chore(secrets): retire sync-secrets.nu; Group-1 not from Infisical (BUNYIP-531) #529

Merged

nrupard merged 1 commit from chore/BUNYIP-531-retire-sync-secrets into main

2026-08-12 22:51:56 +02:00

nrupard commented

2026-08-12 22:31:47 +02:00

Owner

Group-1 startup secrets come from the compose secrets file (the SOPS compose-secrets.yml on the docker hosts) or init-secrets.nu in dev, never Infisical. Only Group-2 integration secrets (SMTP, /runtime) use Infisical. This removes the Group-1-from-Infisical mechanism, reversing BUNYIP-504.

Removed

scripts/sync-secrets.nu (the Infisical -> Group-1 file renderer).
Its check.yml self-test step and the just sync-secrets recipe.

Docs rewritten (Group-1 = compose secrets file / init-secrets, not Infisical)

docs/secrets-infisical.md (retitled, Group-1 section is now file/SOPS; only Group-2 plus the E2E credential live in Infisical), CLAUDE.md, README.md, the compose.yml header, scripts/init-secrets.nu, docs/getting-started.md, docs/e2e.md.

Unaffected

The E2E password (Infisical /bunyip/e2e) is a test credential, not a Group-1 startup secret.

Note

docs/e2e.md previously cited BUNYIP-505 ("move the c-01 secret source off sops and the CI secrets onto Infisical"), which contradicts this direction (Group-1 stays in SOPS); the reference is dropped. BUNYIP-505 likely needs closing or revising.

Companion doc updates: docker runbook + governance INFISICAL.md. BUNYIP-530 (migrate Group-1 /bunyip/app -> /app) is now obsolete and will be closed.

Group-1 startup secrets come from the compose secrets file (the SOPS `compose-secrets.yml` on the docker hosts) or `init-secrets.nu` in dev, never Infisical. Only Group-2 integration secrets (SMTP, `/runtime`) use Infisical. This removes the Group-1-from-Infisical mechanism, reversing BUNYIP-504. ## Removed - `scripts/sync-secrets.nu` (the Infisical -> Group-1 file renderer). - Its `check.yml` self-test step and the `just sync-secrets` recipe. ## Docs rewritten (Group-1 = compose secrets file / init-secrets, not Infisical) `docs/secrets-infisical.md` (retitled, Group-1 section is now file/SOPS; only Group-2 plus the E2E credential live in Infisical), `CLAUDE.md`, `README.md`, the `compose.yml` header, `scripts/init-secrets.nu`, `docs/getting-started.md`, `docs/e2e.md`. ## Unaffected The E2E password (Infisical `/bunyip/e2e`) is a test credential, not a Group-1 startup secret. ## Note `docs/e2e.md` previously cited BUNYIP-505 ("move the c-01 secret source off sops and the CI secrets onto Infisical"), which contradicts this direction (Group-1 stays in SOPS); the reference is dropped. BUNYIP-505 likely needs closing or revising. Companion doc updates: docker runbook + governance `INFISICAL.md`. BUNYIP-530 (migrate Group-1 `/bunyip/app` -> `/app`) is now obsolete and will be closed.

nrupard added 1 commit

2026-08-12 22:31:47 +02:00

chore(secrets): retire sync-secrets.nu; Group-1 secrets are not from Infisical

E2E / PR gate (pull_request) Successful in 22s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 4m45s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

1dc0182335

Group-1 startup secrets (postgres, DATABASE_URL, JWT_SECRET, APP_ENCRYPTION_KEY, ...) come from the compose secrets file (the SOPS compose-secrets.yml on the docker hosts) or init-secrets.nu in dev, never from Infisical. Only Group-2 integration secrets (SMTP, /runtime) use Infisical. Remove the Group-1-from-Infisical mechanism (reverses BUNYIP-504): delete scripts/sync-secrets.nu, drop its check.yml self-test step and the just sync-secrets recipe, and rewrite docs/secrets-infisical.md, CLAUDE.md, README.md, the compose.yml header, init-secrets.nu, getting-started.md, and e2e.md so no doc presents Group-1 as Infisical-sourced. The E2E password (Infisical /bunyip/e2e) is unaffected.

#BUNYIP-531

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>