ic-builder
cf4094b9e4
ci / vet (pull_request) Successful in 1m9s
Vault access tokens expire (~10min); consumers hit 401s after container recreates. Now: refresh_token persisted at login and rotated on every refresh (Vaultwarden semantics); 401 on an authed call refreshes once and retries; if refresh is unavailable, full relogin (password+TOTP injected by the sm shims from the TSGCOO vault-account env) is attempted before failing. cmdLogin passes the TOTP seed again (regression). QA: corrupted access_token -> TSGCOO sm read self-healed end-to-end. Ticket: https://projects.knownelement.com/issues/832
27 lines
955 B
YAML
27 lines
955 B
YAML
# KNELSecretsManager Go CLI (ukrrs-secretsmgr-cli) — always-hot container per
|
|
# house convention (Charles 2026-08-31): docker exec per invocation, never
|
|
# docker run per call. Scoped ops only; NEVER bare compose down.
|
|
#
|
|
# docker compose -f /path/to/this up -d smcli
|
|
# docker exec -i ukrrs-secretsmgr-cli smcli env creds/cloudron
|
|
#
|
|
# Credentials for the vault account come from a 0600 env file (SM_EMAIL,
|
|
# SM_PASSWORD, SM_TOTP_SECRET, SM_SERVER) — never committed.
|
|
name: knel-secretsmanager
|
|
services:
|
|
smcli:
|
|
image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:8abfc55dfa7ca9e70b286a249b7ca823531bd55da29bed70d3354a58ec4d8fec
|
|
container_name: ukrrs-secretsmgr-cli
|
|
restart: unless-stopped
|
|
entrypoint: ["sleep", "infinity"]
|
|
init: true
|
|
env_file:
|
|
- path: ./smcli.env
|
|
required: false
|
|
environment:
|
|
SM_STATE_DIR: /data/state
|
|
volumes:
|
|
- smcli-state:/data/state
|
|
volumes:
|
|
smcli-state:
|