44r0n7/pi-kit
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Config hygiene: env-only tokens + lint to block secrets in manifests/systemd #11

New Issue
Open
opened 2025-12-15 00:37:18 +00:00 by 44r0n7 · 0 comments
44r0n7 commented 2025-12-15 00:37:18 +00:00
Owner
Copy Link

Proposal

  • Ensure AUTH token is only read from env; never persist to state, manifest, or systemd unit files.
  • Add a lightweight lint/check (pre-commit or CI) that fails if PIKIT_AUTH_TOKEN or similar patterns appear in tracked files (manifests, systemd units, code).
  • Document how to inject tokens via systemd drop-in or runtime env without committing them.

Acceptance

  • No tokens are written to state or logs.
  • Lint fails when secrets are committed.
  • Docs clarify the safe way to provide tokens.
Proposal - Ensure AUTH token is only read from env; never persist to state, manifest, or systemd unit files. - Add a lightweight lint/check (pre-commit or CI) that fails if PIKIT_AUTH_TOKEN or similar patterns appear in tracked files (manifests, systemd units, code). - Document how to inject tokens via systemd drop-in or runtime env without committing them. Acceptance - No tokens are written to state or logs. - Lint fails when secrets are committed. - Docs clarify the safe way to provide tokens.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
44r0n7
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: 44r0n7/pi-kit#11
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?