thesabear/public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix secret-distribution.md evidence command, bump verify

Browse Source 
The registry-token example's shown grep command didn't actually
reproduce the shown output (it matched the first 'service: automation'
entry, gitea, not registry-token). Fixed to grep on the registry-token
path directly, so the command is genuinely reproducible. Re-verified
everything else live: SSH cert flow's 2h timer, the technitium API
token lookup snippet, and the flow diagram - all accurate.
This commit is contained in:
automation-bot committed 2026-09-19 00:23:50 +03:00
1 parent c241ed618d
commit 00f50ffdab
1 file changed
+4 -4
Download Patch File Download Diff File Expand all files Collapse all files
docs/secret-distribution.md
+4 -4
View File
@@ -1,6 +1,6 @@
<!-- verified: 2026-09-06 <!-- verified: 2026-09-19
iac@49ff427 : ansible/roles/secure_vault/ssh_ca_client, ansible/roles/secure_vault/vault_agent/defaults/main.yml, ansible/roles/secure_vault/SecureVault – Vault Contract.md, ansible/roles/secure_vault/securevault-vault-facts.md iac@f770e1c : ansible/roles/secure_vault/ssh_ca_client, ansible/roles/secure_vault/vault_agent/defaults/main.yml, ansible/roles/secure_vault/SecureVault – Vault Contract.md, ansible/roles/secure_vault/securevault-vault-facts.md
ansible@ccbda37 : roles/app_update/defaults/main.yml ansible@24e1bf0 : roles/app_update/defaults/main.yml
trilium : DvKxK0gHXsng, wovVrgvoDVy2, GW8BMoTKtRBe, 1seDR2nBmxKO trilium : DvKxK0gHXsng, wovVrgvoDVy2, GW8BMoTKtRBe, 1seDR2nBmxKO
--> -->
@@ -80,7 +80,7 @@ That redeploy-and-restart sequence isn't just a claim — here's a real one, sta
**Shared-secret variant:** not every template is host-scoped — one credential needed by every docker host for its own registry pushes (see [`docs/registry-and-build.md`](registry-and-build.md)) is templated from a single shared path rather than a per-host one. Same mechanics, just a shared source instead of a private one — and it relies on every host's policy already granting read access to that shared path, the same "shared + private" pattern described in [`docs/secrets-and-pki.md`](secrets-and-pki.md)'s access model. This is the real template list entry, repeated per host: **Shared-secret variant:** not every template is host-scoped — one credential needed by every docker host for its own registry pushes (see [`docs/registry-and-build.md`](registry-and-build.md)) is templated from a single shared path rather than a per-host one. Same mechanics, just a shared source instead of a private one — and it relies on every host's policy already granting read access to that shared path, the same "shared + private" pattern described in [`docs/secrets-and-pki.md`](secrets-and-pki.md)'s access model. This is the real template list entry, repeated per host:
``` ```
$ grep -A4 "service: automation" vault_agent/defaults/main.yml $ grep -B1 -A3 "registry-token.ctmpl" vault_agent/defaults/main.yml
- service: automation - service: automation
src_path: .../automation-vm/registry-token/registry-token.ctmpl src_path: .../automation-vm/registry-token/registry-token.ctmpl
dest_path: /opt/docker/docker_volumes/registry-token/registry-token dest_path: /opt/docker/docker_volumes/registry-token/registry-token