dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

infisical: fully bootstrapped — machine identity, env vars, profiles wired

Browse Source
This commit is contained in:
authentik Default Admin
2026-07-07 22:01:43 +02:00
parent 24b8772d72
commit 806795c63d
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docker-compose.yml
View File

@@ -125,7 +125,7 @@ services:
# Redis (required by Infisical — Phase 5) # Redis (required by Infisical — Phase 5)
redis: redis:
image: redis:7-alpine image: redis:7-alpine
profiles: ["infisical"] profiles: ["infisical", "full"]
volumes: volumes:
- redis-data:/data - redis-data:/data
healthcheck: healthcheck:
@@ -137,7 +137,7 @@ services:
# Infisical self-hosted (Phase 5 secrets management) # Infisical self-hosted (Phase 5 secrets management)
infisical: infisical:
image: infisical/infisical:latest image: infisical/infisical:latest
profiles: ["infisical"] profiles: ["infisical", "full"]
depends_on: depends_on:
postgres: postgres:
condition: service_healthy condition: service_healthy

2
scripts/cutover-checklist.md
View File

@@ -9,7 +9,7 @@ Status: [x] = done, [ ] = pending
- [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes - [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes
- [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121). - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121).
- [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh) - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh)
- [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: infisical). Admin account created (`oikos@hubris.network`). ENCRYPTION_KEY fix: must be 32-char raw string, NOT hex (Infisical docs incorrect). Next: complete org/project/machine-identity setup via browser at http://localhost:8080, then wire `OIKOS_SECRET_BACKEND=infisical` to oikos services. - [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: full+infisical). Admin: `oikos@hubris.network`. Project: `oikos` (a436936f). Machine identity: `oikos-api` (UA: 82e6e362-bbee-...). ENCRYPTION_KEY must be 32-char raw string (Infisical docs incorrectly say hex). Env vars wired in `.env`: OIKOS_INFISICAL_SITE_URL/CLIENT_ID/CLIENT_SECRET/PROJECT_ID/ENV + OIKOS_SECRET_BACKEND=infisical. SOPS fallback preserved.
- [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path). - [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path).
## Cutover ## Cutover