fetch secrets by uuid instead of listing all

2026-03-20 15:51:43 -04:00
parent 2099464245
commit 33a238308d
4 changed files with 15 additions and 9 deletions
@@ -200,8 +200,9 @@ Machine accounts: `hantim-server` (token at `/etc/bws-token`), `hantim-ci` (rese
 ### Service secrets (`.env.keys`)

 Services that need secrets declare them in `.env.keys` (format:
-`ENV_VAR=bws-secret-name`, one per line). `deploy.sh` fetches each secret
-from bws and generates `.env` before starting the service.
+`ENV_VAR=bws-secret-uuid`, one per line, with `# secret-name` comments).
+`deploy.sh` fetches each secret by UUID from bws and generates `.env`
+before starting the service.

 ### Gitea org-level secrets