trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(staging): enable federation on persistent staging

Browse source 
social-federation rollout step 12.2 — inbound soak. Persistent staging
gets FEDERATION_ENABLED=true; PR previews keep the flag empty so
preview journals never emit federation traffic.

- docker-compose.staging.yml: journal accepts FEDERATION_ENABLED +
  FEDERATION_KEY_ENCRYPTION_KEY (both default empty).
- cd-staging.yml: persistent staging env sets FEDERATION_ENABLED=true;
  the encryption key arrives via the existing SOPS decryption.
- secrets.app.env: new FEDERATION_KEY_ENCRYPTION_KEY (SOPS-encrypted,
  generated with openssl rand -hex 32).

Production is unaffected: the flagship compose doesn't pass these vars
and the flag defaults off in code.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-06-06 15:45:44 +02:00
parent bec249f93f
commit 57f9440cf5
3 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
infrastructure/docker-compose.staging.yml
View file

@ -61,6 +61,11 @@ services:
WAHOO_CLIENT_SECRET: ""
WAHOO_WEBHOOK_TOKEN: ""
DEMO_BOT_ENABLED: ""
# Federation soak (social-federation rollout step 12.2). Enabled by
# cd-staging.yml for persistent staging only; PR previews leave both
# empty (flag off) so preview journals never emit federation traffic.
FEDERATION_ENABLED: ${FEDERATION_ENABLED:-}
FEDERATION_KEY_ENCRYPTION_KEY: ${FEDERATION_KEY_ENCRYPTION_KEY:-}
healthcheck:
test: ["CMD-SHELL", "curl -sf http://localhost:3000/api/health || exit 1"]
interval: 15s

5
infrastructure/secrets.app.env
View file

@ -19,9 +19,10 @@ DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:TBs=,iv:nSHXlED3C4CXGIPTZcNeB81FEtmL
DEMO_BOT_REGION=ENC[AES256_GCM,data:fo5W9GNkYvCz5vx/OAISKzuXoIh5peNV3C73Z4aFIp+FCQ==,iv:THo3TcutFEdtBamnBxwS0SU3jYOmuAFdeoiOUxSVS4E=,tag:aoNkh4xIOr2dTW7UZeCPeA==,type:str]
BROUTER_AUTH_TOKEN=ENC[AES256_GCM,data:U+oiuOkJQAO0LHIAlyjemObTL7hZlDS5XYdtFuWZx5ZWZodxVASeHYZAJXw=,iv:tHspZedPIpdPM4G7z/WlwtH/gLszgH/lS8DsKdtaYoc=,tag:BCfL7Qrr7GGQGQPIl+hZyQ==,type:str]
BROUTER_URL=ENC[AES256_GCM,data:0ZB+DOVrJEiSrOdig0sea4fazkAT3Q==,iv:MoTSlxF8vqv/+FXUUpFlp/W3wedypcMwHwsc5uhruWA=,tag:Z+UpkmbsFM2D6l+hYcugpw==,type:str]
FEDERATION_KEY_ENCRYPTION_KEY=ENC[AES256_GCM,data:XZU3Dqe6kZYko7beVSuMPEAghase1EfxSSMOk2JBZJjyuFPMvhCpvlP0EI6uR02G4JYiqOB+ocirmOIIC5BlSw==,iv:SQDVam6ZzooQrdDExNKLoJHoe7eX5G9NVkQhvZjWC/I=,tag:/AP4JNosAOqrYiOfG5mXUg==,type:str]
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeDhnUTEzNDk5N1ZPSGFZ\nWjhFaEk3ZC9ackk4UTRaTFNuVkFnTmhXdEVZCnhjU0lFdHJ4dVpjSFYveFhFZmZN\neE0rMEZSNjBNU0RSeWloR2pYQmhlL0UKLS0tIGs5ZzVKbzN3WDBUQkZMSjBJQ0tr\nYkdBRHJra3daMVpSY1JIS2E3cHQyaG8Ky0cBnpRibgbX4famAtqxjc1oGvy5DuO9\nzk6zIQhM99XIoF7W/wn3JF6hPNSBOy7Bd7wVPUVVoE/uE0pIB+VSxQ==\n-----END AGE ENCRYPTED FILE-----\n
sops_age__list_0__map_recipient=age1vukt8py0s2mm47fx6qh6vykckfkdqslf9w68ekytfzvc8xp7e3rqn6p64n
sops_lastmodified=2026-05-23T19:05:37Z
sops_mac=ENC[AES256_GCM,data:yxghS3UGqoKPi3PBPccezuGb/8KsyYGmZ2NVbx4/JNMvJTs/75E2u5H7IKcs77+zVpjT9rk0BoCGF5ryXQcpHgSuttVBvU5fLsg5OcyfkVEn09bbsV1Wf6pKqKzeZdPocVtnplyqbF4Bvha04Q4lsfKNSnVDwYnf9qs6w+A4WFo=,iv:mahufs1RVuAwHrrShCIYPgISbGaO3NJ38pYvu3v3Nn4=,tag:eYcDjvPajPcNin7BC+RqlA==,type:str]
sops_lastmodified=2026-06-06T13:44:40Z
sops_mac=ENC[AES256_GCM,data:QwwhtiVBfNb0LrEkJCR07UYxYuJ46fLnXAl5LnTAdeM1J4WdNrvBhAiKyUe0JGnvB6yMKqScf40fW6s9iEuobuTUYqeU+eiTzHh6MvhW5C9m95nrqBKtefIW+ji8pPS4BT9fjD0q2jOcBlSnRku2K2OKYsx9l+Sf6TZxT2V4EMY=,iv:r9fJyLyL24lYZmksv6VjZB9sVi0i6uZk0glAYzhBOBE=,tag:f+/0OfKsfvJMqUY79QbPKw==,type:str]
sops_unencrypted_suffix=_unencrypted
sops_version=3.12.2