trails/openspec/specs/secret-management/spec.md at acb92b32fa03c54f87d9dfad0e4d20a7a742bf5f

Ullrich Schäfer 0b9b99984e Fix all OpenSpec validation failures (36/36 passing)

- Add ## Purpose sections and convert delta headers to ## Requirements
  on all 25 specs
- Add SHALL keywords to requirements missing them (gpx-import,
  planner-session, planner-journal-handoff)
- Convert prose GPX format section to proper scenarios (no-go-areas)
- Create specs/ delta files for 7 changes that were missing them
  (activity-photos, local-dev-stack, multi-day-routes, route-discovery,
  route-sharing, visual-redesign, waypoint-notes)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-06 22:17:52 +02:00

1.1 KiB

Raw Blame History

Purpose

SOPS-encrypted secrets stored in the repository, split into app and infra files, decryptable with a single age key at deploy time.

Requirements

Requirement: Encrypted secrets in repository

Production secrets SHALL be stored as SOPS-encrypted files in the repository, decryptable only with a single age private key. Secrets are split into two files: secrets.app.env (application secrets) and secrets.infra.env (infrastructure secrets).

Scenario: Edit secrets

WHEN a developer runs sops infrastructure/secrets.app.env or sops infrastructure/secrets.infra.env
THEN the file is decrypted in a temporary editor, and re-encrypted on save

Scenario: CD decryption

WHEN the CD workflow runs
THEN both encrypted secrets files are decrypted using the AGE_SECRET_KEY GitHub secret and merged at deploy time as env files for docker-compose

Scenario: Secret audit trail

WHEN a secret is changed
THEN the change appears in git history as a diff of the encrypted file with a commit message describing what changed

1.1 KiB Raw Blame History