GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests 4 Projects Releases Packages Wiki Activity Actions

deploy plan: NetworkTagSecret step is re-run safe (never overwrites or duplicates)

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Libby 2026-11-09 15:48:45 +00:00
commit 7895d05a13
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/deploy-main-to-live.md
View file

@ -144,7 +144,11 @@ Record the time and the output line of each in the deploy record. Stop at the fi
`/srv/bifrost/env/bifrost.env`, after the timestamped backup, printing nothing. The secret is random, 32 or more
characters, and is never echoed, logged or pasted into a chat. For example (`openssl rand -hex 32` gives 64 hex
characters and nothing that needs quoting in a systemd `EnvironmentFile`):
`sudo -n sh -c 'umask 077; cd /srv/bifrost/env && cp -a bifrost.env bifrost.env.pre-<UTC> && { printf "\nConceptVotes__NetworkTagSecret="; openssl rand -hex 32 | tr -d "\n"; printf "\n"; } >> bifrost.env && chown bifrost bifrost.env && chmod 600 bifrost.env'`
`sudo -n sh -c 'umask 077; cd /srv/bifrost/env && if grep -q "^ConceptVotes__NetworkTagSecret=" bifrost.env; then echo "ConceptVotes__NetworkTagSecret already set, left unchanged"; else cp -a bifrost.env bifrost.env.pre-<UTC> && { printf "\nConceptVotes__NetworkTagSecret="; openssl rand -hex 32 | tr -d "\n"; printf "\n"; } >> bifrost.env; fi && chown bifrost bifrost.env && chmod 600 bifrost.env'`
The guard makes a re-run safe: an existing `ConceptVotes__NetworkTagSecret=` line is never overwritten or duplicated, and the
skip message prints no value. (If a duplicate key ever got in, systemd's `EnvironmentFile` takes the last one, so remove
the extra line by hand; do not leave two.) A present line shorter than 32 characters is not replaced by this command
either: fix it deliberately, with the rotation warning below in mind.
(the same, with the value from the operator's own source, for `Heimdall__AppSecret`, which is not generated here).
The file ends mode 600, owner `bifrost`, and the backup `bifrost.env.pre-<UTC>` beside it keeps the old content.
Re-run the name-only check after, and check the length by count only: