Migrate prod cluster secrets to new format

10 files changed, 47 insertions, 9 deletions

diff --git a/cluster/prod/app/drone-ci/secrets.toml b/cluster/prod/app/drone-ci/secrets.toml
new file mode 100644
index 0000000..5bd98d0
--- /dev/null
+++ b/cluster/prod/app/drone-ci/secrets.toml
@@ -0,0 +1,47 @@
+# Drone's secrets
+
+[secrets."drone-ci/rpc_secret"]
+type = 'command'
+rotate = true
+command = 'openssl rand -hex 16'
+
+[secrets."drone-ci/cookie_secret"]
+type = 'command'
+rotate = true
+command = 'openssl rand -hex 16'
+
+[secrets."drone-ci/db_enc_secret"]
+type = 'command'
+command = 'openssl rand -hex 16'
+
+
+# Oauth config for gitea
+
+[secrets."drone-ci/oauth_client_secret"]
+type = 'user'
+description = 'OAuth client secret (for gitea)'
+
+[secrets."drone-ci/oauth_client_id"]
+type = 'user'
+description = 'OAuth client ID (on Gitea)'
+
+
+# S3 config for Git LFS storage
+
+[secrets."drone-ci/s3_db_bucket"]
+type = 'constant'
+value = 'drone-db'
+
+[secrets."drone-ci/s3_sk"]
+type = 'user'
+description = 'S3 (garage) secret key for Drone'
+
+[secrets."drone-ci/s3_ak"]
+type = 'user'
+description = 'S3 (garage) access key for Drone'
+
+[secrets."drone-ci/s3_storage_bucket"]
+type = 'constant'
+value = 'drone-storage'
+
+
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret
deleted file mode 100644
index 04c819e..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/cookie_secret
+++ /dev/null
@@ -1 +0,0 @@
-CMD openssl rand -hex 16
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret
deleted file mode 100644
index 3f9e696..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/db_enc_secret
+++ /dev/null
@@ -1 +0,0 @@
-CMD_ONCE openssl rand -hex 16
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id b/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id
deleted file mode 100644
index c801b28..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_id
+++ /dev/null
@@ -1 +0,0 @@
-USER OAuth client ID (on Gitea)
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret
deleted file mode 100644
index b79b688..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/oauth_client_secret
+++ /dev/null
@@ -1 +0,0 @@
-USER OAuth client secret (for gitea)
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret b/cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret
deleted file mode 100644
index 04c819e..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/rpc_secret
+++ /dev/null
@@ -1 +0,0 @@
-CMD openssl rand -hex 16
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak
deleted file mode 100644
index 3a8e4a2..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_ak
+++ /dev/null
@@ -1 +0,0 @@
-USER S3 (garage) access key for Drone
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket
deleted file mode 100644
index c36f17d..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_db_bucket
+++ /dev/null
@@ -1 +0,0 @@
-CONST drone-db
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk
deleted file mode 100644
index 46fd9fa..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_sk
+++ /dev/null
@@ -1 +0,0 @@
-USER S3 (garage) secret key for Drone
diff --git a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket b/cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket
deleted file mode 100644
index ca2702c..0000000
--- a/cluster/prod/app/drone-ci/secrets/drone-ci/s3_storage_bucket
+++ /dev/null
@@ -1 +0,0 @@
-CONST drone-storage