trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add BROUTER_AUTH_TOKEN to app secrets (SOPS)

Browse source 
Adds the shared-secret header value consumed by the Planner
(as X-BRouter-Auth outbound) and by the BRouter host's Caddy
sidecar (enforced inbound). Lives in secrets.app.env only;
cd-brouter.yml will also read from this file, making it the
single source of truth. secrets.infra.env is intentionally NOT
updated — cd-infra no longer touches BRouter after the move.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-04-23 22:34:51 +02:00
parent f0fe6abfa4
commit 12010b48c2
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
2 changed files with 28 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

10
openspec/changes/relocate-brouter-to-dedicated-host/tasks.md
View file

@ -19,10 +19,12 @@
## 2. Secrets and config
- [ ] 2.1 Generate a 32-byte random `BROUTER_AUTH_TOKEN`
- [ ] 2.2 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.infra.env` (SOPS) and commit the re-encrypted file
- [ ] 2.3 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.app.env` (SOPS) for the Planner
- [ ] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`
- [x] 2.1 Generate a 32-byte random `BROUTER_AUTH_TOKEN`
- `openssl rand -base64 32`; active token lives only in SOPS and the operator's clipboard history. Rotate by regenerating and re-running 2.3.
- [ ] ~~2.2 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.infra.env` (SOPS)~~ **obsoleted** — after relocation, `cd-infra` no longer deploys BRouter and therefore doesn't need the token. `cd-brouter` reads it from `secrets.app.env` instead (see 5.1). Single source of truth.
- [x] 2.3 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.app.env` (SOPS) for the Planner
- Token added via `sops -d | append | sops -e`; round-trip decrypt confirms. Committed in this branch.
- [ ] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`, `BROUTER_DEPLOY_SSH_PORT`
- [ ] 2.5 Document the rotation runbook in `docs/deployment.md` (or equivalent)
## 3. BRouter host compose project