coulomb/fluid-telegram
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make the secret layout configuration, not a constant

Browse source 
ops-warden routes API-key needs to railiance-platform, whose convention is
platform/workloads/<domain>/<workload>/<bundle>. This repository invented
secret/fluid-telegram/<campaign>/telegram instead, which is not its call to
make -- a service that picks its own paths in someone else's store is how a
policy ends up written around a mistake.

Mount and prefix are now BAO_MOUNT and FLUID_BAO_PREFIX, with the old scheme
kept as a development fallback. The runbook points at `warden access` for the
current shape and at OIDC login rather than a plain token, and names the
check that tells whether a login actually took.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1361245@bnt-lap001
Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a
This commit is contained in:
tegwick 2026-09-04 22:32:09 +02:00
parent de7a7bdd2a
commit ff2b19456f
3 changed files with 37 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/provisioning.md
View file

@ -118,8 +118,17 @@ Reconciliation is **converging, never destructive**:
Nothing sensitive enters the spec or the resolved state. Both are committed.
Paths are computed as `<mount>/fluid-telegram/<campaign>/telegram/<key>`, so two
campaigns on one interface cannot read each other's credentials.
Paths are `<mount>/<prefix>/<key>`, set by `BAO_MOUNT` and `FLUID_BAO_PREFIX`.
The default (`secret/fluid-telegram/<campaign>/telegram`) is a development
fallback, and the campaign is part of it so that two campaigns on one interface
cannot read each other's credentials.
**This repository does not get to invent the fleet's secret layout.** ops-warden
routes API-key needs to railiance-platform, whose convention is
`platform/workloads/<domain>/<workload>/<bundle>` — see
`ops-warden/wiki/CredentialRouting.md`. The final names are owner-confirmed, so
they are configuration here rather than a constant, and the production values
are settled with railiance-platform before the first apply.
| Secret | Key | Rule |
|---|---|---|

19
docs/seeding-runbook.md
View file

@ -73,7 +73,24 @@ secret/fluid-telegram/hall-of-helix/telegram/bot-token written by the t
secret/fluid-telegram/hall-of-helix/telegram/redaction-salt written by the tool, once
```
Set these before any command below. `BAO_MOUNT` defaults to `secret`.
Those are the **development defaults**. The fleet convention for an API-key
bundle is `platform/workloads/<domain>/<workload>/<bundle>`, owned by
railiance-platform; ask ops-warden for the current shape and override it:
```bash
export BAO_MOUNT=platform
export FLUID_BAO_PREFIX=workloads/infotech/fluid-telegram
```
Authenticate the way ops-warden routes you, which is OIDC through key-cape
rather than a plain token login:
```bash
warden access 'openbao token for reading a kv secret' # shows auth, path, policy
bao login -method=oidc role=<domain>
```
`bao token lookup` succeeding is the check that the login actually took.
```bash
export BAO_ADDR=https://bao.coulomb.social