diff --git a/ops/generate_auth.sh b/ops/generate-auth.sh
similarity index 100%
rename from ops/generate_auth.sh
rename to ops/generate-auth.sh
diff --git a/ops/git.yaml b/ops/git.yaml
index 5358d93..0e145f1 100644
--- a/ops/git.yaml
+++ b/ops/git.yaml
@@ -1,15 +1,26 @@
 ---
 
-apiVersion: v1
-kind: Secret
+# gitea-admin-secret: sealed with kubeseal. Encrypted, safe to commit.
+# Rotate: recreate plaintext secret + re-seal, e.g.
+#   kubectl -n ops create secret generic gitea-admin-secret \
+#     --from-literal=username=ntr --from-literal=password="$NEWPW" \
+#     --from-literal=email=ntr@strix.systems --dry-run=client -o yaml | \
+#   kubeseal --controller-name sealed-secrets-controller \
+#     --controller-namespace kube-system --format yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
 metadata:
   name: gitea-admin-secret
   namespace: ops
-type: Opaque
-stringData:
-  username: ntr
-  password: "REDACTED"
-  email: "ntr@strix.systems"
+spec:
+  encryptedData:
+    email: AgCCwKb/cTRNKgtg7gPwId5rVYzf++0BDWA8miOcfAFciSWX1hSXFL7LGe52Ln2UpYD7BRZkkGq2Rz53XM+irSKFnD0K+F8/+S2wu4Nxk2GbwBEHbANd3ATnxxdBsqRrEYZFHy5X29sFIF1Kp+p7UwJhudZVMjuSlJ9awXri+XR3te/Fmpa/kT5SF7gc9DQPrNsH3UaTVBhxJ1nFNKShdSTVLC8/fD5RgxMPxwexx3ny7a9YJxQh97Te8ZrR24ZceccY+lmbxadsqqth8KjeqAdUkH/LSkIelRr9v4xbKnV5oGwOKjRDF4tZxgoLmkHvoP97tp9b0/aEEyRU78Zz5aMRwWNsY78O4/ufudUIyUctctgNZ4x6N1QSHHFFGcAB12e15jP+5TgZj9RUov2B6NSIab2XJU4pm4H65OGsX9osHIGou5lRMZvRi/SZlkbtkzx3OwMfc5TSw7aRQ6fSiYagsxWmKJWVs+OFjI/b9ee436/C63u1yilWFT7VHoJzRGck35DWk4xvatOb77inJBwLahruDXBGD2BB4hGVRB7cNJ+aAavEgBVvPstN9ssD3TNwVPQxL7CQiDrt9sj5Og4FDl1F+F2UNfP4RrNYHIQFZeFDQwrKXRkzeCA76sYE6ee8RvurHDiia2HoF9RL3cx0EqDiuqAKBpbzFSdSCcCWWvsvx0ICbialykyB8dTn/Mktzu0+3hf5FiV/seI=
+    password: AgAytYm5H0dVZUrvE2Ag8WrkWVMeGHJ/I6g85kFUIxMXKDi2Hnz0MuyTizCUovJVT3ab9CAgUOlP2JbIrbO8PnXhdlVgHWcSxq+5K32dMuUjZL7582bRo9buC+7BBxrBDk8/L/CcvfvP4Dow1KFzxI7jFuOz8LzuGgtzGgl5bowxskcAibAMSXR3EN3UGLGIticjiuKNZJRFwt9AD/nn1ZOH/HLX/QiFY7Cv53/IIBFQvUSEtRzlzCKAn7WjMHx9hGgo050j97mNgs1uQp9vGeW8OAIaPidzOsPL2ISW6TGOpf6mSx1BsENkwbNsVJ2avFCi3yBGH26cOEWJBSnwBsmfcnSJbuQZFBBKARRaRMpXSm5qxMsjfbHUFHKtCnazb/xM/e52CFkbZl0M4jo2EHTlPFH8D+Oqo0b+Y43pMaFojaYx+mCnFImgl+3ArD+oMpazfzGlz6BQ2NetpNC8uy5AtP+8k75ZbUU+ZSiZPttyqQ/6PPCxC9H1UB0KEuWiTFQuiLoC1qeLR5+FDMgEsXPZCFu2hi/0WNXlQ+KHtlf5g3z3o0lz8YMHNAMDgArKRG3YPDQgT1iravTKlyduOu1GzIAGU+af30OO6NDSIFkdSu1PA9j4qTVNjdpgDu+OR5k5bOlJPqYVoVsZugkLAsILeIO6l9rygeJzTjG791RovaeeF7zaVGV/FsKtBD0hsa9Kg3WwI3+1IYnS3OPWPKxKiD5sHd9m
+    username: AgBLWJhYYenlLJQyyOFjibScElVtwT006b6QLTde1TZlLjqrLdw1PsH7rWAWfsCHbZJzRo/nWxIxiYWMAMQNTxco1wghBbalxWQsyhcreEPRgQJxRDKRf/+7gRVophUgrJ6Ej3EwDNGnEtdtCw+QIedXvCQtlt5MNzch+S/mxylhZF9CswpPDOEnoqbM5RELu8LUuYiThD5NNKFah4j/c92CZFVbtZzprUOLphUVWzGDde6krmJZpDhDSl4VwVbjPU700C0qrsJhGZlwDlXTwDXMH552X6qCh+GHeh1Ig6ll7npQSMlwFWsYyz0dRMYXkaASdrh4arhukzkTmjHXDtgIoiXqEdhjayZ0oIcSVgyzX0dK62wxWtYITPhREJkKSrLPs0vrz480qNiZ69gXKZiBSernyvwZ0w5oxlkMfMRQyUHUcpzfG1z94w9gh5GDvHS6r1hHH3Hndtt7owGbCtOtySUsrdeEiNG95uvI44vqpFc8RAzspYZ9HsiQnTu0Xg3hM40YRiAyFr4n/He0SMf1FQE7F4dPEv5zPK4/swAfq/n2DzpQDr/vhCnL+2y7VVG/pp+1Ox6qm5nhS0xmnlwDqkgFfTbUPPyvwY+oOBo0EDAYEY9a1CitlSD176FJomL4BP3KWB1OqgWpH3YwWBnI3QMKXKWd44Mt4Wh3ihJLhpzfLJQeBIhH1tu8ca4/hvs+pNA=
+  template:
+    metadata:
+      name: gitea-admin-secret
+      namespace: ops
 
 ---
 
diff --git a/ops/minio-auth.sh b/ops/minio-auth.sh
new file mode 100755
index 0000000..f79533a
--- /dev/null
+++ b/ops/minio-auth.sh
@@ -0,0 +1,21 @@
+gen_password() { head -c 16 /dev/urandom | sha256sum | cut -d " " -f 1; }
+
+MINIO_ROOT_USER="minioadmin"
+MINIO_ROOT_PASSWORD=$(gen_password)
+
+kubectl create secret generic minio \
+    -n ops \
+   --from-literal=MINIO_ROOT_USER=${MINIO_ROOT_USER} \
+   --from-literal=MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD} \
+
+# cat <<EOF | ssh root@strix tee /etc/rancher/k3s/registries.yaml
+# mirrors:
+#   registry.ntwl.xyz:
+#     endpoint:
+#       - "https://registry.ntwl.xyz"
+# configs:
+#   "registry.ntwl.xyz":
+#     auth:
+#       username: ntr
+#       password: pw
+# EOF