deploy: isolate git and connector secrets

2026-08-04 15:04:39 +02:00
parent ff271d3cce
commit b5071f1494
7 changed files with 189 additions and 3 deletions
@@ -0,0 +1,15 @@
+# Selected direct PostgreSQL/pgvector connector secrets. Each target must match a corresponding
+# THT_WS_*_FILE=/run/secrets/<target> binding; source paths are host-only operator configuration.
+services:
+  core:
+    secrets:
+      - source: psd_clinical_dwh_password
+        target: psd-clinical-dwh-password
+      - source: psd_clinical_vector_password
+        target: psd-clinical-vector-password
+
+secrets:
+  psd_clinical_dwh_password:
+    file: ${THT_WS_PSD_CLINICAL_DWH_PASSWORD_SOURCE:?set THT_WS_PSD_CLINICAL_DWH_PASSWORD_SOURCE}
+  psd_clinical_vector_password:
+    file: ${THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_SOURCE:?set THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_SOURCE}