Praxis CI
e8a05adcd1
- TASK-05-01 scripts/create-operator.py: CLI that reads PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS + PRAXIS_PG_DSN from env, creates the pool, applies migrations, hashes the password with argon2id, and INSERTs with ON CONFLICT DO NOTHING (idempotent — D-052). --update flag forces rehash + ON CONFLICT DO UPDATE. Missing env → exit 1 (R-BOOT-02). Connection failure → 3x retry with 5s backoff (R-BOOT-01). - TASK-05-02 .ciagent/config.json: added "operator" secrets scope (PRAXIS_PG_PASSWORD, PRAXIS_COOKIE_SECRET, PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS, PRAXIS_VC_ISSUER_KEY). .ciagent/.env.secrets.example: template (committed, no real secrets). .gitignore: added negations so .env.secrets.example is tracked while .env.secrets stays ignored. - TASK-05-03 tests/test_create_operator.py: 7 tests (mocked PgStore) — create, already-exists (no update), --update rehashes, missing env → exit 1, password is argon2id (not plaintext). ---ci--- project: praxis phase: 1 milestone: v0.4 status: execute persona: devops-engineer task: 05-01,05-02,05-03 requirements: covered: [REQ-AUTH-01] ---/ci---
29 lines
1.2 KiB
Bash
29 lines
1.2 KiB
Bash
# Praxis — Operator-tier secrets template (v0.4, TASK-05-02).
|
|
# Copy to .ciagent/.env.secrets and fill in real values.
|
|
# .env.secrets is gitignored (verified in .gitignore: .env.secrets).
|
|
# This file (.env.secrets.example) is committed as documentation.
|
|
|
|
# ─── Operator tier (v0.4) ───────────────────────────────────────────────────
|
|
# Postgres password. Generate: openssl rand -base64 32
|
|
PRAXIS_PG_PASSWORD=
|
|
|
|
# Full Postgres DSN. host=postgres is the docker-compose service DNS name.
|
|
# postgresql://praxis:${PRAXIS_PG_PASSWORD}@postgres:5432/praxis
|
|
PRAXIS_PG_DSN=
|
|
|
|
# Cookie signing secret (>=32 bytes). Generate: openssl rand -base64 48
|
|
PRAXIS_COOKIE_SECRET=
|
|
|
|
# Bootstrap operator credentials (scripts/create-operator.py).
|
|
PRAXIS_BOOTSTRAP_OPERATOR_USER=
|
|
PRAXIS_BOOTSTRAP_OPERATOR_PASS=
|
|
|
|
# VC issuer root key (nacl.SecretBox, 32 bytes). Generate:
|
|
# python3 -c "import nacl.utils; print(nacl.utils.random(32).hex())"
|
|
PRAXIS_VC_ISSUER_KEY=
|
|
|
|
# Issuer URL (public base for VC identifiers).
|
|
PRAXIS_ISSUER_URL=https://praxis.example/issuers/v0.4
|
|
|
|
# Cookie Secure flag — set false ONLY for the HTTP pilot (R-AUTH-01, G-031).
|
|
PRAXIS_COOKIE_SECURE=true |