Sergei Poljanski
b6bcc9f882
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
The public bingo site is moving out of the asxpio container and only needs to read the bingo tables and the bingo/ photos. Give it a role limited to SELECT on those two tables (with read-only transactions by default) and a MinIO user limited to GetObject under asxpio-invoices/bingo/, instead of reusing asxpio's read-write credentials. Both steps are skipped while the BINGO_* secrets are unset, so this deploys safely before they exist. Tables missing on a fresh install are granted on the next deploy. Assisted-by: Claude:opus-5
20 lines
734 B
Bash
20 lines
734 B
Bash
# Storage stack — Postgres + MinIO
|
|
# Copy to .env for local use. Production .env is regenerated by the deploy
|
|
# workflow from Forgejo secrets.
|
|
|
|
# Postgres superuser (used only by init + admin tasks)
|
|
POSTGRES_PASSWORD=change-me
|
|
|
|
# MinIO root account (used only by init + admin tasks)
|
|
MINIO_ROOT_USER=storage-admin
|
|
MINIO_ROOT_PASSWORD=change-me-32-chars-min
|
|
|
|
# Per-app credentials provisioned by the init containers.
|
|
# These are also added as secrets on every consuming app's repo.
|
|
ASXPIO_DB_PASSWORD=change-me
|
|
ASXPIO_S3_ACCESS_KEY=change-me
|
|
ASXPIO_S3_SECRET_KEY=change-me
|
|
# datacenterbingo: read-only on asxpio's bingo tables and bingo/ photos.
|
|
BINGO_DB_PASSWORD=change-me
|
|
BINGO_S3_ACCESS_KEY=change-me
|
|
BINGO_S3_SECRET_KEY=change-me
|