From 8e6911beb5695eb3661e52cffeef1261e3348a1c Mon Sep 17 00:00:00 2001 From: Chris Alfano Date: Tue, 8 Sep 2026 19:12:04 -0400 Subject: [PATCH 1/4] feat(codeforphilly-ng): add production deployment of the codeforphilly.org rewrite Stands the rewrite up in its own `codeforphilly-ng` namespace alongside the legacy laddr app, mirroring the cfp-sandbox-cluster wiring: upstream manifests projected from codeforphilly-ng:deploy/kustomize/base at a pinned release tag, a per-cluster Gateway/HTTPRoute, and a kustomize lens. Pre-cutover host is next.codeforphilly.org. Because the apex already resolves to this cluster's Envoy gateway, cutover is a hostname move between _gateways/code-for-philly.yaml and _gateways/codeforphilly-ng.yaml with no DNS change; rollback is a revert. Sealed secrets (codeforphilly-ng.secrets/) land in a follow-up commit. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01RdRwHvDupRLV8GuJpYKzEr --- .../codeforphilly-ng/app/manifests.toml | 13 +++++ .holo/lenses/codeforphilly-ng.toml | 9 ++++ .holo/sources/codeforphilly-ng.toml | 6 +++ _gateways/codeforphilly-ng.yaml | 44 +++++++++++++++ codeforphilly-ng/app/kustomization.yaml | 54 +++++++++++++++++++ codeforphilly-ng/app/namespace.yaml | 4 ++ codeforphilly-ng/kustomization.yaml | 7 +++ 7 files changed, 137 insertions(+) create mode 100644 .holo/branches/k8s-manifests/codeforphilly-ng/app/manifests.toml create mode 100644 .holo/lenses/codeforphilly-ng.toml create mode 100644 .holo/sources/codeforphilly-ng.toml create mode 100644 _gateways/codeforphilly-ng.yaml create mode 100644 codeforphilly-ng/app/kustomization.yaml create mode 100644 codeforphilly-ng/app/namespace.yaml create mode 100644 codeforphilly-ng/kustomization.yaml diff --git a/.holo/branches/k8s-manifests/codeforphilly-ng/app/manifests.toml b/.holo/branches/k8s-manifests/codeforphilly-ng/app/manifests.toml new file mode 100644 index 0000000..d379eb2 --- /dev/null +++ b/.holo/branches/k8s-manifests/codeforphilly-ng/app/manifests.toml @@ -0,0 +1,13 @@ +[holomapping] +holosource = "codeforphilly-ng" +root = "deploy/kustomize/base" +files = [ + "configmap.yaml", + "deployment.yaml", + "service.yaml", + "serviceaccount.yaml", + "pvc-private.yaml", +] +# Excludes the upstream `gateway.yaml` + `httproute.yaml` (replaced by +# per-cluster _gateways/codeforphilly-ng.yaml) and `kustomization.yaml` +# (we compose our own at codeforphilly-ng/app/kustomization.yaml). diff --git a/.holo/lenses/codeforphilly-ng.toml b/.holo/lenses/codeforphilly-ng.toml new file mode 100644 index 0000000..a729f74 --- /dev/null +++ b/.holo/lenses/codeforphilly-ng.toml @@ -0,0 +1,9 @@ +[hololens] +container = "ghcr.io/hologit/lenses/kustomize:latest" + +[hololens.input] +root = "codeforphilly-ng" +files = "**" + +[hololens.output] +merge = "replace" diff --git a/.holo/sources/codeforphilly-ng.toml b/.holo/sources/codeforphilly-ng.toml new file mode 100644 index 0000000..2e6bef6 --- /dev/null +++ b/.holo/sources/codeforphilly-ng.toml @@ -0,0 +1,6 @@ +[holosource] +url = "https://github.com/CodeForPhilly/codeforphilly-ng.git" + +# Pinned to a release tag, never a branch (same rule as balancer). Bump this +# and codeforphilly-ng/app/kustomization.yaml's image tag together per release. +ref = "refs/tags/v0.1.0" diff --git a/_gateways/codeforphilly-ng.yaml b/_gateways/codeforphilly-ng.yaml new file mode 100644 index 0000000..295bae2 --- /dev/null +++ b/_gateways/codeforphilly-ng.yaml @@ -0,0 +1,44 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: codeforphilly + namespace: codeforphilly-ng + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod-gateway +spec: + gatewayClassName: eg + listeners: + # Pre-cutover host. At cutover, move the `codeforphilly.org` and + # `www.codeforphilly.org` listeners here from _gateways/code-for-philly.yaml + # (and the matching HTTPRoute hostnames below) in one commit. Rollback is a + # revert of that commit. + - name: https-next + protocol: HTTPS + port: 443 + hostname: next.codeforphilly.org + tls: + mode: Terminate + certificateRefs: + - name: next-codeforphilly-org-gw-tls + allowedRoutes: + namespaces: + from: Same +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: codeforphilly + namespace: codeforphilly-ng +spec: + parentRefs: + - name: codeforphilly + hostnames: + - next.codeforphilly.org + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: codeforphilly + port: 80 diff --git a/codeforphilly-ng/app/kustomization.yaml b/codeforphilly-ng/app/kustomization.yaml new file mode 100644 index 0000000..edd4b25 --- /dev/null +++ b/codeforphilly-ng/app/kustomization.yaml @@ -0,0 +1,54 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +# codeforphilly-ng — the codeforphilly.org rewrite (Fastify + React + gitsheets). +# Production deployment. Runs alongside the legacy laddr app in `code-for-philly` +# until cutover, which is a hostname move in _gateways/ (no DNS change: the apex +# already resolves to this cluster's Envoy gateway). +# +# Upstream manifests are projected from codeforphilly-ng:deploy/kustomize/base +# at the tag pinned in .holo/sources/codeforphilly-ng.toml. Bump that ref and +# the image tag below together on each release. +namespace: codeforphilly-ng + +resources: + - namespace.yaml + - manifests/configmap.yaml + - manifests/deployment.yaml + - manifests/service.yaml + - manifests/serviceaccount.yaml + - manifests/pvc-private.yaml + +images: + - name: ghcr.io/codeforphilly/codeforphilly-ng + newTag: v0.1.0 + +patches: + # Pre-cutover public host. Flip to codeforphilly.org in the same commit that + # moves the apex listener in _gateways/codeforphilly-ng.yaml. + - target: + version: v1 + kind: ConfigMap + name: codeforphilly-env + patch: | + - op: replace + path: /data/CFP_SITE_HOST + value: next.codeforphilly.org + # Release tags are immutable; don't re-pull on every pod start. + - target: + group: apps + version: v1 + kind: Deployment + name: codeforphilly + patch: | + - op: replace + path: /spec/template/spec/containers/0/imagePullPolicy + value: IfNotPresent + # Second env Secret carrying the SAML IdP key pair carried over from the + # legacy laddr `saml2` secret (see codeforphilly-ng.secrets/). + - op: add + path: /spec/template/spec/containers/0/envFrom/- + value: + secretRef: + name: codeforphilly-saml + optional: true diff --git a/codeforphilly-ng/app/namespace.yaml b/codeforphilly-ng/app/namespace.yaml new file mode 100644 index 0000000..b2b12ae --- /dev/null +++ b/codeforphilly-ng/app/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: codeforphilly-ng diff --git a/codeforphilly-ng/kustomization.yaml b/codeforphilly-ng/kustomization.yaml new file mode 100644 index 0000000..9852d1c --- /dev/null +++ b/codeforphilly-ng/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +# Sub-kustomizations set their own namespace. k8s-normalize routes by +# metadata.namespace at projection time. +resources: + - app From e2da220aab36821c784ac2eb256cb17037b1efdf Mon Sep 17 00:00:00 2001 From: Chris Alfano Date: Tue, 8 Sep 2026 19:16:33 -0400 Subject: [PATCH 2/4] feat(codeforphilly-ng): seal production secrets - codeforphilly-saml: the SAML IdP