feat(k8s/gitea): enable Actions and split packages/actions into extra PVC

kubernetes/app/gitea/TODO.md

@@ -0,0 +1,122 @@
+# Gitea setup checklist
+
+## Secrets (must be done before committing)
+
+- [+] Generate OIDC client secret:
+  ```bash
+  docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 \
+    --variant sha512 --iterations 310000 --random --random.length 72
+  ```
+  - Plaintext → `secret.sops.yaml` (`gitea-oauth-authelia.secret`)
+  - Hash → Authelia configmap (`sops -d -i kubernetes/infrastructure/controllers/authelia/configmap.sops.yaml`, replace `CHANGE_ME_pbkdf2_hash`, `sops -e -i`)
+
+- [+] Fill in `secret.sops.yaml` (`gitea-credentials`, `gitea-admin` passwords and email) then encrypt:
+  ```bash
+  cd kubernetes && sops -e -i app/gitea/secret.sops.yaml
+  ```
+
+- [+] Fill in `secret-backup.sops.yaml` (both `CHANGE_ME` in repo URLs, restic passwords, B2 creds) then encrypt:
+  ```bash
+  cd kubernetes && sops -e -i app/gitea/secret-backup.sops.yaml
+  ```
+
+## Synology / Backups
+
+- [+] Add htpasswd user `gitea` on rest-server:
+  ```bash
+  docker run --rm httpd:2-alpine htpasswd -nbB gitea 'YOUR_PW'
+  # append output to /volume1/docker/rest-server/config/htpasswd on Synology
+  ```
+
+- [+] Init restic repos:
+  ```bash
+  restic -r "rest:http://gitea:OQXxm5MHxXNCQuXrzXSUjj8zHO6KKtRYtrWLINFVsmhJq2QuA6CclpA12lAZ4Zwj@synology.mgmt.lviv:8888/gitea-db/" init
+  restic -r "rest:http://gitea:OQXxm5MHxXNCQuXrzXSUjj8zHO6KKtRYtrWLINFVsmhJq2QuA6CclpA12lAZ4Zwj@synology.mgmt.lviv:8888/gitea-data/" init
+  B2_ACCOUNT_ID=003c68ad65aa815000000000f B2_ACCOUNT_KEY='K003NHIj6SX+UO04MhycojpI/NTgIiM' restic -r "b2:berezovskyi-backup-homelab-gitea:/db/"   init
+  B2_ACCOUNT_ID=003c68ad65aa815000000000f B2_ACCOUNT_KEY='K003NHIj6SX+UO04MhycojpI/NTgIiM' restic -r "b2:berezovskyi-backup-homelab-gitea:/data/" init
+  ```
+
+- [+] Create B2 bucket `berezovskyi-backup-homelab-gitea` (if it doesn't exist yet)
+
+## Network / DNS
+
+- [+] Router: forward `WAN:22/tcp` → `<node-ip>:32022/tcp`
+- [+] Ensure node firewall allows `32022/tcp` from router
+- [+] DNS: point `gitea.berezovskyi.dev` → cluster external IP (same as other `*.berezovskyi.dev` services)
+
+## Deploy & verify
+
+- [+] Commit and push; wait for Flux to reconcile (~1 min):
+  ```bash
+  flux get hr -n flux-system gitea
+  kubectl get pods -n gitea
+  ```
+
+- [+] Functional checks:
+  - `https://gitea.berezovskyi.dev` loads, only "Sign in with authelia" button visible (no local login form)
+  - Click SSO → Authelia 2FA → back to Gitea, logged in
