjH2waHFe80+2nG6B2xazMqwCK4/qzkOcZ0Ko6U6UmQ4YXold
+            Q1Gm+Uy+GX46n5nE2HJwsm3NqbVldYjnQONk1iyGljGIHyewOcN5Lg/j/0q9r15n
+            dkUMaroPHHVh2QC9fj2G5Y8cPdW6EXP2YlGWIF7KSloDo1QJiuglWIzFXcXLVSt1
+            Vhm/qYiVTlm/UMrJg10DyN3jEaDLGFdOA97PUcmLo8lVQpuB7S27WzXuXELBgtVR
+            OxMaVJKDJJz2Qjx4wJOI7cxABoFq1OPqy+JnPxc9TGcBKAG0X0Ez+r29zbpaXkZR
+            2ZmlMbdunvLMkuaEgjZfF5x8CX3ER5woD5/p/74rWQIusBlZHo4MCDMlh/hBrVWj
+            frMA7bF+XgIrSS10CxtEFIFXQqzGJJqXNbJY4wQ911zihVl5sxG7dvzRF8RhzkPM
+            3Hny6APAYw/ZtsP4S37v82FPk302Lv2MJn0VladI2qRm/uXtoQo2y9JDRpByNF7S
+            XgFd43oP+qGAYupbEZEv9+ODOi24NmpG6tHmbOfJ/d44402X13ONPL6b9YPcbwmD
+            +0PmHSahWzSYWY0tbns10+nrWDm0yHlO+ZYDVl7lr4vdPRE4pxA1iVohfLWCXGU=
+            =Mb23
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

renovate.json

@@ -7,7 +7,7 @@
   "enabledManagers": [
     "docker-compose",
     "helm-values",
-    "helmv3"
+    "flux"
   ],
   "packageRules": [
     {
@@ -18,12 +18,18 @@
       "commitMessage": "chore(docker): bump {{{depName}}} in {{{packageFile}}}"
     },
     {
-      "description": "helm updates",
+      "description": "helm values updates",
       "matchManagers": [
-        "helm-values",
-        "helmv3"
+        "helm-values"
       ],
       "commitMessage": "chore(kube): bump {{{depName}}} in {{{packageFile}}}"
+    },
+    {
+      "description": "Flux HelmRelease chart version updates",
+      "matchManagers": [
+        "flux"
+      ],
+      "commitMessage": "chore(kube): bump chart {{{depName}}} in {{{packageFile}}}"
     }
   ]
 }