jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore(secrets): allow committing *.sops.yml; keep all recipients on rotation #28

Merged
jfraeys merged 1 commit from jfraeys/chore/secrets-p2-gitignore-sops into main 2026-10-09 19:38:34 -04:00
Conversation 0 Commits 1 Files changed 5 +56 -2
jfraeys commented 2026-10-09 19:29:07 -04:00
Owner
Copy link

P2 part A (no secrets touched; the cutover itself is a separate step).

  • .gitignore: secrets/* also ignored vault.sops.yml, so the encrypted vault
    could never reach git. Add exceptions for secrets/*.sops.yml|yaml;
    plaintext vault.yml, .vault_pass and backups stay ignored.
  • rotate-secret.sh and rotate-ovh-s3-credentials.sh parsed a single recipient
    from .sops.yaml with grep|awk. With the recovery key added in #27 that would
    fail or silently drop the recovery recipient. Both now call
    scripts/lib/sops-recipients.py, which parses .sops.yaml and returns every
    recipient. A test encryption confirmed both land in the ciphertext.
  • docs/incidents.md: near-miss entry.

🤖 Generated with Claude Code

P2 part A (no secrets touched; the cutover itself is a separate step). - .gitignore: secrets/* also ignored vault.sops.yml, so the encrypted vault could never reach git. Add exceptions for secrets/*.sops.yml|yaml; plaintext vault.yml, .vault_pass and backups stay ignored. - rotate-secret.sh and rotate-ovh-s3-credentials.sh parsed a single recipient from .sops.yaml with grep|awk. With the recovery key added in #27 that would fail or silently drop the recovery recipient. Both now call scripts/lib/sops-recipients.py, which parses .sops.yaml and returns every recipient. A test encryption confirmed both land in the ciphertext. - docs/incidents.md: near-miss entry. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
chore(secrets): allow committing *.sops.yml; keep all recipients on rotation
All checks were successful
Lint / lint (pull_request) Successful in 1m26s
Details
e63c90114e
 
.gitignore's secrets/* also hid vault.sops.yml, so the encrypted vault could
never reach git. rotate-secret.sh and rotate-ovh-s3-credentials.sh parsed a
single recipient from .sops.yaml and would have dropped the recovery key;
both now use scripts/lib/sops-recipients.py.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!28
No description provided.