dsql
f9e5e4f24d
The Deploy page got long and the code annotations rendered inconsistently
(some as (n) numbers, some as clickable +, and a marker on a fully-commented
line made that line vanish). Fix both:
- Deploy is now a HUB (docs/deploy/index.md): the intro + collision rule +
central-deploy note, then card links to three focused sub-pages. Deploy
stays the single global-nav entry; sub-pages are not_in_nav, reached from
the hub cards.
- deploy/compose.md — compose convention, storage tiers, how deploy fills
it in, subprocess/browser knobs, checklist
- deploy/dockerfile.md — services-account image, COPY, layer caching, uv
- deploy/secrets.md — keeping secrets out of the image
- Replace code annotations with INLINE COMMENTS on the compose/Dockerfile
examples: everything visible at once, no + to click, and the commented
MOUNTS_DIR line no longer disappears.
- Update inbound links (index card, standards, workflow, environments) to
deploy/ and deploy/compose.md; nav Deploy -> deploy/index.md with
not_in_nav for the sub-pages.
Verified in-browser: hub cards link correctly, sub-pages render with visible
inline comments (0 annotation markers), left nav shows only Deploy;
mkdocs build --strict clean (validates not_in_nav + all cross-links).
Signed-off-by: disqualifier <dev@disqualifier.me>
20 lines
832 B
Markdown
20 lines
832 B
Markdown
# Secrets
|
|
|
|
!!! warning "Secrets never go in the image"
|
|
We do **not** commit secrets (usually, lol). They stay **gitignored** and live on
|
|
the host in your config dir, reaching your container read-only via `${CONFIG_DIR}`.
|
|
Add them to `.dockerignore` so a `COPY . .` can't sweep them into a layer.
|
|
|
|
## How it works
|
|
|
|
- Secrets live on the **host**, in your config dir — never in git, never in the image.
|
|
- They reach the container **read-only** via the injected `${CONFIG_DIR}` mount (see
|
|
**[Compose convention](compose.md)**).
|
|
- Keep them out of the build context: list them in `.dockerignore` so a blanket
|
|
`COPY . .` can't pull them into a layer.
|
|
|
|
## Rotating a secret
|
|
|
|
A host-side edit — update the file and the service picks it up on restart. No rebuild,
|
|
and nothing you run: flag it and we handle the restart.
|