fix: split up secrets

clusters/homelab/apps/sparkyfitness/kustomization.yaml

@@ -3,7 +3,9 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - minio-secret.sops.yaml
-  - secret.sops.yaml
+  - secret-db.sops.yaml
+  - secret-appdb.sops.yaml
+  - secret-app.sops.yaml
   - cnpg-cluster.yaml
   - cnpg-scheduledbackup.yaml
   - helmrepository.yaml

clusters/homelab/apps/sparkyfitness/secret-app.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: sparkyfitness-app-secret
+    namespace: sparkyfitness
+stringData:
+    api_encryption_key: ENC[AES256_GCM,data:CzmFKmsZM+7hGQ9Fn6b7KG3v0f5T/M9C8yFVXNW58McBQjc/EaP22FzsrPzbuCti7ivlzp9gueUHBQT+gLH6ew==,iv:jjMZIxN+MZaO9L2Of13CQIuy8w7HUrva4+dzqBU5mkk=,tag:8lOM7dsa+wZiYedi7fBIig==,type:str]
+    better_auth_secret: ENC[AES256_GCM,data:Ohdp36Au5E8LQlOt1VvpS05OmzxpO5GWwiZtb9iaxp9KNposAPlUYVeBUe3Ga+W8Llm8MsYZX57pIHIEADB2eg==,iv:Ac3/T0v13EPYZXXftkWFvls/jsyVjivdXb8GJBmZz5c=,tag:bWrcLAnwyB45wGA39cFBYw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrcW92anpneU5qSXVSRDU0
+            cDZ5WFdLbHdrZGZuRDhjSElrZ0xwa1Fha0Q0CkxsRkJDbDV2Z0lWamtSNmRXMnN4
+            Ym1EQnFXdGVZd25aSFlzQnVkUG12Qk0KLS0tIGxUYjhzZmRmbTJ4Q055Ymo1ZUV5
+            R1NEbFRkRmViVUpnVE90M0xUREd5UWMKV3wsUaWjxmxlPc5hpHq48KzyNJG1/LV4
+            hGCug7NFmSip+ckiHzpkMUE9EYtwrYkYTG167p54TK49amPrJMtBsQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-26T10:10:29Z"
+    mac: ENC[AES256_GCM,data:PCFAtUT/U4E1dRqNTkSU2guAGON6/4z+td5kXTW7mtO2uYBfnbqIBG8wBvqO5WV4aigEovET/7M5viGEeJ9C6nIm6/02heQAGAfIne0eN4jwsEndYkvBQiXL4dHaSMCqd+F40YUn3HvJ6EsjK8OdP8dLFj1A0YX7IPn57P3SuDs=,iv:h5a4al3R2xSC9BDYQR47XzoZ5C301M/hKRe4UK95fLc=,tag:/wk2SZd84SCBy2XSSK0KFA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4

clusters/homelab/apps/sparkyfitness/secret-appdb.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: sparkyfitness-appdb-secret
+    namespace: sparkyfitness
+stringData:
+    username: ENC[AES256_GCM,data:2W3eNmg=,iv:te/DYHis3DR/NyIsvYOS7rGV0JrdbQ5bRijYSMcUXJU=,tag:JJUerOaU46mee5m2B9GbdQ==,type:str]
+    password: ENC[AES256_GCM,data:KFM1If6EDgc=,iv:H87FkkTWHzx+a2uoMMKqTdoZViHWqeETGtizcfNyffY=,tag:1UYRrr7V7fg40IBztx+0rA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6VnFvNFd6RlV6c1FMcER5
+            Unk5UkszRllnYXh1N0pFTjJNaXB2TFJrWUY0Ckc4UjVUOTFOUDczZlpjTnVmYk93
+            ekU2bWordm9KU0ppQmhkYy9VdGxkQnMKLS0tIHZncmwxUldFcnp2eVpjWmNyUEFq
+            NXdmd0pYcGwvdjlETDh6MzlBdjM1R2MKMf67oQhXCf31zSdxJpHYm73q0fg/aLam
+            slirfY+97QDmLO9uZsv+JM5VIZytBUpLb1C0Yo7dsNej9z/ZYlK0Wg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-26T10:11:52Z"
+    mac: ENC[AES256_GCM,data:eK0ZNoojzAUn8g5uNBrOGJLZ6HVpmCeojDyv9/0H2ydUXTxgjRKSpYHA+TigI8z+eXLA4Ny+slMeWHm8OcEQvzW73wVBI4m64qhju+LJL9j/96RZZJ15l46hM2jnzi8QsuzjRNHbu/G5dC/ZD3C0dWwWq2ysEc6oueZ5jZSv4Rk=,iv:zRT86zA4VuUGzZvkaIJYA25BjaXOosnuspxVX3pc4KA=,tag:NFqjR1//GABdcUD2Oo/8Bw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4

