mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
d4f313d149
ruff wraps the ternary in _sandbox_workers (8ce66075b) and the yaml formatter reflows db_key_base's description (e3d5ab287); both lines were written over the limit. No behaviour changes. autoformat runs as quality-high's first phase, so it corrects a line only on the run AFTER the one that introduced it -- which is why git status is worth reading after every gate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
56 lines
2.5 KiB
YAML
56 lines
2.5 KiB
YAML
---
|
|
credentials:
|
|
mcp_bearer:
|
|
description: "Bearer an MCP client must present to this role's adapter instance. Distinct from the credential the adapter presents upstream: holding a token the
|
|
application accepts says nothing about who called the adapter."
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{32,}$"
|
|
length: 48
|
|
secret_key_base:
|
|
description: Rails secret key base used to verify signed cookies and tokens
|
|
algorithm: random_hex
|
|
validation: "^[a-f0-9]{128}$"
|
|
otp_key_base:
|
|
description: Key base encrypting two-factor authentication secrets
|
|
algorithm: random_hex
|
|
validation: "^[a-f0-9]{128}$"
|
|
db_key_base:
|
|
description: "Key base encrypting CI/CD variable values, terraform state, Pages TLS private keys, and integration and webhook credentials. settings.rb raises
|
|
MultipleDbKeyBaseError on a second key and upstream ships no re-encrypt task, so a rotation is one-way."
|
|
algorithm: random_hex
|
|
validation: "^[a-f0-9]{128}$"
|
|
rotatable: false
|
|
encrypted_settings_key_base:
|
|
description: Key base encrypting settings files
|
|
algorithm: random_hex
|
|
validation: "^[a-f0-9]{128}$"
|
|
active_record_encryption_primary_key:
|
|
description: Primary key for Active Record encrypted columns
|
|
algorithm: random_hex_16
|
|
validation: "^[a-f0-9]{32}$"
|
|
active_record_encryption_deterministic_key:
|
|
description: Deterministic key for Active Record encrypted columns
|
|
algorithm: random_hex_16
|
|
validation: "^[a-f0-9]{32}$"
|
|
active_record_encryption_key_derivation_salt:
|
|
description: "PBKDF2 salt every Active Record encryption key derives from. It has no list form, so rotating it voids the primary-key rotation list as well."
|
|
algorithm: random_hex_16
|
|
validation: "^[a-f0-9]{32}$"
|
|
rotatable: false
|
|
gitlab_shell_secret:
|
|
description: Shared token authenticating gitlab-shell and gitaly against the rails API
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{64}$"
|
|
gitaly_token:
|
|
description: Auth token shared between rails and the gitaly gRPC listener
|
|
algorithm: alphanumeric
|
|
validation: "^[A-Za-z0-9]{64}$"
|
|
workhorse_secret:
|
|
description: 32-byte value shared between workhorse and rails, mounted base64-encoded
|
|
algorithm: random_hex_16
|
|
validation: "^[a-f0-9]{32}$"
|
|
openid_connect_signing_key:
|
|
description: RSA private key signing GitLab's own OpenID Connect provider tokens
|
|
algorithm: rsa_pem_2048
|
|
validation: "^-----BEGIN RSA PRIVATE KEY-----[\\s\\S]+-----END RSA PRIVATE KEY-----\\s*$"
|