forgejo_admin/pal-e-platform
1
0
Fork 1
Code Issues 33 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Onboard 5 secrets to Salt pillar pipeline #45

Merged
forgejo_admin merged 2 commits from 44-onboard-keycloak-paledocs-secrets-to-sal into main 2026-03-14 15:59:50 +00:00
Conversation 1 Commits 2 Files changed 4 +209 -1
forgejo_admin commented 2026-03-14 15:08:46 +00:00
Owner
Copy link

Summary

  • GPG-encrypt 5 secrets into salt/pillar/secrets/platform.sls (keycloak, paledocs DB, slack webhook, telegram bot token, telegram chat ID)
  • Add all 5 to TF_SECRET_VARS in Makefile (10 → 15 secrets)
  • Add metadata entries to secrets_registry.sls
  • Add ## Secrets Architecture section to README documenting the full pipeline

Changes

  • salt/pillar/secrets/platform.sls — 5 new GPG-encrypted secret blocks
  • salt/pillar/secrets_registry.sls — 5 new metadata entries with origin, rotation, notes
  • Makefile — TF_SECRET_VARS expanded from 10 to 15 entries
  • README.md — New Secrets Architecture section (pipeline diagram, components table, adding-a-secret procedure, GPG key info, current secret count)

Terraform Changes

No infrastructure changes. This PR only affects the secrets rendering pipeline:

  • make tofu-secrets will now render 15 vars instead of 10
  • make tofu-plan / make tofu-apply no longer require manual -var flags

Test Plan

  • make tofu-secrets completes without error (requires sudo -v first)
  • grep -c '=' terraform/secrets.auto.tfvars returns 15
  • make tofu-plan succeeds with no missing variable errors

Review Checklist

  • No plaintext secret values in any committed file
  • All GPG blocks encrypted with key 81A03D1CF874DC90
  • TF_SECRET_VARS matches variable names in variables.tf
  • Registry entries have accurate origin and rotation metadata

Discovered Scope

  • Phase 6.4 (apply-on-merge CI) needs these same secrets as Woodpecker TF_VAR_* env vars — separate issue

Related

  • Issue #32 / PR #34 — keycloak_admin_password gap origin
  • PR #23 — paledocs_db_password gap origin
  • PR #35 — slack_webhook_url gap origin
  • PR #43 — telegram_bot_token + telegram_chat_id gap origin
  • sop-secrets-management — the public SOP

Closes #44

🤖 Generated with Claude Code

## Summary - GPG-encrypt 5 secrets into `salt/pillar/secrets/platform.sls` (keycloak, paledocs DB, slack webhook, telegram bot token, telegram chat ID) - Add all 5 to `TF_SECRET_VARS` in Makefile (10 → 15 secrets) - Add metadata entries to `secrets_registry.sls` - Add `## Secrets Architecture` section to README documenting the full pipeline ## Changes - `salt/pillar/secrets/platform.sls` — 5 new GPG-encrypted secret blocks - `salt/pillar/secrets_registry.sls` — 5 new metadata entries with origin, rotation, notes - `Makefile` — `TF_SECRET_VARS` expanded from 10 to 15 entries - `README.md` — New Secrets Architecture section (pipeline diagram, components table, adding-a-secret procedure, GPG key info, current secret count) ## Terraform Changes No infrastructure changes. This PR only affects the secrets rendering pipeline: - `make tofu-secrets` will now render 15 vars instead of 10 - `make tofu-plan` / `make tofu-apply` no longer require manual `-var` flags ## Test Plan - [ ] `make tofu-secrets` completes without error (requires `sudo -v` first) - [ ] `grep -c '=' terraform/secrets.auto.tfvars` returns 15 - [ ] `make tofu-plan` succeeds with no missing variable errors ## Review Checklist - [ ] No plaintext secret values in any committed file - [ ] All GPG blocks encrypted with key `81A03D1CF874DC90` - [ ] `TF_SECRET_VARS` matches variable names in `variables.tf` - [ ] Registry entries have accurate origin and rotation metadata ## Discovered Scope - Phase 6.4 (apply-on-merge CI) needs these same secrets as Woodpecker `TF_VAR_*` env vars — separate issue ## Related - Issue #32 / PR #34 — keycloak_admin_password gap origin - PR #23 — paledocs_db_password gap origin - PR #35 — slack_webhook_url gap origin - PR #43 — telegram_bot_token + telegram_chat_id gap origin - `sop-secrets-management` — the public SOP Closes #44 🤖 Generated with [Claude Code](https://claude.com/claude-code)
GPG-encrypt and add to platform.sls:
- keycloak_admin_password (gap since PR #34)
- paledocs_db_password (gap since PR #23)
- slack_webhook_url (gap since PR #35, dormant/empty)
- telegram_bot_token (gap since PR #43)
- telegram_chat_id (gap since PR #43)

All 5 added to TF_SECRET_VARS in Makefile (10 → 15 secrets).
All 5 registered in secrets_registry.sls with metadata.
README updated with Secrets Architecture section documenting
the full pipeline: Salt pillar → GPG → Makefile → tfvars → tofu.

`make tofu-secrets` now renders all 15 secrets. No more manual
`-var` flags needed for any tofu plan/apply.

Closes #44

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
forgejo_admin commented 2026-03-14 15:10:48 +00:00
Author
Owner
Copy link

PR #45 Review

BLOCKERS

  1. Missing woodpecker_api_token registry entry. This PR adds a GPG block for woodpecker_api_token to salt/pillar/secrets/platform.sls (line 145-164), but there is no corresponding metadata entry in salt/pillar/secrets_registry.sls. Every other secret in the pillar has a registry entry. The registry tracks origin, rotation schedule, and notes -- omitting this breaks the "Adding a New Secret" procedure documented in the README (step 4). Add a woodpecker_api_token entry to the platform: section of secrets_registry.sls.

