chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 11:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

chore: restore vault_db_master.yml for update.sh master-pw rotation

Browse Source 
The ansible excision in 5a769f2 was correct in scope -- no more host
inventory, no playbooks, no roles -- except it took out the one file
update.sh depends on for master DB password rotation:
infrastructure/inventory/group_vars/all/vault_db_master.yml

update.sh(1) reads this file (ansible-vault encrypted) at the start of
every run to decrypt the master password used to rotate k8s DB secrets
(knoe-db-user/superuser/knoe), ALTER ROLE on CNPG primary for the
prole/postgres/knoe/authenticator users, and reset Grafana admin creds.
With the vault file gone, update.sh failed with
    ERROR: Vault file not found: .../vault_db_master.yml
and took down the tail of deploy.sh.

Restored from the parent commit of 5a769f2 verbatim -- content is
already ansible-vault AES256 encrypted, so it's safe to carry in a
private repo. The `.vault_pass` file that decrypts it remains
gitignored (never committed). Broader `infrastructure/` stays gone.

TODO (deferred): migrate this one remaining ansible-vault secret to
either OpenBao or a k8s Secret so knoe-db doesn't retain a residual
ansible-vault dependency surface. Tracked in our pending work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
chrisfu 2026-04-21 00:48:44 -07:00
parent 1b08f72538
commit 47d906cc28
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
infrastructure/inventory/group_vars/all/vault_db_master.yml Normal file
View File

@ -0,0 +1,8 @@
$ANSIBLE_VAULT;1.1;AES256
33623434353765353030333339626631656163343239353230643430356466306461663835383566
3564333737623034343837616632386462306462366538390a623538373034383839376261653734
36653238393437656332373965663866653730343864333063366462303661356366323262363839
3961633266353131310a313930346164393031623037393339356539616639343536353163343036
61353535633234363535633437356162626234356139323531643534613961633166393135356562
30306634646130353665656262393132656632373634353765316630643665356331363435366165
356261383336383736336336356564386337