From b35825c50b1ba37b5e33de52efc7cfc914432386 Mon Sep 17 00:00:00 2001 From: dtoro Date: Tue, 7 Jul 2026 22:16:16 +0200 Subject: [PATCH] infisical: SOPS migration complete (11 secrets), secrets-issuance decommissioned --- scripts/cutover-checklist.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/cutover-checklist.md b/scripts/cutover-checklist.md index dee96c2..fe5eb9d 100644 --- a/scripts/cutover-checklist.md +++ b/scripts/cutover-checklist.md @@ -9,7 +9,7 @@ Status: [x] = done, [ ] = pending - [x] **Deploy test**: Docker stack running with api + scheduler + notifier + hermes - [x] **Caddy config**: `compose/caddy/Caddyfile.oikos` pushed to `dtoro/caddy-conf` (ed20908). Auto-deploys to caddy (121). - [x] **DNS**: `oikos.hubris.network` already resolves to 192.168.8.175 (mac-mini mesh) -- [x] **Secrets**: Infisical bootstrapped 2026-07-07 — running on `:8080` (profile: full+infisical). Admin: `oikos@hubris.network`. Project: `oikos` (a436936f). Machine identity: `oikos-api` (UA: 82e6e362-bbee-...). ENCRYPTION_KEY must be 32-char raw string (Infisical docs incorrectly say hex). Env vars wired in `.env`: OIKOS_INFISICAL_SITE_URL/CLIENT_ID/CLIENT_SECRET/PROJECT_ID/ENV + OIKOS_SECRET_BACKEND=infisical. SOPS fallback preserved. +- [x] **Secrets**: Infisical bootstrapped + migration complete 2026-07-07. All 11 SOPS secrets migrated to Infisical (oikos project, dev env). Machine identity `oikos-api` has RW access verified via Go SDK. ENCRYPTION_KEY must be 32-char raw string (docs incorrect). SOPS fallback preserved for DR. secrets-issuance decommissioned — stopped/disabled on apps/105; superseded by Infisical. - [x] **Watchdog**: crontab entry added (every 2 min → `scripts/watchdog.sh`). Path fixed 2026-07-07 (was stale worktree path). ## Cutover