wehub-resource-sync
161ef94b4f
Check engine pin consistency / Dockerfile / CI pin consistency (push) Successful in 8s
Sirius CI/CD Pipeline / Detect Changes (push) Successful in 23s
Validate Docker Configuration / Validate Docker Compose Configuration (push) Successful in 47s
Sirius CI/CD Pipeline / Build API (${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Build UI (${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Engine Manifest (push) Has been cancelled
Sirius CI/CD Pipeline / Merge API Manifest (push) Has been cancelled
Sirius CI/CD Pipeline / Merge UI Manifest (push) Has been cancelled
Sirius CI/CD Pipeline / Build Engine (${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Build Infra (${{ matrix.service }}, ${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Infra Manifest (sirius-postgres) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Infra Manifest (sirius-rabbitmq) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Infra Manifest (sirius-valkey) (push) Has been cancelled
Sirius CI/CD Pipeline / Integration Test (push) Has been cancelled
Sirius CI/CD Pipeline / Public Stack Contract (push) Has been cancelled
Sirius CI/CD Pipeline / Dispatch Demo Deployment (sirius-demo branch) (push) Has been cancelled
Sirius CI/CD Pipeline / Dispatch Demo Canary (main branch) (push) Has been cancelled
Sirius CI/CD Pipeline / Guard Registry Namespace (push) Has been cancelled
2.3 KiB
2.3 KiB
title, description, template, llm_context, categories, tags, related_docs
| title | description | template | llm_context | categories | tags | related_docs | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ADR: Startup and Secrets Model | Architectural decision record for installer-first startup and stateless infrastructure API key validation. | TEMPLATE.reference | high |
|
|
|
ADR: Startup and Secrets Model
Status
Accepted
Context
Sirius startup historically depended on manual environment setup and a bootstrap pattern that could create drift between runtime configuration and persistent key state. The platform also tolerated insecure defaults in startup and seeding paths.
Decision
- Installer-first startup: a first-run installer is the canonical setup path for generating and merging required secrets/config.
- Internal service key path:
SIRIUS_API_KEY_FILE(Docker secret file mount, preferred) withSIRIUS_API_KEYas a migration fallback — both resolve to the same installer-generated internal key for service-to-service root authentication. - Dynamic key lifecycle in Valkey: user-generated API keys continue to be managed in Valkey.
- Secure fail-fast runtime: production startup and seeding flows must fail when required secrets are missing.
Consequences
Positive
- Deterministic behavior during restart and key rotation.
- Reduced operational complexity from bootstrap reconciliation state.
- Better first-time user experience with automated secret generation.
- Clear separation between infrastructure auth and user key lifecycle.
Tradeoffs
- Stricter env requirements may break permissive legacy startup paths until migrated.
- CI/test and deployment scripts must be updated to provide required variables.
Implementation Notes
- Use
docker-compose.installer.yamlas the canonical installer entrypoint. - Installer writes
secrets/sirius_api_key.txtand setsSIRIUS_API_KEY_FILE=/run/secrets/sirius_api_keyin.envalongsideSIRIUS_API_KEYfor compatibility. - Ensure compose contracts explicitly require auth-critical variables (file and/or env).
- Update runbooks and deployment documentation in lockstep with runtime changes.