docs: point to ~/agent-secret-vault (unified home, ~/projects copy removed)
This commit is contained in:
@@ -11,8 +11,8 @@
|
|||||||
|
|
||||||
## 目標路徑
|
## 目標路徑
|
||||||
|
|
||||||
- Repo:`~/projects/agent-secret-vault`
|
- Repo:`~/agent-secret-vault`
|
||||||
- Vault 檔:`~/projects/agent-secret-vault/secrets/vault.yml`
|
- Vault 檔:`~/agent-secret-vault/secrets/vault.yml`
|
||||||
- Vault password file:`~/.config/vault-pass.txt`
|
- Vault password file:`~/.config/vault-pass.txt`
|
||||||
- 可覆寫環境變數:`VAULT_PASS_FILE=/custom/path`
|
- 可覆寫環境變數:`VAULT_PASS_FILE=/custom/path`
|
||||||
|
|
||||||
@@ -45,8 +45,8 @@ cd agent-secret-vault
|
|||||||
若 clone 失敗,建立 placeholder 讓後續步驟可明確回報缺什麼:
|
若 clone 失敗,建立 placeholder 讓後續步驟可明確回報缺什麼:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
mkdir -p ~/projects/agent-secret-vault/{scripts,secrets,docs}
|
mkdir -p ~/agent-secret-vault/{scripts,secrets,docs}
|
||||||
cat > ~/projects/agent-secret-vault/README.PLACEHOLDER.md <<'PLACEHOLDER'
|
cat > ~/agent-secret-vault/README.PLACEHOLDER.md <<'PLACEHOLDER'
|
||||||
# Placeholder
|
# Placeholder
|
||||||
|
|
||||||
agent-secret-vault repo 尚未成功 clone。
|
agent-secret-vault repo 尚未成功 clone。
|
||||||
@@ -68,7 +68,7 @@ install.env # 安裝用 placeholder
|
|||||||
安裝前必須先設定 `install.env`(或指定 `INSTALL_ENV_FILE`),不要跳過這一步:
|
安裝前必須先設定 `install.env`(或指定 `INSTALL_ENV_FILE`),不要跳過這一步:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
cp -n install.env.example install.env
|
cp -n install.env.example install.env
|
||||||
editor install.env
|
editor install.env
|
||||||
```
|
```
|
||||||
@@ -114,7 +114,7 @@ INSTALL_ENV_FILE=install.local.env ./scripts/install-vault-pass.sh
|
|||||||
執行 installer 前再次確認 env,然後安裝:
|
執行 installer 前再次確認 env,然後安裝:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
./scripts/install-vault-pass.sh --check-env
|
./scripts/install-vault-pass.sh --check-env
|
||||||
./scripts/install-vault-pass.sh
|
./scripts/install-vault-pass.sh
|
||||||
```
|
```
|
||||||
@@ -151,8 +151,8 @@ installer 會先判斷 `~/.config/vault-pass.txt` 是否已存在:
|
|||||||
建立 placeholder,不要自行編造密碼:
|
建立 placeholder,不要自行編造密碼:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
mkdir -p ~/projects/agent-secret-vault/secrets
|
mkdir -p ~/agent-secret-vault/secrets
|
||||||
cat > ~/projects/agent-secret-vault/secrets/vault-pass.txt.zip.PLACEHOLDER <<'PLACEHOLDER'
|
cat > ~/agent-secret-vault/secrets/vault-pass.txt.zip.PLACEHOLDER <<'PLACEHOLDER'
|
||||||
Missing file: secrets/vault-pass.txt.zip
|
Missing file: secrets/vault-pass.txt.zip
|
||||||
Purpose: password-protected archive containing vault-pass.txt
|
Purpose: password-protected archive containing vault-pass.txt
|
||||||
Action: ask human maintainer to provide this archive or use installer method 1/2/3.
|
Action: ask human maintainer to provide this archive or use installer method 1/2/3.
|
||||||
@@ -202,7 +202,7 @@ VAULT_PASS_CONTENT="..." \
|
|||||||
## 4. 驗證安裝
|
## 4. 驗證安裝
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null
|
ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -211,7 +211,7 @@ ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.
