Repository navigation
feat(lab): give golem its own token at the ingest proxy (#485) - #896
Merged
Merged
Conversation
deploy-agent.sh refused golem because, since #834, every client pushes with its own token and golem had none. INGEST_TOKEN_GOLEM joins the Caddy map, compose, render-config.sh's list, the validation env and lab.example.yaml, which also documents §7's PBS_ENCRYPTION_KEY. The real value lands in secrets/lab.sops.yaml on this branch before it merges: compose requires it, so merging first would fail the lab's next render on alexander. Refs #485 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…oken # Conflicts: # docs/changelog.md
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The nested PBS key breaks lab secret parsing, and deployment documentation remains incorrectly ordered and incomplete.
Review effort: Balanced
Findings: 1
Open (3)
What changed in this PR
Adds a dedicated lab ingest token for golem and records its PBS recovery key.
Changes:
- Wires
INGEST_TOKEN_GOLEMthrough Caddy, compose, rendering, and validation. - Documents deployment and secret handling.
- Adds encrypted production secrets.
| File | Description |
|---|---|
stacks/lab/README.md |
Documents golem as an ingest client. |
stacks/lab/compose.yaml |
Passes the token to Caddy. |
stacks/lab/Caddyfile |
Authorizes golem writes. |
secrets/lab.sops.yaml |
Adds encrypted token and PBS key. |
secrets/lab.example.yaml |
Documents new secret slots. |
scripts/seed-validation-env.sh |
Seeds validation token. |
scripts/render-config.sh |
Renders the token into .env. |
docs/runbooks/build-the-backup-guest.md |
Documents agent token export. |
docs/changelog.md |
Records the change. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…t runs (#485) The key pasted as multi-line JSON became a nested YAML map, which secrets-env.sh refuses, so make render STACK=lab would fail. The example and §7 now say one line of compact JSON in single quotes. §10's token step moves above the command, and the lab README generates five tokens. Refs #485 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gerrrt
marked this pull request as draft
October 4, 2026 04:47
Gerrrt
marked this pull request as ready for review
October 4, 2026 04:56
Gerrrt
added a commit
that referenced
this pull request
Oct 4, 2026
Step 1 of the lab ingest-proxy rollout (stacks/lab/README.md), run on alexander with make secrets-edit STACK=lab. It adds INGEST_TOKEN_ODIN, _PHOENIX, _FENRIR and _READER beside #896's INGEST_TOKEN_GOLEM. compose requires all five, so main could not render the lab without this. Committed on alexander as f272db3, which has no push credentials and should not have any: it sits on VLAN 30. The patch came through delta, so it was rebuilt from main's file and the diff. Its blob is 31293ba, and alexander's git rev-parse HEAD:secrets/lab.sops.yaml printed the same. The deploy it carries is already live and proven: three 401s from the proxy on 2026-10-04. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
deploy-agent.shrefusedgolembecause, since #834, each lab client pushes toalexander's ingest proxy with its own token, andgolemhad none. This wiresINGEST_TOKEN_GOLEMthrough the same placesINGEST_TOKEN_FENRIRlives:stacks/lab/Caddyfile(the map line, and the clients comment),stacks/lab/compose.yaml,stacks/lab/README.mdscripts/render-config.shCOMPOSE_VARS,scripts/seed-validation-env.shsecrets/lab.example.yaml, plus a documented slot forPBS_ENCRYPTION_KEY(build-the-backup-guest §7). It isn't a compose var, so it never reaches.env.build-the-backup-guest.md§10: export the token beforedeploy-agent.sh.Before merging (draft until then)
compose requires
INGEST_TOKEN_GOLEM, so the real value has to land insecrets/lab.sops.yamlon this branch first. Onalexander, check out this branch, runmake secrets-edit STACK=lab, and add:INGEST_TOKEN_GOLEM:openssl rand -hex 32PBS_ENCRYPTION_KEY: the whole contents of Saruman's/etc/pve/priv/storage/golem.encCommit and push to this branch. After merge and the lab's redeploy, export
INGEST_TOKEN(=INGEST_TOKEN_GOLEM) andINGEST_TOKEN_READERon the Mac and rerundeploy-agent.shforroot@10.0.30.80.Refs #485.
🤖 Generated with Claude Code