vh/dotfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

claude: vault is the credential source of truth — pull creds FROM it too, not just store

Browse Source 
Extend the secrets directive per operator (2026-08-11): store durable secrets in the
vault AND 'secret get' the creds a task needs from it rather than reading on-disk copies.
This commit is contained in:
Your Name
2026-08-11 21:43:41 -07:00
parent 18853bff77
commit 9db703b7da
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home_root/.claude/CLAUDE.md
+7 -4
View File
@@ -548,10 +548,13 @@ note says otherwise. On other boxes, check first.)
value), `secret list [--prefix P]`, `secret backfill [--dry-run]` (scans THIS value), `secret list [--prefix P]`, `secret backfill [--dry-run]` (scans THIS
box's `~/development/*/{env.sh,.env}` + `~/.config` creds and upserts each). box's `~/development/*/{env.sh,.env}` + `~/.config` creds and upserts each).
Items are hostname-namespaced (`<host>/…`); small text → item note, small binary Items are hostname-namespaced (`<host>/…`); small text → item note, small binary
→ base64 hidden field, >6000 B → a bw attachment. **STANDING DIRECTIVE: store → base64 hidden field, >6000 B → a bw attachment. **STANDING DIRECTIVE (operator,
durable credentials in the vault.** Any token / API key / cert / env-secret worth 2026-08-11): the vault is the credential source of truth — store durable secrets
keeping — not ephemeral, doesn't belong in git — should be `secret put` into the in it AND pull the creds you need FROM it.** Any token / API key / cert / env-secret
vault so it survives and is findable, never left single-copy on a box. The one worth keeping — not ephemeral, doesn't belong in git — should be `secret put` into
the vault so it survives and is findable, never left single-copy on a box; and when
a task needs a credential (e.g. a gitea token to create a repo), **`secret get` it
from the vault** rather than reading an on-disk copy where practical. The one
exception is `bootstrap.env` itself (secrets-zero — it unlocks the vault, so it exception is `bootstrap.env` itself (secrets-zero — it unlocks the vault, so it
can't live inside it; keep it `0600`). **Not a fleet service / no daemon** — each can't live inside it; keep it `0600`). **Not a fleet service / no daemon** — each
new dev box duplicates this stack against its own local secrets (setup steps in new dev box duplicates this stack against its own local secrets (setup steps in