uralkal: restore cde-env (vault/apps/cde)

All 13 cde deployments read their whole environment from vault/apps/cde and
were stuck in Init since the entry was dropped in 1faf404. Same shape as vad,
with uralkal values: documentations_db on 10.133.0.249, MinIO root on
10.133.0.245:9000. PUBLIC_KEY is referenced from vault/common/rsa_keys because
the contour has its own generated key; AMQP_* stay referenced from
rabbitmq/apps/cde.

infrastructure-secrets.yaml

@@ -6064,6 +6064,54 @@ environments:
               depends_on:
                 kafka_ref: main
                 kafka_user: pm
+            - id: cde-env
+              schema: ""
+              namespace: cde
+              ownership: managed
+              targets:
+                - kind: vault
+                  path: vault/apps/cde
+              data:
+                AMQP_HOST: ENC[AES256_GCM,data:axZBwKCFj6mDT3tavQq87qNEEjC19VvTut7cbUNhLHsfO2tpic29oWzBiWAbTplm,iv:FOTWySfpq6ZP8uIKe3NRiqG9XaWLRveOr7FrDClst9Q=,tag:bfb1yVv6PWqqSJ3HSjPM0g==,type:str]
+                AMQP_PORT: ENC[AES256_GCM,data:ty/llVVlQSU=,iv:yRbmmFq1Kl/iFZSWxynJaa0UYGs+0LNpyzLGO1iPb0k=,tag:MHfZk+IW4SiVPto0dMkH5A==,type:str]
+                AUTH_HOST: ENC[AES256_GCM,data:XjGPm+CF+cXI4c+Xk5VWWRSlftMoQUPO4GMcAT34dRYYAUi5ZJEHJJEVXECLel2y4CS7Aeykl8RenmP+42+55loTapY=,iv:9/g48CQG3TP/5PMh2EewYvn5dsnI/UlIPAs4wH4Jg+E=,tag:GF0S9XVqbFW4hU1wuwqWyA==,type:str]
+                CAMUNDA_CLIENT_ID: ENC[AES256_GCM,data:P7iYC3Z4ZZQhVm38,iv:G7wOvF2R80jl841NdgqtLMZrIPtAgQ4ccD57g9cYpF8=,tag:tjf3kSHgllmNOyOeluPr8g==,type:str]
+                CAMUNDA_CLIENT_SECRET: ENC[AES256_GCM,data:1JxXbrR9p+tjeIeqnRrIQuuaqcdCDlXSVJnAQ6n/i56e1lNCsvEICg==,iv:krYTlueSVnXJRGZDdzkEnRFFKwAVMBCkywXHRa/pIH4=,tag:MBybgTe8LV8qm7qAnVOdCA==,type:str]
+                CAMUNDA_KEYCLOAK_URL: ENC[AES256_GCM,data:PMOWYdfN3d1F0C434+VWjwwGPxJQyLgIQtu3ZadbGhNc5CFZ506vFVdrYayEQbPJx6rYSa0/3rzDKpjQ97u4eiqAR9yI8G30,iv:t+hmdq64P9H2qg96/bVl/JvCXbRRoF+IIi02Ir10c+4=,tag:QK314wkcyzOJZSiGCn5ltg==,type:str]
+                CAMUNDA_PROCESS_DEFINITION_ID: ENC[AES256_GCM,data:NquUxq8Je2AP4YEt/NWIeVzDG/hxrVCe,iv:7sFRC8LsO7oHUb5SxQ3FrMj7CJtKN0gjuvWX7x/ATf0=,tag:GrR885l3O5YQLU/MUwBmLA==,type:str]
+                FLOWS_URL: ENC[AES256_GCM,data:BPU7cDydWfhogs+C9967UXaJWUC76W4XsdUfPG956DPIpeuXzVFzhd9+/blZNaq7OKcPWSKChMvv7uCkfUIUSt1vzB8C/xX0,iv:CQjt/ZFg0duP/531T+IR8xWkXBpxDxgAeyO+KHd52vg=,tag:/tmDqXzsrF95Az9cQQBTxg==,type:str]
