Class: WideEvent::Kamal::SecretsEditor

Inherits:
Object
  • Object
show all
Defined in:
lib/wide_event/kamal/secrets_editor.rb

Overview

Plans, then durably writes, the ingest/query token files a Kamal deployment needs plus their references in .kamal/secrets and .gitignore. #apply never touches the filesystem beyond reading and stat-ing the two token files; it only decides what should exist. Callers persist the plan with Result#write! once every other preflight (such as WideEvent::Kamal::DeployEditor#apply) has also succeeded, so a rejected deploy edit never leaves secret files behind.

Defined Under Namespace

Classes: Result, UnsafeTokenFile

Constant Summary collapse

INGEST_TOKEN_PATH = 
".kamal/wide-events-ingest-token"
QUERY_TOKEN_PATH = 
".kamal/wide-events-query-token"
SECRETS_PATH = 
".kamal/secrets"
GITIGNORE_PATH = 
".gitignore"
SECRETS_LINES = 
[
  "WIDE_EVENTS_INGEST_TOKEN=$(cat #{INGEST_TOKEN_PATH})",
  "WIDE_EVENTS_QUERY_TOKEN=$(cat #{QUERY_TOKEN_PATH})"
].freeze
GITIGNORE_LINES = 
[ INGEST_TOKEN_PATH, QUERY_TOKEN_PATH ].freeze

Instance Method Summary collapse

Constructor Details

#initialize(root:) ⇒ SecretsEditor

Returns a new instance of SecretsEditor.



65
66
67
 
# File 'lib/wide_event/kamal/secrets_editor.rb', line 65

def initialize(root:)
  @root = root
end

Instance Method Details

#apply ⇒ Object 



69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/wide_event/kamal/secrets_editor.rb', line 69

def apply
  ingest = plan_token(INGEST_TOKEN_PATH)
  query = plan_token(QUERY_TOKEN_PATH)
  Result.new(
    root: @root,
    ingest_token: ingest.fetch(:value),
    query_token: query.fetch(:value),
    ingest_token_existing: ingest.fetch(:existing),
    query_token_existing: query.fetch(:existing)
  )
end