Nereus/deploy/secrets

Secrets

nereus-db holds two keys, used by postgres.yaml and rollout.yaml:

• POSTGRES_PASSWORD
• DATABASE_URL — postgres://nereus:<password>@nereus-postgres:5432/nereus?sslmode=disable

It is not in base/kustomization.yaml. Plaintext never lands in the repo, and gitleaks runs on every push.

dev (k3d)

Create it directly, before kubectl apply -k deploy/overlays/dev:

set pw (openssl rand -hex 16)
kubectl create secret generic nereus-db -n nereus \
  --from-literal=POSTGRES_PASSWORD=$pw \
  --from-literal=DATABASE_URL="postgres://nereus:$pw@nereus-postgres:5432/nereus?sslmode=disable"

Rotating means deleting the secret, the StatefulSet's PVC, and restarting — Postgres only reads POSTGRES_PASSWORD when it initialises the data directory.

prod (sealed)

Write the plaintext to nereus-db.plain.yaml (gitignored), then:

kubeseal --format yaml < nereus-db.plain.yaml > nereus-db-sealed.yaml

Commit only nereus-db-sealed.yaml and add it to the prod overlay. The controller isn't installed yet — kubectl get crd | grep sealed comes back empty.