From d1a76f99610f015691764f2109f1c6755363f6f8 Mon Sep 17 00:00:00 2001 From: Your Name Date: Sun, 2 Aug 2026 17:14:40 -0400 Subject: [PATCH] docs: sync Infisical secret paths to the two-level tree Co-Authored-By: Claude Opus 4.8 --- README.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 9ad1dd3..6510aa3 100644 --- a/README.md +++ b/README.md @@ -45,21 +45,21 @@ renders heatmaps, places visited, distance/time statistics, and timeline view. is post-create). See `feedback_lxc_bootstrap_user`. 2. **`vars/vault.yml`** — holds `vault_infisical_client_secret`. Shared universal-auth client across all LXC repos — copy from `homelab-ansible-lxc-rag/vars/vault.yml`. -3. **Infisical `/dawarich` folder + 5 secrets** — run `./scripts/bootstrap-secrets.sh`. It creates the folder if missing and pushes: +3. **Infisical `/apps/dawarich` folder + 5 secrets** — run `./scripts/bootstrap-secrets.sh`. It creates the folder if missing and pushes: - `vault_dawarich_db_password` (`openssl rand -hex 32`) - `vault_dawarich_secret_key_base` (`openssl rand -hex 64`) - `vault_dawarich_otp_primary_key` (`openssl rand -hex 32`) - `vault_dawarich_otp_deterministic_key` (`openssl rand -hex 32`) - `vault_dawarich_otp_salt` (`openssl rand -hex 32`) -4. **Infisical `/oidc` secrets** — generate `vault_dawarich_oidc_client_id` +4. **Infisical `/identity/oidc` secrets** — generate `vault_dawarich_oidc_client_id` (40 hex) and `vault_dawarich_oidc_client_secret` (64 hex), push as `--type shared`. These values ARE the credentials — pi-auth creates the Authentik provider with them, it doesn't fetch them back. Generation pattern: ```bash infisical secrets set "vault_dawarich_oidc_client_id=$(openssl rand -hex 20)" \ - --projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /oidc --type shared + --projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /identity/oidc --type shared infisical secrets set "vault_dawarich_oidc_client_secret=$(openssl rand -hex 32)" \ - --projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /oidc --type shared + --projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /identity/oidc --type shared ``` 5. **pi-auth site.yml mapping** — `homelab-ansible-pi-auth/site.yml` must have a `dawarich_oidc_client_id` / `dawarich_oidc_client_secret` set_fact line @@ -94,8 +94,8 @@ Deploys run via **Semaphore** — template `[LXC] Dawarich Deploy` (id 50). Loca echo \"cbalders ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/cbalders && chmod 440 /etc/sudoers.d/cbalders"' ``` -3. `./scripts/bootstrap-secrets.sh` → 5 `/dawarich` secrets in Infisical. -4. Push `/oidc` secrets (see prereq 4 above). +3. `./scripts/bootstrap-secrets.sh` → 5 `/apps/dawarich` secrets in Infisical. +4. Push `/identity/oidc` secrets (see prereq 4 above). 5. Add `dawarich_oidc_client_{id,secret}` set_fact mapping in `homelab-ansible-pi-auth/site.yml`. 6. First `./deploy.sh` here → app boots, migrations run (~3 min cold-start). 7. `cd ../homelab-ansible-pi-auth && ./deploy.sh` → creates Authentik provider + application. @@ -148,18 +148,18 @@ UI to generate a per-user token. Use it as the bearer for either: Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.yml`): -**`/dawarich/`** +**`/apps/dawarich/`** - `vault_dawarich_db_password` — PostGIS DB password - `vault_dawarich_secret_key_base` — Rails `SECRET_KEY_BASE` - `vault_dawarich_otp_primary_key` — OTP/attr-encryption primary key - `vault_dawarich_otp_deterministic_key` — OTP deterministic-encryption key - `vault_dawarich_otp_salt` — OTP key-derivation salt -**`/oidc/`** +**`/identity/oidc/`** - `vault_dawarich_oidc_client_id` — Authentik OIDC client ID - `vault_dawarich_oidc_client_secret` — Authentik OIDC client secret -**`/shared/`** +**`/platform/notify/`** - `vault_watchtower_gotify_url` — Watchtower Gotify notification URL - `vault_watchtower_api_token` — Watchtower HTTP API trigger token