c1566ca033
deploy/Dockerfile is mf.toml's build in Docker: pnpm install, Vite, deno compile, with NODE_AUTH_TOKEN from fnox decrypted by the host's age key (BuildKit secret). deploy/compose.yaml runs db apply once, then the server behind Caddy labels. fnox.toml holds the 7 secrets MF had, encrypted for Elias's key; the VPS's recipient is added once its key exists.
7 lines
284 B
Shell
Executable file
7 lines
284 B
Shell
Executable file
#!/bin/sh
|
|
# Decrypts fnox.toml's secrets with the host's age key (mounted at /run/secrets/age_key) into the
|
|
# environment of the command only: never written to disk, never a Docker env var.
|
|
set -eu
|
|
FNOX_AGE_KEY="$(cat /run/secrets/age_key)"
|
|
export FNOX_AGE_KEY
|
|
exec fnox exec -- "$@"
|