Secrets and Env Strategy¶

Source of Secrets¶

• Canonical source: 1Password vault items
• Injection mechanism: op inject in ./init
• Templates in git: *.env.tmpl
• Runtime outputs not committed: .env, service/.env

Flow Diagram¶

flowchart TD
  Vault[1Password vault item] --> Tmpl[Environment templates]
  Tmpl --> Inject[Init secret injection]
  Inject --> Root[Root environment file]
  Inject --> ServiceEnv[Service env files]
  Root --> Compose[Compose interpolation]
  ServiceEnv --> Compose
  Compose --> Runtime[containers]

Rotation and Validation¶

./init validates GitLab credentials before cloning dependencies, reducing broken local setup due to expired credentials.