platform/fullstack
Template
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

chore: evaluate Secretspec for environment and secret management #1

New issue
Open
opened 2026-09-12 15:13:35 +05:00 by hayshin · 0 comments
hayshin commented 2026-09-12 15:13:35 +05:00
Owner
Copy link

Goal

Evaluate and integrate Secretspec as the canonical specification for application configuration and secrets in this template.

Scope

  • Define one repository-level configuration/secret schema for API, worker, database, SMTP, OTel, and browser-safe values.
  • Keep browser exposure restricted to explicitly projected VITE_* values; never expose server secrets.
  • Integrate the development flow with devenv shell/devenv up.
  • Document how CI and production container platforms should inject values without committing secret material.
  • Decide whether .env.example is generated, validated, or replaced, and provide a migration path.
  • Add validation/drift checks so documented keys and runtime schemas cannot silently diverge.

Acceptance criteria

  • A fresh clone has a documented Secretspec bootstrap flow.
  • API and worker startup receive the same canonical values they validate today.
  • Local development, tests, migration jobs, and all OCI targets are covered.
  • No real secret values or generated local secret files are committed.
  • Existing Zod runtime validation remains the final process-boundary check unless a reviewed replacement provides equivalent guarantees.
## Goal Evaluate and integrate [Secretspec](https://secretspec.dev/) as the canonical specification for application configuration and secrets in this template. ## Scope - Define one repository-level configuration/secret schema for API, worker, database, SMTP, OTel, and browser-safe values. - Keep browser exposure restricted to explicitly projected `VITE_*` values; never expose server secrets. - Integrate the development flow with `devenv shell`/`devenv up`. - Document how CI and production container platforms should inject values without committing secret material. - Decide whether `.env.example` is generated, validated, or replaced, and provide a migration path. - Add validation/drift checks so documented keys and runtime schemas cannot silently diverge. ## Acceptance criteria - A fresh clone has a documented Secretspec bootstrap flow. - API and worker startup receive the same canonical values they validate today. - Local development, tests, migration jobs, and all OCI targets are covered. - No real secret values or generated local secret files are committed. - Existing Zod runtime validation remains the final process-boundary check unless a reviewed replacement provides equivalent guarantees.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
platform/fullstack#1
No description provided.