From 0a65f2be5f6192b1f041566527f6e11d43052c51 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 9 Jul 2026 20:39:55 +0200 Subject: [PATCH] manifests/hub: wire HETZNER_TOKEN + HETZNER_POOL_BOX_ID from Secret/storagebox (offsite provisioning) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Runbook Phase 0b. Values come from the out-of-band felhom-system/storagebox secret; optional:true so the pod starts without it (hub degrades to offsite disabled). HETZNER_LOCATION explicit fsn1. NOT synced yet — gated on the secret holding the DEDICATED-project scoped token (the current one fails the scope check: it sees the old project's ep0 box, not the new pool box). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- manifests/hub.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/manifests/hub.yaml b/manifests/hub.yaml index 5a81acc..3641d34 100644 --- a/manifests/hub.yaml +++ b/manifests/hub.yaml @@ -171,16 +171,26 @@ spec: name: wg-endpoint-ssh key: hostkey optional: true + # Offsite provisioning (SLICE 1+2): Hetzner Storage Box API token + the NUMERIC id of the + # pool box, from the out-of-band Secret/storagebox (NOT committed). The token MUST be scoped + # to the dedicated storage project — NEVER the shared-project token (it can touch ep0). + # HETZNER_POOL_BOX_ID is the numeric box id (console #id), not the box name. Optional so the + # pod starts before the secret exists (hub then logs offsite provisioning disabled). - name: HETZNER_POOL_BOX_ID valueFrom: secretKeyRef: name: storagebox key: HETZNER_POOL_BOX_ID + optional: true - name: HETZNER_TOKEN valueFrom: secretKeyRef: name: storagebox key: HETZNER_TOKEN + optional: true + # Non-secret; the hub defaults to fsn1 anyway — explicit for clarity. + - name: HETZNER_LOCATION + value: "fsn1" resources: requests: memory: "64Mi"