feat(ci): staging SOPS file with a staging-only age key #64

Merged

jfraeys merged 1 commit from jfraeys/feat/staging-sops into main 2026-10-11 14:34:22 -04:00

Conversation 0 Commits 1 Files changed 11 +434 -120

jfraeys commented 2026-10-11 14:30:57 -04:00

Owner

Copy link

Run 452 passed hardening validation and the Headscale API step, then the services play failed: LLDAP_ADMIN_PASSWORD is required (CI has no vault). Adds secrets/staging.sops.yml (107 production key names, 98 throwaway values, 9 copied non-secret config) encrypted to operator + recovery + a staging-only key; CI decrypts it with STAGING_SOPS_AGE_KEY. Tested: staging key decrypts it, is refused on the production vault, no throwaway equals a production value, setup branch decrypts with only the staging key available. Needs the Forgejo secret STAGING_SOPS_AGE_KEY (sync step) before staging can pass. 🤖 Generated with Claude Code

Run 452 passed hardening validation and the Headscale API step, then the services play failed: `LLDAP_ADMIN_PASSWORD is required` (CI has no vault). Adds secrets/staging.sops.yml (107 production key names, 98 throwaway values, 9 copied non-secret config) encrypted to operator + recovery + a staging-only key; CI decrypts it with STAGING_SOPS_AGE_KEY. Tested: staging key decrypts it, is refused on the production vault, no throwaway equals a production value, setup branch decrypts with only the staging key available. Needs the Forgejo secret STAGING_SOPS_AGE_KEY (sync step) before staging can pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit 2026-10-11 14:31:33 -04:00

feat(ci): staging decrypts its own SOPS file with a staging-only age key ... cf5f60d82f

Run 452 reached the services play and failed at "LLDAP_ADMIN_PASSWORD is required": CI has no vault.
secrets/staging.sops.yml carries the production key set with throwaway values, encrypted to operator,
recovery and a staging-only key (vault key / Forgejo secret STAGING_SOPS_AGE_KEY). setup decrypts it
in CI; the staging key is refused on the production vault. Generator: scripts/gen-staging-secrets.py.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit 17f9fc75e7 into main 2026-10-11 14:34:22 -04:00

jfraeys referenced this pull request from a commit 2026-10-11 14:34:22 -04:00

Merge pull request 'feat(ci): staging SOPS file with a staging-only age key' (#64) from jfraeys/feat/staging-sops into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!64

No description provided.