fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(homelab): require secrets sync after env changes

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-14 02:00:25 +00:00
parent a650c1a56b
commit df70c6cbca
2 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/operations/SECRETS_MANAGEMENT.md
View File

@@ -98,19 +98,25 @@ What it does:
Run this any time you create or update a stack's `.env` file. Run this any time you create or update a stack's `.env` file.
**Operational rule:** after any live `.env` change on PD, Doris or the operator must run the sync script and confirm whether it committed/pushed changes or reported the secrets repo already up to date. Do not treat live `.env` edits as complete until this sync step is checked.
--- ---
## git-crypt on TrueNAS ## git-crypt on TrueNAS
apt is blocked on TrueNAS Scale. git-crypt is installed via Docker and stored on the persistent dataset at `/mnt/docker-ssd/bin/git-crypt`. apt is blocked on TrueNAS Scale. git-crypt is installed via Docker.
### Current installation (already done on PD) ### Preferred installation location
``` ```
/mnt/docker-ssd/bin/git-crypt /mnt/docker-ssd/bin/git-crypt
``` ```
PATH is set in `/home/truenas_admin/.bashrc` and `/root/.bashrc`: ### Compatibility note
The original bootstrap script installs to `/root/bin/git-crypt`, while the newer runbook expects `/mnt/docker-ssd/bin/git-crypt`. Standardize on `/mnt/docker-ssd/bin/git-crypt` and make sure PATH includes that directory for both `root` and `truenas_admin`.
Recommended PATH entry:
```bash ```bash
export PATH="/mnt/docker-ssd/bin:$PATH" export PATH="/mnt/docker-ssd/bin:$PATH"
@@ -175,6 +181,12 @@ On a fresh PD after reinstalling TrueNAS:
git clone ssh://git@10.5.1.6:2222/fizzlepoof/truenas-stacks.git /mnt/docker-ssd/docker/compose git clone ssh://git@10.5.1.6:2222/fizzlepoof/truenas-stacks.git /mnt/docker-ssd/docker/compose
``` ```
5. **Redeploy stacks** per `DEPLOYMENT_CHECKLIST.md` 5. **Redeploy stacks** per `DEPLOYMENT_CHECKLIST.md`
6. **After any future live `.env` edit**, immediately run:
```bash
export PATH="/mnt/docker-ssd/bin:$PATH"
bash /mnt/docker-ssd/docker/compose/scripts/sync-envs-to-secrets.sh
```
Then verify the secrets repo is either updated and pushed or already unchanged.
--- ---

7
docs/planning/SCHOOL_INTAKE_PIPELINE.md
View File

@@ -77,9 +77,6 @@ This gives Doris a simple handoff point after the Telegram conversation is compl
## Live work still needed ## Live work still needed
- import/activate the new n8n intake workflow - configure class profiles with real Paperless IDs / tag mappings
- import/activate the Paperless enrichment workflow
- create shared Postgres database/user/schema
- configure class profiles with real Paperless IDs
- decide Telegram delivery wording/confirmation behavior - decide Telegram delivery wording/confirmation behavior
- test with real ENGL + HIST documents - after any live `.env` changes for this pipeline, sync them into the encrypted homelab secrets repo (`docs/operations/SECRETS_MANAGEMENT.md`)