clawverse/apress
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(demo): all three demo secrets now vaulted in Infisical

Browse Source 
ANTHROPIC_OAUTH_TOKEN + APESS_NODE_TOKEN added to cloud-providers/prod alongside
ELEVENLABS_API_KEY. Runbook secrets section is now a single Infisical pull for all
three (APESS_NODE_TOKEN vault key -> NODE_TOKEN env). Verified end-to-end.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
Omar Sobh
2026-07-21 05:12:34 -07:00
co-authored by Claude Opus 4.8
parent eb8c41b14b
commit 1642fbce39
1 changed files with 9 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/DEMO-RUNBOOK.md
+9 -13
View File
@@ -6,29 +6,25 @@ animation** on command from **web chat, Telegram, and voice** — same agent, sa
## Secrets ## Secrets
Three env-only secrets are needed. **ElevenLabs lives in Infisical** on the `icarus` All three env-only secrets live in **Infisical** on the `icarus` instance (project
instance (project `cloud-providers`, env `prod`, alongside the other provider API keys): `cloud-providers`, env `prod`). Pull them into the environment in one block:
```bash ```bash
DOM=http://icarus.lan:8443 # or https://icarus.taila4f562.ts.net DOM=http://icarus.lan:8443 # or https://icarus.taila4f562.ts.net
CP=0788e188-b746-4ea0-a4b2-e0c2d0aec1b6 # cloud-providers project id
export INFISICAL_TOKEN=$(infisical login --method=universal-auth \ export INFISICAL_TOKEN=$(infisical login --method=universal-auth \
--client-id=$(cat ~/.infisical/macbook-admin-id) \ --client-id=$(cat ~/.infisical/macbook-admin-id) \
--client-secret=$(cat ~/.infisical/macbook-admin-secret) \ --client-secret=$(cat ~/.infisical/macbook-admin-secret) \
--domain=$DOM --silent --plain) --domain=$DOM --silent --plain)
export ELEVENLABS_API_KEY=$(infisical secrets get ELEVENLABS_API_KEY \ get(){ infisical secrets get "$1" --projectId=$CP --env=prod --domain=$DOM --plain; }
--projectId=0788e188-b746-4ea0-a4b2-e0c2d0aec1b6 --env=prod --domain=$DOM --plain) export ANTHROPIC_OAUTH_TOKEN=$(get ANTHROPIC_OAUTH_TOKEN) # Claude Max setup-token (cloud brain)
``` export NODE_TOKEN=$(get APESS_NODE_TOKEN) # Uno Q gateway bearer token
export ELEVENLABS_API_KEY=$(get ELEVENLABS_API_KEY) # ElevenLabs TTS voice
The other two are **exported manually** (not yet in Infisical — see "next steps" if you
want them vaulted too):
```bash
export ANTHROPIC_OAUTH_TOKEN=sk-ant-oat01-… # Claude Max setup-token (cloud brain)
export NODE_TOKEN=zc_… # Uno Q gateway bearer token
``` ```
**None of these may be written to disk or committed** — env-only. Infisical is the vault; **None of these may be written to disk or committed** — env-only. Infisical is the vault;
`recover.sh` and `serve.py` read them from the environment. `recover.sh` and `serve.py` read them from the environment. (Vault key `APESS_NODE_TOKEN`
maps to the `NODE_TOKEN` env var the scripts expect.)
## Pre-flight (~5 min before, board plugged into USB) ## Pre-flight (~5 min before, board plugged into USB)