From 9e2067eb1b13ba9f955f20a95fa4ce37e2657749 Mon Sep 17 00:00:00 2001
From: phg <mail@philip-henning.com>
Date: Wed, 2 Sep 2026 12:55:00 +0200
Subject: [PATCH] feat: update environment configuration and secrets management

---
 .age-docker.toml                       |  2 +-
 env/common.env => .env                 |  0
 .gitignore                             |  4 +--
 komodo.toml                            |  6 ++--
 prod.template.env                      | 46 --------------------------
 secrets/prod.env.age => secret.env.age |  0
 6 files changed, 6 insertions(+), 52 deletions(-)
 rename env/common.env => .env (100%)
 delete mode 100644 prod.template.env
 rename secrets/prod.env.age => secret.env.age (100%)

diff --git a/.age-docker.toml b/.age-docker.toml
index a583111..340ca84 100644
--- a/.age-docker.toml
+++ b/.age-docker.toml
@@ -9,4 +9,4 @@ users = ["phg"]
 production = ["sbx0docker01"]
 
 [secrets]
-"secrets/prod.env.age" = ["users", "production"]
+"secret.env.age" = ["users", "production"]
diff --git a/env/common.env b/.env
similarity index 100%
rename from env/common.env
rename to .env
diff --git a/.gitignore b/.gitignore
index 17f08d1..a038329 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,5 @@
 # Project
-.env
 lego.env
-.komodo/
 data/*
 data/nginx/*
 !data
@@ -9,6 +7,8 @@ data/nginx/*
 !data/authentik/custom-templates
 !data/nginx
 !data/nginx/default.conf.template
+.komodo/
+.secrets/
 
 # VScode
 .vscode/*
diff --git a/komodo.toml b/komodo.toml
index d882323..c7d7c62 100644
--- a/komodo.toml
+++ b/komodo.toml
@@ -14,13 +14,13 @@ branch = "main"
 run_directory = ""
 file_paths = ["docker-compose.yml", "docker-compose.override.yml"]
 additional_env_files = [
-  { path = "env/common.env", track = true },
+  { path = ".env", track = true },
   { path = ".komodo/prod.env", track = false },
 ]
 config_files = [
-  { path = "secrets/prod.env.age", requires = "Redeploy" },
+  { path = "secret.env.age", requires = "Redeploy" },
 ]
-compose_cmd_wrapper = "with-age-env secrets/prod.env.age .komodo/prod.env -- [[COMPOSE_COMMAND]]"
+compose_cmd_wrapper = "with-age-env secret.env.age .komodo/prod.env -- [[COMPOSE_COMMAND]]"
 compose_cmd_wrapper_include = ["config", "pull", "up", "run"]
 webhook_enabled = false
 webhook_force_deploy = false
diff --git a/prod.template.env b/prod.template.env
deleted file mode 100644
index d18bb0d..0000000
--- a/prod.template.env
+++ /dev/null
@@ -1,46 +0,0 @@
-# SETTINGS from env.template
-# Misc configuration
-COMPOSE_PROJECT_NAME=sso-s1q-dev
-PUBLIC_DOMAIN=sso.s1q.dev
-TLS_DOMAIN=*.s1q.dev
-
-# Server Versions
-AUTHENTIK_TAG=2025.8.1
-POSTGRES_TAG=17.6-alpine
-REDIS_TAG=8.0-alpine
-
-# Error reporting & Logging
-AUTHENTIK_ERROR_REPORTING__ENABLED=true
-AUTHENTIK_LOG_LEVEL=warning
-
-# Email configuration
-# SMTP Host Emails are sent to
-AUTHENTIK_EMAIL__HOST=mail.s1q.dev
-AUTHENTIK_EMAIL__PORT=25
-AUTHENTIK_EMAIL__USERNAME=smtp@s1q.dev
-# Use StartTLS
-AUTHENTIK_EMAIL__USE_TLS=true
-# Use SSL
-AUTHENTIK_EMAIL__USE_SSL=false
-AUTHENTIK_EMAIL__TIMEOUT=10
-# Email address authentik will send from, should have a correct @domain
-AUTHENTIK_EMAIL__FROM=sso@s1q.dev
-
-# Exposed ports for Authentik -- Ports are note exposed due to traefik setup
-# COMPOSE_PORT_HTTP=80
-# COMPOSE_PORT_HTTPS=443
-
-
-# MaxMind GeoIP
-GEOIPUPDATE_ACCOUNT_ID=765001
-
-
-# PostgreSQL configuration
-PG_USER=authentik
-PG_DB=authentik
-
-# Secrets -- uncomment and add secrets
-#PG_PASS=
-#AUTHENTIK_SECRET_KEY=
-#AUTHENTIK_EMAIL__PASSWORD=
-#GEOIPUPDATE_LICENSE_KEY=
diff --git a/secrets/prod.env.age b/secret.env.age
similarity index 100%
rename from secrets/prod.env.age
rename to secret.env.age