+  - `ssh -T -p 32022 git@<node-ip>` → `Hi <user>! You've successfully authenticated...`
+  - Test backup: `kubectl create job --from=cronjob/gitea-db-backup gitea-db-backup-test -n gitea`
+  - Verify snapshot: `restic -r "rest:http://gitea:<pw>@synology.storage.lviv:8888/gitea-db/" snapshots`
+
+## Actions + Container Registry (Phase 1 + Phase 2)
+
+### Phase 1 — Gitea config, extra PVC, backup (single commit)
+
+- [+] Init restic repo for `gitea-extra`:
+  ```bash
+  restic -r "rest:http://gitea:OQXxm5MHxXNCQuXrzXSUjj8zHO6KKtRYtrWLINFVsmhJq2QuA6CclpA12lAZ4Zwj@synology.storage.lviv:8888/gitea-extra/" init
+  B2_ACCOUNT_ID=003c68ad65aa815000000000f B2_ACCOUNT_KEY='K003NHIj6SX+UO04MhycojpI/NTgIiM' \
+    restic -r "b2:berezovskyi-backup-homelab-gitea:/extra/" init
+  ```
+
+- [ ] Commit Phase 1 files (`release.yaml`, `pvc-extra.yaml`, `cronjob-backup.yaml`, `secret-backup.sops.yaml`, `networkpolicy.yaml`) → wait for Flux:
+  ```bash
+  flux reconcile hr -n flux-system gitea
+  kubectl get pvc -n gitea gitea-extra
+  kubectl exec -n gitea gitea-0 -- ls -la /data/extra
+  ```
+
+- [ ] Test backup:
+  ```bash
+  kubectl create job --from=cronjob/gitea-extra-backup gitea-extra-backup-test -n gitea
+  ```
+
+### Phase 2 — act_runner (separate commit, after token is generated)
+
+- [ ] Generate runner registration token:
+  ```bash
+  kubectl exec -n gitea gitea-0 -- gitea --config /data/gitea/conf/app.ini actions generate-runner-token
+  ```
+
+- [ ] Replace `REPLACE_ME_WITH_RUNNER_TOKEN` in `secret-runner.sops.yaml` with the value above, then encrypt:
+  ```bash
+  cd kubernetes && sops -e -i app/gitea/secret-runner.sops.yaml
+  ```
+
+- [ ] Commit Phase 2 files (`secret-runner.sops.yaml`, `release-actions.yaml`).
+
+- [ ] Verify runner:
+  ```bash
+  kubectl get hr -n flux-system gitea-actions
+  kubectl logs -n gitea statefulset/gitea-actions-act-runner -c act-runner | tail -20
+  ```
+  In UI: `https://gitea.berezovskyi.dev/-/admin/actions/runners` → runner with status `Idle`.
+
+- [ ] Smoke-test workflow (in any repo, `.gitea/workflows/test.yaml`):
+  ```yaml
+  on: push
+  jobs:
+    test:
+      runs-on: ubuntu-latest
+      steps:
+        - uses: actions/checkout@v4
+        - run: echo "ok"
+  ```
+
+- [ ] Smoke-test container registry:
+  ```bash
+  echo "$GITEA_TOKEN" | docker login gitea.berezovskyi.dev -u <user> --password-stdin
+  docker tag alpine:3 gitea.berezovskyi.dev/<user>/test:latest
+  docker push gitea.berezovskyi.dev/<user>/test:latest
+  ```

