feat: support literal values in vault manifests, use for DISABLE_SIGNUP - #150
Merged
Conversation
Admin account is already created; closes public signup now that it's no longer needed. Maps to a new DISABLE_SIGNUP GitHub Variable, set to true. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…ping Closing rybbit's public signup is a fixed decision for this deployment, not something vault-sourced or meant to be toggled back later - it would be exactly the same regardless of which vault fed the deploy. That's what x-internal-env is for, so no GitHub Variable is needed at all for it. Also updates client's NEXT_PUBLIC_DISABLE_SIGNUP to match, which previously referenced the same var directly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ineedjet
changed the title
Vault manifest env: values were always "the name of a GitHub Secret or
Variable to look up" - no way to express a fixed, non-secret constant
without creating a whole repo Variable just to hold it. Homogeneous
with how docker-compose.yml already distinguishes vault-sourced from
internal values, but using the same ${VAR} interpolation marker
compose itself uses rather than a second section: ${NAME} is a
lookup reference, any other value (string, number, bool) is a literal
used as-is with no lookup and no way to fail on "missing."
Migrates every existing vault manifest's env: values to the ${NAME}
form to keep meaning "lookup" now that a bare value means something
different. Reverts DISABLE_SIGNUP back to vault-sourced (x-vault-env)
now that the vault itself can hold it directly as a literal - no
GitHub Variable needed, no compose-level hardcoding either.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ineedjet
changed the title
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closing rybbit's public signup is a fixed decision for this deployment - not a secret, not something meant to change back later. Wiring it through a GitHub Variable felt like the wrong tool (creating a whole repo Variable just to hold a constant); hardcoding it into the compose file's `x-internal-env` (first attempt) felt wrong too, since it's a per-target choice, not something that's the same for every deployment of rybbit everywhere.
Landed on: teach vault manifests to hold literal values directly, homogeneous with how `docker-compose.yml` already tells vault-sourced from fixed values apart - but reusing the exact `${VAR}` interpolation marker compose itself already uses, instead of inventing a second section:
```yaml
vaults/rybbit.yml
env:
DOMAIN: ${DOMAIN} # reference - look up the GitHub Secret/Variable
DATABASE_PASSWORD: ${DATABASE_PASSWORD}
SESSION_KEY: ${SESSION_KEY}
DISABLE_SIGNUP: true # literal - used as-is, no lookup, can't be "missing"
```
`render-env.py`: a string wrapped as `${NAME}` is a reference (validated, resolved against Secrets then Variables, fails loud if missing); anything else - string, number, bool - is a literal, passed straight through (booleans render lowercase `true`/`false` to match dotenv/shell convention, not Python's `True`/`False`).
This changes the meaning of a bare value in every existing manifest's `env:` (previously always a lookup name), so migrated `vaults/traefik.yml`, `vaults/rybbit.yml`, and `vaults/cloudflared.yml` to the `${NAME}` form in the same commit. Updated README and `encrypt-env/README.md` accordingly.
Test plan