clusters/homelab/apps/sparkyfitness/secret-db.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: sparkyfitness-db-secret
+    namespace: sparkyfitness
+stringData:
+    username: ENC[AES256_GCM,data:MwntdRhy,iv:FidQ06IhG2LAQ8u3YMsh2UOar7xIB4wC6W2j0jISX80=,tag:daHSVH7I5NgubOr61ej1PQ==,type:str]
+    password: ENC[AES256_GCM,data:JD1/O4DrpJM=,iv:oZvQbyyF8dQqqq4O6y/jr16NgyxenmxYJT0IflpFgAI=,tag:aXtD1VA2pCHKJpbEOrfd+Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1bldxd3lRcVRibllsYjEr
+            aVRsTVBvOE1mOUVKNzlOVExZMjEyMVVtMlVFCnduWEV2R01tbVY5VlgzektqMGEy
+            Z2ZsZXg3bDBUVjh6eTdsRXNFa1BPcEEKLS0tIHE3d1RlVVBJbFkzRFRUaktLMUt0
+            VFFJZWl6TytQT1BDTFRuZnhUWXZoT2cK5mpTmKpbdxoXDiRD6E6LmlPEGY77LUDB
+            M8o0ip5virdiLxQ4dqhdmkEcHM6J64e1g/KW5H4cwSm41ooxPoEfyA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-26T10:10:29Z"
+    mac: ENC[AES256_GCM,data:cjvQFhCUeoRDLaELnGMmyCDj+REMNHHnDwUPwdXWEBRbEZeKfaEqQ2Q2Cp2vEFxezJe5fopZlAawNos00/b49qzMfusuOA+dE4wbMD4R51BWtJYd8fWs0GuRyMWtilyu5aiLttl3rPXkpylryYfBGGLf8OkO4fR8BYMbL5aDu9c=,iv:vfgh3MePi8DtNbhHVbg9octmGq6D6jymVKTEDqBy5A4=,tag:mFeMkQqtxVVMFJiOW9zXEA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4

