secret-distribution: verify against live-checked KB, fix diagram, add real evidence

Browse Source

Source Trilium note (Secret Distribution Model) was live-verified and
stamped this session - Certificate Flow, App Secret Flow, Configuration
Distribution Flow, and the technitium_api_token Vault-KV exception all
confirmed against the real hosts, not just trusted from the KB.

Replaced the Mermaid diagram, which incorrectly showed the Configuration
Distribution Flow feeding into Vault directly, with a corrected version:
that flow is a control-plane gate on what Vault Agent renders, not a
peer data flow. Added a real Vault Agent log excerpt proving the full
redeploy chain (restart -> render -> reload_command -> container
recreated) actually happens, and restored the technitium_api_token
exception that was in the source note but missing from this doc.

...

This commit is contained in:

thesabear committed 2026-08-26 01:23:22 +03:00

1 parent b4827a3d42

commit 1c3a2c83a5

3 files changed

+12 -11

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

assets/vault-agent-reload.png

BIN

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 290 KiB