NITS

  1. PR title/body count mismatch. The title says "Onboard 5 secrets" and the body lists keycloak, paledocs DB, slack webhook, telegram bot token, telegram chat ID. But the diff actually adds 6 GPG blocks to platform.sls -- the 6th being woodpecker_api_token, which was previously in TF_SECRET_VARS and variables.tf but had no encrypted value in the pillar. Consider updating the title/body to say "6 secrets" or at minimum noting the woodpecker_api_token gap fix in the Changes section.

  2. README categorization could be more precise. "Platform (12)" lumps woodpecker_api_token (a CI concern) in with infrastructure secrets. Not blocking, but a note like "Platform/CI (12)" or splitting CI out would be clearer. Minor.

SOP COMPLIANCE

  • Branch named after issue (44-onboard-keycloak-paledocs-secrets-to-sal references #44)
  • PR body follows template (Summary, Changes, Test Plan, Related all present)
  • Closes #44 present in PR body
  • Related section does not reference plan-pal-e-platform (the parent plan)
  • No plaintext secrets committed -- all 16 GPG blocks properly formatted with matching BEGIN/END markers
  • All GPG blocks encrypted with key 81A03D1CF874DC90 (verified via encoded key ID prefix)
  • TF_SECRET_VARS in Makefile (15 entries) matches variables.tf declarations (15 variable blocks, excluding woodpecker_agent_secret which is Salt-only)
  • Registry entries have proper metadata (origin, description, created date, rotation_days, notes) for all 5 new secrets
  • README Secrets Architecture section is accurate (pipeline diagram, components table, procedure, GPG key info, count of 15)
  • No scope creep -- all changes directly serve secret onboarding
  • terraform/secrets.auto.tfvars is gitignored via *.tfvars pattern in .gitignore

VERDICT: NOT APPROVED

One blocker: woodpecker_api_token needs a registry entry in secrets_registry.sls to match every other secret in the pipeline. Fix that and this is ready to merge.

## PR #45 Review ### BLOCKERS 1. **Missing `woodpecker_api_token` registry entry.** This PR adds a GPG block for `woodpecker_api_token` to `salt/pillar/secrets/platform.sls` (line 145-164), but there is no corresponding metadata entry in `salt/pillar/secrets_registry.sls`. Every other secret in the pillar has a registry entry. The registry tracks origin, rotation schedule, and notes -- omitting this breaks the "Adding a New Secret" procedure documented in the README (step 4). Add a `woodpecker_api_token` entry to the `platform:` section of `secrets_registry.sls`. ### NITS 1. **PR title/body count mismatch.** The title says "Onboard 5 secrets" and the body lists keycloak, paledocs DB, slack webhook, telegram bot token, telegram chat ID. But the diff actually adds 6 GPG blocks to `platform.sls` -- the 6th being `woodpecker_api_token`, which was previously in `TF_SECRET_VARS` and `variables.tf` but had no encrypted value in the pillar. Consider updating the title/body to say "6 secrets" or at minimum noting the `woodpecker_api_token` gap fix in the Changes section. 2. **README categorization could be more precise.** "Platform (12)" lumps `woodpecker_api_token` (a CI concern) in with infrastructure secrets. Not blocking, but a note like "Platform/CI (12)" or splitting CI out would be clearer. Minor. ### SOP COMPLIANCE - [x] Branch named after issue (`44-onboard-keycloak-paledocs-secrets-to-sal` references #44) - [x] PR body follows template (Summary, Changes, Test Plan, Related all present) - [x] `Closes #44` present in PR body - [ ] Related section does not reference `plan-pal-e-platform` (the parent plan) - [x] No plaintext secrets committed -- all 16 GPG blocks properly formatted with matching BEGIN/END markers - [x] All GPG blocks encrypted with key `81A03D1CF874DC90` (verified via encoded key ID prefix) - [x] `TF_SECRET_VARS` in Makefile (15 entries) matches `variables.tf` declarations (15 variable blocks, excluding `woodpecker_agent_secret` which is Salt-only) - [x] Registry entries have proper metadata (origin, description, created date, rotation_days, notes) for all 5 new secrets - [x] README Secrets Architecture section is accurate (pipeline diagram, components table, procedure, GPG key info, count of 15) - [x] No scope creep -- all changes directly serve secret onboarding - [x] `terraform/secrets.auto.tfvars` is gitignored via `*.tfvars` pattern in `.gitignore` ### VERDICT: NOT APPROVED One blocker: `woodpecker_api_token` needs a registry entry in `secrets_registry.sls` to match every other secret in the pipeline. Fix that and this is ready to merge.
Pre-existing gap caught by QA. The GPG block existed in platform.sls
and the var was in TF_SECRET_VARS, but the metadata entry in
secrets_registry.sls was missing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
forgejo_admin deleted branch 44-onboard-keycloak-paledocs-secrets-to-sal 2026-03-14 15:59:50 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
domain:backend

   
domain:devops

   
domain:frontend

   
status:approved

QA passed, awaiting merge approval

  
status:in-progress

Dev agent is actively working

  
status:needs-fix

QA found issues, back to dev

  
status:qa

PR submitted, awaiting QA review

  
type:bug

Bug fix

  
type:devops

Infrastructure/CI/config work

  
type:feature

New functionality

No labels
domain:backend
domain:devops
domain:frontend
status:approved
status:in-progress
status:needs-fix
status:qa
type:bug
type:devops
type:feature
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
forgejo_admin/pal-e-platform!45
No description provided.