From 40b512dd96065317a0d827f65a323ade9e80cc5a Mon Sep 17 00:00:00 2001 From: Your Name Date: Sun, 2 Aug 2026 17:14:43 -0400 Subject: [PATCH] docs: sync Infisical secret paths to the two-level tree Co-Authored-By: Claude Opus 4.8 --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 5553396..950d923 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ Two services on one LXC, sharing one Claude Max OAuth subscription: - **Meridian**: Node 22 from NodeSource apt + `npm i -g @rynfar/meridian`. systemd unit `meridian.service` as user `meridian`, bound to `0.0.0.0:3456`, `HOME=/opt/meridian`. - **LiteLLM**: Python venv at `/opt/litellm/venv` + `pip install 'litellm[proxy]'`. systemd unit `litellm.service` as user `litellm`, bound to `0.0.0.0:4000`. `Requires=meridian.service` so it can't outlive the backend. - **OAuth credentials** at `/opt/meridian/.claude/` (mode 0700, owned by `meridian`). -- **LITELLM_MASTER_KEY** at `/opt/litellm/litellm.env` (mode 0600, owned by `litellm`). Source of truth in Infisical `/meridian/vault_litellm_master_key`. Pulled by `deploy.sh` on the controller and exported for the playbook to consume. +- **LITELLM_MASTER_KEY** at `/opt/litellm/litellm.env` (mode 0600, owned by `litellm`). Source of truth in Infisical `/apps/meridian/vault_litellm_master_key`. Pulled by `deploy.sh` on the controller and exported for the playbook to consume. - **No Caddy, no Cloudflare.** Both ports exposed via the same UDM alias `meridian.lan.balders.ca → .164`. ## Bootstrap @@ -69,7 +69,7 @@ Two services on one LXC, sharing one Claude Max OAuth subscription: ``` 6. Smoke via LiteLLM (OpenAI format, master-key auth): ```bash - KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /meridian --plain) + KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /apps/meridian --plain) curl http://192.168.1.164:4000/v1/chat/completions \ -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' \ -d '{"model":"claude-haiku-4-5","max_tokens":40,"messages":[{"role":"user","content":"reply with the single word: pong"}]}' @@ -79,7 +79,7 @@ Two services on one LXC, sharing one Claude Max OAuth subscription: Pulled from Infisical at deploy time (`infisical.vault.read_secrets` in `site.yml`): -**`/meridian/`** +**`/apps/meridian/`** - `vault_litellm_master_key` — LiteLLM proxy master key (required; sanity-checked in `site.yml`) - `vault_openai_api_key` — OpenAI key for LiteLLM `direct_*` models (optional, `default('')`) - `vault_gemini_api_key` — Gemini key for LiteLLM `direct_*` models (optional, `default('')`) @@ -97,8 +97,8 @@ Available model aliases (same on both endpoints, all backed by Claude Max): `cla ```bash # vault_pulse_admin_token (possibly stale — verify before removing; not read by the playbook, manual recipe only) -PULSE_ADMIN_TOKEN=$(infisical secrets get vault_pulse_admin_token --env prod --path /pulse --plain) -LITELLM_KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /meridian --plain) +PULSE_ADMIN_TOKEN=$(infisical secrets get vault_pulse_admin_token --env prod --path /automation/pulse --plain) +LITELLM_KEY=$(infisical secrets get vault_litellm_master_key --env prod --path /apps/meridian --plain) curl -X POST https://pulse.balders.ca/api/settings/ai/update \ -H "X-API-Token: $PULSE_ADMIN_TOKEN" -H 'Content-Type: application/json' \ -d "{\"provider\":\"openai\",\"openai_api_key\":\"$LITELLM_KEY\",\"openai_base_url\":\"http://meridian.lan.balders.ca:4000/v1\",\"model\":\"claude-haiku-4-5\",\"enabled\":true}" @@ -112,7 +112,7 @@ curl -X POST https://pulse.balders.ca/api/ai/test -H "X-API-Token: $PULSE_ADMIN_ - **Subsequent deploys**: via Semaphore template "Meridian Deploy" (scheduled Sun 02:55 EDT). `LITELLM_MASTER_KEY` is auto-reconciled into Semaphore environment 4 by `homelab-ansible-lxc-semaphore/scripts/sync-semaphore-state.py` (merge-only `ENVIRONMENT_KEYS` step). - **Token refresh**: handled automatically by the Claude Code SDK. Manual fallback: `sudo -u meridian /usr/bin/meridian refresh-token`. - **Restart after creds change**: `sudo systemctl restart meridian` (LiteLLM follows automatically via `Requires=`). -- **Rotate master key**: update `/meridian/vault_litellm_master_key` in Infisical, redeploy, update consumers (Pulse, paperless-ai, etc.). +- **Rotate master key**: update `/apps/meridian/vault_litellm_master_key` in Infisical, redeploy, update consumers (Pulse, paperless-ai, etc.). - **Logs**: `journalctl -u meridian -f` / `journalctl -u litellm -f`. ## Files