feat: onboard zep + LinkedIn secrets to canonical backup layer #74

New issue

Closed

opened 2026-03-15 02:12:38 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-15 02:12:38 +00:00

Owner

Lineage

plan-pal-e-platform → Platform Hardening (secrets hygiene)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want all production secrets GPG-encrypted in the Salt pillar with registry metadata
So that the canonical backup layer is complete and auditable for all active services

Context

Six new secrets exist in plaintext backups (~/secrets/) but are not yet in the Salt pillar or registry. These are app secrets (MiroFish + Posts/LinkedIn), not platform secrets. Per the sop-secrets-management decision gate: Terraform does NOT create k8s Secrets for these values, so only Steps 1–4 (canonical backup layer) apply here. When MiroFish and Posts services deploy, actual k8s Secrets will use the SOPS path in app repo kustomize overlays.

Secrets: zep_api_key, linkedin_access_token, linkedin_refresh_token, linkedin_client_id, linkedin_client_secret, linkedin_person_id.

File Targets

Files to modify:

salt/pillar/secrets/platform.sls — add 6 GPG-encrypted values
salt/pillar/secrets_registry.sls — add 6 registry metadata entries

Files NOT to touch:

Makefile — these secrets are not in TF_SECRET_VARS (not Terraform-consumed)
terraform/variables.tf — no Terraform variable blocks needed
terraform/main.tf — no Terraform references needed

Acceptance Criteria

All 6 secrets GPG-encrypted in salt/pillar/secrets/platform.sls
All 6 secrets have metadata in salt/pillar/secrets_registry.sls
No changes to Makefile, variables.tf, or main.tf
CI tofu plan shows zero diff (secrets not consumed by Terraform)

Test Expectations

CI pipeline passes (tofu plan zero diff)
Run command: CI runs automatically on PR

Constraints

Follow sop-secrets-management SOPS path (Steps 1–4 only)
GPG key: 81A03D1CF874DC90
No Terraform variable blocks for app-only secrets

Checklist

PR opened
CI passes
No unrelated changes

sop-secrets-management — decision gate updated this session
plan-2026-03-14-mirofish-launch — MiroFish project (zep consumer)
plan-pal-e-posts — Posts project (LinkedIn consumer)

### Lineage `plan-pal-e-platform` → Platform Hardening (secrets hygiene) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want all production secrets GPG-encrypted in the Salt pillar with registry metadata So that the canonical backup layer is complete and auditable for all active services ### Context Six new secrets exist in plaintext backups (`~/secrets/`) but are not yet in the Salt pillar or registry. These are **app secrets** (MiroFish + Posts/LinkedIn), not platform secrets. Per the `sop-secrets-management` decision gate: Terraform does NOT create k8s Secrets for these values, so only Steps 1–4 (canonical backup layer) apply here. When MiroFish and Posts services deploy, actual k8s Secrets will use the SOPS path in app repo kustomize overlays. Secrets: `zep_api_key`, `linkedin_access_token`, `linkedin_refresh_token`, `linkedin_client_id`, `linkedin_client_secret`, `linkedin_person_id`. ### File Targets Files to modify: - `salt/pillar/secrets/platform.sls` — add 6 GPG-encrypted values - `salt/pillar/secrets_registry.sls` — add 6 registry metadata entries Files NOT to touch: - `Makefile` — these secrets are not in TF_SECRET_VARS (not Terraform-consumed) - `terraform/variables.tf` — no Terraform variable blocks needed - `terraform/main.tf` — no Terraform references needed ### Acceptance Criteria - [ ] All 6 secrets GPG-encrypted in `salt/pillar/secrets/platform.sls` - [ ] All 6 secrets have metadata in `salt/pillar/secrets_registry.sls` - [ ] No changes to Makefile, variables.tf, or main.tf - [ ] CI `tofu plan` shows zero diff (secrets not consumed by Terraform) ### Test Expectations - [ ] CI pipeline passes (`tofu plan` zero diff) - Run command: CI runs automatically on PR ### Constraints - Follow `sop-secrets-management` SOPS path (Steps 1–4 only) - GPG key: `81A03D1CF874DC90` - No Terraform variable blocks for app-only secrets ### Checklist - [ ] PR opened - [ ] CI passes - [ ] No unrelated changes ### Related - `sop-secrets-management` — decision gate updated this session - `plan-2026-03-14-mirofish-launch` — MiroFish project (zep consumer) - `plan-pal-e-posts` — Posts project (LinkedIn consumer)