docs(staging): mosquitto cert SAN + key permission requirements (KI-100)

docs(staging): mosquitto cert SAN + key permission requirements #100

Merged

Documents the two mosquitto gotchas found during the first staging deploy: server cert needs localhost SANs (healthcheck connects to 127.0.0.1), and key files must be readable by the container's mosquitto user (bind-mount perms apply). Docs-only.

Copy

Commits were merged into target branch

docs(staging): mosquitto cert SAN + key permission requirements

The server cert needs localhost SANs (healthcheck connects to
127.0.0.1) and keys must be world-readable for the container's
mosquitto user. Documented after debugging the first staging deploy.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

c9faf7f9

fix(secrets): authorize staging key in root .sops.yaml + backup script env fix

- .sops.yaml: add the staging host's age key as recipient for .env.sops
  (was only added to deploy/staging/.sops.yaml; root file governs the
  root .env.sops that services/common/env.py decrypts at runtime)
- staging-backup.sh: export SOPS_AGE_KEY_FILE for cron context (no shell
  env at 03:30) and document it

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

3 weeks ago

91db7a1f

syntropicagent merged 3 weeks ago (merge commit: b6b5fa3a )
Login to comment

Submitter	syntropicagent
Target	main
Source	fix/sops-staging-key

Jobs

Merge Strategy

Create Merge Commit

Watchers (1)

Reference

pr KI-100