hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Rotate operator secrets into agenix and deepen caches
Some checks failed
Build Rust / Cargo Test (push) Waiting to run
Details
Build Site / Next.js Build (push) Waiting to run
Details
Build Apple / Build App (iOS Simulator) (push) Failing after 52s
Details
Build Apple / Build App (macOS) (push) Failing after 1m1s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-03-19 00:28:18 -07:00
parent 7039bf5aad
commit 03415e579b
28 changed files with 526 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

8
secrets/README.md
View file

@ -9,11 +9,19 @@ For the Forgejo Namespace Cloud runtime:
- `secrets/forgejo/nsc-token.age`
- `secrets/forgejo/nsc-dispatcher-config.age`
- `secrets/forgejo/nsc-autoscaler-config.age`
- `secrets/cloudflare/api-token.age`
- `secrets/hetzner/api-token.age`
- `secrets/forwardemail/api-token.age`
- `secrets/forwardemail/hetzner-s3-user.age`
- `secrets/forwardemail/hetzner-s3-secret.age`
Use:
- `make secret name=forgejo/nsc-token`
- `make secret-file name=forgejo/agent-ssh-key file=/path/to/source`
- `Scripts/provision-forgejo-nsc.sh` to refresh the Forgejo Namespace token and runtime configs in `secrets/forgejo/*.age`
- `make secret-file name=cloudflare/api-token file=/path/to/cloudflare-token.txt`
- `make secret-file name=hetzner/api-token file=/path/to/hetzner-api-token.txt`
The forge host decrypts these files at activation time and feeds the resulting
paths into `services.burrow.forge`, `services.burrow.forgeRunner`, and