jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

docs(secrets): SOPS docs, first-time init, dead-code cleanup #30

Merged
jfraeys merged 4 commits from jfraeys/chore/secrets-docs-cleanup into main 2026-10-09 20:50:44 -04:00
Conversation 0 Commits 4 Files changed 11 +156 -70
jfraeys commented 2026-10-09 20:02:21 -04:00
Owner
Copy link

Follow-up to #29. No behavior change to the SOPS vault.

  • Docs: README secrets section rewritten for SOPS + age; deploy examples use
    scripts/with-vault.sh instead of --ask-vault-pass; vault-lockout runbook
    marked legacy-only; .env documented as machine-local only.
  • docs/secrets-management-sops.md: "Retiring Ansible Vault" checklist (every
    place that still expects it; to be done last, after the full check).
  • First-time init: scripts/init-secrets.sh (generate secrets into an encrypted
    vault.sops.yml; scratch-repo tested), scripts/age-operator-keygen.sh
    (Keychain; only the overwrite guard was exercised), README "First-time init"
    and prereqs. ./setup now warns when no vault exists.
  • Removed two uncalled shell functions (create_password_item, log_rotate).

Not done here: removing the Ansible Vault code paths (deferred to the end of
the plan), the staging deploy under SOPS, deploying the rotated vaultwarden +
authelia secrets.

🤖 Generated with Claude Code

Follow-up to #29. No behavior change to the SOPS vault. - Docs: README secrets section rewritten for SOPS + age; deploy examples use scripts/with-vault.sh instead of --ask-vault-pass; vault-lockout runbook marked legacy-only; .env documented as machine-local only. - docs/secrets-management-sops.md: "Retiring Ansible Vault" checklist (every place that still expects it; to be done last, after the full check). - First-time init: scripts/init-secrets.sh (generate secrets into an encrypted vault.sops.yml; scratch-repo tested), scripts/age-operator-keygen.sh (Keychain; only the overwrite guard was exercised), README "First-time init" and prereqs. ./setup now warns when no vault exists. - Removed two uncalled shell functions (create_password_item, log_rotate). Not done here: removing the Ansible Vault code paths (deferred to the end of the plan), the staging deploy under SOPS, deploying the rotated vaultwarden + authelia secrets. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
README secrets section, deploy examples (with-vault.sh instead of
--ask-vault-pass), .env-vs-vault split and BW_SESSION note; vault-lockout
runbook marked legacy-only; ovh-setup-wizard hints point at sops. Working
Ansible Vault code paths are untouched until the legacy vault is retired.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add scripts/init-secrets.sh (generate service secrets straight into an
encrypted vault.sops.yml; tested in a scratch repo: 24 keys, 2 recipients) and
scripts/age-operator-keygen.sh (operator key into the Keychain). ./setup now
warns when no vault exists at all instead of continuing silently, and the
README gains prereqs and a First-time init section.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
chore(scripts): remove two uncalled shell functions
All checks were successful
Lint / lint (pull_request) Successful in 1m22s
Details
ff47630f3b
 
create_password_item (init-vaultwarden.sh) and log_rotate (rotate-secret.sh)
are defined but referenced nowhere.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!30
No description provided.