Skip to content

v1.13.0

Choose a tag to compare

View all tags
@wmantly wmantly released this 01 Aug 16:35
· 36 commits to master since this release
v1.13.0
aeccbcb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changed

  • Secrets now load from OpenBao at boot via @simpleworkjs/bao-conf, which deep-merges secret/proxy/conf over the file-loaded config. The proxy authenticates to OpenBao with a scoped VAULT_TOKEN (policy proxy — read-only on its own path), never the root token. Because the OIDC clientSecret is captured at require time inside createOidcClient (during require('../models'), which require('../app') triggers transitively), bin/www now defers require('../app') until after bao-conf.init() resolves. Fail-soft: if OpenBao is unreachable, boot continues from CONF_SECRETS. The config/proxy-secrets.js file is now an operator-edit seed artifact (gitignored); OpenBao is authoritative. See theta-env's Secrets docs.
  • Bumped package version to track the release tag.
Assets 2
Loading