History

Conrad Kramer 3210570ff3 Some checks failed Build Apple / Build App (iOS Simulator) (push) Waiting to run Details Build Apple / Build App (macOS) (push) Waiting to run Details Build Rust / Cargo Test (push) Successful in 1m3s Details Build Site / Next.js Build (push) Has been cancelled Details Refresh namespace runtime config and linux nix env		2026-03-19 04:23:37 -07:00
..
cloudflare	Rotate operator secrets into agenix and deepen caches	2026-03-19 00:28:18 -07:00
forgejo	Refresh namespace runtime config and linux nix env	2026-03-19 04:23:37 -07:00
forwardemail	Rotate operator secrets into agenix and deepen caches	2026-03-19 00:28:18 -07:00
hetzner	Rotate operator secrets into agenix and deepen caches	2026-03-19 00:28:18 -07:00
README.md	Rotate operator secrets into agenix and deepen caches	2026-03-19 00:28:18 -07:00
secrets.nix	Rotate operator secrets into agenix and deepen caches	2026-03-19 00:28:18 -07:00

README.md

Secrets

Burrow secrets live in secrets/<name>.age and are managed with agenix.

For the Forgejo Namespace Cloud runtime:

secrets/forgejo/admin-password.age
secrets/forgejo/agent-ssh-key.age
secrets/forgejo/nsc-token.age
secrets/forgejo/nsc-dispatcher-config.age
secrets/forgejo/nsc-autoscaler-config.age
secrets/cloudflare/api-token.age
secrets/hetzner/api-token.age
secrets/forwardemail/api-token.age
secrets/forwardemail/hetzner-s3-user.age
secrets/forwardemail/hetzner-s3-secret.age

Use:

make secret name=forgejo/nsc-token
make secret-file name=forgejo/agent-ssh-key file=/path/to/source
Scripts/provision-forgejo-nsc.sh to refresh the Forgejo Namespace token and runtime configs in secrets/forgejo/*.age
make secret-file name=cloudflare/api-token file=/path/to/cloudflare-token.txt
make secret-file name=hetzner/api-token file=/path/to/hetzner-api-token.txt

The forge host decrypts these files at activation time and feeds the resulting paths into services.burrow.forge, services.burrow.forgeRunner, and services.burrow.forgejoNsc.