Deploy storage stack / deploy (push) Successful in 19s

Details

Provision read-only credentials for datacenterbingo

The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.

Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.

Assisted-by: Claude:opus-5

2026-10-12 03:47:57 +04:00

4.4 KiB

Raw Blame History

Forgejo secrets — storage repo

Add these to git.czsk.it/asxpi/storage → Settings → Actions → Secrets before the first deploy. All values are opaque to the storage stack; nothing is domain-specific.

How to generate a value

openssl rand -hex 32       # 64-char hex, good for any password/key
openssl rand -base64 24    # 32-char base64, fine for MinIO root password

For MinIO access keys prefer alphanumeric, 20 chars:

LC_ALL=C tr -dc 'A-Z0-9' </dev/urandom | head -c 20; echo

For MinIO secret keys, 40+ chars:

LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | head -c 40; echo

Required secrets

Deploy access (same pattern as the asxpio repo)

Secret	Value
`DEPLOY_IP`	Production host IP/hostname.
`DEPLOY_USER`	SSH user on the prod host.
`DEPLOY_SSH_KEY`	Private SSH key authorised on the prod host.

Reuse the same key the asxpio repo uses.

Postgres

Secret	Value
`POSTGRES_PASSWORD`	Postgres superuser password. `openssl rand -hex 32`. Used only by init/admin.

MinIO

Secret	Value
`MINIO_ROOT_USER`	Root username, e.g. `storage-admin`. Any string ≥ 3 chars.
`MINIO_ROOT_PASSWORD`	Root password. ≥ 8 chars; use `openssl rand -base64 24`.

Per-app credentials provisioned for asxpio

These are also added (with the same values) on the asxpio repo so the app can connect.

Secret	Value
`ASXPIO_DB_PASSWORD`	Postgres password for the `asxpio` role. `openssl rand -hex 32`.
`ASXPIO_S3_ACCESS_KEY`	20-char alphanumeric, see snippet above.
`ASXPIO_S3_SECRET_KEY`	40-char alphanumeric, see snippet above.

Per-app credentials provisioned for datacenterbingo

These are read-only:

Role bingo gets SELECT on bingo_datacenters and bingo_incidents in the asxpio DB, and default_transaction_read_only.
The MinIO user may only GetObject under asxpio-invoices/bingo/.

The same values go on the datacenterbingo repo.

Secret	Value
`BINGO_DB_PASSWORD`	Postgres password for the `bingo` role. `openssl rand -hex 32`.
`BINGO_S3_ACCESS_KEY`	20-char alphanumeric.
`BINGO_S3_SECRET_KEY`	40-char alphanumeric.

The table grants need asxpio's migrations to have run. On a fresh install, deploy storage again after asxpio's first boot.

After adding secrets

Push to main. The Forgejo workflow brings Postgres and MinIO up, then runs postgres-init (creates asxpio role + DB) and minio-init (creates asxpio-invoices bucket and an asxpio-scoped user).

Confirm both init containers exited 0:

ssh deploy@prod 'docker compose -f /opt/storage/docker-compose.yml ps'
ssh deploy@prod 'docker logs storage-postgres-init storage-minio-init'

Add the matching ASXPIO_DB_PASSWORD, ASXPIO_S3_ACCESS_KEY, ASXPIO_S3_SECRET_KEY (plus ADMIN_USER, ADMIN_PASSWORD) on the asxpio repo — see asxpio/SECRETS.md.
Deploy asxpio.

Rotation

POSTGRES_PASSWORD / MINIO_ROOT_PASSWORD: update secret, push. Init scripts only touch per-app roles, so the root passwords are applied on container restart (Postgres) or via the env on next boot (MinIO). For MinIO root rotation, recreating the container is enough.
Per-app password / keys: update both repos' secrets, push storage first (re-provisions the role/user with the new password), then push the consumer.

4.4 KiB Raw Blame History