coulomb/fluid-telegram
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make the secret layout configuration, not a constant

Browse source 
ops-warden routes API-key needs to railiance-platform, whose convention is
platform/workloads/<domain>/<workload>/<bundle>. This repository invented
secret/fluid-telegram/<campaign>/telegram instead, which is not its call to
make -- a service that picks its own paths in someone else's store is how a
policy ends up written around a mistake.

Mount and prefix are now BAO_MOUNT and FLUID_BAO_PREFIX, with the old scheme
kept as a development fallback. The runbook points at `warden access` for the
current shape and at OIDC login rather than a plain token, and names the
check that tells whether a login actually took.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1361245@bnt-lap001
Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a
This commit is contained in:
tegwick 2026-09-04 22:32:09 +02:00
parent de7a7bdd2a
commit ff2b19456f
3 changed files with 37 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
internal/secrets/secrets.go
View file

@ -54,12 +54,19 @@ func NewFromEnv(campaign string) (*Store, error) {
return nil, fmt.Errorf("no OpenBao token: set BAO_TOKEN, or run `bao login` "+
"to write ~/.vault-token (BAO_ADDR is %s)", addr)
}
// Mount and prefix are configurable because this repo does not get to invent
// the fleet's secret layout. ops-warden routes API-key needs to
// railiance-platform, whose convention is
// platform/workloads/<domain>/<workload>/<bundle> -- see
// ops-warden/wiki/CredentialRouting.md. The defaults below are a local
// fallback for development, not the intended production location.
mount := firstNonEmpty(os.Getenv("BAO_MOUNT"), "secret")
prefix := firstNonEmpty(os.Getenv("FLUID_BAO_PREFIX"), "fluid-telegram/"+campaign+"/telegram")
return &Store{
addr: strings.TrimSuffix(addr, "/"),
token: token,
mount: mount,
prefix: "fluid-telegram/" + campaign + "/telegram",
prefix: strings.Trim(prefix, "/"),
hc: &http.Client{Timeout: 20 * time.Second},
}, nil
}