jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore(secrets): P3 ownership and consumer mapping in the manifest #37

Merged
jfraeys merged 1 commit from jfraeys/chore/p3-manifest-ownership into main 2026-10-10 11:14:41 -04:00
Conversation 0 Commits 1 Files changed 1 +356
jfraeys commented 2026-10-10 10:05:41 -04:00
Owner
Copy link

P3 of the secrets plan (ownership + consumer mapping, the gate for any rotation automation).

  • Every manifest entry gets owner, replicas, privileges, expiry (unknown stays unknown), rotation procedure; rotation says "scripts/rotate-secret.sh" only where that script actually references the key.
  • 13 new entries for secrets found only in .env or the vault (OS_PASSWORD, TF_VAR_linode/cloudflare/desec tokens, root/user passwords, Zedmail + 4 Postfix sender API keys, OVH_APPLICATION_SECRET, VAULT_DEPLOY_TOKEN). .env-owned ones are marked as migrating to the vault in P4.
  • The 11 entries with no key in the real vault are marked "unset in the real vault", not deleted.
  • Verified: original fields unchanged for all 46 entries; manage secret list-expiring still works.

Open after this: privileges for most provider tokens are still "unknown" (needs the owner in the provider UIs); P3 does not fix them.

🤖 Generated with Claude Code

P3 of the secrets plan (ownership + consumer mapping, the gate for any rotation automation). - Every manifest entry gets owner, replicas, privileges, expiry (unknown stays unknown), rotation procedure; rotation says "scripts/rotate-secret.sh" only where that script actually references the key. - 13 new entries for secrets found only in .env or the vault (OS_PASSWORD, TF_VAR_linode/cloudflare/desec tokens, root/user passwords, Zedmail + 4 Postfix sender API keys, OVH_APPLICATION_SECRET, VAULT_DEPLOY_TOKEN). .env-owned ones are marked as migrating to the vault in P4. - The 11 entries with no key in the real vault are marked "unset in the real vault", not deleted. - Verified: original fields unchanged for all 46 entries; `manage secret list-expiring` still works. Open after this: privileges for most provider tokens are still "unknown" (needs the owner in the provider UIs); P3 does not fix them. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Every manifest entry now carries an owner, replicas, privileges, expiry and
rotation procedure (unknowns recorded as "unknown", not guessed), plus 13
entries for secrets that lived only in .env or the vault: OS_PASSWORD,
TF_VAR_* provider tokens, Zedmail/Postfix API keys, OVH_APPLICATION_SECRET and
VAULT_DEPLOY_TOKEN. The 11 manifest entries with no key in the real vault are
marked unset rather than dropped. Original fields are unchanged and
`manage secret list-expiring` still reads the file.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!37
No description provided.