trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/changes/sops-age-split-cd/tasks.md
Ullrich Schäfer 57094323d2
SOPS+age secrets, split CD workflows, GitHub OAuth for Grafana 
Secrets:
- Add .sops.yaml with age encryption config
- Add encrypted secrets.app.env (app secrets) and secrets.infra.env (Grafana OAuth)
- CD decrypts at deploy time with AGE_SECRET_KEY — all other secrets
  move out of GitHub Actions into version-controlled encrypted files

Split CD:
- cd-apps.yml: triggered by apps/packages changes, builds Docker images, deploys apps
- cd-infra.yml: triggered by infrastructure/ changes, copies configs, restarts services
- Remove monolithic cd.yml

Grafana auth:
- GitHub OAuth (trails-cool org), disable login form
- Remove Caddy basic_auth block and all GRAFANA_* env vars/secrets

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 17:28:04 +01:00

2.3 KiB
Raw Blame History

1. SOPS + age Setup

  • 1.1 Generate age key pair (age-keygen), store public key in .sops.yaml, private key as AGE_SECRET_KEY GitHub secret
  • 1.2 Create .sops.yaml at repo root with age encryption rule for secrets.*.env
  • 1.3 Create infrastructure/secrets.app.env with app secrets (POSTGRES_PASSWORD, JWT_SECRET, SESSION_SECRET, SMTP_URL, SMTP_FROM, SENTRY_AUTH_TOKEN, DEPLOY_GHCR_TOKEN), encrypt with sops -e
  • 1.4 Create infrastructure/secrets.infra.env with infra secrets (GF_AUTH_GITHUB_CLIENT_ID, GF_AUTH_GITHUB_CLIENT_SECRET), encrypt with sops -e
  • 1.5 Remove migrated secrets from GitHub Actions (keep only AGE_SECRET_KEY, DEPLOY_SSH_KEY, DEPLOY_HOST)

2. GitHub OAuth for Grafana

  • 2.1 Register GitHub OAuth app (callback: grafana.internal.trails.cool/login/github)
  • 2.2 Add GF_AUTH_GITHUB_CLIENT_ID and GF_AUTH_GITHUB_CLIENT_SECRET to secrets.env
  • 2.3 Update docker-compose.yml: add GitHub OAuth env vars to Grafana, remove GF_SECURITY_ADMIN_USER/PASSWORD
  • 2.4 Update Caddyfile: remove basic_auth block for grafana.internal, just reverse_proxy
  • 2.5 Remove Caddy GRAFANA_USER/GRAFANA_PASSWORD_HASH env vars from docker-compose.yml

3. Split CD Workflows

  • 3.1 Create .github/workflows/cd-apps.yml — triggered by apps/, packages/, pnpm-lock.yaml changes
  • 3.2 Create .github/workflows/cd-infra.yml — triggered by infrastructure/ changes
  • 3.3 Add sops + age install step to both workflows
  • 3.4 cd-apps decrypt step: sops -d secrets.app.env > .env, SCP to server
  • 3.5 cd-infra decrypt step: merge secrets.app.env + secrets.infra.env into .env, SCP to server
  • 3.6 cd-apps: build images, push, SSH deploy (pull, migrate, restart apps)
  • 3.7 cd-infra: copy configs, SSH deploy (restart infra services)
  • 3.8 Remove old cd.yml workflow
  • 3.9 Remove GRAFANA_* exports and password reset from deploy script
  • 3.10 Both workflows use docker compose --env-file .env up -d instead of inline exports

4. Verify

  • 4.1 Test sops encrypt/decrypt cycle locally
  • 4.2 Test cd-apps deploys only on app changes (not infra)
  • 4.3 Test cd-infra deploys only on infra changes (not apps)
  • 4.4 Test Grafana GitHub OAuth login
  • 4.5 Verify old GitHub secrets can be removed after migration