mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbach
0b9b21bd9b
meta/volumes.yml separates type: secret from type: config, and the
distinction is what a reader relies on: a config volume is the one you
may show someone or mount read-only for every process. Four roles
rendered a live client secret or an account password into one anyway.
The mode makes it concrete rather than theoretical. 9e7f28db20 widened
these to 0444 for a real reason - swarm config objects mount root:root
and 0440 crashloops a non-root app user - so every process in the
container can read what the type says is safe to show.
The vocabulary comes from how this repository actually writes secrets,
not from a word list. All four are suppressed with the upstream reason
they cannot be split: Jenkins CasC reads one file, Zammad's wizard takes
no reference. They are recorded rather than fixed, and a fifth role
cannot join them silently.
17 lines
588 B
YAML
17 lines
588 B
YAML
---
|
|
# nocheck: config-volume-secret Mobilizon evaluates one Elixir config file at boot, so the OIDC client secret is an expression inside the same document as every other setting; there is no separate secret file the release reads.
|
|
uploads:
|
|
type: volume
|
|
name: mobilizon_uploads
|
|
mounts:
|
|
- service: mobilizon
|
|
target: /var/lib/mobilizon/uploads
|
|
|
|
config_exs:
|
|
type: config
|
|
source: "{{ [ lookup('container', 'web-app-mobilizon', 'directories.config'), 'config.exs' ] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: mobilizon
|
|
target: /etc/mobilizon/config.exs
|