From bf5a138d1ca61bf9df201154b4296f8093c12e0b Mon Sep 17 00:00:00 2001 From: Fizzlepoof Date: Thu, 14 May 2026 02:00:25 +0000 Subject: [PATCH] docs(homelab): require secrets sync after env changes --- docs/operations/SECRETS_MANAGEMENT.md | 18 +++++++++++++++--- docs/planning/SCHOOL_INTAKE_PIPELINE.md | 7 ++----- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/docs/operations/SECRETS_MANAGEMENT.md b/docs/operations/SECRETS_MANAGEMENT.md index d62610c..b05d5ca 100644 --- a/docs/operations/SECRETS_MANAGEMENT.md +++ b/docs/operations/SECRETS_MANAGEMENT.md @@ -98,19 +98,25 @@ What it does: Run this any time you create or update a stack's `.env` file. +**Operational rule:** after any live `.env` change on PD, Doris or the operator must run the sync script and confirm whether it committed/pushed changes or reported the secrets repo already up to date. Do not treat live `.env` edits as complete until this sync step is checked. + --- ## git-crypt on TrueNAS -apt is blocked on TrueNAS Scale. git-crypt is installed via Docker and stored on the persistent dataset at `/mnt/docker-ssd/bin/git-crypt`. +apt is blocked on TrueNAS Scale. git-crypt is installed via Docker. -### Current installation (already done on PD) +### Preferred installation location ``` /mnt/docker-ssd/bin/git-crypt ``` -PATH is set in `/home/truenas_admin/.bashrc` and `/root/.bashrc`: +### Compatibility note + +The original bootstrap script installs to `/root/bin/git-crypt`, while the newer runbook expects `/mnt/docker-ssd/bin/git-crypt`. Standardize on `/mnt/docker-ssd/bin/git-crypt` and make sure PATH includes that directory for both `root` and `truenas_admin`. + +Recommended PATH entry: ```bash export PATH="/mnt/docker-ssd/bin:$PATH" @@ -175,6 +181,12 @@ On a fresh PD after reinstalling TrueNAS: git clone ssh://git@10.5.1.6:2222/fizzlepoof/truenas-stacks.git /mnt/docker-ssd/docker/compose ``` 5. **Redeploy stacks** per `DEPLOYMENT_CHECKLIST.md` +6. **After any future live `.env` edit**, immediately run: + ```bash + export PATH="/mnt/docker-ssd/bin:$PATH" + bash /mnt/docker-ssd/docker/compose/scripts/sync-envs-to-secrets.sh + ``` + Then verify the secrets repo is either updated and pushed or already unchanged. --- diff --git a/docs/planning/SCHOOL_INTAKE_PIPELINE.md b/docs/planning/SCHOOL_INTAKE_PIPELINE.md index e424138..5b98c95 100644 --- a/docs/planning/SCHOOL_INTAKE_PIPELINE.md +++ b/docs/planning/SCHOOL_INTAKE_PIPELINE.md @@ -77,9 +77,6 @@ This gives Doris a simple handoff point after the Telegram conversation is compl ## Live work still needed -- import/activate the new n8n intake workflow -- import/activate the Paperless enrichment workflow -- create shared Postgres database/user/schema -- configure class profiles with real Paperless IDs +- configure class profiles with real Paperless IDs / tag mappings - decide Telegram delivery wording/confirmation behavior -- test with real ENGL + HIST documents +- after any live `.env` changes for this pipeline, sync them into the encrypted homelab secrets repo (`docs/operations/SECRETS_MANAGEMENT.md`)