feat: distribute Hero WARP enrollment secrets - #64
Merged
Conversation
Contributor
OpenTofu TestOpenTofu test passed. View run output |
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputOpenTofu will perform the following actions:
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
+ created_at = (known after apply)
+ id = (known after apply)
+ key_id = (known after apply)
+ plaintext_value = (sensitive value)
+ remote_updated_at = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
[REDACTED: potentially sensitive plan output]
+ updated_at = (known after apply)
}
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
+ created_at = (known after apply)
+ id = (known after apply)
+ key_id = (known after apply)
+ plaintext_value = (sensitive value)
+ remote_updated_at = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
[REDACTED: potentially sensitive plan output]
+ updated_at = (known after apply)
}
Plan: 2 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
+ created_at = (known after apply)
+ id = (known after apply)
+ key_id = (known after apply)
+ plaintext_value = (sensitive value)
+ remote_updated_at = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
[REDACTED: potentially sensitive plan output]
+ updated_at = (known after apply)
}
[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
+ created_at = (known after apply)
+ id = (known after apply)
+ key_id = (known after apply)
+ plaintext_value = (sensitive value)
+ remote_updated_at = (known after apply)
+ repository = "hero-host-config"
+ repository_id = (known after apply)
[REDACTED: potentially sensitive plan output]
+ updated_at = (known after apply)
}
Plan: 2 to add, 0 to change, 0 to destroy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Declare the two already-encrypted Hero WARP enrollment source fields as narrowly scoped GitHub Actions secrets for the private
hero-host-configrepository:HERO_HOST_CONFIG_WARP_CLIENT_IDHERO_HOST_CONFIG_WARP_CLIENT_SECRETThe generic organization-wide Cloudflare authentication-secret broadcast remains explicitly excluded from
hero-host-config.Fixes #
None.
Type of change
Validation
opentofu / testandopentofu / planpassed.No local OpenTofu init, plan, apply, import, state, or secret-decryption operation was run or claimed by the agent.
Impact and rollout
Producer:
tfroot-cloudflarepreviously created the dedicated service token;tfroot-githubmain now contains its owner-authored SOPS-encrypted source fields. This PR adds only their non-secret distribution declarations.Consumer: after a reviewed merge and environment-gated
mainapply,hero-host-configreceives exactly the two named Actions secrets. No other repository receives them.Unchanged: no generic Cloudflare secret distribution, WARP enrollment, Cloudflared migration, GitHub Actions execution, host configuration, or live host mutation is included.
Delivery stages: authored, submitted, and CI-validated. Merge and the environment-gated root apply remain separate confirmation-gated stages. Workflow credential selection, host reconciliation, and functional verification are future stages.
Rollback: before apply, close or revert this PR. After an apply, remove these two mappings through a reviewed change and apply; rotate the Cloudflare service token separately if revocation is needed.
Safety and secrets
AI-assisted change: an OpenCode agent prepared this non-secret OpenTofu mapping and pull request. The encrypted source material was owner-authored and was not retrieved or changed by the agent.