mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(deploy): isolate local vector compose secrets

Browse Source
This commit is contained in:
marcopan
2026-07-12 02:56:00 +02:00
parent 6c67235caf
commit 532073d550
8 changed files with 141 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/local-vector-smoke.sh
+2 -1
View File
@@ -36,7 +36,8 @@ export THT_VECTOR_BOOTSTRAP_USER=thoth_bootstrap_smoke
export THOTH_SMOKE_OWNER="$smoke_owner"
compose() {
docker compose --project-name "$smoke_project" --profile local-vector "$@"
docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
--project-name "$smoke_project" --profile local-vector "$@"
}
resource_ids() {
scripts/test-container-deployment.sh
+6 -1
View File
@@ -23,7 +23,8 @@ THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE="$tmp/bootstrap" \
THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE="$tmp/migrator" \
THT_VECTOR_READER_PASSWORD_SECRET_FILE="$tmp/local_reader" \
THT_VECTOR_WRITER_PASSWORD_SECRET_FILE="$tmp/local_writer" \
docker compose --profile local-vector config >"$tmp/local-vector.yaml"
docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
--profile local-vector config >"$tmp/local-vector.yaml"
grep -q 'THT_VECTOR_READER_PASSWORD_FILE: /run/secrets/vector_reader_password' "$tmp/local-vector.yaml"
grep -q 'THT_VECTOR_WRITER_PASSWORD_FILE: /run/secrets/vector_writer_password' "$tmp/local-vector.yaml"
if grep -q 'contract-local_' "$tmp/local-vector.yaml"; then
@@ -48,6 +49,10 @@ grep -q 'AUTH_MODE: upstream' "$tmp/production.yaml"
grep -q 'THOTH_PUBLIC_EXPOSURE: "true"' "$tmp/production.yaml"
grep -q 'target: thoth_ca.pem' "$tmp/production.yaml"
grep -q 'THT_DWH_API_KEY_FILE: /run/secrets/dwh_api_key' "$tmp/production.yaml"
if grep -q 'THT_VECTOR_READER_PASSWORD_FILE\|THT_VECTOR_WRITER_PASSWORD_FILE\|target: vector_reader_password\|target: vector_writer_password' "$tmp/production.yaml"; then
echo "production external config contains local direct vector secrets" >&2
exit 1
fi
if awk '/^FROM / && $2 !~ /@sha256:/ { found=1 } END { exit !found }' \
docker/core.Dockerfile docker/frontend.Dockerfile; then
scripts/test-external-compose-lifecycle.sh
Executable
+23
View File
@@ -0,0 +1,23 @@
#!/bin/sh
set -eu
cd "$(dirname "$0")/.."
project="thothii-external-lifecycle-$$"
cleanup() { docker compose --project-name "$project" --profile external down --volumes >/dev/null 2>&1 || true; }
trap cleanup EXIT HUP INT TERM
unset THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE
unset THT_VECTOR_READER_PASSWORD_SECRET_FILE THT_VECTOR_WRITER_PASSWORD_SECRET_FILE
rendered=$(docker compose --project-name "$project" --profile external config)
if printf '%s' "$rendered" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|vector_.*password'; then
echo "external config contains local vector secret references" >&2
exit 1
fi
docker compose --project-name "$project" --profile external up --build --wait core
core=$(docker compose --project-name "$project" --profile external ps -q core)
inspect=$(docker inspect "$core")
if printf '%s' "$inspect" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|/run/secrets/vector_.*password'; then
echo "external core inspect contains local vector secret references" >&2
exit 1
fi
echo "external core lifecycle without local vector secrets passed."
scripts/vector-rotate-bootstrap-password.sh
+3 -2
View File
@@ -29,7 +29,8 @@ trap 'rm -f "$replacement"' EXIT HUP INT TERM
cp "$new_secret" "$replacement"
chmod 0600 "$replacement"
docker compose --project-name "$project" --profile local-vector run --rm --no-deps \
docker compose -f compose.yaml -f deploy/compose.local-vector.yaml \
--project-name "$project" --profile local-vector run --rm --no-deps \
--user 0:0 \
--entrypoint /opt/venv/bin/python \
--volume "$old_secret:/run/secrets/bootstrap-old:ro" \
@@ -42,4 +43,4 @@ mv -f "$replacement" "$old_secret"
trap - EXIT HUP INT TERM
echo "Deployment bootstrap secret atomically replaced only after verified database login."
echo "Re-run: docker compose --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"
echo "Re-run: docker compose -f compose.yaml -f deploy/compose.local-vector.yaml --project-name $project --profile local-vector up --wait vector-reconcile vector-migrate core"