jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore: retire the P7 key wizard and the stale terraform backup script, label migration scripts #147

Merged
jfraeys merged 1 commit from jfraeys/chore/retire-p7-wizard-and-stale-backup into main 2026-10-14 11:09:00 -04:00
Conversation 0 Commits 1 Files changed 8 +14 -496
jfraeys commented 2026-10-14 10:54:26 -04:00
Owner
Copy link
  • Removed scripts/project-keys-wizard.sh (migration-only). forge-agent's P7 keys are done: operator + recovery keys, encrypted secrets/dev.sops.yml, integration run through sops and the isolation drill all passed on 2026-10-14. The keygen scripts keep their optional project argument; README points at that.
  • Removed scripts/backup-terraform.sh: out of date. State lives in the S3 backend (terraform/main.tf), but the script archived local terraform/*.tfstate files, which do not exist; it printed "No terraform state files found" and exited 0 (a silent no-op that looks like success). docs/runbooks/node-failure.md now describes the remote state and a manual tofu state pull snapshot, and says plainly that the repo has no separate backup of the state object.
  • Labelled the three remaining migration scripts MIGRATION-ONLY with when to delete them: cloudflare-migration-setup-wizard.sh, export-cloudflare-zone.sh, ovh-setup-wizard.sh.
  • P7 row in docs/secrets-remediation.md: "Keys met (forge-agent); gate test 2 pending". Not marked Met, because gate test 2 (an app deploying through the documented contract) is still open in #118.

Kept on purpose: scripts/tests/test-project-key-isolation.sh (CI gate for the isolation property, not a migration tool).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

- **Removed `scripts/project-keys-wizard.sh`** (migration-only). forge-agent's P7 keys are done: operator + recovery keys, encrypted `secrets/dev.sops.yml`, integration run through sops and the isolation drill all passed on 2026-10-14. The keygen scripts keep their optional project argument; README points at that. - **Removed `scripts/backup-terraform.sh`**: out of date. State lives in the S3 backend (`terraform/main.tf`), but the script archived local `terraform/*.tfstate` files, which do not exist; it printed "No terraform state files found" and exited 0 (a silent no-op that looks like success). `docs/runbooks/node-failure.md` now describes the remote state and a manual `tofu state pull` snapshot, and says plainly that the repo has no separate backup of the state object. - **Labelled the three remaining migration scripts** `MIGRATION-ONLY` with when to delete them: `cloudflare-migration-setup-wizard.sh`, `export-cloudflare-zone.sh`, `ovh-setup-wizard.sh`. - **P7 row** in `docs/secrets-remediation.md`: "Keys met (forge-agent); gate test 2 pending". Not marked Met, because gate test 2 (an app deploying through the documented contract) is still open in #118. Kept on purpose: `scripts/tests/test-project-key-isolation.sh` (CI gate for the isolation property, not a migration tool). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
chore: retire the P7 key wizard and the stale terraform backup script, label the migration scripts
All checks were successful
Lint / lint (pull_request) Successful in 2m26s
Details
Secret scan / scan (pull_request) Successful in 17s
Details
a47e64c78b
 
- Remove scripts/project-keys-wizard.sh: P7 keys for forge-agent are done (keys,
  encrypted dev.sops.yml, integration run and isolation drill passed 2026-10-14);
  it was migration-only. The keygen scripts keep their optional project argument.
- Remove scripts/backup-terraform.sh: state lives in the S3 backend, the script
  archived local *.tfstate files that do not exist, printed a warning and exited 0
  (a silent no-op). node-failure.md now describes the remote state and a manual
  `tofu state pull` snapshot.
- Mark the three migration scripts (cloudflare wizard, zone export, ovh wizard)
  MIGRATION-ONLY with when to delete them.
- P7 row: keys met, gate test 2 still pending (not marked Met).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!147
No description provided.