kubernetes/app/gitea/cronjob-backup.yaml

@@ -148,3 +148,65 @@ spec:
             - name: data
               persistentVolumeClaim:
                 claimName: gitea-data
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-extra-backup
+  namespace: gitea
+  labels:
+    app: gitea-backup
+spec:
+  schedule: "15 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: gitea-backup
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              imagePullPolicy: IfNotPresent
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n gitea-extra backup
+                  resticprofile -c /secrets/profiles.yaml -n gitea-extra copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_KEY
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  memory: 1Gi
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: extra
+                  mountPath: /data-extra
+                  readOnly: true
+          volumes:
+            - name: secrets
+              secret:
+                secretName: gitea-backup-config
+            - name: extra
+              persistentVolumeClaim:
+                claimName: gitea-extra

kubernetes/app/gitea/networkpolicy.yaml

@@ -79,6 +79,26 @@ spec:
       ports:
         - port: 5432
 ---
+# Allow act_runner pods to reach gitea-http (HelmRelease for Actions registers and polls jobs via cluster-internal Service)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-runner-to-gitea
+  namespace: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: actions-act-runner
+      ports:
+        - port: 3000
+---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:

kubernetes/app/gitea/pvc-extra.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-extra
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-synology-ssd
+  resources:
+    requests:
+      storage: 30Gi

kubernetes/app/gitea/release.yaml

@@ -51,6 +51,14 @@ spec:
       accessModes:
         - ReadWriteOnce
 
+    extraVolumes:
+      - name: gitea-extra
+        persistentVolumeClaim:
+          claimName: gitea-extra
+    extraContainerVolumeMounts:
+      - name: gitea-extra
+        mountPath: /data/extra
+
     resources:
       requests:
         cpu: 100m
@@ -125,6 +133,21 @@ spec:
           UPDATE_AVATAR: true
           REGISTER_EMAIL_CONFIRM: false
 
+        actions:
+          ENABLED: true
+          DEFAULT_ACTIONS_URL: github
+          LOG_RETENTION_DAYS: 7
+          ARTIFACT_RETENTION_DAYS: 7
+          LOG_COMPRESSION: zstd
+
+        "storage.packages":
+          PATH: /data/extra/packages
+        "storage.actions_log":
+          PATH: /data/extra/actions_log
+        "storage.actions_artifacts":
+          STORAGE_TYPE: local
+          PATH: /data/extra/actions_artifacts
+
       additionalConfigFromEnvs:
         - name: GITEA__database__DB_TYPE
           value: postgres

