docs: point to ~/agent-secret-vault (unified home, ~/projects copy removed)

This commit is contained in:
user.email
2026-08-13 15:56:54 +08:00
parent 2e35c69e78
commit 67f4932ebd
3 changed files with 19 additions and 19 deletions
+12 -12
View File
@@ -11,8 +11,8 @@
## 目標路徑 ## 目標路徑
- Repo:`~/projects/agent-secret-vault` - Repo:`~/agent-secret-vault`
- Vault 檔:`~/projects/agent-secret-vault/secrets/vault.yml` - Vault 檔:`~/agent-secret-vault/secrets/vault.yml`
- Vault password file:`~/.config/vault-pass.txt` - Vault password file:`~/.config/vault-pass.txt`
- 可覆寫環境變數:`VAULT_PASS_FILE=/custom/path` - 可覆寫環境變數:`VAULT_PASS_FILE=/custom/path`
@@ -45,8 +45,8 @@ cd agent-secret-vault
若 clone 失敗,建立 placeholder 讓後續步驟可明確回報缺什麼: 若 clone 失敗,建立 placeholder 讓後續步驟可明確回報缺什麼:
```bash ```bash
mkdir -p ~/projects/agent-secret-vault/{scripts,secrets,docs} mkdir -p ~/agent-secret-vault/{scripts,secrets,docs}
cat > ~/projects/agent-secret-vault/README.PLACEHOLDER.md <<'PLACEHOLDER' cat > ~/agent-secret-vault/README.PLACEHOLDER.md <<'PLACEHOLDER'
# Placeholder # Placeholder
agent-secret-vault repo 尚未成功 clone。 agent-secret-vault repo 尚未成功 clone。
@@ -68,7 +68,7 @@ install.env # 安裝用 placeholder
安裝前必須先設定 `install.env`(或指定 `INSTALL_ENV_FILE`),不要跳過這一步: 安裝前必須先設定 `install.env`(或指定 `INSTALL_ENV_FILE`),不要跳過這一步:
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
cp -n install.env.example install.env cp -n install.env.example install.env
editor install.env editor install.env
``` ```
@@ -114,7 +114,7 @@ INSTALL_ENV_FILE=install.local.env ./scripts/install-vault-pass.sh
執行 installer 前再次確認 env,然後安裝: 執行 installer 前再次確認 env,然後安裝:
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
./scripts/install-vault-pass.sh --check-env ./scripts/install-vault-pass.sh --check-env
./scripts/install-vault-pass.sh ./scripts/install-vault-pass.sh
``` ```
@@ -151,8 +151,8 @@ installer 會先判斷 `~/.config/vault-pass.txt` 是否已存在:
建立 placeholder,不要自行編造密碼: 建立 placeholder,不要自行編造密碼:
```bash ```bash
mkdir -p ~/projects/agent-secret-vault/secrets mkdir -p ~/agent-secret-vault/secrets
cat > ~/projects/agent-secret-vault/secrets/vault-pass.txt.zip.PLACEHOLDER <<'PLACEHOLDER' cat > ~/agent-secret-vault/secrets/vault-pass.txt.zip.PLACEHOLDER <<'PLACEHOLDER'
Missing file: secrets/vault-pass.txt.zip Missing file: secrets/vault-pass.txt.zip
Purpose: password-protected archive containing vault-pass.txt Purpose: password-protected archive containing vault-pass.txt
Action: ask human maintainer to provide this archive or use installer method 1/2/3. Action: ask human maintainer to provide this archive or use installer method 1/2/3.
@@ -202,7 +202,7 @@ VAULT_PASS_CONTENT="..." \
## 4. 驗證安裝 ## 4. 驗證安裝
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null
``` ```
@@ -211,7 +211,7 @@ ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.
## 5. 讀取單一 secret ## 5. 讀取單一 secret
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
./scripts/get-secret.sh <dot.path> ./scripts/get-secret.sh <dot.path>
``` ```
@@ -227,7 +227,7 @@ cd ~/projects/agent-secret-vault
## 6. Worker 需要 env 時 ## 6. Worker 需要 env 時
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
umask 077 umask 077
./scripts/render-env.sh gitea > /tmp/gitea.env ./scripts/render-env.sh gitea > /tmp/gitea.env
set -a set -a
@@ -243,7 +243,7 @@ rm -f /tmp/gitea.env
只有在人類明確要求更新 secrets 時才做: 只有在人類明確要求更新 secrets 時才做:
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
git pull --ff-only git pull --ff-only
./scripts/vault.sh edit ./scripts/vault.sh edit
ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null
+3 -3
View File
@@ -4,7 +4,7 @@
## 基本資訊 ## 基本資訊
- vault 位置:`~/projects/agent-secret-vault/secrets/vault.yml` - vault 位置:`~/agent-secret-vault/secrets/vault.yml`
- vault password 位置:`~/.config/vault-pass.txt` - vault password 位置:`~/.config/vault-pass.txt`
- 加密格式:ansible-vault(AES256) - 加密格式:ansible-vault(AES256)
@@ -13,7 +13,7 @@
### 方法 1:用 vault.sh 腳本(推薦) ### 方法 1:用 vault.sh 腳本(推薦)
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
# 檢視 vault 內容 # 檢視 vault 內容
./scripts/vault.sh view ./scripts/vault.sh view
@@ -56,7 +56,7 @@ rm /tmp/gitea.env
解決: 解決:
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
./scripts/vault.sh init ./scripts/vault.sh init
``` ```
+4 -4
View File
@@ -62,7 +62,7 @@ installer 會先檢查:
維護者若要讓其他 agent / 機器安裝,先在已可解密的機器上執行: 維護者若要讓其他 agent / 機器安裝,先在已可解密的機器上執行:
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
./scripts/create-vault-pass-archive.sh ./scripts/create-vault-pass-archive.sh
git add secrets/vault-pass.txt.zip git add secrets/vault-pass.txt.zip
git commit -m "Add vault password archive" git commit -m "Add vault password archive"
@@ -76,7 +76,7 @@ git push
安裝流程要求先填 repo 內的 env 檔: 安裝流程要求先填 repo 內的 env 檔:
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
cp -n install.env.example install.env cp -n install.env.example install.env
editor install.env editor install.env
./scripts/install-vault-pass.sh --check-env ./scripts/install-vault-pass.sh --check-env
@@ -121,14 +121,14 @@ VAULT_PASS_ZIP_PASSWORD_FILE=/secure/path/zip-password.txt \
### 查看 vault ### 查看 vault
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
./scripts/vault.sh view ./scripts/vault.sh view
``` ```
### 編輯 vault ### 編輯 vault
```bash ```bash
cd ~/projects/agent-secret-vault cd ~/agent-secret-vault
git pull --ff-only git pull --ff-only
./scripts/vault.sh edit ./scripts/vault.sh edit
git add secrets/vault.yml git add secrets/vault.yml