Repository navigation
chore(secrets): prometheus's alert-path keys for the in-house ntfy, encrypted (#136) - #720
Merged
Merged
Conversation
…ncrypted (#136) secrets/observability.sops.yaml as edited on prometheus during the cutover: - Three new keys: ALERTMANAGER_URGENT_EXTERNAL_URL, ALERTMANAGER_SECURITY_EXTERNAL_URL and ALERTMANAGER_NTFY_TOKEN. - The three ALERTMANAGER_*_WEBHOOK_URL values repointed at ntfy.matrix.elysium. Every value is ENC[AES256_GCM,...] to the same two age recipients as before. check-sops-encrypted.sh and check_sops_rules.py pass. Committed so the monitoring host's deployment checkout is clean. It had been dirty since the edit, which raised DeployDrifted and stopped convergence (ScheduledJobFailed, then "converge has not succeeded in 3h 30m"). Refs #136 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
secrets/observability.sops.yamlas edited on prometheus during the #136 cutover:ALERTMANAGER_URGENT_EXTERNAL_URL,ALERTMANAGER_SECURITY_EXTERNAL_URLandALERTMANAGER_NTFY_TOKEN.ALERTMANAGER_*_WEBHOOK_URLkeys now point atntfy.matrix.elysium.Why
The monitoring host's deployment checkout has been dirty since the edit. That raised
DeployDrifted, and convergence stopped (ScheduledJobFailed, then "converge has not succeeded in 3h 30m"). Committing the encrypted file makes the checkout clean again. Trinity's equivalent was #717.Blast radius
None at runtime. This is the file prometheus already renders from.
After merge, run on prometheus:
git checkout -- secrets/observability.sops.yaml && git pull --ff-only && make render && make reload. Convergence resumes on its next hourly run.No change to network segmentation or firewall rules
No new port published to a VLAN that could not already reach the service
No credential added outside
secrets/*.sops.yaml: every value isENC[AES256_GCM,…]Verification
Encrypted: all 16 top-level values are
ENC[AES256_GCM,…].check-sops-encrypted.shpasses (4 SOPS files, all encrypted).Same recipients: the file is encrypted to the same two age recipients as the version on
main, andcheck_sops_rules.pymatches it to its rule.Keys: the key-level diff against
mainshows exactly the three new keys.Secrets checks pass
Deployed: this is the file prometheus runs from
Docs: n/a
Refs #136
🤖 Generated with Claude Code