c41feaa2f6
All checks were successful
PR build (required check) / changes (pull_request) Successful in 7s
PR build (required check) / build-backend (pull_request) Has been skipped
secrets-guard / encrypted (pull_request) Successful in 8s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 10s
PR build (required check) / gate (pull_request) Successful in 3s
sops (and other user-installed CLI tools) live in ~/.local/bin, which
isn't on systemd --user's default PATH. Once a host is flipped into
SOPS-configured mode (the /etc/thermograph/secrets-env marker),
render-secrets.sh's own render step fails outright ("sops not
installed but this host is configured for SOPS secrets") even though
it's installed for the interactive user -- the runner just can't see
it. Found via the LAN dev daemon crash-looping on a missing
THERMOGRAPH_AUTH_SECRET after dev.yaml correctly gained one.
|
||
|---|---|---|
| .. | ||
| backup | ||
| db | ||
| forgejo | ||
| migrations | ||
| openmeteo | ||
| secrets | ||
| stack | ||
| swarm | ||
| twa | ||
| Caddyfile | ||
| deploy-dev.sh | ||
| deploy.sh | ||
| migrate-db.py | ||
| POSTGRES-MIGRATION.md | ||
| provision-agent-access.sh | ||
| provision-dev-lan.sh | ||
| provision-mail-supervision.sh | ||
| provision-mail.sh | ||
| provision-secrets.sh | ||
| render-secrets.sh | ||
| thermograph-dev.service | ||
| thermograph.env.example | ||
| thermograph.service | ||