Thomas SharedInboxandClaude Sonnet 4.6
839a3c63f9
Store all production secrets encrypted in secrets.age (committed to the repo) using age. Only one secret needs to be in CI: SECRETS_AGE_KEY. When a secret changes locally, update secrets.env and re-run scripts/secrets-encrypt.sh to commit a new secrets.age. CI picks up the updated secrets automatically on the next push — no manual CI variable updates required. Changes: - scripts/secrets-encrypt.sh: encrypt secrets.env → secrets.age - scripts/secrets-decrypt.sh: decrypt secrets.age → GITHUB_ENV (CI) or eval-safe export block (local) - scripts/test_secrets.sh: encrypt/decrypt round-trip tests - secrets.env.example: template documenting all production secret keys - ci/main.go: add CheckSecrets function (runs test_secrets.sh via Dagger), wire into Check(), update Graph(); add age to toolchain apt packages - .forgejo/Dockerfile: add age package - .forgejo/workflows/deploy.yml: replace per-secret CI references with a single "Decrypt production secrets" step using SECRETS_AGE_KEY - flake.nix: add age to dev shell - Taskfile.yml: add check-secrets task, include in check-fast - .gitignore: ignore plaintext secrets.env - DAGGER.md: document Option 5 (encrypted secrets file) as active approach Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
29 lines
956 B
Bash
29 lines
956 B
Bash
# Copy this file to secrets.env and fill in real values.
|
|
# Then encrypt to secrets.age: scripts/secrets-encrypt.sh
|
|
#
|
|
# secrets.env — plaintext, git-ignored
|
|
# secrets.age — encrypted, committed to the repository
|
|
# .age-public-key — age public key, committed (not secret)
|
|
#
|
|
# Multi-line values (SSH keys, certificates) must be stored as a single line
|
|
# with literal \n for newlines, wrapped in double quotes. Example:
|
|
# SSH_PRIVATE_KEY="<header line>\n<base64 body lines>\n<footer line>"
|
|
#
|
|
# One-time setup:
|
|
# age-keygen -o ~/.config/age/sharedinbox.key
|
|
# age-keygen -y ~/.config/age/sharedinbox.key > .age-public-key
|
|
# # Store the private key content in CI as SECRETS_AGE_KEY secret.
|
|
|
|
ANDROID_KEYSTORE_BASE64=
|
|
ANDROID_KEYSTORE_PASSWORD=
|
|
PLAY_STORE_CONFIG_JSON=
|
|
SSH_PRIVATE_KEY=
|
|
SSH_KNOWN_HOSTS=
|
|
SSH_USER=
|
|
SSH_HOST=
|
|
ANDROID_APK_SCP_HOST=
|
|
ANDROID_APK_SCP_USER=
|
|
ANDROID_APK_SCP_PATH=
|
|
FIREBASE_TEST_LAB_SERVICE_ACCOUNT_KEY=
|
|
FIREBASE_PROJECT_ID=
|