# Recovery / bootstrap administrator credential for Stalwart.
#
# This Secret is referenced by:
#   - recoveryAdmin.existingSecret in the HelmRelease, which injects it into the
#     Stalwart pod (and the tls-sync sidecar) so the cert-manager certificate can
#     be pushed to Stalwart via JMAP. Keep it present for the lifetime of the
#     deployment; the tls-sync sidecar needs it on every cert renewal.
#
# The username/password here are ONLY the recovery account.
apiVersion: v1
kind: Secret
metadata:
    name: stalwart-recovery-admin
    namespace: stalwart
    labels:
        app.kubernetes.io/name: stalwart
        app.kubernetes.io/component: recovery-admin
type: Opaque
stringData:
    username: ENC[AES256_GCM,data:AB2zGZo=,iv:DShjxCtBagfnqm3oXLj3EVkV/bNEqnYXGJVSN4Jwd+M=,tag:++ig5p1ec7WZU3G6SvOnsg==,type:str]
    password: ENC[AES256_GCM,data:v0HBWQEiGkpslw==,iv:OUEKmtKJVnXuJwMTyST8ycz6cZ6qvipWPfmxDyCQ+cw=,tag:whNSOquceAh0LxzH77cQdw==,type:str]
sops:
    lastmodified: "2026-08-26T19:28:03Z"
    mac: ENC[AES256_GCM,data:4ts11OGRul28LVfQT6g6tnLmpSaMchaO06j3iYecak7yRqXnzsYyWu/LYweybCgQ20zeyZOnFU7rM/VUpkafueu+KmVrw+HsE1WOzjI4g911BGNEz6DOK8MliFtaYitFwRzJfZE4Fh/M8Wos+aGEs59IR1FsiB0DHbdd57pUYT0=,iv:XkiIh3vRCkKzQ3LNYsTa6HkBYOhblK6hWqiw0O9ufVc=,tag:QMS69yIJDfvM/BnMFvUk4g==,type:str]
    pgp:
        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ//VOfCE4MQxdlmnzN8BYlmlouOePL7E51T4ERhLpTrCpZF
            5rLhni/YdGDyKtPOm/9nIeF6zr5FCateZdArJx9QVT7xXIs0Tvl2xZpRvDRxHwyt
            o+zFTUUaUUj8b0V6ZR0jnjPJmhK/iwpTbG4aCBe1rWl+bUwHt25KWtgAfyMtdJ0j
            SUcuOyjcc/hEUuZeoDNEwxbbWsInA54/hfUjCJU9iLUzC3zc7k+5PpsZfKh4ABIA
            qSj/+p98a3VrcZLc5VG89z9T0SunBfCX0AmIf2O/xUhUT08IBfGti9XyE2TC7vMQ
            WxX+sYB4cK+tIDcWAMWipq46iRVhWNS2qjdRS8tUpwoVsVLZSrQiUdIxBtzlJqrm
            toN36T1b8Vl3XS+LD53oWDJ54YnnSV9oxmBjwNaZ5dGVkz+FoBNqLab8FZ8GZQS4
            bFJLjbuq4hxvgD6U74PG/feLnxWXjJ6w7t66VqJndo+yqTMSzedM31iNqqp1norm
            LGjT5QhFkR5NwHdAN1S9AlmMm9tGxIE2GAHKHzPyrvus47PfgaidtA7KyiNtC88X
            SnSIF9uT0VYR0MjD9nGlW+VAP08KU+9+vqpVDoqE0CbI8hCl7lMOg5Eyzh44Zp42
            YyRLDqib/IeUKxob3/L4Ia+TWXOp/dEFbfOoKw+CreYUrP8ltrVk5qozlMy9TZfS
            XgEJztLQbB1pqJEoBL7bA0HOU4VXEyOddAj9BW7hZcV/xk2DwUJjDhcozAjVY0dQ
            W68Oc/Fm8/c/UHwpBRSfmxofR2kDIygYS3AQavyXfogLWfdulEbDpulqsmu0VLM=
            =oe+v
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2