21 lines
1.3 KiB
Markdown
21 lines
1.3 KiB
Markdown
# deployment-source
|
|
|
|
Demo repo for deployment, for clevermicro repos and swarm-cd. This repo will demo how to render the stack file with encrypted secrects and how to commit to the target repo and make PR. This is all down by the pipeline.
|
|
|
|
The encrypted file is `prod-config.enc.yaml`. Currently it is encrypted by SOPS with AGE, here is the recipient list:
|
|
|
|
+ age1kj66pvftzmz7t7klnghacleymtmj2szckkc50dvq8yldqp2gavpsegrfvl (Rui Hu)
|
|
+ age18rl4xxj6m55u44k82vwleurx5d5xhf5vj84n3ewg9rj5nh69rsjsjzqw66 (test key, the private key is `AGE-SECRET-KEY-1DEACUTGUPQWVPR29MVM3LV8JMW8RXS8A4UC2QGERN3VAQ225Z6XQN36C5D`, this is only for testing!!!)
|
|
+ age18ust9l2rx59n9t6h9chpqvhm3j5kc9p75rpxefm83w95s7fqq59qxjzfuj (pipeline runner)
|
|
|
|
For VSC, use extension: https://marketplace.visualstudio.com/items/?itemName=signageos.signageos-vscode-sops to automatically
|
|
decrypt the sops file, by placing your private age key in `~/.config/sops/age/keys.txt` (one private key per line, with `#` for comments).
|
|
This is similar to `sops prod-config.enc.yaml` but instead of vm, you got vsc.
|
|
|
|
The script to render the stack file: `render-stack.sh`, it will decrypt the yaml, call gomplate and renders the final stack file to `compose.prod.yaml`
|
|
|
|
Runner secrets:
|
|
|
|
+ `SOPS_AGE_KEY`: The private key for container
|
|
+ `GIT_USERNAME`: Forgejo username
|
|
+ `GIT_PASSWORD`: Forgejo access token |