From 24b8772d726c7db5aa6a4cdb013ef235359ef4c4 Mon Sep 17 00:00:00 2001 From: dtoro Date: Tue, 7 Jul 2026 21:46:57 +0200 Subject: [PATCH] =?UTF-8?q?cutover:=20Infisical=20bootstrapped=20=E2=80=94?= =?UTF-8?q?=20running,=20admin=20created,=20awaiting=20browser=20setup?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 2 ++ scripts/cutover-checklist.md | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 7a2a95d..e680c87 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,5 @@ bin/hermes # commands (ssh, pct, logs, restart, status, open, secret, client, sync, mcp). # Remove oikos/* when bin/homelab is ported to Go. backups/ +.env +.infisical-credentials diff --git a/scripts/cutover-checklist.md b/scripts/cutover-checklist.md index c138ecc..9dddf51 100644 --- a/scripts/cutover-checklist.md +++ b/scripts/cutover-checklist.md @@ -9,7 +9,7 @@ Status: [x] = done, [ ] = pending - [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121). - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh) -- [ ] **Secrets**: Infisical not yet bootstrapped — blocked by Infisical v0.162.0 KMS migration bug (ERR_CRYPTO_INVALID_KEYLEN). SOPS fallback is active and working. Deferred pending upstream fix or version pin. +- [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: infisical). Admin account created (`oikos@hubris.network`). ENCRYPTION_KEY fix: must be 32-char raw string, NOT hex (Infisical docs incorrect). Next: complete org/project/machine-identity setup via browser at http://localhost:8080, then wire `OIKOS_SECRET_BACKEND=infisical` to oikos services. - [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path). ## Cutover