docs(secrets): document the Group-2 Infisical runtime fetch (BUNYIP-528) #524

Merged

nrupard merged 1 commit from docs/BUNYIP-528-group2-infisical-docs into main

2026-08-12 19:57:13 +02:00

nrupard commented

2026-08-12 19:01:25 +02:00

Owner

Completes the documentation for the two-tier secret model. bunyip-api now fetches its Group-2 integration secret SMTP_PASSWORD from Infisical at runtime (BUNYIP-525, deployed on c-01 via docker PR #346), but docs/secrets-infisical.md and its siblings still documented only the Group-1 file-sync tier.

Changes

docs/secrets-infisical.md: restructured into a Group-1 (file sync) section and a new Group-2 (runtime fetch) section. The Group-2 section documents the INFISICAL_* env vars (which are plain env vs secret_env, with defaults), the source precedence, how to make Infisical the effective SMTP source on a host, fetch validation, and Group-2 troubleshooting rows. The folder tree now includes /bunyip/runtime, and SMTP_PASSWORD's dual source is noted.
docs/getting-started.md: the infisical CLI is Group-1 only; Group-2 SMTP is app-fetched at runtime with no CLI.
README.md: qualify "secrets are files, never environment variables" with the Group-2 runtime-fetch exception.
docs/e2e.md: add /bunyip/runtime to the folder mental model.

Key documented fact: source precedence

The Infisical fetch fills SMTP_PASSWORD only when the slot is empty (bunyip-api/src/main.rs gates on config.infisical.enabled && config.email.smtp_password.is_empty()). Effective order, highest first: DB email_config row > Group-1 env/file SMTP_PASSWORD > Group-2 Infisical fetch. So Infisical is the effective SMTP source on a host only when there is no DB row and no Group-1 value. This is why c-01 currently sends email off its SOPS SMTP_PASSWORD (the fetch is enabled but inert until that value is removed; the completing step is tracked in DEV-581).

Scope

Docs only. The config change to remove SMTP_PASSWORD from Group-1 (to force Infisical as the sole SMTP source) is separate: on c-01 it is the completing step in DEV-581.

Related: BUNYIP-525 (the fetch), DEV-581 (c-01 enablement + the docker setup runbook), and a governance PR for the universal "Infisical with any app" guide.

Completes the documentation for the two-tier secret model. bunyip-api now fetches its Group-2 integration secret `SMTP_PASSWORD` from Infisical at runtime (BUNYIP-525, deployed on c-01 via docker PR #346), but `docs/secrets-infisical.md` and its siblings still documented only the Group-1 file-sync tier. ## Changes - `docs/secrets-infisical.md`: restructured into a Group-1 (file sync) section and a new **Group-2 (runtime fetch)** section. The Group-2 section documents the `INFISICAL_*` env vars (which are plain env vs `secret_env`, with defaults), the source precedence, how to make Infisical the effective SMTP source on a host, fetch validation, and Group-2 troubleshooting rows. The folder tree now includes `/bunyip/runtime`, and `SMTP_PASSWORD`'s dual source is noted. - `docs/getting-started.md`: the `infisical` CLI is Group-1 only; Group-2 SMTP is app-fetched at runtime with no CLI. - `README.md`: qualify "secrets are files, never environment variables" with the Group-2 runtime-fetch exception. - `docs/e2e.md`: add `/bunyip/runtime` to the folder mental model. ## Key documented fact: source precedence The Infisical fetch fills `SMTP_PASSWORD` only when the slot is empty (`bunyip-api/src/main.rs` gates on `config.infisical.enabled && config.email.smtp_password.is_empty()`). Effective order, highest first: DB `email_config` row > Group-1 env/file `SMTP_PASSWORD` > Group-2 Infisical fetch. So Infisical is the effective SMTP source on a host only when there is no DB row and no Group-1 value. This is why c-01 currently sends email off its SOPS `SMTP_PASSWORD` (the fetch is enabled but inert until that value is removed; the completing step is tracked in DEV-581). ## Scope Docs only. The config change to remove `SMTP_PASSWORD` from Group-1 (to force Infisical as the sole SMTP source) is separate: on c-01 it is the completing step in DEV-581. Related: BUNYIP-525 (the fetch), DEV-581 (c-01 enablement + the docker setup runbook), and a governance PR for the universal "Infisical with any app" guide.

nrupard added 1 commit

2026-08-12 19:01:25 +02:00

docs(secrets): document the Group-2 Infisical runtime fetch, sweep stale secret docs

E2E / PR gate (pull_request) Successful in 27s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 8m45s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

7bf1c32bb8

- Restructure docs/secrets-infisical.md into the two tiers: a Group-1 file-secret (sync) section and a new Group-2 runtime-fetch section covering the INFISICAL_* env vars, the source precedence (DB email_config row > Group-1 env/file SMTP_PASSWORD > Infisical fetch), how to make Infisical the effective SMTP source on a host, and Group-2 troubleshooting rows.
- Add /bunyip/runtime to the folder-layout tree and note SMTP_PASSWORD's dual source.
- getting-started.md: the infisical CLI is Group-1 only; Group-2 SMTP is app-fetched at runtime with no CLI.
- README.md: qualify "secrets are files, never environment variables" with the Group-2 runtime-fetch exception.
- e2e.md: add /bunyip/runtime to the folder mental model.

#BUNYIP-528

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>