dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

0.27.1 — flat Infisical keys (_), seed-secrets.sh in deploy, plist cleanup, .env strip
Some checks failed
ci / build-test (push) Has been cancelled
Details
ci / docker-build (push) Has been cancelled
Details
ci / web (push) Has been cancelled
Details
Desktop App / Build Linux (amd64) (push) Has been cancelled
Details
Desktop App / Attach to Release (push) Has been cancelled
Details

Browse Source
This commit is contained in:
David Toro
2026-08-06 22:08:02 +02:00
parent c9d506b0f8
commit 7a34d8c8a0
7 changed files with 85 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
cmd/oikos/main.go
View File

@@ -53,18 +53,18 @@ func main() {
)
if sec != nil {
overlays := secrets.ConfigOverlays(map[string]func(string){
"matrix/token": func(v string) { cfg.MatrixToken = v },
"approval/hmac-secret": func(v string) { cfg.ApprovalHMACSecret = v },
"mcp/bearer-token": func(v string) { cfg.MCPBearerToken = v },
"api/token": func(v string) { cfg.APIToken = v },
"oidc/client-secret": func(v string) { cfg.OIDCClientSecret = v },
"matrix_token": func(v string) { cfg.MatrixToken = v },
"approval_hmac-secret": func(v string) { cfg.ApprovalHMACSecret = v },
"mcp_bearer-token": func(v string) { cfg.MCPBearerToken = v },
"api_token": func(v string) { cfg.APIToken = v },
"oidc_client-secret": func(v string) { cfg.OIDCClientSecret = v },
})
n := secrets.OverlayConfig(ctx, sec, overlays)
slog.Info("secrets resolved from Infisical", "count", n)
secrets.VerifyExpectedSecrets(ctx, sec, []string{
"matrix/token", "approval/hmac-secret", "mcp/bearer-token",
"api/token", "oidc/client-secret", "openrouter/api-key", "webhook/hmac-secret",
"matrix_token", "approval_hmac-secret", "mcp_bearer-token",
"api_token", "oidc_client-secret", "openrouter_api-key", "webhook_hmac-secret",
})
}
@@ -381,13 +381,13 @@ func runSecret(ctx context.Context, cfg config.Config) {
// expectedSecrets is the set of keys that should exist in Infisical
// for a fully-migrated deployment.
var expectedSecrets = []string{
"matrix/token",
"approval/hmac-secret",
"mcp/bearer-token",
"api/token",
"oidc/client-secret",
"openrouter/api-key",
"webhook/hmac-secret",
"matrix_token",
"approval_hmac-secret",
"mcp_bearer-token",
"api_token",
"oidc_client-secret",
"openrouter_api-key",
"webhook_hmac-secret",
}
// runSecretVerify checks that all expected secrets are present in Infisical.
@@ -425,11 +425,11 @@ func runSecretAudit(ctx context.Context, cfg config.Config) {
backend := newInfisicalBackendOrFail(cfg)
envValues := map[string]string{
"matrix/token": cfg.MatrixToken,
"approval/hmac-secret": cfg.ApprovalHMACSecret,
"mcp/bearer-token": cfg.MCPBearerToken,
"api/token": cfg.APIToken,
"oidc/client-secret": cfg.OIDCClientSecret,
"matrix_token": cfg.MatrixToken,
"approval_hmac-secret": cfg.ApprovalHMACSecret,
"mcp_bearer-token": cfg.MCPBearerToken,
"api_token": cfg.APIToken,
"oidc_client-secret": cfg.OIDCClientSecret,
}
fmt.Println("key infisical env status")