deploy: isolate git and connector secrets

2026-08-04 15:04:39 +02:00
parent ff271d3cce
commit b5071f1494
7 changed files with 189 additions and 3 deletions
@@ -0,0 +1,9 @@
+# Select this override only for an SSH Git remote. The host-only source files must be absolute,
+# normalized paths; strict host-key checking is mandatory for registry pull and publish.
+services:
+  core:
+    environment:
+      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
+    volumes:
+      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:?set THT_WORKSPACE_GIT_SSH_KEY_FILE}:/run/secrets/workspace-registry-git-ssh-key:ro
+      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:?set THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE}:/run/secrets/workspace-registry-git-known-hosts:ro