aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

[HOM-59] security(media): ExternalSecrets + runbook for app credentials #266

Open
aaron wants to merge 1 commit from security/HOM-59-media-credentials into live
pull from: security/HOM-59-media-credentials
merge into: aaron:live
Conversation 0 Commits 1 Files changed 5 +135
aaron commented 2026-06-18 08:17:56 +00:00
Owner
Copy link

Adds ExternalSecrets and SOPS-backed runbook for media app credentials as requested in HOM-59.

  • Filebrowser: inject FB_USERNAME / FB_PASSWORD from filebrowser-credentials ExternalSecret.
  • Navidrome: inject ND_DEFAULTADMINUSER / ND_DEFAULTADMINPASSWORD from navidrome-credentials ExternalSecret.
  • Jellyfin / Jellyseerr: no env-var support for admin passwords; add interactive-rotation runbook at docs/runbooks/media-stack-config.md and SOPS-encrypted source secrets for the chosen passwords.

Companion PR: prod#347 (SOPS source secrets).

Relates to HOM-59.

Adds ExternalSecrets and SOPS-backed runbook for media app credentials as requested in [HOM-59](/HOM/issues/HOM-59). - Filebrowser: inject `FB_USERNAME` / `FB_PASSWORD` from `filebrowser-credentials` ExternalSecret. - Navidrome: inject `ND_DEFAULTADMINUSER` / `ND_DEFAULTADMINPASSWORD` from `navidrome-credentials` ExternalSecret. - Jellyfin / Jellyseerr: no env-var support for admin passwords; add interactive-rotation runbook at `docs/runbooks/media-stack-config.md` and SOPS-encrypted source secrets for the chosen passwords. Companion PR: [prod#347](https://forgejo.aaron.reynoza.org/aaron/prod/pulls/347) (SOPS source secrets). Relates to [HOM-59](/HOM/issues/HOM-59).
[HOM-59] security(media): ExternalSecrets + runbook for app credentials
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
38526ee3fa 
Adds ExternalSecrets + secretRef injection for Filebrowser (FB_USERNAME,
FB_PASSWORD) and Navidrome (ND_DEFAULTADMINUSER, ND_DEFAULTADMINPASSWORD).
Jellyfin and Jellyseerr do not support admin-password env vars, so add a
SOPS-backed runbook for interactive first-time setup and rotation.

Relates to [HOM-59].

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Required
Details
CI Review / helm-validate (pull_request) Has been cancelled
Required
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Required
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Required
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Required
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
This pull request has changes conflicting with the target branch.
  • core/manifests/apps/media/navidrome.yaml
  • docs/runbooks/media-stack-config.md
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin security/HOM-59-media-credentials:security/HOM-59-media-credentials
git switch security/HOM-59-media-credentials
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!266
No description provided.