From 55847b6df0baed7a12d1d7ae57fde63af30b0908 Mon Sep 17 00:00:00 2001 From: Daniel Allaire Date: Tue, 7 Jul 2026 12:07:39 -0400 Subject: [PATCH] =?UTF-8?q?GUI=20:=20compl=C3=A9ter=20la=20checklist=20des?= =?UTF-8?q?=20secrets=20attendus?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SECRETS_ATTENDUS listait 16 secrets ; en manquaient 8 (OIDC des 3 clients, cookie oauth2, restic, clé SSH sauvegarde, + nextcloud admin/oidc/bd). Le panneau Intrants du GUI montre désormais la vraie liste (noms seulement, jamais de valeur — la garde d'écriture des secrets reste inchangée). Co-Authored-By: Claude Opus 4.8 --- scripts/inventory_gui.py | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/scripts/inventory_gui.py b/scripts/inventory_gui.py index dadbc6f..d181c50 100644 --- a/scripts/inventory_gui.py +++ b/scripts/inventory_gui.py @@ -101,12 +101,26 @@ INTRANTS_CLES_INTERDITES = { } # Rappel en lecture seule (jamais de valeur) : secrets a fournir via Ansible Vault. SECRETS_ATTENDUS = [ + # Accès Proxmox (proxmox.vault.yml) "proxmox_api_token_id", "proxmox_api_token_secret", + # PKI (step-ca) "vault_step_ca_password", "vault_step_ca_provisioner_password", + # Identité (LDAP / Keycloak) "vault_openldap_admin", "vault_ldap_sssd", "vault_keycloak_admin", - "vault_postgresql_keycloak", "vault_bd_keycloak", "vault_forgejo_admin", - "vault_forgejo_secret_key", "vault_forgejo_internal_token", "vault_bd_forgejo", - "vault_grafana_admin", "vault_redis", "vault_bd_icingadb", + # Bases de données + "vault_postgresql_keycloak", "vault_bd_keycloak", "vault_bd_forgejo", + "vault_bd_icingadb", "vault_bd_nextcloud", + # Forge (Forgejo) + "vault_forgejo_admin", "vault_forgejo_secret_key", "vault_forgejo_internal_token", + # Observabilité / cache + "vault_grafana_admin", "vault_redis", + # Applications (admin) + "vault_nextcloud_admin", + # Secrets OIDC des clients SSO (un par app fédérée) + "vault_grafana_oidc", "vault_forgejo_oidc", "vault_icingaweb2_oidc", + "vault_nextcloud_oidc", "vault_oauth2_cookie", + # Sauvegarde (restic hors-nœud) + "vault_restic_password", "vault_backup_ssh_privkey", ] # Garde-fous des executions (verifier / deployer) depuis l'interface.