# Gitea headless-install bootstrap secret (WS-APPS, Phase 6). SOPS-encrypted (age).
# secret-key: FIXED, persistent Gitea SECRET_KEY (must not regenerate per restart).
# admin-*: break-glass local admin (docs/15 availability caveat). Recover with:
#   infra/devcontainer/dev.sh run sops -d apps/gitea-bootstrap-secret.sops.yaml
apiVersion: v1
kind: Secret
metadata:
    name: gitea-bootstrap
    namespace: gitea
    labels:
        app.kubernetes.io/name: gitea
type: Opaque
stringData:
    secret-key: ENC[AES256_GCM,data:N4wgSipwTYNgkwujPzGs8Bo63IzUip1TwfVq9fG+Z2nECrgIV9PYkEyL4ic3Ej9f5udOE4fHwsbgcyuiJw==,iv:p33bef3z2fDbaAi6beGF+CWmeTeS7Vn46ce1/2zQH4g=,tag:CLJ+kZbmz0tiPtOsI3+dIg==,type:str]
    admin-username: ENC[AES256_GCM,data:hyWYQ3UC8c9H2Os=,iv:bgn72bsILLxChY9QAsAD3tYWvsWS2CBe0FlneCCSr+E=,tag:7qP/P8TjDmRFsuXjJF8A2g==,type:str]
    admin-password: ENC[AES256_GCM,data:GPz1vracB1U6YurrV1AEhX9VEGx3lwCOXqOmKAg6+/6NjGPmTv+r2uosawVYtwie,iv:L/QKFqo7RpSg4eQGie/+R5BDBgTiTzwDdWuofJeebFE=,tag:cD6AU9tahLskTaaU/A7BOA==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1bXVWK2sxUDNyZ0UvcFhW
            MDZ2akY3ditycjdQN0FSM2JYcXZod2lqS0F3ClF6T2pOdmxNZ3JwSjdLeDBBYmR4
            QU52bWlDdGVBZkM2ZW1BNkRFSjVpcTQKLS0tIHdYS1VQaE5mSUhXR1U4UktyM1Jm
            Nys4V2NBZWF6U2lER05HV3FNZ1pOQ1kKEVHBTPTAJfiQBzkP/QezTzOfS96nYzxg
            Ad1m50j67vyFaBCVAb0/0toEUAm+qEV4wzOglaNmZuScavY4ntwCIw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-08-25T23:06:33Z"
    mac: ENC[AES256_GCM,data:ik735BfSMdlB4IUceScEfY4aNNNo61po7W7x/6iod1VvsiMo0+7nUrVqD2uiL8p066k6g/hV+BNg5BwnYRVjvkVm8tU60ctcjEDfinxtgnqRNBVK81RROn5GtsRCzuBxiJ5J8ulgb45+jG9ND6Xuo9XuTZ35PWs/4/Ebdl/jpPM=,iv:Nt3QtDz3S37AnrtG2nd1TIHgFFemgxXrKrHfXTVo6S4=,tag:ScMtwQAF8a4heyhN+iXt/A==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)$
    version: 3.9.4