Alliance-Boreale/Set-OPS-Public
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

GUI : compléter la checklist des secrets attendus

Browse source 
SECRETS_ATTENDUS listait 16 secrets ; en manquaient 8 (OIDC des 3 clients,
cookie oauth2, restic, clé SSH sauvegarde, + nextcloud admin/oidc/bd). Le
panneau Intrants du GUI montre désormais la vraie liste (noms seulement, jamais
de valeur — la garde d'écriture des secrets reste inchangée).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Daniel Allaire 2026-07-07 12:07:39 -04:00
parent b5e2edd3de
commit 55847b6df0
1 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
scripts/inventory_gui.py
View file

@ -101,12 +101,26 @@ INTRANTS_CLES_INTERDITES = {
}
# Rappel en lecture seule (jamais de valeur) : secrets a fournir via Ansible Vault.
SECRETS_ATTENDUS = [
# Accès Proxmox (proxmox.vault.yml)
"proxmox_api_token_id", "proxmox_api_token_secret",
# PKI (step-ca)
"vault_step_ca_password", "vault_step_ca_provisioner_password",
# Identité (LDAP / Keycloak)
"vault_openldap_admin", "vault_ldap_sssd", "vault_keycloak_admin",
"vault_postgresql_keycloak", "vault_bd_keycloak", "vault_forgejo_admin",
"vault_forgejo_secret_key", "vault_forgejo_internal_token", "vault_bd_forgejo",
"vault_grafana_admin", "vault_redis", "vault_bd_icingadb",
# Bases de données
"vault_postgresql_keycloak", "vault_bd_keycloak", "vault_bd_forgejo",
"vault_bd_icingadb", "vault_bd_nextcloud",
# Forge (Forgejo)
"vault_forgejo_admin", "vault_forgejo_secret_key", "vault_forgejo_internal_token",
# Observabilité / cache
"vault_grafana_admin", "vault_redis",
# Applications (admin)
"vault_nextcloud_admin",
# Secrets OIDC des clients SSO (un par app fédérée)
"vault_grafana_oidc", "vault_forgejo_oidc", "vault_icingaweb2_oidc",
"vault_nextcloud_oidc", "vault_oauth2_cookie",
# Sauvegarde (restic hors-nœud)
"vault_restic_password", "vault_backup_ssh_privkey",
]
# Garde-fous des executions (verifier / deployer) depuis l'interface.