Lucas WintherandClaude Opus 5.5
665ac7d52f
stack_secrets reads KV v2 on the target host and writes the stack's .env at 0600, failing loudly on a sealed vault, a bad token, a missing field or an unsafe value. Adds an example OpenBao stack on app and moves webapp onto it; metrics keeps a hand-placed .env. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
12 lines
487 B
Bash
12 lines
487 B
Bash
# Documentation, not a template. The compose_stack role renders .env on the host
|
|
# from OpenBao during every sync, from the stack_secrets in
|
|
# ansible/playbooks/webapp.yml (and webapp-staging.yml, from its own path). Edits
|
|
# to a .env on the host are overwritten by the next deploy.
|
|
#
|
|
# POSTGRES_PASSWORD kv/stacks/webapp field postgres_password
|
|
# SECRET_KEY kv/stacks/webapp field secret_key
|
|
#
|
|
# See "Adding a secret" in docs/secrets.md.
|
|
POSTGRES_PASSWORD=
|
|
SECRET_KEY=
|