cbalders/homelab-ansible-lxc-dawarich
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: sync Infisical secret paths to the two-level tree

Browse Source 
Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Your Name
2026-08-02 17:14:40 -04:00
co-authored by Claude Opus 4.8
parent 771763d3f9
commit d1a76f9961
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9 -9
View File
@@ -45,21 +45,21 @@ renders heatmaps, places visited, distance/time statistics, and timeline view.
is post-create). See `feedback_lxc_bootstrap_user`. is post-create). See `feedback_lxc_bootstrap_user`.
2. **`vars/vault.yml`** — holds `vault_infisical_client_secret`. Shared 2. **`vars/vault.yml`** — holds `vault_infisical_client_secret`. Shared
universal-auth client across all LXC repos — copy from `homelab-ansible-lxc-rag/vars/vault.yml`. universal-auth client across all LXC repos — copy from `homelab-ansible-lxc-rag/vars/vault.yml`.
3. **Infisical `/dawarich` folder + 5 secrets** — run `./scripts/bootstrap-secrets.sh`. It creates the folder if missing and pushes: 3. **Infisical `/apps/dawarich` folder + 5 secrets** — run `./scripts/bootstrap-secrets.sh`. It creates the folder if missing and pushes:
- `vault_dawarich_db_password` (`openssl rand -hex 32`) - `vault_dawarich_db_password` (`openssl rand -hex 32`)
- `vault_dawarich_secret_key_base` (`openssl rand -hex 64`) - `vault_dawarich_secret_key_base` (`openssl rand -hex 64`)
- `vault_dawarich_otp_primary_key` (`openssl rand -hex 32`) - `vault_dawarich_otp_primary_key` (`openssl rand -hex 32`)
- `vault_dawarich_otp_deterministic_key` (`openssl rand -hex 32`) - `vault_dawarich_otp_deterministic_key` (`openssl rand -hex 32`)
- `vault_dawarich_otp_salt` (`openssl rand -hex 32`) - `vault_dawarich_otp_salt` (`openssl rand -hex 32`)
4. **Infisical `/oidc` secrets** — generate `vault_dawarich_oidc_client_id` 4. **Infisical `/identity/oidc` secrets** — generate `vault_dawarich_oidc_client_id`
(40 hex) and `vault_dawarich_oidc_client_secret` (64 hex), push as `--type shared`. (40 hex) and `vault_dawarich_oidc_client_secret` (64 hex), push as `--type shared`.
These values ARE the credentials — pi-auth creates the Authentik provider These values ARE the credentials — pi-auth creates the Authentik provider
with them, it doesn't fetch them back. Generation pattern: with them, it doesn't fetch them back. Generation pattern:
```bash ```bash
infisical secrets set "vault_dawarich_oidc_client_id=$(openssl rand -hex 20)" \ infisical secrets set "vault_dawarich_oidc_client_id=$(openssl rand -hex 20)" \
--projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /oidc --type shared --projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /identity/oidc --type shared
infisical secrets set "vault_dawarich_oidc_client_secret=$(openssl rand -hex 32)" \ infisical secrets set "vault_dawarich_oidc_client_secret=$(openssl rand -hex 32)" \
--projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /oidc --type shared --projectId 50062d7c-06ff-4d5c-8ca3-6c0cdba9f270 --env prod --path /identity/oidc --type shared
``` ```
5. **pi-auth site.yml mapping** — `homelab-ansible-pi-auth/site.yml` must have 5. **pi-auth site.yml mapping** — `homelab-ansible-pi-auth/site.yml` must have
a `dawarich_oidc_client_id` / `dawarich_oidc_client_secret` set_fact line a `dawarich_oidc_client_id` / `dawarich_oidc_client_secret` set_fact line
@@ -94,8 +94,8 @@ Deploys run via **Semaphore** — template `[LXC] Dawarich Deploy` (id 50). Loca
echo \"cbalders ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/cbalders && echo \"cbalders ALL=(ALL) NOPASSWD:ALL\" > /etc/sudoers.d/cbalders &&
chmod 440 /etc/sudoers.d/cbalders"' chmod 440 /etc/sudoers.d/cbalders"'
``` ```
3. `./scripts/bootstrap-secrets.sh` → 5 `/dawarich` secrets in Infisical. 3. `./scripts/bootstrap-secrets.sh` → 5 `/apps/dawarich` secrets in Infisical.
4. Push `/oidc` secrets (see prereq 4 above). 4. Push `/identity/oidc` secrets (see prereq 4 above).
5. Add `dawarich_oidc_client_{id,secret}` set_fact mapping in `homelab-ansible-pi-auth/site.yml`. 5. Add `dawarich_oidc_client_{id,secret}` set_fact mapping in `homelab-ansible-pi-auth/site.yml`.
6. First `./deploy.sh` here → app boots, migrations run (~3 min cold-start). 6. First `./deploy.sh` here → app boots, migrations run (~3 min cold-start).
7. `cd ../homelab-ansible-pi-auth && ./deploy.sh` → creates Authentik provider + application. 7. `cd ../homelab-ansible-pi-auth && ./deploy.sh` → creates Authentik provider + application.
@@ -148,18 +148,18 @@ UI to generate a per-user token. Use it as the bearer for either:
Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.yml`): Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.yml`):
**`/dawarich/`** **`/apps/dawarich/`**
- `vault_dawarich_db_password` — PostGIS DB password - `vault_dawarich_db_password` — PostGIS DB password
- `vault_dawarich_secret_key_base` — Rails `SECRET_KEY_BASE` - `vault_dawarich_secret_key_base` — Rails `SECRET_KEY_BASE`
- `vault_dawarich_otp_primary_key` — OTP/attr-encryption primary key - `vault_dawarich_otp_primary_key` — OTP/attr-encryption primary key
- `vault_dawarich_otp_deterministic_key` — OTP deterministic-encryption key - `vault_dawarich_otp_deterministic_key` — OTP deterministic-encryption key
- `vault_dawarich_otp_salt` — OTP key-derivation salt - `vault_dawarich_otp_salt` — OTP key-derivation salt
**`/oidc/`** **`/identity/oidc/`**
- `vault_dawarich_oidc_client_id` — Authentik OIDC client ID - `vault_dawarich_oidc_client_id` — Authentik OIDC client ID
- `vault_dawarich_oidc_client_secret` — Authentik OIDC client secret - `vault_dawarich_oidc_client_secret` — Authentik OIDC client secret
**`/shared/`** **`/platform/notify/`**
- `vault_watchtower_gotify_url` — Watchtower Gotify notification URL - `vault_watchtower_gotify_url` — Watchtower Gotify notification URL
- `vault_watchtower_api_token` — Watchtower HTTP API trigger token - `vault_watchtower_api_token` — Watchtower HTTP API trigger token