refactor(secrets): OBJECT_STORAGE_* -> LINODE_OBJECT_STORAGE_* #269

Merged

jfraeys merged 2 commits from jfraeys/refactor/linode-object-storage-names into main 2026-10-17 15:08:03 -04:00

Conversation 0 Commits 2 Files changed 32 +362 -308

jfraeys commented 2026-10-17 14:22:01 -04:00

Owner

Copy link

Do not merge until the operator steps below are done: the code reads only the new names. Stacked on #268 (merge that first; until then this PR also shows its commits).

Renames OBJECT_STORAGE_ACCESS_KEY_ID, _SECRET_ACCESS_KEY, _REGION to LINODE_OBJECT_STORAGE_*, matching OVH_OBJECT_STORAGE_*: the backups role, setup/terraform backend, manage backup, the provisioner defaults, staging workflows, ci-secrets.yml (Forgejo secret names; the vault side CI_STATE_BACKEND_* is unchanged), gen-auth-secrets.sh, manifest and docs. docs/incidents.md keeps the old names (history). New: vault-set.py rename OLD NEW (moves the value, prints names only), with a test.

Operator steps (in order, on this branch)

1. git fetch && git checkout jfraeys/refactor/linode-object-storage-names
2. Rename in the production vault:
   for k in ACCESS_KEY_ID SECRET_ACCESS_KEY REGION; do scripts/secrets/vault-set.py rename OBJECT_STORAGE_$k LINODE_OBJECT_STORAGE_$k; done
3. Regenerate the staging file with the new key names: scripts/secrets/gen-staging-secrets.py
4. Commit both: git add secrets/vault.sops.yml secrets/staging.sops.yml && git commit -m "chore(secrets): rename OBJECT_STORAGE_* keys" && git push
5. Create the Forgejo secrets under the new names (values come from CI_STATE_BACKEND_*): ./infra secrets sync to see what is missing, then ./infra secrets sync --apply --force --vault-key CI_STATE_BACKEND_ACCESS_KEY_ID --vault-key CI_STATE_BACKEND_SECRET_ACCESS_KEY
6. Update your local .env if it has OBJECT_STORAGE_REGION.
7. Remove the PR's WIP prefix, merge, let staging-validate pass, then ./infra approve. Delete the old Forgejo secrets OBJECT_STORAGE_* afterwards.

Until step 7 is done, a checkout of this branch against the old vault (or the reverse) fails with missing keys: that is the reason for merging only after steps 2-5.

Tests: test-vault-rename.sh (new), test-backups-credentials.sh, test-infra-cli.sh, test-setup-var-file.sh, test-state-snapshot.sh pass locally.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

**Do not merge until the operator steps below are done: the code reads only the new names.** Stacked on #268 (merge that first; until then this PR also shows its commits). Renames `OBJECT_STORAGE_ACCESS_KEY_ID`, `_SECRET_ACCESS_KEY`, `_REGION` to `LINODE_OBJECT_STORAGE_*`, matching `OVH_OBJECT_STORAGE_*`: the backups role, `setup`/terraform backend, `manage backup`, the provisioner defaults, staging workflows, `ci-secrets.yml` (Forgejo secret names; the vault side `CI_STATE_BACKEND_*` is unchanged), `gen-auth-secrets.sh`, manifest and docs. `docs/incidents.md` keeps the old names (history). New: `vault-set.py rename OLD NEW` (moves the value, prints names only), with a test. ## Operator steps (in order, on this branch) 1. `git fetch && git checkout jfraeys/refactor/linode-object-storage-names` 2. Rename in the production vault: `for k in ACCESS_KEY_ID SECRET_ACCESS_KEY REGION; do scripts/secrets/vault-set.py rename OBJECT_STORAGE_$k LINODE_OBJECT_STORAGE_$k; done` 3. Regenerate the staging file with the new key names: `scripts/secrets/gen-staging-secrets.py` 4. Commit both: `git add secrets/vault.sops.yml secrets/staging.sops.yml && git commit -m "chore(secrets): rename OBJECT_STORAGE_* keys" && git push` 5. Create the Forgejo secrets under the new names (values come from `CI_STATE_BACKEND_*`): `./infra secrets sync` to see what is missing, then `./infra secrets sync --apply --force --vault-key CI_STATE_BACKEND_ACCESS_KEY_ID --vault-key CI_STATE_BACKEND_SECRET_ACCESS_KEY` 6. Update your local `.env` if it has `OBJECT_STORAGE_REGION`. 7. Remove the PR's WIP prefix, merge, let staging-validate pass, then `./infra approve`. Delete the old Forgejo secrets `OBJECT_STORAGE_*` afterwards. Until step 7 is done, a checkout of this branch against the old vault (or the reverse) fails with missing keys: that is the reason for merging only after steps 2-5. Tests: `test-vault-rename.sh` (new), `test-backups-credentials.sh`, `test-infra-cli.sh`, `test-setup-var-file.sh`, `test-state-snapshot.sh` pass locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 2 commits 2026-10-17 14:22:02 -04:00

feat(backups): choose which provider backs the primary and secondary restic repo ... 77973f75a2

backups_primary_provider / backups_secondary_provider (linode/ovh) pick the credentials per repo, so the
OVH cutover's repo flip is a host_vars + repo-URL change; the Linode key (also the Terraform state key)
is never swapped in the vault. Defaults keep today's behaviour. Test with fake keys, wired into lint.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

refactor(secrets): OBJECT_STORAGE_* -> LINODE_OBJECT_STORAGE_* (matches OVH_OBJECT_STORAGE_*) ... 355641c91b

Code, workflows, CI secret names, manifest and docs use the provider-prefixed names; docs/incidents.md
keeps the old names as history. vault-set.py rename moves a value to a new key without printing it.
Needs the vault/staging/Forgejo renames before merge (see the PR).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit 2026-10-17 14:26:12 -04:00

chore(secrets): rename OBJECT_STORAGE_* keys ef4b222419

jfraeys changed title from WIP: refactor(secrets): OBJECT_STORAGE_* -> LINODE_OBJECT_STORAGE_* to refactor(secrets): OBJECT_STORAGE_* -> LINODE_OBJECT_STORAGE_* 2026-10-17 15:07:52 -04:00

jfraeys merged commit 4460c448bc into main 2026-10-17 15:08:03 -04:00

jfraeys referenced this pull request from a commit 2026-10-17 15:08:05 -04:00

Merge pull request 'refactor(secrets): OBJECT_STORAGE_* -> LINODE_OBJECT_STORAGE_*' (#269) from jfraeys/refactor/linode-object-storage-names into main

jfraeys referenced this pull request 2026-10-17 15:28:20 -04:00

fix(staging): generated staging secrets get a valid ALERTMANAGER_NTFY_TOPIC #271

jfraeys referenced this pull request 2026-10-17 19:38:14 -04:00

Migrate production compute from Linode to OVH (starting with services) #187

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!269

No description provided.