feat: migrate secrets to Infisical

2026-08-02 01:19:41 -04:00
parent 9089f4a257
commit 25d9241b51
34 changed files with 2353 additions and 691 deletions
@@ -5,22 +5,29 @@ services:
    image: ${SHD_IMAGE:-shd-build-stage:local}
    restart: unless-stopped
    init: true
-    env_file:
-      - .env.staging.runtime
    environment:
-      HOST: 0.0.0.0
-      PORT: 3000
-      BODY_SIZE_LIMIT: 6M
-      SKIP_DEFAULT_USERS: 'true'
-      TDR_DATABASE_PATH: /app/data/shd-build-staging.db
-      TDR_AVATAR_STORAGE_PATH: /app/data/avatars
-      TDR_GAME_ICON_STORAGE_PATH: /app/data/game-icons
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: staging
+      INFISICAL_RUNTIME_SCOPE: app
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
      SHD_BUILD_NUMBER: ${SHD_BUILD_NUMBER:-0}
-      UBISOFT_NEWS_IMPORT_ENABLED: 'false'
+      SHD_COMMIT_SHA: ${SHD_COMMIT_SHA:-}
    ports:
      - '0.0.0.0:${SHD_STAGE_PORT:-5569}:3000'
    volumes:
      - shd_stage_data:/app/data
+    secrets:
+      - source: infisical_app_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_app_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
    healthcheck:
      test:
        - CMD
@@ -39,10 +46,23 @@ services:
    init: true
    command:
      - scheduler
-    env_file:
-      - .env.staging.runtime
    environment:
-      SCHEDULER_URL: http://app:3000/api/internal/scheduler
+      INFISICAL_PROJECT_ID: 2ee94b27-e599-4194-9797-3372d42e53f6
+      INFISICAL_ENVIRONMENT: staging
+      INFISICAL_RUNTIME_SCOPE: scheduler
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_FILE: /run/secrets/infisical_client_id
+      INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET_FILE: /run/secrets/infisical_client_secret
+    secrets:
+      - source: infisical_scheduler_client_id
+        target: infisical_client_id
+        uid: '0'
+        gid: '0'
+        mode: 0400
+      - source: infisical_scheduler_client_secret
+        target: infisical_client_secret
+        uid: '0'
+        gid: '0'
+        mode: 0400
    depends_on:
      app:
        condition: service_healthy
@@ -51,3 +71,13 @@ services:
 volumes:
  shd_stage_data:
    name: shd-build-stage-data
+
+secrets:
+  infisical_app_client_id:
+    file: .infisical.app.client-id
+  infisical_app_client_secret:
+    file: .infisical.app.client-secret
+  infisical_scheduler_client_id:
+    file: .infisical.scheduler.client-id
+  infisical_scheduler_client_secret:
+    file: .infisical.scheduler.client-secret