0.27.1 — flat Infisical keys (_), seed-secrets.sh in deploy, plist cleanup, .env strip

VERSION

@@ -1 +1 @@
-0.27.0
+0.27.1

cmd/nomos/main.go

@@ -63,11 +63,11 @@ func main() {
 	var secretsResolved int
 	if sec != nil {
 		resCtx, resCancel := context.WithTimeout(context.Background(), 10*time.Second)
-		if v := secrets.ResolveSecret(resCtx, sec, "mcp/bearer-token", ""); v != "" {
+		if v := secrets.ResolveSecret(resCtx, sec, "mcp_bearer-token", ""); v != "" {
 			mcpToken = v
 			secretsResolved++
 		}
-		openrouterAPIKey = secrets.ResolveSecret(resCtx, sec, "openrouter/api-key", os.Getenv("OPENROUTER_API_KEY"))
+		openrouterAPIKey = secrets.ResolveSecret(resCtx, sec, "openrouter_api-key", os.Getenv("OPENROUTER_API_KEY"))
 		if openrouterAPIKey != "" && openrouterAPIKey != os.Getenv("OPENROUTER_API_KEY") {
 			secretsResolved++
 		}

cmd/oikos/main.go

@@ -53,18 +53,18 @@ func main() {
 	)
 	if sec != nil {
 		overlays := secrets.ConfigOverlays(map[string]func(string){
-			"matrix/token":         func(v string) { cfg.MatrixToken = v },
+			"matrix_token":         func(v string) { cfg.MatrixToken = v },
-			"approval/hmac-secret": func(v string) { cfg.ApprovalHMACSecret = v },
+			"approval_hmac-secret": func(v string) { cfg.ApprovalHMACSecret = v },
-			"mcp/bearer-token":     func(v string) { cfg.MCPBearerToken = v },
+			"mcp_bearer-token":     func(v string) { cfg.MCPBearerToken = v },
-			"api/token":            func(v string) { cfg.APIToken = v },
+			"api_token":            func(v string) { cfg.APIToken = v },
-			"oidc/client-secret":   func(v string) { cfg.OIDCClientSecret = v },
+			"oidc_client-secret":   func(v string) { cfg.OIDCClientSecret = v },
 		})
 		n := secrets.OverlayConfig(ctx, sec, overlays)
 		slog.Info("secrets resolved from Infisical", "count", n)
 
 		secrets.VerifyExpectedSecrets(ctx, sec, []string{
-			"matrix/token", "approval/hmac-secret", "mcp/bearer-token",
+			"matrix_token", "approval_hmac-secret", "mcp_bearer-token",
-			"api/token", "oidc/client-secret", "openrouter/api-key", "webhook/hmac-secret",
+			"api_token", "oidc_client-secret", "openrouter_api-key", "webhook_hmac-secret",
 		})
 	}
 
@@ -381,13 +381,13 @@ func runSecret(ctx context.Context, cfg config.Config) {
 // expectedSecrets is the set of keys that should exist in Infisical
 // for a fully-migrated deployment.
 var expectedSecrets = []string{
-	"matrix/token",
+	"matrix_token",
-	"approval/hmac-secret",
+	"approval_hmac-secret",
-	"mcp/bearer-token",
+	"mcp_bearer-token",
-	"api/token",
+	"api_token",
-	"oidc/client-secret",
+	"oidc_client-secret",
-	"openrouter/api-key",
+	"openrouter_api-key",
-	"webhook/hmac-secret",
+	"webhook_hmac-secret",
 }
 
 // runSecretVerify checks that all expected secrets are present in Infisical.
@@ -425,11 +425,11 @@ func runSecretAudit(ctx context.Context, cfg config.Config) {
 	backend := newInfisicalBackendOrFail(cfg)
 
 	envValues := map[string]string{
-		"matrix/token":         cfg.MatrixToken,
+		"matrix_token":         cfg.MatrixToken,
-		"approval/hmac-secret": cfg.ApprovalHMACSecret,
+		"approval_hmac-secret": cfg.ApprovalHMACSecret,
-		"mcp/bearer-token":     cfg.MCPBearerToken,
+		"mcp_bearer-token":     cfg.MCPBearerToken,
-		"api/token":            cfg.APIToken,
+		"api_token":            cfg.APIToken,
-		"oidc/client-secret":   cfg.OIDCClientSecret,
+		"oidc_client-secret":   cfg.OIDCClientSecret,
 	}
 
 	fmt.Println("key                           infisical  env        status")

cmd/webhook/main.go

@@ -32,7 +32,7 @@ func main() {
 
 	secret := resolveWebhookHMAC(ctx)
 	if secret == "" {
-		fmt.Fprintln(os.Stderr, "WEBHOOK_HMAC_SECRET must be set (env var or Infisical webhook/hmac-secret)")
+		fmt.Fprintln(os.Stderr, "WEBHOOK_HMAC_SECRET must be set (env var or Infisical webhook_hmac-secret)")
 		os.Exit(1)
 	}
 