kubernetes/app/gitea/secret-backup.sops.yaml

@@ -4,23 +4,23 @@ metadata:
     name: gitea-backup-config
     namespace: gitea
 stringData:
-    profiles.yaml: ENC[AES256_GCM,data:uHgGYQxpS3FZ46aVqp8Qu/N4hV6uLRefYRGx/zr0aPcfHGtzsl1Bibw08x3lw6zl5fjS6S8P4rqD/RutSzldQ81/YVXEMu7XIHpyeVwGyFWcYXm7MLkXrhTxuyHjeNAhNJRgrkka45tLxOzf2JSQ7csjLtQ1/fBZ7BbUyZst5WuyJ9cRAX8ljYEwE84EkoXwN3j76913iq/tU8qZG77jf3nfCZIMHcsfEQRtHTkLVwa3kRXkmdOuUhlUB70cN5B1jl0nYvhV6dfGm5jw3jOdxos14w91IVJR7kAmNCJh0HND13frOuNVZNjBQ6Jx5DlhjKQ83aDZS3IxBAzNafptTn0V529EuRYbVr9hKLNzu+MJ8T7ao17zNbUTcpd0wXxQwESyywxea6scXxu6KkAbPKVZJLGC4gyjJAJdnHBMQAbn/XvEUturdA/ExG+B6Nt05KT8sObePyY2k3NwlUjRJxk01Y+di+44E2msg/K6D4u/yZX1Eg4FikMJL5ldBpCmBaeiM2gwdZEnO4hufNr46cdGH4nZxe+HMgsD6NrCpJzeTKnwHxa6DZpBkNk/XOmCU+HLQoIspqHiKVDB6kUY8EaSb+i3Qvqq9IHi7DooiZmXNVTHjEj2RTzqd+/I8S2JmANTs7zvEdtfJJ2K+KhK4tfqjdxRAv3yc+MoCb3AQEf86ZtIEtrjOaVtrZLZEb4GVk43VAHo2t34EXo5/FDQWVRdtdIs7L5TajT9jDZgpvqZQAe9yFwP9thbo+wG3zQaWDcgSWRE16zm14DXLcB58kV08YTyUKKw4KDC8TnHU8SfDpwhgq62z72XIdAADxLHtcAYlQak/2bMAISciEtgoC6XhYHvV85L79DLp5GZTta6mYWo3LJwjxzUgSyXQv6yMfQXw9q/4sQCkz1z19Qi6yAaqtkc6aTv1cN2zCPdFjjsmPdxkPATLhUFfLgNfJspedHiRxM5NWLJPDtpk2hzzp2KPnchTVjSUX1M2MD+z3bowxFPm4NJoiyFgmJRMr+F7HJciZa3s9HUv+0mn9R7T6mABM6XugVpJne50KMylb8mCPz46gV10nUy2xfYT3OuFHVPyN/SWjUkhm7BXm16yXQwZG+O+TNBUA3uxZmXl91GQZGqf14OMeX+S2B++LIxbrVAN3QamaTTJX4O+gZIWAQLOCR4gQUmazQE2cqroqWM00nDG1ZTo9ZzLTPsl8Fo8pGgJfiP/tGc7hjSVsz6vfvRdQs=,iv:3t0Qate3LKwYCMoR4jdAzCtJfMCVW0k3T9EK22io8vU=,tag:AQrbWLhhoWxwOtdxrwvdbA==,type:str]
+    profiles.yaml: ENC[AES256_GCM,data:qtegwOuO6px5lTrzgy3XWky/HV77Z/e6Oqx7Jwdieg2y4KKN0zelC74SpACsOZTd4/irGmdHrtkP2PNVnNB8ylPLv1mKPNi5fvTl4JsHSOZlHfIxmTxgljtsXh4N8o02RIPi5pYKGj/UDIF2yin7HdgtAZfsEhDcXbxENc8iyM1DYMGLVaHo3Z2SoEtILjqz8+fOmm+Pj/snaMZ6qst+a8Fyr5/wdc4S2WjsLyeZ1UDbzy549nBCpszp5Ncy4mGqyFBvQzgCT75cmAxtwYjfEh+Abc65EjB6CNmf9ciIAjlMJ8olQe6k8xTpGhzcT0jaWZfHw3VV454fMhCF9f20PLoGg3UCPgSanSy9OCjLT310ezMaO9ukWJ4dNzJKD/x2xsOCkGRG4Zm2kmJFoDsFILpLToGyfNxHr38M/otZxS9UiuZ7aLSWJW0UubhsPJ1niLnZB/XSd2bTrIbzunm/pgDCOI2wusrT6Qo/iVzMxAt9CKgFzdmvfsThdFflSKb5pK1fA8SRit3B4YTuXX6NiSUUAiAy+PfPGUgixneRJ6DiYKzIAC6X4dZLf8yS04gVPPOL5BaGq7Vh+5RawqEogsnJuNFCpcbVtUmZd4BnydNptueqZKHoxdgNV8ZYlsbWdwF2yhnC99tdXsYp+5CDD4Zm9qBtOjIIW1e