Gabriel Brown
26a4fd0705
Each job logs in as the read-only spoon-ci machine identity and exports the Infisical prod environment, so production values no longer live in Gitea. After pushing the images, CI asks the VPS to redeploy podman-spoon.service over the forced-command deploy key, with the key passed through env so the printed script never contains it. Installs survive a half-written runner cache, and one production deploy runs at a time. Infisical prod carries a valid JWKS; the copy in DOTENV_PROD had escaped quotes, so the Convex env sync had been serving invalid JSON at /.well-known/jwks.json. The first sync from Infisical replaces it.
7 lines
185 B
JSON
7 lines
185 B
JSON
{
|
|
"workspaceId": "57f4b778-582f-49e2-89e1-5c7e6077facb",
|
|
"defaultEnvironment": "",
|
|
"gitBranchToEnvironmentMapping": null,
|
|
"domain": "https://infisical.gbrown.org/api"
|
|
}
|