stack_secrets reads KV v2 on the target host and writes the stack's .env at
0600, failing loudly on a sealed vault, a bad token, a missing field or an
unsafe value. Adds an example OpenBao stack on app and moves webapp onto it;
metrics keeps a hand-placed .env.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
-e start=false (mode sync in CI) lands the payload and starts nothing, for
migrations. A check run on a never-deployed stack now skips Compose with a note
instead of failing on the missing directory.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The same two things as the GitHub workflows, in GitLab's shape: one lint
job, and a per-stack check/deploy button pair. Branch pipelines only, since
a bare `when: manual` would otherwise make GitLab build a merge request
pipeline that drops every job without rules — which looks exactly like the
deploy buttons having vanished.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