/yGQ6Tjsq9qk0yRTYkFjM9awETgKnE+/6mieg5yY3uSIwwP4ZegUW92KH+SrnOs3QrcrTTJY/wlRs4SWQWw7aEUS4yuPZXtPmhYjccl3dWNN3lT1LbOMVTqekoQlJptefbfKLiXy+A6iEYJuORxH1hcjfvqlpk722kJqwWpgqFDP6f0x/wPJxHm3XpzBVo+6qclJ0sFU+OgDReDrgh+qH1IBGuz5A39rvfx6MLuaLOVwWswqArACWe2p9lg0yPTc51nDhloeNwOVMVZ5+StYBMIydYU9wU3SDT1cox7Sd6ahz23XHzSDq30m0uIWpZZNJm5P6KQHk4XEVIk3g9K6GMf1NgafWAFePgTHBt3/A2yXAXwYVK3dyBN6Rwl3F4Neq2n0OJRN6es89rrrf0VhdJJTPW7WjIzmrMyKi8qX7KnN5oI8316N+899CahwL/e1NdD16V7DxWNMjeG74j3lxSmzXWnPn5k0y0POcIkegLdksTNEtqLQgmMzI4gn5Avn/G5CIiz7cexno+4cUeTMVRwx6YH0KxAmxHXJXp9yuqGNoo0pIACTmwpOqvMACrKEPRanxVWbCD/ZQLSiwFzfmUoexH8iUiqcFe01WQh09rXSf87Yhsf/QP/xHZS+a21f0pAtC1ZeNc0wwad5ycI5RgkcokQNcDzCEvPAKt8IKuGvk7Ti6GXXBPhMcIW0yJtuxTL1DAxfYBte/lqvGIGfl3/7b9E+FR/vgnZUl5ykQnwiHTAAmZ0ySEWyyVs93rFt5UecPEUZRyn6tNYrCjJ7hqL4NgwmGEmlLH0V/aBRSZgGNafRfXQi6w2m6Pbdo86Pn55H4fH2HCIXNPBWzFWhzohBFjLTSC4EqjYUvT72r4IimOCqOGUKYuF0giAHvkVWM0GF48x1fiUI11p+N+bDM3Coi0m4mLkof/d+yk1sOcvt1h5XOn5NbmLz/X6HhJrEo8APPhJvu4qzF4KTujafP7KF5dDWBjp5GlooyE74gRj4tLEN0vfcaezS0IwMefmkCPFrpTB/wnDavic1EJ9lYRREggdCVPJLlU9omLhvRTCBRDF62GbQVtgUqVAHqVM0EkdVzeCoSDo3TWUSFi6Dv/ivWuXGJKChM5n4cDVenatbzi4htAXR1bW3zIRXVmQy8HkgLrj42Kg==,iv:PGm23iUxhuDcnKqJeF8/kAwFJ1646ufstWCGSH+0yKA=,tag:2J/E98gHS9N0Agt+nfMTug==,type:str]
-    restic-password-nas: ENC[AES256_GCM,data:Hp6UPBipoot5NmFKf6jqYWfPUFFi0QNZAjBhuiGCj3h9t9nTxo8vHL9wlP1fY+vNmRTPcG0YFabgV5Q/4yQZTw==,iv:9gWAoQ2RxsnjJfWKbMw2CFoATb84pMdrTvXd+AsSrlk=,tag:12AxyQrODLvQ4TdZazt+3w==,type:str]
+    restic-password-nas: ENC[AES256_GCM,data:fMbuwG48Wc2YScNDYO+V2LjmOsjadatzHYSz0m8kvVfe7tw7lCChZanTSuldX9++E8NSxSGh6cvyRXFoX7ISCw==,iv:zSk8hk9+blNC7AZD2iEMly+t/anLzxjsJrqJzdLlqgE=,tag:C2aRaBHR8m6fRoBI/AMm6Q==,type:str]
-    restic-password-b2: ENC[AES256_GCM,data:QaTM08WEy2pQSs9s8VWQGi7HPu4cirbQhUixi49Ddjj5ffbqAuL+g7jhJNNCEZKI1Ljra51cv9lAFWTDUhbGwQ==,iv:oSbY9X1HPYG5Kgr8vW5tBN/kBu6APqbav+ONKisxRQI=,tag:Gzfz/O2uTkAtoRSfGxPj+g==,type:str]
+    restic-password-b2: ENC[AES256_GCM,data:7/Os6960fd0HF8FHgI/UIRS2XahEcu39VJne5usDznIqQgnp1338mZ3S/9Wf4ZBKgGe0bieE/OKOWddSn2UbZA==,iv:WrMvh6++E+ENqg1r8K/q8qgOEBYBziBhIW+3FqtUH8Q=,tag:or+eTDz9QLI//IQgulGJFg==,type:str]
-    B2_ACCOUNT_ID: ENC[AES256_GCM,data:9FSQY03LaT4Jm21+XQ5VVcfMQJ/QGEU2MA==,iv:OguTShXUeF5cm3Pfb9rC5aHS6LMQP5SlviV12KUi2mE=,tag:OyqEGluTuqYdeaA/g4BGWQ==,type:str]
