73cd6b7aae
Some checks failed
PR build (required check) / changes (pull_request) Successful in 26s
secrets-guard / encrypted (pull_request) Successful in 10s
shell-lint / shellcheck (pull_request) Failing after 14s
PR build (required check) / validate-observability (pull_request) Successful in 1m5s
PR build (required check) / build-frontend (pull_request) Successful in 3m47s
PR build (required check) / build-backend (pull_request) Successful in 4m44s
PR build (required check) / gate (pull_request) Successful in 6s
Docker on the LAN box is the snap package, sandboxed to $HOME (plus a short allowlist) -- it can't see /etc/thermograph.env at all, so env_file: /etc/thermograph.env silently loads nothing for every container there, no matter how correctly the vault renders. Confirmed directly: `docker run --env-file /etc/thermograph.env` fails with "no such file or directory" on a file the shell reads fine; the same file under $HOME loads correctly. render-secrets.sh gains an opt-in second write (THERMOGRAPH_SECRETS_ENV_FILE_MIRROR), deploy-dev.sh points it at infra/deploy/dev-secrets.env (gitignored, re-rendered every deploy), and docker-compose.dev.yml adds it as a second env_file entry for backend/daemon/lake -- compose appends env_file lists across overlays, so this is additive and prod/beta (which never set the mirror var) are unaffected.
33 lines
1 KiB
Text
33 lines
1 KiB
Text
# Terraform state/vars are also ignored inside terraform/.gitignore; repeated here
|
|
# in case a stray file ever lands at repo root.
|
|
*.tfstate
|
|
*.tfstate.*
|
|
.terraform/
|
|
*.tfvars
|
|
!*.tfvars.example
|
|
crash.log
|
|
crash.*.log
|
|
|
|
# The SOPS+age private key must never be committed (deploy/secrets/*.yaml, the
|
|
# encrypted values, are meant to be committed).
|
|
age.key
|
|
*.age.key
|
|
|
|
.DS_Store
|
|
|
|
# lake-iceberg's pytest suite runs in place.
|
|
__pycache__/
|
|
*.pyc
|
|
|
|
# Host-side deploy state (deploy.sh): the live per-service image tags and the
|
|
# cross-repo deploy lock. Untracked on purpose -- they must survive the
|
|
# `git reset --hard` at the top of every deploy (deploy.sh's comments already
|
|
# assumed .image-tags.env was ignored; make it actually true so a stray
|
|
# `git clean` can't destroy the record of what's running).
|
|
deploy/.image-tags.env
|
|
deploy/.deploy.lock
|
|
deploy/.stack-image-tags.env
|
|
|
|
# LAN dev's mirror of the rendered secrets, for snap-confined Docker (see
|
|
# deploy-dev.sh / render-secrets.sh) -- plaintext, re-rendered every deploy.
|
|
deploy/dev-secrets.env
|