trails/openspec/changes/sops-age-split-cd/.openspec.yaml at 57094323d2fa6bcc6c8457fd7b9dcb224aef84f1 - trails-cool/trails - Forgejo: Beyond coding. We forge.

trails-cool/trails

Ullrich Schäfer 57094323d2

SOPS+age secrets, split CD workflows, GitHub OAuth for Grafana

Secrets:
- Add .sops.yaml with age encryption config
- Add encrypted secrets.app.env (app secrets) and secrets.infra.env (Grafana OAuth)
- CD decrypts at deploy time with AGE_SECRET_KEY — all other secrets
  move out of GitHub Actions into version-controlled encrypted files

Split CD:
- cd-apps.yml: triggered by apps/packages changes, builds Docker images, deploys apps
- cd-infra.yml: triggered by infrastructure/ changes, copies configs, restarts services
- Remove monolithic cd.yml

Grafana auth:
- GitHub OAuth (trails-cool org), disable login form
- Remove Caddy basic_auth block and all GRAFANA_* env vars/secrets

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-27 17:28:04 +01:00

2 lines

40 B

YAML

Raw Blame History

	`schema: spec-driven`
	`created: 2026-03-27`