+    B2_ACCOUNT_ID: ENC[AES256_GCM,data:WlKjo0lJlw+75hbtqx4c82ruHe8mritacA==,iv:Vf3nb2vPDINMZ984on9k+490aC78QgxsfzeB08HJuDU=,tag:dRuvQHGDUEerhYwMT5nVgg==,type:str]
-    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:d+qcw1eDNzcVrGoJy2+hy+xpptckxJYN7rSQ+Y/bug==,iv:I5IIcZ8MURrZqn8SncqNvsgaM3QgRMnpzfjwpat5pPw=,tag:CBiigK5dYpxwoVDYYeax2A==,type:str]
+    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:PG1b6qHjjHivuFtXDfXlARCETQwG7m/Z4jcN213ZCQ==,iv:lFpNYXAF9Lvl/5tMlrDK/ZyVSX5gWeuPXDy1onuUSw4=,tag:TPesJVqqs+7lb2YKNzUQEg==,type:str]
 sops:
     age:
-        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TmpUWGVWczArYllEc2x6
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RXRnQTIvc3pBZUYxUXZo
-            a3lxNnVmMDdLTTVENVhhQkhnNmFBcHpzdnlZCnRNTENWRUxKZ2VQazJxYmJOS0Ro
+            VElZVkdNcE95bEdKVGxUdTZuMThvRDdETkdnCmxucXJvYWxHVGZCM0xEMkFDK0I2
-            SjlKT1RXdDkyYXpqdlY5bEkvME1YYWMKLS0tIHErcUdRUDBEdTlzbUNZa0Vya2xn
+            WjJ2QnY1Y09tU3lyOVVXcWIweGt5R28KLS0tIGNvMS8ydDhaaXVrdEpWUnNySEtI
-            ckpUQUQ0cGlNVk9BaEZKUDVHQzRjQmMKcCznhR3n3tG96SdrGKarLNKAZoTi4Xj7
+            MTllRmtEZVdKcElMK3crOUlLQmJ4TEEKXzZkkRdGq/O+0jVB3930QD9ryczL3B7m
-            28m3avAtcOMryv0IrHvL4ogC3CdARRuJzh0UL1J+fOnvmwCZeiIjDg==
+            Mgw9+KXlp3jfOv7xEP2JFjGve4FOP/saJ0OXX8i2gIhNMFUZYoCBHQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-29T19:40:09Z"
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-    mac: ENC[AES256_GCM,data:vr6nY1wUMfB131ApoErgg7bIzGfBy9ZOebeTCsB/UI42Y4ZxHWQbP3IQz9RXwlqgSH1/oeslOrHVgQDSX429XgzKkz4GLA4ebybe/hMQQH3tNIYUEMFq4oQCjZ20sbhnQUV98+Bir6GQMjq+r7BueHFixwmOA4lTu/vM4r82Zvw=,iv:MNyWngFH4pPA3hZhDg1kqd5cBanmSBk03Q8pCyA7m+0=,tag:aNCPGwUGqb3hsoCCIiG40A==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    version: 3.12.2
+    lastmodified: "2026-05-11T17:54:38Z"
+    mac: ENC[AES256_GCM,data:i2cKO0rJB+BJi6JLH8ikz/yv+2xxtbJQZuMNIcXIAIAyqBVjiGhyj/yNmEAiFcT5DBQEQAIGduX7yvZtnM5PIjgRlJmKfnhsWCOvuzGTcpXdUlX6ckRcSoLIYmyVvOjcckY2XebokI3Pgn/RrOW5gHUIm8xU95E+Mc4Tkn4hSz4=,iv:9rUjRdmYQZ87uHaSFGmWWEpl0aB3olxbnAd1I/NYll4=,tag:OGXf3gVtTzTfxj8BSWugAA==,type:str]
+    version: 3.13.0