key pair carried over verbatim from the legacy laddr `saml2` secret so Slack keeps trusting the same signing cert across cutover (only the SSO URL changes on the Slack side). - codeforphilly-data-deploy-key: new read-write deploy key registered on CodeForPhilly/codeforphilly-data for the push daemon. - codeforphilly-secrets: fresh JWT signing key, data remote, and the hot-reload bearer secret shared with sandbox so codeforphilly-data's notify-deployments workflow can fan out to both targets. GitHub OAuth and Postmark credentials follow once provisioned. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01RdRwHvDupRLV8GuJpYKzEr --- .../codeforphilly-data-deploy-key.yaml | 13 +++++++++++++ codeforphilly-ng.secrets/codeforphilly-saml.yaml | 15 +++++++++++++++ .../codeforphilly-secrets.yaml | 15 +++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 codeforphilly-ng.secrets/codeforphilly-data-deploy-key.yaml create mode 100644 codeforphilly-ng.secrets/codeforphilly-saml.yaml create mode 100644 codeforphilly-ng.secrets/codeforphilly-secrets.yaml diff --git a/codeforphilly-ng.secrets/codeforphilly-data-deploy-key.yaml b/codeforphilly-ng.secrets/codeforphilly-data-deploy-key.yaml new file mode 100644 index 0000000..30994de --- /dev/null +++ b/codeforphilly-ng.secrets/codeforphilly-data-deploy-key.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: codeforphilly-data-deploy-key + namespace: codeforphilly-ng +spec: + encryptedData: + id_ed25519: AgB9qEE7dyKORCuvvXx2i5vKhfEIsl//YP4EgEogtbVWlKPmUWQCyAUYvT2+kz1Qtt/DSHYT5XgnJ3OSeEqfaBFKkqtysch31/wJJOS+vXVVCsBCPWek3cno8CnG1wqmtGlziTIEQC5480lV3sgnvSsnIOlkt7Yc76HIuaUZj6Yw5CCOCTIidJLI+pYVoZPYlXPNj0Vk9sprnUnmOZuyJxAIcnAHzqP8QenfKpNI/hczr10MPNKMnc12NtsUtZH2tmDry4aj120RdEVTwyz4KHGMypBcJVs5U6wU4V4LWDOwXrFTs8aZzxRsXKup4KzxAU4xEXCQI+HY1aeS4cy1t4dj5zracoFs3cjgmsuJdVcW40/9T9Tr3AmHGmJzXxo2OtY97w9R+0enaqrQzaPdh3qDpqjnxC6Yuf0N4OmU6X4ZNbGu/p/SHHMSbNHgL/MDuaspG+R3a8N0wBze96Lw1z1CGJN1Z/iOpkcwQzE8HdGhbvOFYzzo1+sTejNXXke4JnC+fyuSzOg1Io5OiY9mJZ5xIx34VQxP0cNVRtWJtC4j/iAYBtlR7XKLpht/paWZLjWkhZl0PGatoySCWJQbEXC4AuIYlbSTv+6ONBBURmf6Qu0CZPKrf+PUNwRJCgrP+kO9smW8DphfVCdRXfa0rqe98dHwXsplEvmCdjjbXmX50CdL9UPMG8N4Ddg8ktrzvjZK1fCyX4K/FRC1OdriQ0ZvFVc2X32NMm4FUqK3PrvqESVOq6Ve6cCNl0emI393DVxVNVdEGUH8WA7Nhoxrn3i9BV1wy76ZwmNgeKLw0f6em4luMECl26FT4oF+7hx0PHfpN7m9R6AgPDKPkFRTt2sNTI/U2UKlWSxAUseM6Ae3jQ0msP+MIgRwiUAo6akXqFQr2DlvjNee4n4HfUFMpbUIuen9pMQKXoTZigkHpwto2KmXG4KaEEFV5524EZgZRK3i62nCiQIT+9uj2X3u7ObmdyHm4XXOKPu4SasvKuVUe3C+DQpT1xyNbmINH5Og1iSvCMioE+WYDfEFU1NsP6iic9jOZ8NkMsWvkaLYhdF95FV7iWa5mHlg+lvQDSLBQ0cLpoFhaE0Fdb8NZ+Qs1XDBIOfqI5k8U7LY6qVSa927Q4dg6yL3S0skC0xdgJWXETYhZRgpeCf9nmOPJcjyzrnzL2y4XBTBqKiyOm9BqlkN30iFFaF4pz/fDc8UBAggSy0vQfy963Ilkj5xLQsZgFWrVMSuV3FagxZMrYkRYG2PlqXtmtC/+ARkRK6eBEzJDso= + template: + metadata: + name: codeforphilly-data-deploy-key + namespace: codeforphilly-ng diff --git a/codeforphilly-ng.secrets/codeforphilly-saml.yaml b/codeforphilly-ng.secrets/codeforphilly-saml.yaml new file mode 100644 index 0000000..46ddc05 --- /dev/null +++ b/codeforphilly-ng.secrets/codeforphilly-saml.