Added fixes before token usage cutoff. Added required credentials for dns api for cert-manager and external-dns

bootstrap/sops/README.md

@@ -6,16 +6,19 @@ Spec: [ADR-0007 (SOPS+age)](../../../home-network-k3s/decisions/adr-0007-secrets
 [docs/07](../../../home-network-k3s/docs/07-security-and-secrets.md) · Requirement: **R-SEC-01**
 (secrets encrypted at rest in git, decrypted only in-cluster).
 
-> **AUTHOR-ONLY. Nothing here has been executed. No key or secret material exists in this output.**
-> No `age-keygen`, `sops`, or `kubectl` was run. The age keypair is generated later by the operator;
-> `.sops.yaml` carries only a **placeholder** for the public recipient.
+> The SOPS **creation rules** live in the single canonical [repo-root `.sops.yaml`](../../.sops.yaml).
+> The operator generates the age keypair via `age-keygen.sh`, pastes the **public** recipient into that
+> root file, and installs the **private** key in-cluster as the `sops-age` Secret. No private key
+> material ever enters git. (`CREDENTIALS.md` is the end-to-end provisioning checklist.)
 
 ## Files
 | File | Purpose |
 |---|---|
 | `age-keygen.sh` | Operator-run script: generates the age keypair to a path **outside the repo**, prints only the **public** recipient. **Refuses** to write inside the repo or clobber an existing key. |
-| `.sops.yaml` | SOPS creation rules (encrypt only `data`/`stringData` → readable diffs). `age:` recipient is a clearly-marked `REPLACE-ME` placeholder filled at bootstrap. **Effective home is the repo root** (see below). |
 | `age-key-secret.md` | Runbook + `kubectl create secret` template installing the age **private** key as the `sops-age` Secret in `flux-system` (the sanctioned out-of-band step). Rotation + DR custody included. |
+| `CREDENTIALS.md` | End-to-end operator checklist: SOPS setup + the full secret inventory (per component/phase). |
+| `secret-templates/` | `*.yaml.example` scaffolds (correct name/namespace/keys, placeholder values) to copy → fill → `sops -e`. |
+| repo-root [`.sops.yaml`](../../.sops.yaml) | The single canonical SOPS creation rules (encrypt only `data`/`stringData` → readable diffs). **At the repo root, NOT here** — a copy in this dir would shadow it for files under `bootstrap/**`. |
 
 ## How this satisfies R-SEC-01 / ADR-0007
 - Secrets are committed **encrypted** (`sops --encrypt`) using the age **public** recipient in
@@ -27,11 +30,11 @@ Spec: [ADR-0007 (SOPS+age)](../../../home-network-k3s/decisions/adr-0007-secrets
 - No key material appears in scripts, docs, PRs, or logs (AGENTS.md §5).
 
 ## Interface / handoff
-- **`.sops.yaml` belongs at the REPOSITORY ROOT.** SOPS discovers it by walking up from the file
-  being encrypted, so it only governs `platform/**` and `apps/**` from root. It is authored here (in
-  this worker's subtree); the **PM/clusters owner installs it at the repo root** (copy or symlink).
-  Flagged as an escalation in the T-1.4 report.
-- **Fill two placeholders at bootstrap:** the `age:` recipient in `.sops.yaml` (from
-  `age-keygen.sh`'s output) — same value in both creation rules.
+- **`.sops.yaml` is a SINGLE file at the REPOSITORY ROOT.** SOPS discovers it by walking up from the
+  file being encrypted, so a root file governs `platform/**`, `apps/**`, `catalog/**`, and `secrets/**`.
+  Do **not** keep a second copy in this directory — it would be discovered first for files under
+  `bootstrap/**` and shadow the root config (that duplicate was removed after it caused exactly that).
+- **Fill the recipient at bootstrap:** paste `age-keygen.sh`'s public recipient into the root
+  `.sops.yaml` — the same value in both creation rules.
 - **Order** (see `../flux/README.md`): `age-keygen.sh` → install `sops-age` Secret (`age-key-secret.md`)
   → `../flux/bootstrap.sh`. The Flux entrypoint fails fast if the Secret is missing.