fetch secrets by uuid instead of listing all

ARCHITECTURE.md

@@ -119,7 +119,8 @@ cert as SANs.
 Services needing secrets declare them in `.env.keys`:
 
 ```
-ENV_VAR=bws-secret-name
+# bws-secret-name
+ENV_VAR=bws-secret-uuid
 ```
 
 During deploy, `deploy.sh`:

README.md

@@ -200,8 +200,9 @@ Machine accounts: `hantim-server` (token at `/etc/bws-token`), `hantim-ci` (rese
 ### Service secrets (`.env.keys`)
 
 Services that need secrets declare them in `.env.keys` (format:
-`ENV_VAR=bws-secret-name`, one per line). `deploy.sh` fetches each secret
+`ENV_VAR=bws-secret-uuid`, one per line, with `# secret-name` comments).
-from bws and generates `.env` before starting the service.
+`deploy.sh` fetches each secret by UUID from bws and generates `.env`
+before starting the service.
 
 ### Gitea org-level secrets
 

docker/garage/.env.keys

@@ -1,3 +1,6 @@
-RPC_SECRET=hantim-garage-rpc-secret
+# hantim-garage-rpc-secret
-ARGENTO_NODE_ID=hantim-garage-argento-node-id
+RPC_SECRET=076a4798-4180-4190-9212-b41200ff08e3
-ADMIN_TOKEN=hantim-garage-admin-token
+# hantim-garage-argento-node-id
+ARGENTO_NODE_ID=98454088-faf7-4d36-b98a-b41200ff52dd
+# hantim-garage-admin-token
+ADMIN_TOKEN=5565abc1-cd9f-451e-97a2-b412015dbb53

scripts/deploy.sh

@@ -57,11 +57,12 @@ if [ -f "docker/$APP/.env.keys" ] && [ -f /etc/bws-token ]; then
     env_content=""
     while IFS= read -r line || [ -n "$line" ]; do
         [ -z "$line" ] && continue
+        [[ "$line" = \#* ]] && continue
         var_name="${line%%=*}"
-        secret_key="${line#*=}"
+        secret_id="${line#*=}"
-        value=$(bws secret list | jq -r --arg key "$secret_key" '.[] | select(.key == $key) | .value')
+        value=$(bws secret get "$secret_id" | jq -r .value)
         if [ -z "$value" ]; then
-            echo "ERROR: Secret '$secret_key' not found in bws."
+            echo "ERROR: Secret '$secret_id' not found in bws."
             echo "  Check that the secret exists and the machine account has access."
             exit 1
         fi