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: codeforphilly-saml + namespace: codeforphilly-ng +spec: + encryptedData: + SAML_CERTIFICATE: AgBngrw3wejQUx4nQrMj1++NKdXl1KN4P2zp7tUc2OmdsntyS1orkvZ3HZKhQc5TG7+JwyjcSbSbIevkVU+rnBt5RQzkinABn1T7wPXpzDseO/0I7U6H03FYODa0kRRBAxFvUvw8hgIn2uCbFa61mAuDGFG4sQNpeSCRkRjJR9uu+C5Dx3wv1uRN1M/X9rI/tqVOyS66vXNW26kJM3uIxSYZTp7LAVNGXepU5yulSVxo4MKD+i84cRijiFXjf8qrM52seSHTQ9wZdVdozNSaTu8WZ62r6b2yR+8A50wp93JZsVLn0c4VuZVmdYd4/2ob2/sHZGz/UDBfR+bL2km4ed4KUGamA2eSYtqEjTHNcD20xWCmWXLBYXSm3ug9G9kPJKblzF6jaIw+NHAl+QrlIYBimNvYORcrGM68o6FDNMWZ7YHHFOEn8LTZ7iHwhCRW8tVhxH0tI9/QYw2th7zy7uS/dMl1+AmMbWcvEd847zQXSXLdsfLNR1O2UUEZanu6KckAJuYhYIFp8C4FVX7P/Obnj44yhjbBsCL9BONUnO1/8ndruIc3dTCsLgbaR0gN8tUGXEfY/PGEz3ON6w96y6CBD1lc8J5eXu3axzSJD+YfmlGiVFzI4omnSkZtrzSKE92rWZPjx478EWVASEwZ5BxUwaziVFLgOEHPpeKxvbQD0+n2aVoM7GskNQxExuNTSxcAM8AlOF7Glui1iY6F2mnbxCTa2HwUuqCYEDjUUVInuwvHiLeLGZAuRfxet307SYDc2zJgAQ5j9QHg73Y7S814Pc/6hu5z5klLKYAOJWvnzoyKL1sa+vqMRi5WnB52gluIcvGL0oYCyXcoy77gC22DhktaSxAGeaizNneO3PcYqszxj4br34YKBAU3DLgZuC7QrS43a7yMwHcAmQa8cRRW7g3r64LF6bOQl6BYyPCNymCk78Ubp7AhygF2eJ+sWJLaE7p4hkLzs5kIhXhhtCB13pt9Nx6H7+vfg8BIYEn9PSo0OmF2Z/jQ5B5Rjt+VGLTrfHRVKgGvJ21GJhWxJAHS+GWwwhk058lpRd0npy2Gsn5YInc0h8Q9G/Kacjw1WyvsXpIXtkEuTQ4LRBLtFA+E9/zsBCrZxxIJjpoehMZ8v5JMnbfijXqNQ6AO7+oX5k2n/SoG/0sa+a2wD1P1ZlZOk43v1b+58nPXo7kK5FhwvfT2L/poLcOgWrAQjxUhFm65m8QJwr/h2/7fNWgyWDnjhHes11RPdYl3Negj/dQZQ+kaQMVBdimy83DhuvJ5HCq36FAtFvz356ADwtJgi7fLMQGPRtvChJTwA1b+Wo7wxz/JTqZhmz/1Y+TkTKNxaswtYrjPpRh5dZce83o8n2FNLu7OEqk//bELwXLUHcZqE2N9XFM1kRUjQn/4Jair3z2t8bqMCQdiAKpylbpl/y7BqcmU+z4TghwdlTnQYjswY6tMIWkB3ORMIoorLt6oD1HpL6wyStjy95mK+ATCOn1Rn7LCFr5agWeaLXlA9WwSD+FLhAaseWPfHKYScWgEFCndniSq/Zs4eF7FmSHEsG7hL+zkjlBNugXwyYuB36r4/+QRpp1e5P2efRmohbWfQiYzJA63me66N2hRnLKcYQlAoZpb5vetDNNrBDjJ4Ocvp4cYMPH8ihgcLeknLLq/WH4QRlPQdgmOZOzaA5rBsYg8SsRdP/psS0OiAsGnJ0IM5+BvwLw/EOnqrw4o1E7Da8NwJvRV/TdSRJqj6EJbseYQBz8LdjpEG/mPLFvNpYyR0E0SdPNz9JxruJ07quUWFwx+axm8ly0rOf0XB9OqCGqGBE07uwp1vRg4AXPgPDT91zDn15BUKoTN57hqvmWDuVAZHqQNgdBh52PcdkfVloMINtOJIl2fr7IABQe5JOJJ0FspESJtQQz9t25yVh4EIUd0vg582IV2TRzNBkidjH4hOXqCr+4NB1Eto3wWNIn12cJvoOqFE48h/hivRzn6KsTtSb7HjUMvO77NNuKtx60HwYUDlwDchzd4ipIUNlnhO7O2vXsAbFhtLW8tmVV4ygHr3FeGUSg5hLzUjZL7QsEqAvG6ighi7B8Wl+Bz3UYUfmcWw6JF7r2LIQCo7NU8Fec08ivpfPmkNNf7cZinb20C6ZM503v8FZsRDYIWNPML/TZwqNpwc51gVLMENA1jn4Ejmje9jdXG7amWMqmULhNGfiwbX1XEAka/kz/qLQKHJ6LNCfniC5B5nCeZP1dtg42nW7R9kG1GhvIw9cgYdL7oxySNe+MJor8tygXhba7LE05uuhIl0wBR1Wua0UK7WRQDC2lLZsy+ZOk20pDESqPautWTW/dPugQ3IdFK/46GORy933QtxDp5ztOE+hZBiBI0i06S0WbF1/u5dYK87dWdZJbbq4gKS3GQA8yRmWlr2snn/DHMZ/lJMZUJo6pJ+2xzK/wq6lmlUJJumH30wt2BduGO0g1EdadGOpz8X/UkcqqY46i9Pby/bcX8v2ZtvNVtgYf+lkaHYAgs3uv/tMicYqSTENaVFA== + SAML_PRIVATE_KEY: AgAecw2/UrkwyJM6SWyQEdxhfTyV+PXb9bSfAGnKFPieiyw9OzpPNZof3naMBoREkIMC59tUFDjiv4xjggumjGkhhn2iZOHORGZ4/F6bh/1Y0mNZE5enRDBp3oms7DdtX4jNESJCLwGAh4Q5GAOcVWbun1GwSlKZ5ZXefk5cGyV3/88iqlQx+mzoV/AZ30Tmaof0I1uYoUzEi5/SEvJlGBY7eR5JRSgJqB+ou+FAxjmm4x95AMZ4NviUM/WLdW6FNabQzU02aAFzIPKDs1tsnDcPAdMQV9y4B2d6X2XgyNK4wMQ772IMTYx3Z3lLtUYZR71EiDOQoev5+RgPUlYrAVTsSWhl7yFGU+boGg5LbcjjQgiytZK1mFxMCuO6JSgJ+gOaGDWvhOajFDxZxfoN7K4Ksk2OSu1pm4clcrYhV/uVkFJD4jXB4pDfItVDQmMNCN+PhQSA11Q+4Vt4PNlEQIQ9Tyn9OZ+sL6Kz77pczwZtRXUaSBx/BNA73PwAxZto3m9wEG2QnI/3QwrFLu03B9YFGraH0NvSwArcoHGqBdJB9zhQHU2UqmVs+zuA49pZEiZHTWzd7XIIrMHX9iWbptDMeie8lgN3XxyZpWggNqbjRTD6xH4ot0abKU0cKRBEEo3L79fjqoADMomUZ+Tir4PX/4X17ESwTHzwi4DAK0CPQYulwi1gjtWtCGgU8Ln4dRIl6I0EVXTe77yfEDlaZKARz0JguMhQpOBLHLGjv1Ipn9l1PTizAXAYnh9yL+f/ssDg7pgsDxRYbikN3f29EJhl0bADAdJLZld70P//+PSAsCghWRNtPixJDpU8VWB+b7XXrMNOBw3kPsIVrq++iGiMvgIzjpOh/MnkjER4uDx8Xu7+o+tSrltkvJ35Vj8YwwZynltCe7i77+llV/yBQn2oRbNe5eIRAaV9jyGwlVELQOA83SUIJJor1Dm77APwfD455VgBU/98ix1CQvRXyy2US2K/4X9/5E4w5es4bGJ/pWpv9QzezFqhBGiw+kpvZyc8t/+jqurOsDOGvENS8MsU3ECxaz7XeaVvTaf0kpVMI3SKgvHNeYudiLkE1mBanhYpSkJ+GQjnZYamMqyRpUkejEhrlh9uygzCxPx+2HpZiuAGhqocA9eebFHPQo05/mLwyPcvGPZiMc6qLCtVKhiGoe1lH4aVMLLqP0CzE0EXc4UP19sYEXGQ5BMYBHKXQezPzNqjJLyS9tJFxSPa4S0QGi2VgvZR3wW/ctP5HWg2E80i0QMoq6Y/bkVRvSdD0OmME1tpkD6MUlIQIIvjypjjTiY8AHpsWe8llCYLzNzsaVS/15XZKjg3oPFz8f507xSZHInCvhTDbjV+SuhEKTLp+ZDNlGUOiKjKsouQIr7oH7HmSa5u2Xaks9hdD++A+kgg3w0cPqMThBHMgH2DmutLvQ//M/LhsApEITTX6w+fsoUBuOy82gWPIDTUbjvs8zXccrK9OikhtPHwBuE9/8Xy45nQaO04LgR/wnUZUVgrIeytM82Ztw7vQsM3W42QHWai8vmuhinV2a8azAYt+5yqqe8NxEYSMtautmzQXcBp3EUDKogTjKq8SscHjmu/hGNkTTE849JBVinKpAJWXciBfTd4fS9mCZZbh+B/vkyKDmGqDeYIihnihcHhfH8kiV3ap4iclhoqClt3f3wlVDhm65LJUBtMYrHSeTfe/mhXvurZdkPXaSv5g3+eGhstKJ7H3U46bvskDyX/I1JcGwAsIek12OF8HBlcv5vy6xyllMfTR6WtCB3//D9W3/IkQY8nU2CgjGKmdrD87Xkh6KelBwsJgBnzUsaPqZ+CRlCyUorZV1EvHCOXItO7oAgDSZJdX8R1t2dzElqXSonYdaYD/Q/qBFF6D/4diujj0IqS1WRX0wMupVdy51i6VtpHncZQt3lrFj6y6JCt3SXS/uBWm8+DOtGDcCZQNfJjyPB17bZ2l1ZHEGLl+zjkyahgOi2vdwETQ9gkcY2+rfIb/0oGgsLYQzxka3dW3LabNCcDfe6vEeluFAUPRNMdhVNGo1GD2nL3Dh+eAVAkwDbAf2AM3aZbII8oABmBBWceJEHMBaSOv4PaJxJgik3JSqDCxiCYt7PIrm+iv7jRpbiNaw2ximH6qFzk0kCmPoix9Emt5SR7ZEjvQviR3Mji0F9ikmMv+o+3cSr4xPeDPOPiXE6f4XTh2KbnGeJ74jGyWh+kkSJjwfrePVsFRz//jrGNJCuRg8Lse1wvwNGddRGRHVaxABFy09nAHvfPhUIRFB9rk8hhbIDpdASzfbxyFRENkmDpBw+bOoiXCMarWvTv4aMYGMI7H08X7fQiaGcHhRhKvxfuxb6BGpdb9nGTq4cgdqnd5DPZSZyUUl/0lpw1W4TFZeFYgEtqQ9pP9S1TUGdPcpTPbTK0kVPypt/LEgkad9iOn3Ds90wbtfm3CH94gRnwESJuJY319sSTLxpk6Jm63q/AIGqzX7kRr83kDfE/GnQXtfybKJJ0NkCnNFS4YB5OzzhHN53uDRoUP6znK/gJ8Ybe+vsS0R9r+lsqZshWOMhpzu3GTEW02gdY5Ft1dQz+DKGKF6Jasv+aBJGNwCC4i13cYMrVjgcmzwIzXqK3FxAX42D0rXL4v1Skal/9jBwKsnj0MyHdOkyQAsWtIEVu6nbRvmmlXtqYbR3CPeotMnABacui2TvHnXtIENPFp131Z5TXU9YrFRiohTOUnD3UQVfpym4pnRsyyt/BDIG1S6XoN6QRSzBKNNiUnD9px7UvKKLG4ZFTzUDdvfMD5H3hRFXcahuytXNFd7j8yGY5/Ek8cvbjIyHTlAfGrjBv21i5fch3KH1epPKu4kjUyk0XEuAyYcugR2JQnKaie+El+UW5kqFiWeb/tRs89uddc3pEyG17dvyR4rUFR5JIdMyHcn5unV+P3LYdl6uMqoY2FU3AZhU6CnnW+J3l1/qeSINcbeDfrIyf4fs= + template: + metadata: + name: codeforphilly-saml + namespace: codeforphilly-ng + type: Opaque diff --git a/codeforphilly-ng.secrets/codeforphilly-secrets.yaml b/codeforphilly-ng.secrets/codeforphilly-secrets.yaml new file mode 100644 index 0000000..2e0bae0 --- /dev/null +++ b/codeforphilly-ng.secrets/codeforphilly-secrets.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: codeforphilly-secrets + namespace: codeforphilly-ng +spec: + encryptedData: + CFP_DATA_RELOAD_SECRET: AgAyFdDUJuQI0000J1SAY/gC7rgTpA9t316bAKV+n5KX5zApT9w5PzYNagqrQhR+03G8xoit8c+kbOYbjVDJj+dimGudQxcbaBez96JQ7RxntfiRd2KjVV5k1x7lviicqZyh2sjeqxYExtBGnQfXu8VmF9+EiqJRj+qmYLiVM1MdawphjFj8AkNyXPB+YhOy9NKElCGDJ9UEFe/HItLYKdi09kVX2vORYdS1KfghE5zz/YP/ktyfGX395VExkZd2nGukIn6BMcuYNspf3zaANgFUeZHGsE61JrNDgf4xEgpA3G5ZaXs7hDI3xfv+IdZKILVREB89Imew1fFcwbGzqJp/xqlUd0/TEn3YcQ5CYlTKrEjC/0i7TZOxX1ksHoTOLvr6A6bPnyVqTLFoO/jqYXRRfZ5aSSi6ALJZABhBSeSvg3Q9RoGS5VnaHkVxNqrX8rEpuvsWeTC4+Em4DVHTH64qFopuFyu90Nh7X3xSBMcxE9wvXpxDPVcYVKo4j+q4ZLcUQQWnoHgz7uoBO7ECUKHfLmxTyGqL5EbKJWCN2poSy3hveenC2tmYCa0w/jY2oYn8ykd4vtT/gfma9++SnQqQBoJa3k+rJe9XWLfgXb9F5H8eBfPBHvG9xv3Z1XbBEDgBeiaKKuYX+2JQ5GnZkr6mnH6z5qJGjVvdBQJdTNU+RL1JLvxn6gR3dSEJhc10rd5zs5RAHL3gtJk/WuIxdXC4AmcGHzGcrC/20rnoja7O/WxvR3bbBQASUrdJ5GxFNQY= + CFP_DATA_REMOTE: AgCrb65RW/8B0IRckEpPzKf7C/t+DychAoBo4dXXHmC6ditekATw8S1pZKFX7zc4vfQCr15lQ5Xcl0QydQHT7oXfJC2sxq+vVm8PPErqQmHRpN0Da9YvoD1zEHNuE5vaF6wp8VaP7Jv7QP71a+5DTxOaxYGLhZblLeKP/9EyGXfDUxhFIGH22uHKFP4K7kHeUThPpgjqN59bdefrBiEii0JCTazuIGG0lh4oszZE879KR00CvS243ItSt3NSLots38sypxPWh3CGboZIqIcss5BEYDM2+U7+1OsnRT343QDkpLQMzP7JuU37jPCW/ugP/0xQ1a/NPl9Z+kA2pa1NF/OhYi9dNQtDWvRpPqZd1k9y9iRL9CR2GtsQZD+w6Um2OqDKMsHw27xzkhlRVaGh32DQsJ/82LZiId+x0LRCehljPmaYEIWhai3C4QviOCPPLKXDHkKdc6n/cSUCaLj0RdjUIl+HzSWTvnMMKGE+HIIW3DUFawdWR9f7FN3FzZtF6292Xuju5vxQV2IFIMhqlLlkDW014Chf9OYenN+nR67mx4jUJwRcAEBo8vz4tv4FeR1VaOzuoaBaKuskrpKk6to4aRKDOzixXJ4bU5EQoHMVjWn2nqpyBf+x4pn0eJTQ1GcHFBiD+6XH7EOSPXPKQr42yDOikM6/5qURAGBgucpcyMKmkrFnu2K4TKK/UBzcco5oSPXgJTGr4gFboYKEOmMohifPqL/3P+hyEXaGC0OvS9UmsoHAqqjeLPz85+qOwKX/J6A= + CFP_JWT_SIGNING_KEY: AgBSbHF5DM57I2J+C0y7xMYLUcp0GZilWIH3KqfqCZJnP5mawIB9x3uEcPqDHQ0goHXuNAeoFz+2YH3aPUkCwfl91CDKsiXniQGmNgtUcDux8pS3NyBxRsgR6BsbkjsYtiqOlg+BJrCJoxDRYpID5j2xPN4Og4zEkcnYvxz/Fo4Jvvj8/0V87X7E7mx0T1siT0P/+lyfj9rI9JmK4KDleaLDsN0h6xrfE/oQiUfjZkVsJt9Xa7TtA0zjFkTR6J/mjdkWdy3WfvT/IAJ6jjsT72komfmvaCpphfrSZ+AMg32oLIY1yBvT9tkUE9cqs5Qjjrdv2EzCNIuED587pK2csBy2EEGX2Ft4OooIQp08PIutneaN/6C1pmBDftfc/w4fX+HIaucZU/tkFcNui+QzfrDyk0JBHBwXelNBUGNKekABwSHwGTjIP8NrlZlR1mW9hu14hgMr2s852CjNhP/Efw8Ars2XhLrIgb51m8gci3XkVGkfrq2lI3e1JX2EqRbXLOzju3iBs9JoBKy+EK3zGQ8hOE9Zfy+jyBE0rlamxzbiwt9CROG7Tit9Nh+6QE4nkOoXFjZKv12nm07h+dIx1dMDdYS/4EFx2AHRvYwpd/9K1U5B3qQ36zof91PYIyX2MQWCeGXCRCKPGm4U0Rz5JCHhw5pzxufZ2jQBxG9GoncjwHxMXoympe6V7/CXY2Rw82M1fi1mzatBAVhYLN+UKdzLwxB+qprRW4lJmtba/ZXVaVlldMY9qkREZ9mM+CrYA4Ckrz/QMUVi0lBh9epLtylh1Ooi3cYNFD70quexXa4BRaC0tAQqEJq1 + template: + metadata: + name: codeforphilly-secrets + namespace: codeforphilly-ng From 83d9a26c6ae3032cf407e6d5506b1f335b0a388c Mon Sep 17 00:00:00 2001 From: Chris Alfano Date: Tue, 8 Sep 2026 19:19:29 -0400 Subject: [PATCH 3/4] feat(codeforphilly-ng): seal Postmark server token Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01RdRwHvDupRLV8GuJpYKzEr --- codeforphilly-ng.secrets/codeforphilly-secrets.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/codeforphilly-ng.secrets/codeforphilly-secrets.yaml b/codeforphilly-ng.secrets/codeforphilly-secrets.yaml index 2e0bae0..8ad577b 100644 --- a/codeforphilly-ng.secrets/codeforphilly-secrets.yaml +++ b/codeforphilly-ng.secrets/codeforphilly-secrets.yaml @@ -9,6 +9,7 @@ spec: CFP_DATA_RELOAD_SECRET: AgAyFdDUJuQI0000J1SAY/gC7rgTpA9t316bAKV+n5KX5zApT9w5PzYNagqrQhR+03G8xoit8c+kbOYbjVDJj+dimGudQxcbaBez96JQ7RxntfiRd2KjVV5k1x7lviicqZyh2sjeqxYExtBGnQfXu8VmF9+EiqJRj+qmYLiVM1MdawphjFj8AkNyXPB+YhOy9NKElCGDJ9UEFe/HItLYKdi09kVX2vORYdS1KfghE5zz/YP/ktyfGX395VExkZd2nGukIn6BMcuYNspf3zaANgFUeZHGsE61JrNDgf4xEgpA3G5ZaXs7hDI3xfv+IdZKILVREB89Imew1fFcwbGzqJp/xqlUd0/TEn3YcQ5CYlTKrEjC/0i7TZOxX1ksHoTOLvr6A6bPnyVqTLFoO/jqYXRRfZ5aSSi6ALJZABhBSeSvg3Q9RoGS5VnaHkVxNqrX8rEpuvsWeTC4+Em4DVHTH64qFopuFyu90Nh7X3xSBMcxE9wvXpxDPVcYVKo4j+q4ZLcUQQWnoHgz7uoBO7ECUKHfLmxTyGqL5EbKJWCN2poSy3hveenC2tmYCa0w/jY2oYn8ykd4vtT/gfma9++SnQqQBoJa3k+rJe9XWLfgXb9F5H8eBfPBHvG9xv3Z1XbBEDgBeiaKKuYX+2JQ5GnZkr6mnH6z5qJGjVvdBQJdTNU+RL1JLvxn6gR3dSEJhc10rd5zs5RAHL3gtJk/WuIxdXC4AmcGHzGcrC/20rnoja7O/WxvR3bbBQASUrdJ5GxFNQY= CFP_DATA_REMOTE: AgCrb65RW/8B0IRckEpPzKf7C/t+DychAoBo4dXXHmC6ditekATw8S1pZKFX7zc4vfQCr15lQ5Xcl0QydQHT7oXfJC2sxq+vVm8PPErqQmHRpN0Da9YvoD1zEHNuE5vaF6wp8VaP7Jv7QP71a+5DTxOaxYGLhZblLeKP/9EyGXfDUxhFIGH22uHKFP4K7kHeUThPpgjqN59bdefrBiEii0JCTazuIGG0lh4oszZE879KR00CvS243ItSt3NSLots38sypxPWh3CGboZIqIcss5BEYDM2+U7+1OsnRT343QDkpLQMzP7JuU37jPCW/ugP/0xQ1a/NPl9Z+kA2pa1NF/OhYi9dNQtDWvRpPqZd1k9y9iRL9CR2GtsQZD+w6Um2OqDKMsHw27xzkhlRVaGh32DQsJ/82LZiId+x0LRCehljPmaYEIWhai3C4QviOCPPLKXDHkKdc6n/cSUCaLj0RdjUIl+HzSWTvnMMKGE+HIIW3DUFawdWR9f7FN3FzZtF6292Xuju5vxQV2IFIMhqlLlkDW014Chf9OYenN+nR67mx4jUJwRcAEBo8vz4tv4FeR1VaOzuoaBaKuskrpKk6to4aRKDOzixXJ4bU5EQoHMVjWn2nqpyBf+x4pn0eJTQ1GcHFBiD+6XH7EOSPXPKQr42yDOikM6/5qURAGBgucpcyMKmkrFnu2K4TKK/UBzcco5oSPXgJTGr4gFboYKEOmMohifPqL/3P+hyEXaGC0OvS9UmsoHAqqjeLPz85+qOwKX/J6A= CFP_JWT_SIGNING_KEY: AgBSbHF5DM57I2J+C0y7xMYLUcp0GZilWIH3KqfqCZJnP5mawIB9x3uEcPqDHQ0goHXuNAeoFz+2YH3aPUkCwfl91CDKsiXniQGmNgtUcDux8pS3NyBxRsgR6BsbkjsYtiqOlg+BJrCJoxDRYpID5j2xPN4Og4zEkcnYvxz/Fo4Jvvj8/0V87X7E7mx0T1siT0P/+lyfj9rI9JmK4KDleaLDsN0h6xrfE/oQiUfjZkVsJt9Xa7TtA0zjFkTR6J/mjdkWdy3WfvT/IAJ6jjsT72komfmvaCpphfrSZ+AMg32oLIY1yBvT9tkUE9cqs5Qjjrdv2EzCNIuED587pK2csBy2EEGX2Ft4OooIQp08PIutneaN/6C1pmBDftfc/w4fX+HIaucZU/tkFcNui+QzfrDyk0JBHBwXelNBUGNKekABwSHwGTjIP8NrlZlR1mW9hu14hgMr2s852CjNhP/Efw8Ars2XhLrIgb51m8gci3XkVGkfrq2lI3e1JX2EqRbXLOzju3iBs9JoBKy+EK3zGQ8hOE9Zfy+jyBE0rlamxzbiwt9CROG7Tit9Nh+6QE4nkOoXFjZKv12nm07h+dIx1dMDdYS/4EFx2AHRvYwpd/9K1U5B3qQ36zof91PYIyX2MQWCeGXCRCKPGm4U0Rz5JCHhw5pzxufZ2jQBxG9GoncjwHxMXoympe6V7/CXY2Rw82M1fi1mzatBAVhYLN+UKdzLwxB+qprRW4lJmtba/ZXVaVlldMY9qkREZ9mM+CrYA4Ckrz/QMUVi0lBh9epLtylh1Ooi3cYNFD70quexXa4BRaC0tAQqEJq1 + POSTMARK_SERVER_TOKEN: AgAOBQ1kPqrcoVKwq2kL4xDypnzfwlqfx4Rdpm0UxGPykQ8DWhWzwcJxlJEzlP6mvMg4yTwil0uqex48iksiOG0JFbXOdLPsbJtrLIpHFPIHJeDUhMq6dptAZxI19TDd5Jt11Uc8nv7ciOn+n7r5OkDDG+C47ClYpdXezcKF+2l/rGrM7KmC5J1yvEyG+o9WPb7ATUafhjlyA6D6IbGYZSKEkHWVF+FVlE61yw1ppO9WAveUX0Q7elN/QDiNK4bjEWv6znMSPiKtIrnlaAJ2yQs5X2vsUK3Ys9qFtQfsVGex+S2MVjy6NwfxouIhu/g8W45odQjbtDYAOC26AIBq2HrY3VqmGR7wm+/W9JO/pCgrpfe2KllDVbj7Lk3C/kbSyYZSAsax2KpuU4oFgpb3RHB2dliPRu4wQu25HVzStTfWyP6TA1jtQ1tzWbZeNcWIYR6v5vgcST28+Junq9BANN29yj/E3laeSnmyGUUrJJkzGPBA/wWXPux5gwRVulhthP/JpQkwTv4+cOBkYnXREqYRVnQX+mla8tnd7nSOwmyD7GIAVl3s8vIaiNy+NfWl7954BpHRclfvhsDWjWSphnkcj0FqxZdpZTnSV5pkdJCXMKvYZ8DTfXG+5sYQ3KgwLdW5DAoVxGimnh8jdmhxqC++pWavgT2s8NVudATDg48TVE1yrlP9Vsn05Sy2Y/B1KBqx9MxTroYLcY0fXAxj69OFhZFI+V12HDRBhv9uWOD7HDkOUTU= template: metadata: name: codeforphilly-secrets From 16f808e517e95d598cc6b33039bd98a2a1f7ace5 Mon Sep 17 00:00:00 2001 From: Chris Alfano Date: Tue, 8 Sep 2026 19:31:39 -0400 Subject: [PATCH 4/4] feat(codeforphilly-ng): seal GitHub OAuth app credentials New org OAuth app "Code for Philly" (the legacy laddr app was renamed "Code for Philly (legacy)"). Callback is registered on the apex; GitHub accepts the pre-cutover next.codeforphilly.org subdomain against it, so no edit is needed on cutover day. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01RdRwHvDupRLV8GuJpYKzEr --- codeforphilly-ng.secrets/codeforphilly-secrets.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/codeforphilly-ng.secrets/codeforphilly-secrets.yaml b/codeforphilly-ng.secrets/codeforphilly-secrets.yaml index 8ad577b..3254e29 100644 --- a/codeforphilly-ng.secrets/codeforphilly-secrets.yaml +++ b/codeforphilly-ng.secrets/codeforphilly-secrets.yaml @@ -9,6 +9,8 @@ spec: CFP_DATA_RELOAD_SECRET: AgAyFdDUJuQI0000J1SAY/gC7rgTpA9t316bAKV+n5KX5zApT9w5PzYNagqrQhR+03G8xoit8c+kbOYbjVDJj+dimGudQxcbaBez96JQ7RxntfiRd2KjVV5k1x7lviicqZyh2sjeqxYExtBGnQfXu8VmF9+EiqJRj+qmYLiVM1MdawphjFj8AkNyXPB+YhOy9NKElCGDJ9UEFe/HItLYKdi09kVX2vORYdS1KfghE5zz/YP/ktyfGX395VExkZd2nGukIn6BMcuYNspf3zaANgFUeZHGsE61JrNDgf4xEgpA3G5ZaXs7hDI3xfv+IdZKILVREB89Imew1fFcwbGzqJp/xqlUd0/TEn3YcQ5CYlTKrEjC/0i7TZOxX1ksHoTOLvr6A6bPnyVqTLFoO/jqYXRRfZ5aSSi6ALJZABhBSeSvg3Q9RoGS5VnaHkVxNqrX8rEpuvsWeTC4+Em4DVHTH64qFopuFyu90Nh7X3xSBMcxE9wvXpxDPVcYVKo4j+q4ZLcUQQWnoHgz7uoBO7ECUKHfLmxTyGqL5EbKJWCN2poSy3hveenC2tmYCa0w/jY2oYn8ykd4vtT/gfma9++SnQqQBoJa3k+rJe9XWLfgXb9F5H8eBfPBHvG9xv3Z1XbBEDgBeiaKKuYX+2JQ5GnZkr6mnH6z5qJGjVvdBQJdTNU+RL1JLvxn6gR3dSEJhc10rd5zs5RAHL3gtJk/WuIxdXC4AmcGHzGcrC/20rnoja7O/WxvR3bbBQASUrdJ5GxFNQY= CFP_DATA_REMOTE: AgCrb65RW/8B0IRckEpPzKf7C/t+DychAoBo4dXXHmC6ditekATw8S1pZKFX7zc4vfQCr15lQ5Xcl0QydQHT7oXfJC2sxq+vVm8PPErqQmHRpN0Da9YvoD1zEHNuE5vaF6wp8VaP7Jv7QP71a+5DTxOaxYGLhZblLeKP/9EyGXfDUxhFIGH22uHKFP4K7kHeUThPpgjqN59bdefrBiEii0JCTazuIGG0lh4oszZE879KR00CvS243ItSt3NSLots38sypxPWh3CGboZIqIcss5BEYDM2+U7+1OsnRT343QDkpLQMzP7JuU37jPCW/ugP/0xQ1a/NPl9Z+kA2pa1NF/OhYi9dNQtDWvRpPqZd1k9y9iRL9CR2GtsQZD+w6Um2OqDKMsHw27xzkhlRVaGh32DQsJ/82LZiId+x0LRCehljPmaYEIWhai3C4QviOCPPLKXDHkKdc6n/cSUCaLj0RdjUIl+HzSWTvnMMKGE+HIIW3DUFawdWR9f7FN3FzZtF6292Xuju5vxQV2IFIMhqlLlkDW014Chf9OYenN+nR67mx4jUJwRcAEBo8vz4tv4FeR1VaOzuoaBaKuskrpKk6to4aRKDOzixXJ4bU5EQoHMVjWn2nqpyBf+x4pn0eJTQ1GcHFBiD+6XH7EOSPXPKQr42yDOikM6/5qURAGBgucpcyMKmkrFnu2K4TKK/UBzcco5oSPXgJTGr4gFboYKEOmMohifPqL/3P+hyEXaGC0OvS9UmsoHAqqjeLPz85+qOwKX/J6A= CFP_JWT_SIGNING_KEY: