Migrate prod cluster secrets to new format

1 files changed, 29 insertions, 0 deletions

diff --git a/cluster/prod/app/plume/secrets.toml b/cluster/prod/app/plume/secrets.toml
new file mode 100644
index 0000000..a445979
--- /dev/null
+++ b/cluster/prod/app/plume/secrets.toml
@@ -0,0 +1,29 @@
+[service_user."plume"]
+password_secret = "plume/pgsql_pw"
+
+
+[secrets."plume/secret_key"]
+type = 'command'
+rotate = true
+command = 'openssl rand -base64 32'
+
+
+# Plume backup
+
+[secrets."plume/backup_restic_repository"]
+type = 'user'
+description = 'Restic repository'
+example = 's3:https://s3.garage.tld'
+
+[secrets."plume/backup_restic_password"]
+type = 'user'
+description = 'Restic password to encrypt backups'
+
+[secrets."plume/backup_aws_secret_access_key"]
+type = 'user'
+description = 'Backup AWS secret access key'
+
+[secrets."plume/backup_aws_access_key_id"]
+type = 'user'
+description = 'Backup AWS access key ID'
+