From 67f4932ebdc65a2789cb76684d1701bfae5547ee Mon Sep 17 00:00:00 2001 From: "user.email" Date: Thu, 13 Aug 2026 15:56:54 +0800 Subject: [PATCH] docs: point to ~/agent-secret-vault (unified home, ~/projects copy removed) --- docs/agent-install-runbook.md | 24 ++++++++++++------------ docs/agent-integration.md | 6 +++--- docs/human-guide.md | 8 ++++---- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/docs/agent-install-runbook.md b/docs/agent-install-runbook.md index 05796be..6e3c510 100644 --- a/docs/agent-install-runbook.md +++ b/docs/agent-install-runbook.md @@ -11,8 +11,8 @@ ## 目標路徑 -- Repo:`~/projects/agent-secret-vault` -- Vault 檔:`~/projects/agent-secret-vault/secrets/vault.yml` +- Repo:`~/agent-secret-vault` +- Vault 檔:`~/agent-secret-vault/secrets/vault.yml` - Vault password file:`~/.config/vault-pass.txt` - 可覆寫環境變數:`VAULT_PASS_FILE=/custom/path` @@ -45,8 +45,8 @@ cd agent-secret-vault 若 clone 失敗,建立 placeholder 讓後續步驟可明確回報缺什麼: ```bash -mkdir -p ~/projects/agent-secret-vault/{scripts,secrets,docs} -cat > ~/projects/agent-secret-vault/README.PLACEHOLDER.md <<'PLACEHOLDER' +mkdir -p ~/agent-secret-vault/{scripts,secrets,docs} +cat > ~/agent-secret-vault/README.PLACEHOLDER.md <<'PLACEHOLDER' # Placeholder agent-secret-vault repo 尚未成功 clone。 @@ -68,7 +68,7 @@ install.env # 安裝用 placeholder 安裝前必須先設定 `install.env`(或指定 `INSTALL_ENV_FILE`),不要跳過這一步: ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault cp -n install.env.example install.env editor install.env ``` @@ -114,7 +114,7 @@ INSTALL_ENV_FILE=install.local.env ./scripts/install-vault-pass.sh 執行 installer 前再次確認 env,然後安裝: ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault ./scripts/install-vault-pass.sh --check-env ./scripts/install-vault-pass.sh ``` @@ -151,8 +151,8 @@ installer 會先判斷 `~/.config/vault-pass.txt` 是否已存在: 建立 placeholder,不要自行編造密碼: ```bash -mkdir -p ~/projects/agent-secret-vault/secrets -cat > ~/projects/agent-secret-vault/secrets/vault-pass.txt.zip.PLACEHOLDER <<'PLACEHOLDER' +mkdir -p ~/agent-secret-vault/secrets +cat > ~/agent-secret-vault/secrets/vault-pass.txt.zip.PLACEHOLDER <<'PLACEHOLDER' Missing file: secrets/vault-pass.txt.zip Purpose: password-protected archive containing vault-pass.txt Action: ask human maintainer to provide this archive or use installer method 1/2/3. @@ -202,7 +202,7 @@ VAULT_PASS_CONTENT="..." \ ## 4. 驗證安裝 ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null ``` @@ -211,7 +211,7 @@ ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass. ## 5. 讀取單一 secret ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault ./scripts/get-secret.sh ``` @@ -227,7 +227,7 @@ cd ~/projects/agent-secret-vault ## 6. Worker 需要 env 時 ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault umask 077 ./scripts/render-env.sh gitea > /tmp/gitea.env set -a @@ -243,7 +243,7 @@ rm -f /tmp/gitea.env 只有在人類明確要求更新 secrets 時才做: ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault git pull --ff-only ./scripts/vault.sh edit ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null diff --git a/docs/agent-integration.md b/docs/agent-integration.md index c6c2048..eae371f 100644 --- a/docs/agent-integration.md +++ b/docs/agent-integration.md @@ -4,7 +4,7 @@ ## 基本資訊 -- vault 位置:`~/projects/agent-secret-vault/secrets/vault.yml` +- vault 位置:`~/agent-secret-vault/secrets/vault.yml` - vault password 位置:`~/.config/vault-pass.txt` - 加密格式:ansible-vault(AES256) @@ -13,7 +13,7 @@ ### 方法 1:用 vault.sh 腳本(推薦) ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault # 檢視 vault 內容 ./scripts/vault.sh view @@ -56,7 +56,7 @@ rm /tmp/gitea.env 解決: ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault ./scripts/vault.sh init ``` diff --git a/docs/human-guide.md b/docs/human-guide.md index 128f9a3..100f820 100644 --- a/docs/human-guide.md +++ b/docs/human-guide.md @@ -62,7 +62,7 @@ installer 會先檢查: 維護者若要讓其他 agent / 機器安裝,先在已可解密的機器上執行: ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault ./scripts/create-vault-pass-archive.sh git add secrets/vault-pass.txt.zip git commit -m "Add vault password archive" @@ -76,7 +76,7 @@ git push 安裝流程要求先填 repo 內的 env 檔: ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault cp -n install.env.example install.env editor install.env ./scripts/install-vault-pass.sh --check-env @@ -121,14 +121,14 @@ VAULT_PASS_ZIP_PASSWORD_FILE=/secure/path/zip-password.txt \ ### 查看 vault ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault ./scripts/vault.sh view ``` ### 編輯 vault ```bash -cd ~/projects/agent-secret-vault +cd ~/agent-secret-vault git pull --ff-only ./scripts/vault.sh edit git add secrets/vault.yml