mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbach
0b9b21bd9b
meta/volumes.yml separates type: secret from type: config, and the
distinction is what a reader relies on: a config volume is the one you
may show someone or mount read-only for every process. Four roles
rendered a live client secret or an account password into one anyway.
The mode makes it concrete rather than theoretical. 9e7f28db20 widened
these to 0444 for a real reason - swarm config objects mount root:root
and 0440 crashloops a non-root app user - so every process in the
container can read what the type says is safe to show.
The vocabulary comes from how this repository actually writes secrets,
not from a word list. All four are suppressed with the upstream reason
they cannot be split: Jenkins CasC reads one file, Zammad's wizard takes
no reference. They are recorded rather than fixed, and a fifth role
cannot join them silently.
20 lines
680 B
YAML
20 lines
680 B
YAML
---
|
|
# nocheck: config-volume-secret Jenkins Configuration-as-Code reads one casc.yaml that carries the OIDC client secret and the seeded administrator password beside every non-secret setting; the plugin offers no split file and no secret indirection, so the credential travels in the same read-only mount.
|
|
jenkins_data:
|
|
type: volume
|
|
nfs:
|
|
uid: "1000"
|
|
gid: "1000"
|
|
mode: "0770"
|
|
mounts:
|
|
- service: jenkins
|
|
target: /var/jenkins_home
|
|
|
|
casc:
|
|
type: config
|
|
source: "{{ [ lookup('container', 'web-app-jenkins', 'directories.instance'), 'casc.yaml' ] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: jenkins
|
|
target: /var/jenkins_home/casc.yaml
|