From 549bbdb6a18bb0c166393e8fa23d7f14effd0d3b Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 6 Sep 2026 19:57:04 +0200 Subject: [PATCH] Declare the environment Heimdall actually needs The first workload launch reached Heimdall.s own config validation and failed on GC_ACCESS_TOKEN_ENCRYPTION_KEY_BASE64, which the incumbent supplies from service.env and the binding did not. Rather than discover one variable per deployment, the recipe now declares the whole set the incumbent sets -- 32 names -- so the binding may supply them and admit() stops rejecting each in turn. Deliberately excluded: the Spotiverse app secrets (that profile is retired), GC_ACCESS_CULTCACHE_PATH and GC_ACCESS_PROVIDER_HEALTH_IDENTITY_PATH. Idunn owns both now -- state location arrives as --state-root, and the signing identity arrives as an inherited descriptor. Co-Authored-By: Claude Opus 5 --- deployment/idunn/recipe.toml | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/deployment/idunn/recipe.toml b/deployment/idunn/recipe.toml index 8f0de73..d57b13e 100644 --- a/deployment/idunn/recipe.toml +++ b/deployment/idunn/recipe.toml @@ -108,7 +108,40 @@ arguments = [ ] transport = "http" route_required = true -optional_environment = [] +optional_environment = [ + "CULTMESH_URI_ODIN_RUDP", + "GC_ACCESS_APP_BIFROST_BACKEND_CALLBACK_URLS", + "GC_ACCESS_APP_BIFROST_SHARED_SECRET", + "GC_ACCESS_APP_GHOSTLIGHT_BACKEND_CALLBACK_URLS", + "GC_ACCESS_APP_GHOSTLIGHT_RUNTIME_IDS", + "GC_ACCESS_APP_GHOSTLIGHT_SHARED_SECRET", + "GC_ACCESS_APPLY_SCHEMA_ON_STARTUP", + "GC_ACCESS_APP_SHARED_SECRET", + "GC_ACCESS_BIFROST_PATRON_SUPPORT_ENDPOINT", + "GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET", + "GC_ACCESS_COMPLETION_TTL_SECONDS", + "GC_ACCESS_IDUNN_HEALTH_CONTRACT", + "GC_ACCESS_IDUNN_RUDP_HEALTH", + "GC_ACCESS_ISSUER", + "GC_ACCESS_ODIN_CULTMESH_URI", + "GC_ACCESS_PRIVATE_COMMAND_HOST", + "GC_ACCESS_PRIVATE_COMMAND_PORT", + "GC_ACCESS_PROVIDER_DISCORD_CLIENT_ID", + "GC_ACCESS_PROVIDER_DISCORD_CLIENT_SECRET", + "GC_ACCESS_PROVIDER_PATREON_CLIENT_ID", + "GC_ACCESS_PROVIDER_PATREON_CLIENT_SECRET", + "GC_ACCESS_PROVIDER_TWITCH_CLIENT_ID", + "GC_ACCESS_PROVIDER_TWITCH_CLIENT_SECRET", + "GC_ACCESS_PROVIDER_YOUTUBE_CLIENT_ID", + "GC_ACCESS_PROVIDER_YOUTUBE_CLIENT_SECRET", + "GC_ACCESS_SESSION_TTL_SECONDS", + "GC_ACCESS_SIGNING_KEY_ID", + "GC_ACCESS_SIGNING_PRIVATE_KEY_BOOTSTRAP", + "GC_ACCESS_SIGNING_PRIVATE_KEY_PATH", + "GC_ACCESS_STATE_TTL_SECONDS", + "GC_ACCESS_STORAGE_BACKEND", + "GC_ACCESS_TOKEN_ENCRYPTION_KEY_BASE64", +] required_environment = [ "GAMECULT_IDUNN_RUNTIME_BUNDLE", "GAMECULT_IDUNN_CANDIDATE_BIND",