+                FLOWS_INTERNAL_URL: ENC[AES256_GCM,data:RqD98W1TINUNKwtmADa7n3iYLiBAhFLyP7VePzVBGtegyDoOuZndUDjMQaw9/XVN4c2rI4x3B0OQg024yaZwp1ow4py4B+ndJ+E2wA==,iv:sV22vbMDMBHNffaeGGAkCQbSuzmspI/pYrZRF9OYXxQ=,tag:IoZobs0ufOZDW0IEgfkvfQ==,type:str]
+                LOG_LEVEL: ENC[AES256_GCM,data:pGx7rnP+sug=,iv:h6NihDYUqvrXJ//RzlwYUJHE5m1kSMOWoW9NjLLO1wk=,tag:d7h4Ik+1uduCDnggmuLQJQ==,type:str]
+                OPERATE_URL: ENC[AES256_GCM,data:9VnX5CcnPoActKCvnOP4kpBCaYyfPQWsoecldza4kEZoJialL0co6q2jbNOKSG9uPAo/FT10JLbEtxgU5k28WsaLtiI=,iv:jdUvEHx2IzS0RAjouBfQtEcQ9af3hfb9LdESUzpD6ZM=,tag:fNMn/S9LlyQm6TqW4hX+7Q==,type:str]
+                PASSWORD: ENC[AES256_GCM,data:oR454s87r9FYIWjc,iv:uq/nYRSy++B6jdNT2whNRkSwPsjMDnptqk4iDD4wq/8=,tag:wMhFkivP0usPJgsM4a/AfQ==,type:str]
+                USERNAME: ENC[AES256_GCM,data:VdGjfn+Fkj5SGNHa,iv:g7pfrguycCO/4Bik+Z9SYkwHdgbpTlH7CdMfywKULTM=,tag:49m0Jy7Ilg/xRyoxzlVMHg==,type:str]
+                PDM_URL: ENC[AES256_GCM,data:bxxGPWRey8kxE1xqVchM/F85/jl46Ts326JzEx7DF/vcSLBTSS8iPIIcYG4wg/W0/apW9vI6z3s3lPgJ1qfx3ZKv/FHI3ICgUgwbS86xjB0ib1ADET7G2w==,iv:X527CXyPEAp6nAQZzuImAsVnpYaFzXjFS5QsINpuhYY=,tag:jT7RiM4sEvFD5d5rfQHYSA==,type:str]
+                S3_ENDPOINT_URL: ENC[AES256_GCM,data:19h3/vL0P3Y+ByCYqE1DsfMpAir0IV+qM5xWruyuMcM=,iv:Vy/TtCI4tVEAAj2nPVczI3F9X1/jsTDhmSe9ulXgdu4=,tag:52FU5A9iIuoly0nVLhghiQ==,type:str]
+                S3_ACCESS_KEY_ID: ENC[AES256_GCM,data:RcZCkzLoF1/Ug7ueareMQQ==,iv:2VlSVX7HclK33EDLCR4/qs9T3EtkFJEQWtoNMXbfWdw=,tag:55pkgzZF3yJwLLp9+0zQqQ==,type:str]
+                S3_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:doSuq7eNqvtsiNAQsZrw9A==,iv:T4owsUNBf7RvI+gBA0e3UOLcZlu+n+pqBatPugzu8u8=,tag:/nlVIyk1e4CdYpq3/Y3R+w==,type:str]
+                TELEGRAM_ALERT_GROUP_ID: ENC[AES256_GCM,data:HuZzlsJzR6vOZYHOVpSm9Q==,iv:nkDbBzKe3R1IsHyN00SW6y8p82GKdslVuqhRphqmFuU=,tag:VffIUZRgU2PL+DOySfeb5g==,type:str]
+                TELEGRAM_TOKEN: ENC[AES256_GCM,data:mIAElApSHv9A9WgreFKB/+GjjGeZdD8Js0rwtzbenegcXYtInFhTzJYlZOKQm2dz8duAT7hV1Qt52iSPspV+bw==,iv:27FiPP4fbmp6O8ARbNzVSNgI7KcDr7dxrM6RZOwBvDE=,tag:QOepZyqgGfCdk65HqmmIdg==,type:str]
+                WORKFLOWS_HOST: ENC[AES256_GCM,data:e+sFGyFUfMrdy5zB3KPIfxHeeMqOIy9NYpmrre11YyIV7oyfCF5OjiFwv3NSTqpj2as1MoZlp3JyaE2EG2sMhUsvOk0=,iv:MWkTmJq10XXWIN0ZvdTJsv25hUc03VBvLeVfsjg8Dqg=,tag:g4dFNkIp1u4kf7UFggPAMw==,type:str]
+                WORKSPACES_URL: ENC[AES256_GCM,data:hyHMnc4UVH9ojKwhsXcaG4DhV2iXwmCaq1f0+cFes0eUmNvoqUV6SEypIBJW2Ygje0FA8KWUqRwhpvMgcx08BpZ0rUU=,iv:aFp3xrO8HnVi5gwRceHQ1rjpWRJ+Y9t4N0dKUP3XYpw=,tag:TV0aj8msNR/ueIYQl+0pWg==,type:str]
+                ZEEBE_GATEWAY: ENC[AES256_GCM,data:+yupC1ppINIaMtd3xstQ9Snp5hxRysIz7L9A4K5c/E7rE9CPLk/iPYzChjwUA0g5lFMLG4aTCq/EAyYX92Ay8bIZt50HHiq6,iv:/Msn+gGtWGXB9CqC0RHywNoWae9Z3G04ApNsYN/WzsE=,tag:c4RQ1Yl1SnvmbzUmyJ6aOg==,type:str]
+                DATABASE_URL: ENC[AES256_GCM,data:vvYbm0oW8HrBOmPYkMXvdTBVCTuOgOPUZgoC9mcHCdSWnCUszpdrRpS5Vgb3iFH/UabFyOZsDi/LtTZXhds7gRz5lPxiitNT9Rc3qDdc9vLVyClS0U24b1GHcKT1dKdC+seafaaKkIiOrSSZoTOKlMkapZQ0V3cmdp9h0bvfXrjAWbZ479skgs1qzCiv9E+2cN1kAg==,iv:2REhF0AjysNfgL/nziAUG5N8VoY3OLYAO9MijGJobrY=,tag:X9R8iF0uupAQLGFG7va7cQ==,type:str]
+              extra_fields:
+                AMQP_USER:
+                    source:
+                        kind: secret_ref
+                        ref: vault://rabbitmq/apps/cde#username
+                AMQP_PASSWORD:
+                    source:
+                        kind: secret_ref
+                        ref: vault://rabbitmq/apps/cde#password
+                AMQP_PATH_API:
+                    source:
+                        kind: secret_ref
+                        ref: vault://rabbitmq/apps/cde#vhost
+                PUBLIC_KEY:
+                    source:
+                        kind: secret_ref
+                        ref: vault://vault/common/rsa_keys#public_key
 sops:
     age:
         - recipient: age1ztyyem7qy3fn7vjprnadhsv2txds8a63pr76uut264qwnwxv8v9qwpkagt
@@ -6084,7 +6132,7 @@ sops:
             dkhZMjdzdUh4bEQ5dDN2NnZabjBtUTQKeV6OU8Ob1P9j9E2G8ydznEX+vjHQhlEP
             fXp6UP1kQrRRAOEuhH4cyXT2YgPq5HMcDemyFHUH0JPxiew370fMzA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-10-07T11:14:14Z"
-    mac: ENC[AES256_GCM,data:lDLpC7HKK6PLihgK3yWXK3rPOlTQ9aSMikL1nucF2xyM3ulGg+vW4kGdOAsYz8bc8Ta3MGveAL5pf/kkzFKjJpn58RQJy6esFmwCXHp/Fn0efI8CkUxWtxhVlEtYdUV+5uFObYrQ/ueS8/W2phVwIce3E/qsLc0jsl1UY2qF2KE=,iv:ir33z88ixX8lkQYAN+/jVpTiCExtRA821ValZ+vRp2c=,tag:20zTseXVLgDvrFpnV/BFLQ==,type:str]
+    lastmodified: "2026-10-08T09:12:10Z"
+    mac: ENC[AES256_GCM,data:7muUpNA8ZNEK9O/cH0IIzIwY3+SHGOTqK8mWkZ7O9CwkuDPHJ18CC2OQX7c2MzMpMbDQieT8ym1Kk2DOu3LcIaK3BVhXxk52nVGagBK8HrEmxdsEOTK+gZ/tjeR5QK2Na0RG290xQBMOng4nT8WhJ7c/m09zKwGkBHzrtc7+Ggo=,iv:5ZGVTQptsJ1Lyf5pUJS4JrVKd6SVTnumN9OgOGOI7rs=,tag:fuCVCvWpcpcpiLTJtcvmEQ==,type:str]
     encrypted_regex: ^(data)$
     version: 3.12.2