trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/specs/secret-management/spec.md
Ullrich Schäfer 424e692ee0
Add service health monitoring: postgres, node, cAdvisor exporters + dashboard 
Exporters:
- postgres_exporter: DB connections, transactions, cache hit ratio, query stats
- node_exporter: host CPU, memory, disk, network
- cAdvisor: per-container CPU and memory usage

PostgreSQL:
- Enable pg_stat_statements for query-level performance tracking
- Track index scans vs sequential scans, cache hit ratio

Dashboard (service-health.json):
- DB: connections, size, transactions/s, slow queries, cache hit ratio, index usage
- Host: disk gauge, CPU, memory, network I/O, disk I/O
- BRouter: request latency p50/p95/p99, container CPU + memory
- All containers: CPU and memory comparison

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 18:50:42 +01:00

752 B
Raw Blame History

Requirements

Requirement: Encrypted secrets in repository

Production secrets SHALL be stored as a SOPS-encrypted file in the repository, decryptable only with a single age private key.

Scenario: Edit secrets

  • WHEN a developer runs sops infrastructure/secrets.env
  • THEN the file is decrypted in a temporary editor, and re-encrypted on save

Scenario: CD decryption

  • WHEN the CD workflow runs
  • THEN the encrypted secrets file is decrypted using the AGE_SECRET_KEY GitHub secret and provided to docker-compose as an env file

Scenario: Secret audit trail

  • WHEN a secret is changed
  • THEN the change appears in git history as a diff of the encrypted file with a commit message describing what changed