pal-e-docs

TODO: Add paledocs_db_password to Salt pillar and Makefile

todo-paledocs-db-password-pillar Todo

todo done
Project

TODO: Add paledocs_db_password to Salt pillar and Makefile

Problem

paledocs_db_password is a required Terraform variable (added in PR #23, Phase 3) but was never added to the Salt pillar or the Makefile's TF_SECRET_VARS list. This means make tofu-plan and make tofu-apply always fail — every tofu operation requires a manual -var="paledocs_db_password=..." flag.
The password currently lives only in ~/secrets/pal-e-docs/database.env as plaintext. It should be GPG-encrypted in the Salt pillar like every other platform secret.

Work Required

  • Encrypt the password into Salt pillar — Add paledocs_db_password to salt/pillar/secrets/platform.sls using the same GPG encryption pattern as the other secrets.
  • Add to Makefile TF_SECRET_VARS — Append paledocs_db_password to the variable list in the Makefile (line ~46-50) so make tofu-secrets renders it into secrets.auto.tfvars.
  • Verify — make tofu-plan should succeed without any manual -var flags.

Context

Discovered during Phase 3 (2026-03-02). Confirmed still broken 2026-03-13 when running tofu plan for PR #31 (Litestream removal). Every TF operation since Phase 3 has required the manual workaround.

GPG Encryption Command

Paste the output block into salt/pillar/secrets/platform.sls under secrets.platform.paledocs_db_password.
  • sop-secrets-management — secrets strategy for platform credentials
  • phase-postgres-3-migrate-pal-e-docs — the phase that introduced this variable
  • plan-2026-02-26-tf-modularize-postgres — parent plan