clusters/homelab/apps/sparkyfitness/secret.sops.yaml

@@ -1,99 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: sparkyfitness-db-secret
-    namespace: sparkyfitness
-stringData:
-    username: ENC[AES256_GCM,data:s5+BtLM=,iv:dTKvQbdYNNN4UlgJ7qDdooXGNWzBcrE6722LQR4S4b8=,tag:0HrGT2vIaY4GaQyNsSQSRA==,type:str]
-    password: ENC[AES256_GCM,data:0f8Q/Y/4DXc=,iv:QqQVUoOlNA+DtyrdkRrchvxgLH79CAAGVDcDRXJnYLY=,tag:eft8ZcpVGCRkD7qkN0fQEg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aFJlM09ESFZSdmQyWHZN
-            NzlhVE80eDg3cFZJbzRJajAzOGtiNWhqeUVZCjAvaWh0ekZtcWNEcHZ5aHhnODRV
-            T3JPSFJxL3JKNk9oeDlGQnhQNFZrbzAKLS0tIHF2Rm9LVnhzYzRkVHRhd08zREdL
-            eEw0NzNiQWVhSXF1Q2xkZGRTOGhLalEKRu8XUE7qmaoyKOx/y+2h3/B4xzx2+toD
-            2y3ZVV5YDb266EfDQ/TyH0JyuNczw9F4nzWCHHP0NeCFQVJMSfl0og==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-26T09:47:34Z"
-    mac: ENC[AES256_GCM,data:igQwMXuNacNSeVlsy1GmFA//a9s+fa+qBdwlLvdbw2U1lcw2akgTGhjxolg4ACKU+K9RpM3hOxvwp8DOdLwRk/duHwlvVranOlLq7+lky8D3Ec4z/YBHAnLnF5F7pyEtEA7/vKf2q47yoUkxvoZfPn4XEIV+zVUUTt8jdJzHuY4=,iv:UR3NYMFO5LmI4gqwe6QhL1EPlavp5N14Tk6ggWEDTKI=,tag:V9zOZlt64NXdce86PAfDRA==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4
----
-apiVersion: v1
-kind: Secret
-metadata:
-    name: sparkyfitness-appdb-secret
-    namespace: sparkyfitness
-stringData:
-    username: ENC[AES256_GCM,data:onGgewc=,iv:Nlf05QgJ3a3WiBbhz8RzYEs4J5SGGo6OXhZMq5+eFks=,tag:WHaCk2rS78ekJTXf4M7R0A==,type:str]
-    password: ENC[AES256_GCM,data:TnZcBesc7gI=,iv:YgDJ0LMgUgPgcXRagfMLdaeQIR7g7jy5pIS00fRUICM=,tag:hqkfmvev8UVOn8fBy0ocUA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aFJlM09ESFZSdmQyWHZN
-            NzlhVE80eDg3cFZJbzRJajAzOGtiNWhqeUVZCjAvaWh0ekZtcWNEcHZ5aHhnODRV
-            T3JPSFJxL3JKNk9oeDlGQnhQNFZrbzAKLS0tIHF2Rm9LVnhzYzRkVHRhd08zREdL
-            eEw0NzNiQWVhSXF1Q2xkZGRTOGhLalEKRu8XUE7qmaoyKOx/y+2h3/B4xzx2+toD
-            2y3ZVV5YDb266EfDQ/TyH0JyuNczw9F4nzWCHHP0NeCFQVJMSfl0og==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-26T09:47:34Z"
-    mac: ENC[AES256_GCM,data:igQwMXuNacNSeVlsy1GmFA//a9s+fa+qBdwlLvdbw2U1lcw2akgTGhjxolg4ACKU+K9RpM3hOxvwp8DOdLwRk/duHwlvVranOlLq7+lky8D3Ec4z/YBHAnLnF5F7pyEtEA7/vKf2q47yoUkxvoZfPn4XEIV+zVUUTt8jdJzHuY4=,iv:UR3NYMFO5LmI4gqwe6QhL1EPlavp5N14Tk6ggWEDTKI=,tag:V9zOZlt64NXdce86PAfDRA==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4
----
-apiVersion: v1
-kind: Secret
-metadata:
-    name: sparkyfitness-app-secret
-    namespace: sparkyfitness
-stringData:
-    api_encryption_key: ENC[AES256_GCM,data:Nu27yu/HVORcKHBaRGZ/f3TrliDDySrjKF7RiZHw9ruGebnV8Smtg8cpv570LDilcYr0zG3rXkgy7YHedQ6LkA==,iv:w482arFwsfqy99VxhaYn8FmL1/r5W41hQw7yfS41sas=,tag:oCGTkVohckPhXPvViEzoaA==,type:str]
-    better_auth_secret: ENC[AES256_GCM,data:YqFpjv+QMsEYtyDZQHEx4/cGPP5V1k2r9iynJqzeCMpnYeClMgUHUphlfUNumXJBBtDzMiG/uleViyXdka2qFQ==,iv:HP/zjHSjsx/i9SodTvTxtQP1t7u1sEyHlyVcn/RlVpY=,tag:fTAjB0JOj52/cHK8eLRnew==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            -----END AGE ENCRYPTED FILE-----
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1rydfcalt7pu4jnmh298lgjlasxyjldyaz3xyssk7v54lpu30fv0qna96ea
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4aFJlM09ESFZSdmQyWHZN
-            NzlhVE80eDg3cFZJbzRJajAzOGtiNWhqeUVZCjAvaWh0ekZtcWNEcHZ5aHhnODRV
-            T3JPSFJxL3JKNk9oeDlGQnhQNFZrbzAKLS0tIHF2Rm9LVnhzYzRkVHRhd08zREdL
-            eEw0NzNiQWVhSXF1Q2xkZGRTOGhLalEKRu8XUE7qmaoyKOx/y+2h3/B4xzx2+toD
-            2y3ZVV5YDb266EfDQ/TyH0JyuNczw9F4nzWCHHP0NeCFQVJMSfl0og==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-26T09:47:34Z"
-    mac: ENC[AES256_GCM,data:igQwMXuNacNSeVlsy1GmFA//a9s+fa+qBdwlLvdbw2U1lcw2akgTGhjxolg4ACKU+K9RpM3hOxvwp8DOdLwRk/duHwlvVranOlLq7+lky8D3Ec4z/YBHAnLnF5F7pyEtEA7/vKf2q47yoUkxvoZfPn4XEIV+zVUUTt8jdJzHuY4=,iv:UR3NYMFO5LmI4gqwe6QhL1EPlavp5N14Tk6ggWEDTKI=,tag:V9zOZlt64NXdce86PAfDRA==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4