feat: onboard zep + LinkedIn secrets to canonical backup layer #75
No reviewers
Labels
No labels
domain:backend
domain:devops
domain:frontend
status:approved
status:in-progress
status:needs-fix
status:qa
type:bug
type:devops
type:feature
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
forgejo_admin/pal-e-platform!75
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "74-feat-onboard-zep-linkedin-secrets-to-can"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
secrets_registry.slsChanges
salt/pillar/secrets/platform.sls— 6 new GPG-encrypted secret blocks (zep_api_key, linkedin_access_token, linkedin_refresh_token, linkedin_client_id, linkedin_client_secret, linkedin_person_id)salt/pillar/secrets_registry.sls— 6 new metadata entries underplatform:section with origin, provider, rotation_days, and backup locationTest Plan
tofu planshows zero diff (no Terraform variables reference these secrets)Review Checklist
Related
plan-pal-e-platform— Platform Hardening (secrets hygiene)sop-secrets-management— decision gate updated this session to prevent platform/app path confusionTofu Plan Output
PR #75 Review
DOMAIN REVIEW
Secrets handling -- GOOD. All 6 new secrets are GPG-encrypted with the correct Salt Master key (
81A03D1CF874DC90). Every PGP block has proper-----BEGIN PGP MESSAGE-----/-----END PGP MESSAGE-----delimiters and valid base64 content. No plaintext secret values are committed.Salt pillar structure -- GOOD. All 6 secrets are correctly placed under
secrets:platform:inplatform.sls, consistent with the existing pattern. The YAML structure uses|block scalars for multi-line GPG content.Registry metadata -- GOOD. All 6 entries in
secrets_registry.slsinclude the required fields:origin,description,created,rotation_days, andnotes. Theproviderfield is included where applicable (external secrets). Origin types are correctly categorized:zep_api_key:external(correct -- third-party API key)linkedin_access_token:external(correct)linkedin_refresh_token:external(correct)linkedin_client_id:external(correct)linkedin_client_secret:external(correct)linkedin_person_id:config(correct -- static identifier, not a secret per se)Rotation days -- GOOD. LinkedIn access token at 60 days and refresh token at 365 days match LinkedIn OAuth2 documented expiry windows. Static credentials (client_id, client_secret, person_id, zep_api_key) correctly set to 0.
Terraform isolation -- GOOD. Confirmed: no changes to
terraform/variables.tf,terraform/main.tf, orMakefile. These are app-layer secrets (Zep for MiroFish, LinkedIn for Penny's scheduler) that belong in the Salt pillar backup layer but NOT inTF_SECRET_VARS. The PR correctly identifies these as "app secrets (SOPS path), not platform secrets."Registry ordering -- GOOD. New entries are inserted before the
services:section boundary, maintaining theplatform:grouping.BLOCKERS
None.
NITS
LinkedIn comment placement. The inline comment block in
platform.sls(# LinkedIn OAuth credentials...) appears only abovelinkedin_access_token. Consider whetherzep_api_keywould also benefit from a brief inline comment for consistency with the LinkedIn block (e.g.,# Zep Cloud API key (mirofish agent memory)). Minor -- the registry has this info.Pre-existing:
woodpecker_db_passwordandwoodpecker_agent_secretmissing fromTF_SECRET_VARS. These variables exist invariables.tfbut are absent from the Makefile'sTF_SECRET_VARSlist, meaningmake tofu-secretsdoes not render them. This is NOT introduced by this PR but is worth noting as a pre-existing gap (likely these are passed via-varflags or another mechanism).SOP COMPLIANCE
74-feat-onboard-zep-linkedin-secrets-to-canreferences issue #74)plan-pal-e-platformandsop-secrets-managementtofu planoutput section: Present as a test plan checkbox ("CI tofu plan shows zero diff") rather than actual pasted output. Acceptable since this PR has zero Terraform changes -- there is nothing to plan.tofu fmt/tofu validate: N/A -- no Terraform files changedCloses #74present in Related sectionPROCESS OBSERVATIONS
sop-secrets-managementwas consulted for the platform/app path decision, which is the correct SOP for this type of work.notesfield pointing to the local backup path (~/secrets/mirofish/...,~/secrets/linkedin/...), consistent with the secrets management SOP.VERDICT: APPROVED