asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

Provision read-only credentials for datacenterbingo
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
Details

Browse source 
The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-12 03:47:57 +04:00
commit b6bcc9f882
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
6 changed files with 86 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
.forgejo/workflows/deploy.yaml
View file

@ -35,11 +35,14 @@ jobs:
ASXPIO_DB_PASSWORD: ${{ secrets.ASXPIO_DB_PASSWORD }}
ASXPIO_S3_ACCESS_KEY: ${{ secrets.ASXPIO_S3_ACCESS_KEY }}
ASXPIO_S3_SECRET_KEY: ${{ secrets.ASXPIO_S3_SECRET_KEY }}
BINGO_DB_PASSWORD: ${{ secrets.BINGO_DB_PASSWORD }}
BINGO_S3_ACCESS_KEY: ${{ secrets.BINGO_S3_ACCESS_KEY }}
BINGO_S3_SECRET_KEY: ${{ secrets.BINGO_S3_SECRET_KEY }}
with:
host: ${{ secrets.DEPLOY_IP }}
username: ${{ secrets.DEPLOY_USER }}
key: ${{ secrets.DEPLOY_SSH_KEY }}
envs: POSTGRES_PASSWORD,MINIO_ROOT_USER,MINIO_ROOT_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY
envs: POSTGRES_PASSWORD,MINIO_ROOT_USER,MINIO_ROOT_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY,BINGO_DB_PASSWORD,BINGO_S3_ACCESS_KEY,BINGO_S3_SECRET_KEY
script_stop: true
script: |
umask 077
@ -51,6 +54,9 @@ jobs:
ASXPIO_DB_PASSWORD=${ASXPIO_DB_PASSWORD}
ASXPIO_S3_ACCESS_KEY=${ASXPIO_S3_ACCESS_KEY}
ASXPIO_S3_SECRET_KEY=${ASXPIO_S3_SECRET_KEY}
BINGO_DB_PASSWORD=${BINGO_DB_PASSWORD}
BINGO_S3_ACCESS_KEY=${BINGO_S3_ACCESS_KEY}
BINGO_S3_SECRET_KEY=${BINGO_S3_SECRET_KEY}
EOF
chmod 600 /opt/storage/.env
chmod +x /opt/storage/init/postgres-init.sh /opt/storage/init/minio-bootstrap.sh