coulomb/fluid-telegram
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adopt the confirmed secret layout

Browse source 
platform/workloads/infotech/fluid-telegram/<campaign>/<key>, confirmed with
the owner. The campaign sits between workload and bundle so two campaigns on
one interface cannot read each other's credentials, and both halves stay
overridable because the layout belongs to railiance-platform.

Records what ops-warden is for while it is fresh: it issues SSH certificates
and routes every other credential need to its owner, so it answers how to
authenticate to OpenBao and never holds what is stored there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1361245@bnt-lap001
Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a
This commit is contained in:
tegwick 2026-09-04 23:03:52 +02:00
parent ff2b19456f
commit c2ba960aee
3 changed files with 40 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

20
internal/secrets/secrets.go
View file

@ -54,14 +54,18 @@ func NewFromEnv(campaign string) (*Store, error) {
return nil, fmt.Errorf("no OpenBao token: set BAO_TOKEN, or run `bao login` "+
"to write ~/.vault-token (BAO_ADDR is %s)", addr)
}
// Mount and prefix are configurable because this repo does not get to invent
// the fleet's secret layout. ops-warden routes API-key needs to
// railiance-platform, whose convention is
// platform/workloads/<domain>/<workload>/<bundle> -- see
// ops-warden/wiki/CredentialRouting.md. The defaults below are a local
// fallback for development, not the intended production location.
mount := firstNonEmpty(os.Getenv("BAO_MOUNT"), "secret")
prefix := firstNonEmpty(os.Getenv("FLUID_BAO_PREFIX"), "fluid-telegram/"+campaign+"/telegram")
// The fleet convention, confirmed with the owner:
// platform/workloads/<domain>/<workload>/<bundle>, per
// ops-warden/wiki/CredentialRouting.md and railiance-platform.
//
// The campaign sits between the workload and the bundle so that two
// campaigns on one interface cannot read each other's credentials -- the
// bundle then names the secret itself (operator-app, bot-token, ...).
// Both halves stay overridable: the layout is the owner's to change, not
// this repository's.
mount := firstNonEmpty(os.Getenv("BAO_MOUNT"), "platform")
prefix := firstNonEmpty(os.Getenv("FLUID_BAO_PREFIX"),
"workloads/infotech/fluid-telegram/"+campaign)
return &Store{
addr: strings.TrimSuffix(addr, "/"),
token: token,