asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

Provision read-only credentials for datacenterbingo
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
Details

Browse source 
The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-12 03:47:57 +04:00
commit b6bcc9f882
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
6 changed files with 86 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.env.example
View file

@ -14,3 +14,7 @@ MINIO_ROOT_PASSWORD=change-me-32-chars-min
ASXPIO_DB_PASSWORD=change-me
ASXPIO_S3_ACCESS_KEY=change-me
ASXPIO_S3_SECRET_KEY=change-me
# datacenterbingo: read-only on asxpio's bingo tables and bingo/ photos.
BINGO_DB_PASSWORD=change-me
BINGO_S3_ACCESS_KEY=change-me
BINGO_S3_SECRET_KEY=change-me