From a5f4041d47727d60a17445db43bfe4ac83481f05 Mon Sep 17 00:00:00 2001
From: ahmza <hamza@ahmza.com>
Date: Thu, 3 Sep 2026 04:07:53 +0000
Subject: [PATCH] Add encrypted Cloudflare API token for cert-manager

---
 .../templates/cloudflare-api-token.sops.yaml  | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 apps/cert-manager/templates/cloudflare-api-token.sops.yaml

diff --git a/apps/cert-manager/templates/cloudflare-api-token.sops.yaml b/apps/cert-manager/templates/cloudflare-api-token.sops.yaml
new file mode 100644
index 0000000..3c12b37
--- /dev/null
+++ b/apps/cert-manager/templates/cloudflare-api-token.sops.yaml
@@ -0,0 +1,25 @@
+apiVersion: isindir.github.com/v1alpha3
+kind: SopsSecret
+metadata:
+    name: cloudflare-api-token
+    namespace: cert-manager
+spec:
+    secretTemplates:
+        - name: cloudflare-api-token
+          stringData:
+            api-token: ENC[AES256_GCM,data:Oir/ezHzf81oeonzoIBX/qXG97sPA+BvLIzqlSlPuDFLmA6UtJtYiX/mNhUJ1k1EJeGXGMc=,iv:PtTi8l2wv/sWeVOa2XWSZjhmxw9R45LMSoUXvj5HBqw=,tag:uf00X4QFFYHc4wm8FfpRow==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvQXArR1k3N08xcTVFbDYy
+            cFlxZzZvbm5YQUNYZGp3amdqZ3RuY0llVXlNCmtxU1ZIVzc5dVVIZDRSQUt0V0dy
+            eHVObUxZemozWEtzSzY2TGZtWTlLOG8KLS0tIEcyTzF3VG00QzNwZ2lsNlpQVVZx
+            WGZqK2tESWlFaTZTNmVHZ0JJWWw4R0EKTQ3plnD2yDegvFxCi5M+EUlfbdGniDxE
+            2OX2fDeF6nO95IfIHWN9IHajaePQmzCUNFfcfbggQCI/t1V07nVVEA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-03T04:07:17Z"
+    mac: ENC[AES256_GCM,data:WjDOM+/1ff8feGYoYdJUqNMHDdjp9BVipD1c7DXyxi7Dn7svRFejDmc6/H55dT7KTpwPZXheuxKjiMc4piuRLM7/7OtgyqlRSD+xGbWSQBkIVz2/fVTU71WyC0vmSPi6slMqP2f5LJ2mrP5HIGe8DzwAF6+g7nofkrbcXAlpDQk=,iv:Z4LsynVoQ/F6G0JNn/i0oBrypQYVlaX1wIM6Rdqcgrk=,tag:aZbC5rNv6noxUZ5aIDiQKQ==,type:str]
+    version: 3.13.3