mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
47d906cc28
The ansible excision in5a769f2was correct in scope -- no more host inventory, no playbooks, no roles -- except it took out the one file update.sh depends on for master DB password rotation: infrastructure/inventory/group_vars/all/vault_db_master.yml update.sh(1) reads this file (ansible-vault encrypted) at the start of every run to decrypt the master password used to rotate k8s DB secrets (knoe-db-user/superuser/knoe), ALTER ROLE on CNPG primary for the prole/postgres/knoe/authenticator users, and reset Grafana admin creds. With the vault file gone, update.sh failed with ERROR: Vault file not found: .../vault_db_master.yml and took down the tail of deploy.sh. Restored from the parent commit of5a769f2verbatim -- content is already ansible-vault AES256 encrypted, so it's safe to carry in a private repo. The `.vault_pass` file that decrypts it remains gitignored (never committed). Broader `infrastructure/` stays gone. TODO (deferred): migrate this one remaining ansible-vault secret to either OpenBao or a k8s Secret so knoe-db doesn't retain a residual ansible-vault dependency surface. Tracked in our pending work. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
9 lines
549 B
YAML
9 lines
549 B
YAML
$ANSIBLE_VAULT;1.1;AES256
|
|
33623434353765353030333339626631656163343239353230643430356466306461663835383566
|
|
3564333737623034343837616632386462306462366538390a623538373034383839376261653734
|
|
36653238393437656332373965663866653730343864333063366462303661356366323262363839
|
|
3961633266353131310a313930346164393031623037393339356539616639343536353163343036
|
|
61353535633234363535633437356162626234356139323531643534613961633166393135356562
|
|
30306634646130353665656262393132656632373634353765316630643665356331363435366165
|
|
356261383336383736336336356564386337
|