fix(renovate): env var stuff

kube/clusters/biohazard/config/secrets.sops.env

@@ -55,7 +55,11 @@ SECRET_GRAFANA_OIDC_SECRET=ENC[AES256_GCM,data:g1slCCYzItuKAarADs7FqoyvbjCm89Ms/
 SECRET_GRAFANA_OIDC_URL_SIGNOUT=ENC[AES256_GCM,data:srqHdaeL7hqtTI9sbwu8dIw1uLG5CEJ69DhwmvG7jjnBwfwaZ32jWl36EDRXkyy/GImuP9zV0IFx2KW74JM=,iv:2VxPgqjtaKtdGEVZLLX1bl/SwSENF+bb+fwY65mwN/E=,tag:uJhcSuFKXTbuMdEh7ZiOZA==,type:str]
 SECRET_RENOVATE_TOKEN_GITHUB=ENC[AES256_GCM,data:0AYzHhYg7Mz1QjOXzTkFb0B6P2oh70vanF/8Dt+1KcrYdxJIbsgwrg==,iv:dvbQZurZ1z2y+X01DqkDwKrY/0LWETXt9toPVg4E0hE=,tag:c/+NJn8OfYv3NVeEQJB8aA==,type:str]
 SECRET_RENOVATE_GITHUB_COM_TOKEN=ENC[AES256_GCM,data:474bqFTdlVjUgs0cs8FJeF5dvgFsOMXFa7Uq2G7DEYiGGBcxpTdzhPYi7j92SEP4/1VII8hc7sws51PZ5mrosKuvmgCibysc5lOLzKhwc1H6XT5k8bP94KgT+K0I,iv:olq3UCZhSmfWTVqy/KUgERS4qTtbg2kQLOOWSi1yAqc=,tag:nO7VH08bL+NcRo8cez4cnA==,type:str]
+SECRET_RENOVATE_GITHUB_APP_API_ID=ENC[AES256_GCM,data:/Vw8sMsKhQw0,iv:Rwoc7+9x77UiKQ65/9Akvvub0LqYx0xzsskyCuugVrA=,tag:o5z7lZK/0qhyQIM2JUFZag==,type:str]
+SECRET_RENOVATE_GITHUB_APP_APP_ID=ENC[AES256_GCM,data:IdZq2jAe,iv:NEfhOsDltaPgrFRQIa3u46ej3Nn9utuE0dYHoF3z8d8=,tag:8eiM43IVWgTvqFDbIybFQQ==,type:str]
+SECRET_RENOVATE_GITHUB_APP_INSTALL_ID=ENC[AES256_GCM,data:Mt3LeacYg8Y=,iv:V5XC3pmJpispc4VY664dYSmc3t6E3FbtXgRCoPk5iWM=,tag:oNfpC2VK5silCbQ80StElg==,type:str]
 SECRET_RENOVATE_GITHUB_APP_PRIVKEY_BASE64=ENC[AES256_GCM,data:HxtpnaqZYUyHjTBRJCtTQ5cLPgnnH7VwqATSKtFkLMzoAVzdPRo3FC3DivJ6RY0YYofQoUf2w//xsldhddNDWJvTQ2Ss3cp2gmj+FPe+Fzy5wv5CWqojgAmVFXj25lUT90hAM/rjjQAC2jHc0sV9ZM7T3dBXZ7Kb0eBygVNq+QAeuAZM95mxibcMQCiXjvfXvE/dC11xoww/QZug+llxKoCeBz6PiKC5R5BCMhC4AxDlIFlMBoZ8ewsPuNtdN5y0bODVmwsQrJD39hAHZc4syzXFiwQ/bP1y2Bt7i+URK4aWy2jh9Zfn/cMb75LA+v7j6rfqOQvNf1yNgNoaoQhpUgz1iSPHFk3WAWwaiO4bZ2tFY1+rEFRiYMHI8+U9lOcrJP8iMbNwXtWuLa7ZuvzIdwjeubLXUmUh0FBsk0J9MVCFyrYl/ZuEtRSK36ekI8xJEZtAoFJ4hICJzjs1vxCriTzg3cGMLHtzeLw0aBCW+YoyKSHNtj8XTTDOt4bvbpewLgJ4PslQz6kiOSVEMcV43WtR1OzEg86UflYOA7sBfgIW1vZiXFjxVn5zp5T5keT0ekRqpSyGOr/L+sj4wXEWayeR2ykXBw8T+rkj4V+RrA3P11Id3u0DRN2w8GvVG0qBE5oin48P3gqn6bmtYAB+JHy/2tYrFzCXtrl9kEOf3XV3AwvEzzm9UnBMf2CmsNeiw8k3pSAJPKc7TLekCSrNk3vNyYdi+Pf+e6zCxw3igLP7aO9kiwFMjyySMPWz8TZ5q2k2NE3uE/ULZvLMd3KFW25auVuqwPZO4pDIJk92cKiEd2mVTkm2GJP3Tqih0XbPQV6AspBg0s7aQTFgvsDHhJKw6/JJVQ7QeD5YKzzM4ETbVinLaNix9oFpmbl7TXT7xkASuSQ0a5kYA9efvSU0Psw/k/Wmt4HfJWrxJ+/8tBAcVBU92HBokfAYQEKWUH4cP1MOP+FEtldiZ0OKTOzbzeLkUny86mvLVDQjEvE0Xaj4g8FcLRqZHs2wRrZDAAS1x46h5z15wiD+LoJvX7PgkPhpGjLPVYdM32VGq/tIhGcU/oFu5s9A1QKkJ74Xe2sNOUem5G7cjTNwGnxbWIzDH6dTk2Tia0xyiH0lMDYSkgRHPQLiRi8uybWmzr9A+CtrrRWzksepryj4/M1GMINTcoWGLEoGZ6w81S9d0R4lrB3qxVZNC9Igjzvc9Chpn1PRnoOu4lSAWiyfgimqB+N3svUi2UoWPLWS8uWqQ4qM/CMPuF9QsSUC+9dIbAGwgMsaHLg35F9RPxQLBDjskcQvjPu/Nv39y73skurAIwsaU2j2JjhdpK/kjBdJeQSamxeKbWN8SCz5Edc5Eqv2LEX1UeTJvrey3jqU/FMyed79Jt+jjAkZQLQVGGsYnpQMLfEzKxGNxswjQNy/GJS/3C6wxMPQHh3oH6UqyoE9CBsY/IINRo8xTRq/YoD3ec4gvFQdXQs+k8CzDMw6Sc5vcM7CgOiAHh8G+gzNjwsR6l8OdqLplhEwMLbKXfLV4vGMrdQNUSp33XeVjUTBDU/29yWkv/PrMK+covKpqAFt7XeTCFmNwhlz7ybdItG8HseeYRAnpay659VhCojAUNT+l+iyGfkboIu0Ctd6pJlkH2VPGglm/Axl6Z4ZrvWrkzeJs2UP/iQIIOz1RAUq5L0kDbrTI5V5jV39eQM+A1rj47Pquk5SvZu9o8tQo9UA0PJ7wvh1nH5OqRGjWGdnaJ2sbbyG4FhmP1fsMkPTHKMUBB23iU6itH+HKvsdiLMCPYNypBAjNVldvvbKXraPuqf+E/0JWXeNre9MLIbmWaVq42dom2ITSg+LEqdXVhtpk+YfQ/sYCaU00wgfQ7leyvVabxj8OM5qvzi46WafF3MNFDP9sTgC4qp5HYWj0Y0IyTlR4pZ3Mi6FJYTTiA/2BHde2/Qw4ZTK6G1ppybP0/RAyhPsfhwR/tNxG36zLcfbMXw5TSn1wMrRBDY+KMSOU4wSSlofxHOpw2izulXWVwKEQGLCcHjplc3TgRmihRNk0s+UysgXimEUP1ca7WeeMqNT7HozpEoYlDvKqB8gND5p2V5LkevRBGW/oQJJTTyLMhXtS1+idI49inG72M/jXpG1HePGWwtEm+5BT91VnB7/0cEb3Oc5uGrQwI+d3/tlxXk89B6qcy88biPDD9eknotW9FKSsL/8FfaD+RJMpc0cnCHtI79FYK6JhNODiHfABQn6cjbAU8+AKIwrJFmoAHleGF8Xa9Op4AFCUZuepAmHIhu/EtmZKOedwk+3E97cS4dcio20XSSScj6z8ZPwT3rPmoler71D9sSERExj2VcS+YbhulLTIMhc4MgAguqmvqANaI2EqQdj1UMroznhXRFpSbSNgaB2OEf5kQvYbaO9XWgzYVaHsFHL9xNBq+be8jGnQ6FM32ICqLv1rzSBqBpUMUElxep2v2Y5yGzEPGSHlBZkyTfzlcIb12figy/NRDr7lJujZuG/8exsHJTDinqSfufLokq9eayFE0oNJRC+89xobTjETh0Y3DNliuauWVqfovMENknBDqpss/vLr54SAKsTpUrSlwtUNLh5BQdnwfsfk4B/ZywbUcaTlhEZp8jVTdrPA56Ta6w/uVIrTnBwJacZR708wpJK4ToqJCzVRgvr4RNxl/ggETa6Z3u8OeRTgaj2oNKBCTvxGfKy9R8p6RqS4bq2Vkliurhlf/mN3VGFAbzIgjTchLWjU0YzLdXYtIXLL7dnf9ftDhN6YOaNdstXdLJTy/bLa7rnG10Hg8Ee1qph1toTDGvjq/87vbCj59XC/TqlBBJZ2Ol1NEl0ViBz9q1rN9pvrITE1ZaudA0WAUG80RJjFZ0PGZ5Y7ZOiQgXLBP6EGSA6O5iAaIAD8uGhUeo/hGl60QNKvX7IyTsW8qsRLByNnIBlhaSSTe/qCQmF8YMmxvpqVBIDzm1xNckGtHhY8sEsGaLhxifZSA==,iv:aRpi3DDoyGna9mgE4s0FZVfQVEl5Dn3CfH4MeKKIk1k=,tag:OpcrSFLLOKAIYEuK8qGDaA==,type:str]
+SECRET_RENOVATE_GIT_PRIVATE_KEY=ENC[AES256_GCM,data:NYnXl6/S/H0BdGBfe8zD6xm7QuSEJ3DjYtj+TWML/sfy6s033aKFLhEOMpelh1mux/312CojLjnPdHe1S4+VadheMzBSr1Wm67wg46RjKg7ulC0pYlCEMX9oNs2UMlaEVcXwJk+F6DW3hooXMGnsq/tUf3+V3uIOXVh/LGieCgCLHf87TzgNOIG/h1sqLSJjh4r+5ab0E6qtKBlTKHoQG+s1cBire9gZc85eVyVe4d7gSxHGHujljyeC6R82xHV+cOx+sES9HnDloIovukCG+TrSTIGzKInVHdBCDrxpljH+h3ggHizsiBOMj7v0+NeoVDrHlksc1OH9U0RWE1pbos5SPx7QetN6eC8h7+m4oceTrKPNiYakRS1ftZpZD7R8w7X22BgHCuT+DxHLB/pTDsP+K4zoJLnmWUSan2wSJ1CjyOZ5y5mokTRxjaovyLlCCHTUF9rxseniQWDlilW/p2KlYsPqfvMhr/7igC5WX4saIQSDdt4pgyRhmk5xkAz4RlaetmF+k9bXqWnIGejRHgcIBOEQe8a6tdF/8Rr04z1m9YGWa3WsFbNWiG7B2kyWmtwbQ/ONWkHlzyLXrgvQJZc6pHlt9Ev4P2QpRM64yi4+b+qnR/mwce/aDPJp0Bmm/CyEuRXvraT+3u1mErxN7neB+NsLOpRqmdoMqHjJxRDcjUa52s+X4s55YuKeOxNxQbQUUwhA/NbDM9tnFg82biWE6uSuZwsIPFMyo60bFsm65noxwlFaOebslgsa5lPsbaQwA9nB8rFulE4BJZWT1SGPP8ra8D0/+MeuqOZtjnTYiVy6xCnaZETwvK9zfwYYgkYba768b7Nd/72saX/mPP7n9Xgkv25AifONa9xPF+CBIrtm/BsRTEOZbmk5zTNS0mjzCxN6WfNEBP2kZmLkdAghgyQfJBsNLEqzpPQOMDmt7otYACqpy394ZZLrLZZ4JViN7yVFBG+Ux2wLezIcM0xgMhDRFu9zcFZuEIisqCMiwKbz5jUFWPCHj4FqiZR8KopIZ0U8jZRZ17V1tEPwfeGoQ+xJg8R7UOZ7izlsfFz+HJeyi3t95xGUiE8Ju20SNICjRSpuPOGzPHcUx96U160o6pj5fJIbCcJau9w2GjNTA4ZLN48pV8WliLyUQVNyx/cOGRgyeLHEVFLpI0SouNLa8ZjKF2LrnCehCguhEAi2QEjQS13FOdGVv0KP8n+pkW8QTD7WMWvqvCmF4nRGrbpV9nSJ6ecLkzC+45h4Rqq/ynpf3mWAv6Lu+PfC0PMWhkwu+UA8Yw==,iv:H6psoQ9dsk7NjTMJ8ECR+iV6a8LDAIu9IFY6cGiLOIE=,tag:dffUMreblFQpOcn7fRzuoA==,type:str]
 SECRET_GTS_OIDC_ISSUER=ENC[AES256_GCM,data:gxmtaBfHW0zVy1NhhFiotX28ubZ4yPm4sDHd7saFDoKvk89yiG7Jggr3ZnUk382BuL0+ABQh,iv:DXj+asZEemXXT2XrGZ5bFu8CAFNli8IIt5q7xC6YiaA=,tag:FXWUO3AmUZ4IYaiyD5sZZQ==,type:str]
 SECRET_GTS_OIDC_CLIENT_ID=ENC[AES256_GCM,data:4z9tVTkc2OXIq/lDEXmHJZnN1SiMAl7NfOLJq9wLpdrwPSdbx61QxA==,iv:wyutHo0Gw/jL93kf4xyy/JNn+tyTuicWBLAIyz6+J8I=,tag:e4gfFhY66NVr/kjOolg5Dw==,type:str]
 SECRET_GTS_OIDC_CLIENT_SECRET=ENC[AES256_GCM,data:Zzak+jXxJvupbm3pO81+elm2EV6hdt7o2T1lneN0+dIZqjchFF8ljPAtY28J7aLgCFUS1KclputyzMqA5f2gCxBleH2TfEFtRkrCI9fBjGkWGC2o9RsJ9mTJwrxu9kdezQJtBYC3sP1SlrThjKPZVC+TOV076J7rIn7qvQYE+5g=,iv:IiQA0Vt1xmQFoVlealmgizGXbB74xJCnkIoc1EwPHoI=,tag:XcXE69tVkCNQcM+m/Pr78Q==,type:str]
@@ -158,12 +162,12 @@ SECRET_NEXTCLOUD_PASSWORDSALT=ENC[AES256_GCM,data:/JNV+qe9uIbWd7sr6RN4J8Yx2Q/ta4
 SECRET_NEXTCLOUD_SECRET=ENC[AES256_GCM,data:EUYQDlwFh5I4NYkjxAVKETXYcOnFTv0JkHaMFxnWMBvDsKg9KFwU9ngyoKXORBML,iv:cNEjj5jH44wBJ6Ot1HVWNYeNcbZGSZOxS5uFrNF/jOU=,tag:A9NnS2a5lFu6XxBN3eTZLw==,type:str]
 SECRET_NEXTCLOUD_ADMIN_USER=ENC[AES256_GCM,data:DPuZCJk8zKjZW+IM7ujaLg==,iv:aNM9RWMpuy3LSriNnojABFIcxCgl3H0Zk/Sm67ZWBOs=,tag:mcQEwj49Di4R+Wm/tnJqLw==,type:str]
 SECRET_NEXTCLOUD_ADMIN_PASSWORD=ENC[AES256_GCM,data:PsdeZgQ5hlCMcx5OFxbXyL4N8wlHFGwPE09LrVCSSgqbXrpTDAAkyFE7TAxuyLn8jvwhZtQOP+GpIpCpBjxmHmGHRlncNdRJXcWuMgQoby+BmemMhxgDbmKbZbU9hB8blf89XpRqhmvfY4N6xp9Oaj88z4epRy2lH/DRDk8GXRncZxqwNNcu1BzI25Wzhou9gMtpxq62tSalJ3PdmnQALPCxaVXVhEwrwdIoOzVXto+kXSzeRY/RAVq/JTq/aUAeS7quTHMc7k70CHZMyRfXIC/CQXt9ZD6ToDQMrw==,iv:aHyVv2oAAWt3Ti4+9pgGy7mCL63gBl0G7gmv4trYOHM=,tag:w32Jy68K/v4hKqdql5ZAAg==,type:str]
-sops_age__list_0__map_recipient=age1u57l4s400gqstc0p485j4646cemntufr0pcyp32yudklsp90xpmszxvnkj
-sops_unencrypted_suffix=_unencrypted
-sops_pgp__list_0__map_created_at=2023-06-01T18:01:07Z
-sops_lastmodified=2023-11-24T02:14:38Z
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxalh5ckhGWGxFTmFqSDQv\ndXlPOUlyYVNkWHA5VGN2TERvaWtWMHlJdFRNCnQ1NlJldEgxb2E0VEdVSDVpbHp5\nZEpTMEQ5dWU0Q2ZWTFBOZFp5Ti95ejQKLS0tIDF0c3VlazRzVWtVQ1JXT3hyTWNN\nWXpUSUNydGY4V04xZ2dTSzlvWmNOTGsKQ3rimeB7zqB4dYMp1pR1AOltXk+GhGsb\ns0jDxr/SiPUaiYoVCY4fqu9geXNRDGlPh3T2Lhs9Siif4Vnc8qTQBw==\n-----END AGE ENCRYPTED FILE-----\n
-sops_mac=ENC[AES256_GCM,data:Mn02RzgCEzwDxkRjFMwiUb02l39CTewWKa33C7n/6qyAvEe+S4g/Z3OKzWquNCtERHvt7kDjxxnWElCiZ92E4xjhBHt0nov7vsl+PaJkNVo4B5fN2NJK++eZxIxqQVrGQYWooxTjse8tjWMXK8LZnQ8LV+uWXD6IK/TCov6hGPg=,iv:VYOMzUTYU/oUwBE789gAj9EdQS2mJAbTfH96S0OAAfI=,tag:A5Y8yPzYqMDQb9y8Nqy0ig==,type:str]
-sops_pgp__list_0__map_fp=31E70E5BC80C58AFF5DD649921AC5A1AC6E5B7F2
-sops_version=3.7.3
 sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhF4DAAAAAAAAAAASAQdANDTQwVjZ/Ad3iqBe0LL2sGCrEvrl6W6VaMjFgJCUkzYw\nwASmi9Y/OqREXtEItA1rKZDTM38LuMfcU4vAeEV0SNWlW5CQquN8UpLwMATrBdXr\n0lwBcvIZFLbbnfqFAdJ1EzbRWvHuh+yn5DBMH+odm3ZLaJqiiV9EaWhfl2rdIOr4\nPJQf6Ev1hueWmc9H45a8nvwH8sOl9MH9hl3TW7o9JOOhGmZ4BBVaSJW6f0UiZw==\n=iSQg\n-----END PGP MESSAGE-----\n
+sops_unencrypted_suffix=_unencrypted
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxalh5ckhGWGxFTmFqSDQv\ndXlPOUlyYVNkWHA5VGN2TERvaWtWMHlJdFRNCnQ1NlJldEgxb2E0VEdVSDVpbHp5\nZEpTMEQ5dWU0Q2ZWTFBOZFp5Ti95ejQKLS0tIDF0c3VlazRzVWtVQ1JXT3hyTWNN\nWXpUSUNydGY4V04xZ2dTSzlvWmNOTGsKQ3rimeB7zqB4dYMp1pR1AOltXk+GhGsb\ns0jDxr/SiPUaiYoVCY4fqu9geXNRDGlPh3T2Lhs9Siif4Vnc8qTQBw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_mac=ENC[AES256_GCM,data:Rxc857mgs/LJdm8cS63IpzlLqXB9pQfdxSzUtHchyLp7GGZZAwn56weU6Pd49xcux+w1P0r8uIapeLN9lKpOXRLcSgFqOF+Yx1mPOlffSPZXb9Po/JLwbe1cByp4eT3eKMlaVMcmXK2fRjLZQKenzu/UMJrg86dl2pZuNgnY68c=,iv:QitV1ffM78IFP4Wz8mVvlPpfIbk4lwDvD1OmYneUtpc=,tag:+9DbeKtCLN1+ptjcx1+rkA==,type:str]
+sops_pgp__list_0__map_created_at=2023-06-01T18:01:07Z
+sops_age__list_0__map_recipient=age1u57l4s400gqstc0p485j4646cemntufr0pcyp32yudklsp90xpmszxvnkj
+sops_version=3.7.3
+sops_lastmodified=2023-11-25T01:15:45Z
+sops_pgp__list_0__map_fp=31E70E5BC80C58AFF5DD649921AC5A1AC6E5B7F2

kube/deploy/apps/renovate/app/hr.yaml

@@ -38,7 +38,7 @@ spec:
               RENOVATE_AUTODISCOVER_FILTER: "JJGadgets/Biohazard"
               # RENOVATE_REPOSITORIES: "JJGadgets/Biohazard"
               RENOVATE_USERNAME: "tinfoild[bot]"
-              RENOVATE_GIT_AUTHOR: "tinfoild <367320+tinfoild[bot]@users.noreply.github.com>"
+              RENOVATE_GIT_AUTHOR: "tinfoild <${SECRET_RENOVATE_GITHUB_APP_API_ID}+tinfoild[bot]@users.noreply.github.com>"
               RENOVATE_CONFIG_FILE: "/config/config.json"
             envFrom:
               - secretRef:
@@ -61,7 +61,7 @@ spec:
             image:
               repository: "ghcr.io/mshekow/github-app-installation-token"
               tag: "2023.11.16"
-            command: ["/bin/sh", "-c", "node index.js 367320 44352851 /privkey | tee /config/RENOVATE_TOKEN"]
+            command: ["/bin/sh", "-c", "node index.js ${SECRET_RENOVATE_GITHUB_APP_APP_ID} ${SECRET_RENOVATE_GITHUB_APP_INSTALL_ID} /privkey | tee /config/RENOVATE_TOKEN"]
             securityContext: *sc
           02-config:
             imagePullPolicy: "IfNotPresent"
@@ -74,6 +74,7 @@ spec:
       main:
         enabled: false
     persistence:
+      # TODO: add either Redis or PVC to cache e.g. index.docker.io to alleviate rate limits
       tmp:
         enabled: true
         type: emptyDir

kube/deploy/apps/renovate/ks.yaml

@@ -4,6 +4,9 @@ kind: Kustomization
 metadata:
   name: renovate-app
   namespace: flux-system
+  labels:
+    prune.flux.home.arpa/disabled: "false"
 spec:
   path: ./kube/deploy/apps/renovate/app
-  dependsOn: []
+  dependsOn: []
+  prune: true