|
|||||||
## 5. 讀取單一 secret
|
## 5. 讀取單一 secret
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
./scripts/get-secret.sh <dot.path>
|
./scripts/get-secret.sh <dot.path>
|
||||||
```
|
```
|
||||||
|
|
||||||
@@ -227,7 +227,7 @@ cd ~/projects/agent-secret-vault
|
|||||||
## 6. Worker 需要 env 時
|
## 6. Worker 需要 env 時
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
umask 077
|
umask 077
|
||||||
./scripts/render-env.sh gitea > /tmp/gitea.env
|
./scripts/render-env.sh gitea > /tmp/gitea.env
|
||||||
set -a
|
set -a
|
||||||
@@ -243,7 +243,7 @@ rm -f /tmp/gitea.env
|
|||||||
只有在人類明確要求更新 secrets 時才做:
|
只有在人類明確要求更新 secrets 時才做:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
git pull --ff-only
|
git pull --ff-only
|
||||||
./scripts/vault.sh edit
|
./scripts/vault.sh edit
|
||||||
ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null
|
ansible-vault view secrets/vault.yml --vault-password-file ~/.config/vault-pass.txt >/dev/null
|
||||||
|
|||||||
@@ -4,7 +4,7 @@
|
|||||||
|
|
||||||
## 基本資訊
|
## 基本資訊
|
||||||
|
|
||||||
- vault 位置:`~/projects/agent-secret-vault/secrets/vault.yml`
|
- vault 位置:`~/agent-secret-vault/secrets/vault.yml`
|
||||||
- vault password 位置:`~/.config/vault-pass.txt`
|
- vault password 位置:`~/.config/vault-pass.txt`
|
||||||
- 加密格式:ansible-vault(AES256)
|
- 加密格式:ansible-vault(AES256)
|
||||||
|
|
||||||
@@ -13,7 +13,7 @@
|
|||||||
### 方法 1:用 vault.sh 腳本(推薦)
|
### 方法 1:用 vault.sh 腳本(推薦)
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
|
|
||||||
# 檢視 vault 內容
|
# 檢視 vault 內容
|
||||||
./scripts/vault.sh view
|
./scripts/vault.sh view
|
||||||
@@ -56,7 +56,7 @@ rm /tmp/gitea.env
|
|||||||
|
|
||||||
解決:
|
解決:
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
./scripts/vault.sh init
|
./scripts/vault.sh init
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|||||||
+4
-4
@@ -62,7 +62,7 @@ installer 會先檢查:
|
|||||||
維護者若要讓其他 agent / 機器安裝,先在已可解密的機器上執行:
|
維護者若要讓其他 agent / 機器安裝,先在已可解密的機器上執行:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
./scripts/create-vault-pass-archive.sh
|
./scripts/create-vault-pass-archive.sh
|
||||||
git add secrets/vault-pass.txt.zip
|
git add secrets/vault-pass.txt.zip
|
||||||
git commit -m "Add vault password archive"
|
git commit -m "Add vault password archive"
|
||||||
@@ -76,7 +76,7 @@ git push
|
|||||||
安裝流程要求先填 repo 內的 env 檔:
|
安裝流程要求先填 repo 內的 env 檔:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
cp -n install.env.example install.env
|
cp -n install.env.example install.env
|
||||||
editor install.env
|
editor install.env
|
||||||
./scripts/install-vault-pass.sh --check-env
|
./scripts/install-vault-pass.sh --check-env
|
||||||
@@ -121,14 +121,14 @@ VAULT_PASS_ZIP_PASSWORD_FILE=/secure/path/zip-password.txt \
|
|||||||
### 查看 vault
|
### 查看 vault
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
./scripts/vault.sh view
|
./scripts/vault.sh view
|
||||||
```
|
```
|
||||||
|
|
||||||
### 編輯 vault
|
### 編輯 vault
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
cd ~/projects/agent-secret-vault
|
cd ~/agent-secret-vault
|
||||||
git pull --ff-only
|
git pull --ff-only
|
||||||
./scripts/vault.sh edit
|
./scripts/vault.sh edit
|
||||||
git add secrets/vault.yml
|
git add secrets/vault.yml
|
||||||
|
|||||||
Reference in New Issue
Block a user