From 1817cba584778f9cd2d772d730e113d48117b6aa Mon Sep 17 00:00:00 2001
From: Bartek Kus <7887446+bartekus@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:01:18 -0600
Subject: [PATCH] fix(009): strip shell quotes from RAUTHY_API_KEY in the pod
 Secret
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SOPS value carried literal single quotes copied from a shell-style
env line, so the backend's rauthy admin calls (spec 011 §5.1 identity
resolution) sent an unknown key name and got 404 no-rows-returned.
Verified the unquoted value authenticates (200) against live rauthy
before re-encrypting. Value-only change inside the encrypted blob.
---
 .../statecraft-hetzner/secrets/statecraft-secrets.sops.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/infra/gitops/clusters/statecraft-hetzner/secrets/statecraft-secrets.sops.yaml b/infra/gitops/clusters/statecraft-hetzner/secrets/statecraft-secrets.sops.yaml
index 8fc5d4f..a0ef7d0 100644
--- a/infra/gitops/clusters/statecraft-hetzner/secrets/statecraft-secrets.sops.yaml
+++ b/infra/gitops/clusters/statecraft-hetzner/secrets/statecraft-secrets.sops.yaml
@@ -16,7 +16,7 @@ stringData:
     SMTP_PASSWORD: ENC[AES256_GCM,data:nkuf1qpfdBHHfo+DjwsYzg==,iv:paPC0nVYubsnXnKPpky7wRt43Ek49Uc1w4PHIaG/E+Q=,tag:hQH63PVDOYON0Jo+t8USJA==,type:str]
     RAUTHY_S3_ACCESS_KEY_ID: ENC[AES256_GCM,data:AD8eBXvbfUddcNgiOB25F4mT2mk=,iv:kA6pA4q0ZTYI8ZKeESPcKwmgk4n01Qd4kD4Ii9um6+0=,tag:IU5BKyl+OudmNxni/5gpsQ==,type:str]
     RAUTHY_S3_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:f8uVCupsinQGj/NjZzLf791P9hvlJdBK+Zp4HT4bFqz5lXAw4J4Aqg==,iv:l/cRTa+ksG1hLHibM/vq7NXSlt5/buRBjjWazLxdSgM=,tag:9z0ZeO5cV7pg1ZTdXbUVtw==,type:str]
-    RAUTHY_API_KEY: ENC[AES256_GCM,data:WqyZSw4AEG1kUzeGmgNY0iICLM8o8oDiHGDmcXdR69v+G6UanifFgYOIHFIVU9I1J++wYSmdbiIyq0NBzgn/nlb2hTbbNygyA/zpm+gJEh5y,iv:ELfk91kDwHCAhdggzJJ8cAy6lkUVgj+NfxS5nM0SvEA=,tag:fTJYpqlt1lRs7S+CwJ3/Gg==,type:str]
+    RAUTHY_API_KEY: ENC[AES256_GCM,data:0t5p9qO/ucRnywBQyn0Qtpz2MEojjYfYJVXWvkAu1PgWflFAapFG1dkM+d3NhzvMWF/NseRGHkvFDORT54baWDMvZOvHS5s8pwPFum54hA==,iv:w1AyG7zBtnErteZ8ovFSk5DgAveyGi8sLZUY3F3PoW0=,tag:gmTYdFjmPY5Cof10NPaNxA==,type:str]
 sops:
     age:
         - enc: |
@@ -29,6 +29,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1pvcta0tp0sneq522ktpht0l6ukmhy2avh4p5kf290teadx5afs3q5uumur
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-22T21:22:46Z"
-    mac: ENC[AES256_GCM,data:blp24/Oe22ID3/YmA9OrTrU7HDi3FrBN4oJOMPdYkGvMNlLrhE9Ivh/QACrKkaD2b+eR2nGkc9OjzeV4BxHtFcwmxzHUIwo+B6i5CCqSNf1u5iN8nRaGInrEsumf5dG2cc+aogCv1J5TuVU+4NooiSyyMKh0YsiQUlNJDKU7dYc=,iv:Z10/HNJNKgJCpTXzCvRlwVCckvkJ2yvE0ww4OlAhI8E=,tag:Z7hKCP7yuYCfqGkHkNad5Q==,type:str]
+    lastmodified: "2026-07-22T22:00:56Z"
+    mac: ENC[AES256_GCM,data:5oDk2UVh4FPBti8fwUwVmo6BhybIPPM708BKjP+Cyruvv3LLWgX3Zc0qdVE6W4o7meqxkoyv2gSE4cXmsATQodBDj3AkMRVcHbtrIgCZiVjFjBQxp5mEaTYUtKiDHur0y4/ll/7IK9S7hAn1S1uBdy9umvPZsal19glE5m1PNRc=,iv:YWcV08iu4RFgmhsiiWT7vShOynnWVUujOHzcv5MQAjA=,tag:kHgPL9UtN2Mlrhdo3pygmQ==,type:str]
     version: 3.13.1