AgBSbHF5DM57I2J+C0y7xMYLUcp0GZilWIH3KqfqCZJnP5mawIB9x3uEcPqDHQ0goHXuNAeoFz+2YH3aPUkCwfl91CDKsiXniQGmNgtUcDux8pS3NyBxRsgR6BsbkjsYtiqOlg+BJrCJoxDRYpID5j2xPN4Og4zEkcnYvxz/Fo4Jvvj8/0V87X7E7mx0T1siT0P/+lyfj9rI9JmK4KDleaLDsN0h6xrfE/oQiUfjZkVsJt9Xa7TtA0zjFkTR6J/mjdkWdy3WfvT/IAJ6jjsT72komfmvaCpphfrSZ+AMg32oLIY1yBvT9tkUE9cqs5Qjjrdv2EzCNIuED587pK2csBy2EEGX2Ft4OooIQp08PIutneaN/6C1pmBDftfc/w4fX+HIaucZU/tkFcNui+QzfrDyk0JBHBwXelNBUGNKekABwSHwGTjIP8NrlZlR1mW9hu14hgMr2s852CjNhP/Efw8Ars2XhLrIgb51m8gci3XkVGkfrq2lI3e1JX2EqRbXLOzju3iBs9JoBKy+EK3zGQ8hOE9Zfy+jyBE0rlamxzbiwt9CROG7Tit9Nh+6QE4nkOoXFjZKv12nm07h+dIx1dMDdYS/4EFx2AHRvYwpd/9K1U5B3qQ36zof91PYIyX2MQWCeGXCRCKPGm4U0Rz5JCHhw5pzxufZ2jQBxG9GoncjwHxMXoympe6V7/CXY2Rw82M1fi1mzatBAVhYLN+UKdzLwxB+qprRW4lJmtba/ZXVaVlldMY9qkREZ9mM+CrYA4Ckrz/QMUVi0lBh9epLtylh1Ooi3cYNFD70quexXa4BRaC0tAQqEJq1 + GITHUB_OAUTH_CLIENT_ID: AgBRBBFON7OL21WmdhiZC2dp/dPS3Qkirry1PD3n3zgineX+ypwvGwaHZGTsBxDVpP4afdsmuYI49lpQB2CBQSi/AhT9ztY02Oltvby21+JfVt8108ZxaN/jFDdKy5EDX2gUuhnI/kYUjlrvD6Bm2OK2df/IfoP/n3VHAwKiQfecDUhwC/LBpRo+/2y+JR10y7JEWn+wGJ9qai5KyxX2oTdiuH6vgfX0t4sfAgrIbLoIbLC7rgCZfarDPdw0R17JsEWZzHf8AMing1SZMMSyyqpO2GI8zEKvneIRHakGHAy1RtU+/iKHQ5EP+X6sSxBrFh/vW08f0HWXpYenTx0yhb37pLZMF7Y1ZlH6UWyNfhsVeaFGDcnlcZtcA4cWD6TcSCayhj8eh/EmdAkN5S8Yxho85Lju+gsbd4kJDmIGK2cRKV5di665GkVYU+zHc/R8GUppgC15KAkoQw5wLo8try0ujFhB+k3PpgP06CWkZO6rJBh0zhH588yaAdoQmQHSpWDFRK5zFrS+4gVqBkoxoNfaLJF2AR+ha1IEr2uMOakLOvZTBoPEdRiInue6D6yQg8jBPN5b/1VMASglKq3qpk6gRrcgIfKBuwn2ZerbIlnzW87jYG6HDmveokExtGPQaV8PChl/Z2WRv0h6Dg7dVGwnd4bj607k5RMlEVDbVG1JkqBSsJFE6ksG9tZotr2DqLM7goIl64IfcFVnj37xHBm9MzToRA== + GITHUB_OAUTH_CLIENT_SECRET: AgCHFLa4zb1eG6GsTlFxl2BS2+WGf060CHAa+1ZeaV57vMzvCwLQdolw719PLguf7tpqwkorOJiQdco0aV4DrzH2RNnKNnXnsztC213lbM8rwZs/iJN54LlZzYlY2eaQDEN6+7Newp1d+5ZY5QJqP9v9ieD3EgEzatuEVNPtPGNpo6XPdQkjvbxJRgGRn0zKdR/tG1AJzIjvP2hDgYHPKAd/xj/Cmm7JIcLCftVgzz17CgDxg4gWKarKArcNqInKcnmn6+F+0kNebBi6GXTm+RXfDgAtVKgOIYSKYdSpLnebpW+uLWmXwZs90bbgjx+QfmYT4KUbN7pa1HSdleMc1XvCKOoixVQx3+652bLTYbJ8waPC8sYY+WRHsk1cL5AvBRNPSgsTcaPqaHJHAK1r2w758rSt2WMqlW5ct18qraXSs7q4Wm22q2KId61a5NsIYCEhfdFN2UwTf+uVGFDgcT5u/kgfHp+J74IIxJucODm3WCKoYisrV3VFt5gBNnpilQXM1zScM2UdeAuiffNx4HhC7ombQdXqhi8QU5STRTdpkp4pUbNXcr1Idc6C06U7cKePZ5MZUQ3vJfUEWXm3nBYEVkRf7c1cu5PaQGrsADnnwTqvZ+NgqMG5fIwwASoUp7KNdHCpUBPp4JOb9bXFhphX6Pn20HjWW0Q/BRPCW3VPy/cik6aiu1GqAXPUO2+ztXaNObGMEwoiavAobOXK8zjSIXeVlHeG0PlPnrMwdRFwoFmIsmnjPHNI POSTMARK_SERVER_TOKEN: AgAOBQ1kPqrcoVKwq2kL4xDypnzfwlqfx4Rdpm0UxGPykQ8DWhWzwcJxlJEzlP6mvMg4yTwil0uqex48iksiOG0JFbXOdLPsbJtrLIpHFPIHJeDUhMq6dptAZxI19TDd5Jt11Uc8nv7ciOn+n7r5OkDDG+C47ClYpdXezcKF+2l/rGrM7KmC5J1yvEyG+o9WPb7ATUafhjlyA6D6IbGYZSKEkHWVF+FVlE61yw1ppO9WAveUX0Q7elN/QDiNK4bjEWv6znMSPiKtIrnlaAJ2yQs5X2vsUK3Ys9qFtQfsVGex+S2MVjy6NwfxouIhu/g8W45odQjbtDYAOC26AIBq2HrY3VqmGR7wm+/W9JO/pCgrpfe2KllDVbj7Lk3C/kbSyYZSAsax2KpuU4oFgpb3RHB2dliPRu4wQu25HVzStTfWyP6TA1jtQ1tzWbZeNcWIYR6v5vgcST28+Junq9BANN29yj/E3laeSnmyGUUrJJkzGPBA/wWXPux5gwRVulhthP/JpQkwTv4+cOBkYnXREqYRVnQX+mla8tnd7nSOwmyD7GIAVl3s8vIaiNy+NfWl7954BpHRclfvhsDWjWSphnkcj0FqxZdpZTnSV5pkdJCXMKvYZ8DTfXG+5sYQ3KgwLdW5DAoVxGimnh8jdmhxqC++pWavgT2s8NVudATDg48TVE1yrlP9Vsn05Sy2Y/B1KBqx9MxTroYLcY0fXAxj69OFhZFI+V12HDRBhv9uWOD7HDkOUTU= template: metadata: