chore: scrub internal network identifiers - #28
Conversation
293c994 to
d201d33
Compare
|
The identifier scrub had replaced the load-bearing kache remote S3 endpoint in Fixed by threading the endpoint through as a new Action required: a repository (or environment) secret named No real endpoint value is committed anywhere in this change — only a doc placeholder in a comment. |
|
Correction: the kache remote endpoint is provisioned as an organization-level Actions variable that this repo is already scoped to, so these workflows now read it via An earlier commit on this branch switched to |
Replaces internal homelab network identifiers in tracked docs/config with
generic RFC5737/example placeholders. No functional/source-code changes;
Rust source and tests were unaffected (cargo check -q passes clean).
Replacement mapping:
- LAN IPs: 10.1.0.1 -> 192.0.2.1, 10.1.0.2 -> 192.0.2.2
- Hostnames (case-insensitive, word-boundary):
- dookie -> devhost
- tootie -> nashost
- squirts -> edgehost
- shart -> backuphost
- steamy/steamyy -> winhost
- vivobook -> laptophost
- mothership -> gatewayhost
- Domains:
- syslog-mcp.tootie.tv -> syslog-mcp.example.internal
- *.tootie.tv (wildcard) -> *.example.internal
- reverse-DNS namespace tv.tootie/... -> tv.nashost/... (unaffected by
device rename since it matched the tootie word-boundary substitution)
No matches found for: Tailscale CGNAT IPs (100.64.0.0/10), the
manatee-triceratops tailnet domain/ts.net hostnames, steamdeck, willynet,
or lab.tootie.tv. aurora.tootie.tv is not referenced in this repo (nothing
to protect, but the mask/unmask step ran regardless as a no-op safeguard).
Sanity check: `cargo check -q` completed with no errors (edits only
touched CI config, Dockerfile labels, and Markdown docs — no Rust source).
The identifier scrub replaced the load-bearing kache S3 endpoint in setup-rust-kache/action.yml with a documentation placeholder, breaking the shared cache. Restore connectivity without reintroducing the raw value: add an `s3-endpoint` input (no default) that callers populate from an encrypted secret, and fail loudly in the Configure kache step when a shared remote is expected (an AWS "kache" profile is present) but no endpoint was supplied, instead of silently falling back to a local-only cache.
The endpoint is already provisioned org-wide as an Actions variable that this repo is scoped to, so read it from vars rather than expecting a repo-level secret that does not exist. Keeps the explicit input and the loud failure when the endpoint is empty.
71db59e to
dfd64ba
Compare
1 participant
Replaces internal network identifiers in tracked files with neutral documentation placeholders: private LAN addresses -> 192.0.2.0/24 values, overlay-network addresses -> 198.51.100.0/24 values, the internal tailnet domain -> example.ts.net, internal service domains -> *.example.internal, and host aliases -> generic role-based names (devhost, nashost, edgehost, backuphost, winhost, laptophost, deckhost, homelan, gatewayhost). No functional changes intended; see the diff for the full set of edits.