infra-sync: refuse to render dev's vault onto a host that is not dev #107

Merged

admin_emi merged 1 commit from fix/sync-dev-render-guard into dev

2026-07-26 07:05:11 +00:00

admin_emi commented

2026-07-26 07:04:39 +00:00

Owner

Found while executing the vps1/vps2 cutover, before it could bite.

sync-dev rendered deploy/secrets/dev.yaml into /etc/thermograph.env unconditionally. That path is dev's env file — and it is also beta's, on the box beta is still running on until the cutover completes. The first sync-dev run only escaped this by failing earlier, on the not-yet-created /opt/thermograph-dev. The moment that checkout exists, the next push to dev would have overwritten the live env file of the environment currently serving beta.thermograph.org with dev's credentials — beta's containers would keep running (env_file is read at container start) and then come up on their next deploy pointed at dev's database password.

The fix gates the render on the host's own secrets-env marker, which provision-dev.sh flips to dev only after beta has vacated vps1. Until then the job syncs the checkout and skips the render loudly rather than failing. Ordering is now enforced by the host's own statement of what it is, instead of by remembering to do the steps in the right order.

Also records the constraint in the cutover runbook's step 8, since "the checkout is safe to create early, the marker is not" is exactly the kind of thing that reads as arbitrary later.

No behaviour change once vps1 really is dev.

Found while executing the vps1/vps2 cutover, before it could bite. `sync-dev` rendered `deploy/secrets/dev.yaml` into `/etc/thermograph.env` unconditionally. That path is dev's env file — and it is also **beta's**, on the box beta is still running on until the cutover completes. The first `sync-dev` run only escaped this by failing earlier, on the not-yet-created `/opt/thermograph-dev`. The moment that checkout exists, the next push to `dev` would have overwritten the live env file of the environment currently serving `beta.thermograph.org` with dev's credentials — beta's containers would keep running (`env_file` is read at container start) and then come up on their next deploy pointed at dev's database password. The fix gates the render on the host's own `secrets-env` marker, which `provision-dev.sh` flips to `dev` only after beta has vacated vps1. Until then the job syncs the checkout and skips the render loudly rather than failing. Ordering is now enforced by the host's own statement of what it is, instead of by remembering to do the steps in the right order. Also records the constraint in the cutover runbook's step 8, since "the checkout is safe to create early, the marker is not" is exactly the kind of thing that reads as arbitrary later. No behaviour change once vps1 really is dev.

admin_emi added 1 commit 2026-07-26 07:04:40 +00:00

infra-sync: refuse to render dev's vault onto a host that is not dev

PR build (required check) / changes (pull_request) Successful in 6s

Details

secrets-guard / encrypted (pull_request) Successful in 5s

Details

PR build (required check) / build-backend (pull_request) Has been skipped

Details

shell-lint / shellcheck (pull_request) Successful in 6s

Details

PR build (required check) / build-frontend (pull_request) Has been skipped

Details

PR build (required check) / validate-observability (pull_request) Has been skipped

Details

PR build (required check) / gate (pull_request) Successful in 1s

Details

e393a7a111

sync-dev rendered deploy/secrets/dev.yaml into /etc/thermograph.env
unconditionally. That path is dev's env file — and it is also BETA's, on the
box beta is still running on until the cutover completes. With the dev checkout
present, the next push to dev would have overwritten the live env file of the
environment currently serving beta.thermograph.org: its containers would keep
running (env_file is read at container start) and then come up on the next
deploy pointed at dev's database password.

The earlier run only escaped this by failing first on the missing checkout.

Gate the render on the host's own secrets-env marker, which provision-dev.sh
flips to 'dev' only after beta has vacated. Until then the job syncs the
checkout and skips the render loudly rather than failing, so the ordering is
enforced by the host's own statement of what it is rather than by remembering
to do the steps in the right order.