@@ -111,5 +111,5 @@ func resolveWebhookHMAC(ctx context.Context) string {
 		os.Getenv("OIKOS_SECRETS_DIR"),
 	)
 	envFallback := os.Getenv("WEBHOOK_HMAC_SECRET")
-	return secrets.ResolveSecret(ctx, sec, "webhook/hmac-secret", envFallback)
+	return secrets.ResolveSecret(ctx, sec, "webhook_hmac-secret", envFallback)
 }

scripts/deploy.sh

@@ -51,10 +51,14 @@ echo "[6/6] health check"
 for i in $(seq 1 $RETRIES); do
     if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
         echo "healthy after ${i}s"
-        exit 0
+        break
     fi
     sleep "$SLEEP"
 done
 
-echo "ERROR: health check failed after $((RETRIES * SLEEP))s"
+# 7. Seed secrets into Infisical (idempotent)
-exit 1
+echo "[7/7] seed secrets"
+docker compose exec -T api oikos secret list > /dev/null 2>&1 && \
+    docker compose cp scripts/seed-secrets.sh api:/opt/oikos/scripts/seed-secrets.sh 2>/dev/null && \
+    docker compose exec -T api /opt/oikos/scripts/seed-secrets.sh || \
+    echo "WARNING: secret seeding skipped (infisical not reachable)"

scripts/deploy/network.hubris.oikos-deploy-webhook.plist

@@ -10,8 +10,16 @@
     </array>
     <key>EnvironmentVariables</key>
     <dict>
-        <key>WEBHOOK_HMAC_SECRET</key>
+        <key>OIKOS_INFISICAL_SITE_URL</key>
-        <string>6502524162d6dbc3f6d137000395d401f1837d74ef9bb0a876f8e6bbd65d1ff2</string>
+        <string>http://localhost:8080</string>
+        <key>OIKOS_INFISICAL_CLIENT_ID</key>
+        <string>82e6e362-bbee-4f22-b44e-215c85bdb14a</string>
+        <key>OIKOS_INFISICAL_CLIENT_SECRET</key>
+        <string>aa7c928b366591741e4fa99016c5644fc6119b4174ba0dab3570db1229e0bdf1</string>
+        <key>OIKOS_INFISICAL_PROJECT_ID</key>
+        <string>a436936f-6610-4698-9075-76013af7c68e</string>
+        <key>OIKOS_INFISICAL_ENV</key>
+        <string>dev</string>
         <key>WEBHOOK_REPO_DIR</key>
         <string>/Users/dtoro/Projects/oikos</string>
         <key>WEBHOOK_LISTEN</key>

scripts/seed-secrets.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+# One-shot: populate Infisical with oikos secrets from env vars.
+# Designed to run inside the oikos-api container where Infisical is reachable.
+# Safe to re-run (set is idempotent).
+#
+# Usage: docker exec oikos-api-1 /opt/oikos/scripts/seed-secrets.sh
+#
+# Secrets are read from the container environment (set via docker-compose).
+# If a secret is already in Infisical, it is updated in place.
+
+set -e
+
+echo "=== seed-secrets: $(date) ==="
+
+KEYS="
+matrix_token:${OIKOS_MATRIX_TOKEN:-}
+approval_hmac-secret:${OIKOS_APPROVAL_HMAC_SECRET:-}
+mcp_bearer-token:${OIKOS_MCP_BEARER_TOKEN:-}
+api_token:${OIKOS_API_TOKEN:-}
+oidc_client-secret:${OIKOS_OIDC_CLIENT_SECRET:-}
+openrouter_api-key:${OPENROUTER_API_KEY:-}
+webhook_hmac-secret:${WEBHOOK_HMAC_SECRET:-}
+"
+
+set_count=0
+skip_count=0
+
+echo "$KEYS" | while IFS=: read -r key value; do
+    [ -z "$key" ] && continue
+    if [ -z "$value" ]; then
+        echo "SKIP: $key (env var empty/missing)"
+        skip_count=$((skip_count + 1))
+        continue
+    fi
+    if oikos secret set "$key" "$value" 2>/dev/null; then
+        echo "SET:  $key"
+        set_count=$((set_count + 1))
+    else
+        echo "FAIL: $key"
+    fi
+done
+
+echo ""
+echo "seed-secrets complete: $set_count set, $skip_count skipped"