Repository navigation
feat(lab): the four ingest tokens the proxy checks (#834) - #907
Merged
Merged
Conversation
Step 1 of the lab ingest-proxy rollout (stacks/lab/README.md), run on alexander with make secrets-edit STACK=lab. It adds INGEST_TOKEN_ODIN, _PHOENIX, _FENRIR and _READER beside #896's INGEST_TOKEN_GOLEM. compose requires all five, so main could not render the lab without this. Committed on alexander as f272db3, which has no push credentials and should not have any: it sits on VLAN 30. The patch came through delta, so it was rebuilt from main's file and the diff. Its blob is 31293ba, and alexander's git rev-parse HEAD:secrets/lab.sops.yaml printed the same. The deploy it carries is already live and proven: three 401s from the proxy on 2026-10-04. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Gerrrt
added
security
Gerrrt
enabled auto-merge (squash)
October 4, 2026 14:18
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The expected flat secret keys and corresponding SOPS metadata are present with no identified issues.
Review effort: Balanced
Findings: None
What changed in this PR
Adds the four missing encrypted ingest-proxy tokens required by the lab stack.
Changes:
- Adds Odin, Phoenix, Fenrir, and reader tokens.
- Updates SOPS metadata and integrity MAC.
| File | Description |
|---|---|
secrets/lab.sops.yaml |
Adds encrypted lab ingest credentials. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Step 1 of the lab ingest-proxy rollout (#834,
stacks/lab/README.md), run on alexander withmake secrets-edit STACK=lab. It adds four keys tosecrets/lab.sops.yaml, next to #896'sINGEST_TOKEN_GOLEM:INGEST_TOKEN_ODININGEST_TOKEN_PHOENIXINGEST_TOKEN_FENRIRINGEST_TOKEN_READERstacks/lab/compose.yamlrequires all five, so without this, main can't render the lab stack anywhere but alexander. The file is ciphertext only: alexander's key alone opens it.How it got here
alexander committed it as
f272db3. It has no GitHub credentials and shouldn't, being on VLAN 30. The patch was printed throughdelta, which reformats a diff and drops its index lines. So the file was rebuilt from main's copy (4ece5c1, alexander's base) and the diff:lastmodifiedandmac) match main exactly;The rebuilt blob is
31293ba275b23259b27491593c5d3c2fefbda859, andgit rev-parse HEAD:secrets/lab.sops.yamlon alexander printed the same ID.Already live
This is the record of a deploy that's already running. alexander ran
make up STACK=labfrom this exact file on 2026-10-04, and the proxy refusedPOST /-/quit,POST /loki/api/v1/deleteandPOST /api/v1/writewith401.Verified
check_sops_rules.pyandcheck_docs.pypass.After merge
On alexander:
git fetch origin, thengit diff HEAD origin/main -- secrets/lab.sops.yamlmust print nothing. Thengit switch main && git reset --hard origin/main.🤖 Generated with Claude Code