FuzeInfra datastore creds provisioned (Postgres role+db, Redis ACL) — run seal-secrets

[claude]

@claude — FuzeInfra datastore provisioning is complete for FuzeKeys onboarding (tracking: izzywdev/FuzeInfra#136).

Provisioned on the shared Contabo cluster (verified)

• Postgres — role fuzekeys_user (LOGIN) + DB fuzekeys (owner = fuzekeys_user), CONNECT revoked from PUBLIC. Verified: fuzekeys_user authenticates over TCP (SCRAM) and can CREATE/DROP TABLE → alembic upgrade head will work.
  • Host: fuzeinfra-postgres.fuzeinfra.svc.cluster.local:5432 · DB fuzekeys
• Redis — per-app ACL user fuzekeys on shared fuzeinfra-redis with ~fuzekeys:* +@all -@admin -@dangerous (own password, NOT the shared one). Verified: SET/GET within fuzekeys:* works; out-of-prefix keys and admin commands return NOPERM.
  • redis://fuzekeys:<pw>@fuzeinfra-redis.fuzeinfra.svc.cluster.local:6379/1 — DB index 1, keys MUST be prefixed fuzekeys: (server-enforced by the ACL).

Credentials — delivery (action needed on izzywdev's side)

The FuzeInfra runner's GitHub App token is scoped to FuzeInfra only and gets HTTP 403 setting secrets on izzywdev/FuzeKeys, so I could not push them directly. @izzywdev has the values staged securely in a cluster Secret (fuzeinfra/fuzekeys-db-credentials, no Argo tracking) and will push them as GH Actions secrets:

• FUZEKEYS_DB_USER = fuzekeys_user
• FUZEKEYS_DB_PASSWORD
• FUZEKEYS_REDIS_URL
• (convenience) DATABASE_URL / DATABASE_URL_ASYNC composed against .../fuzekeys

Acceptance for your side

1. After secrets land, run seal-secrets.
2. Compose DATABASE_URL/DATABASE_URL_ASYNC against fuzeinfra-postgres.fuzeinfra.svc.cluster.local:5432/fuzekeys (or use the ready-made ones).
3. All Redis keys must be prefixed fuzekeys: (index 1).
4. Verify alembic upgrade head from the fuzekeys namespace.

Ping FuzeInfra#136 if the schema needs extensions/additional grants.

[izzywdev]

@claude Creds are now live — all 12 keys were pushed to this repo's GitHub Actions secrets by the owner (fresh post-rotation values from FuzeInfra#136):

FUZEKEYS_DATABASE_URL, FUZEKEYS_DATABASE_URL_ASYNC, FUZEKEYS_DB_HOST, FUZEKEYS_DB_NAME, FUZEKEYS_DB_PASSWORD, FUZEKEYS_DB_PORT, FUZEKEYS_DB_USER, FUZEKEYS_REDIS_DB, FUZEKEYS_REDIS_PASSWORD, FUZEKEYS_REDIS_PREFIX, FUZEKEYS_REDIS_URL, FUZEKEYS_REDIS_USER

Proceed:

1. Run (or wire up) the seal-secrets workflow using these secrets. Contract: Postgres at fuzeinfra-postgres.fuzeinfra.svc.cluster.local:5432/fuzekeys; Redis via FUZEKEYS_REDIS_URL (ACL user fuzekeys, DB index 1) — all Redis keys MUST be prefixed fuzekeys: (enforced server-side, out-of-prefix ops return NOPERM).
2. Acceptance: alembic upgrade head succeeds against fuzekeys from the fuzekeys namespace.
3. Report DONE:/BLOCKED: here. Never echo secret values to logs or comments.

Note: FuzeInfra#146 (Redis ACL persistence) is pending merge — the Redis ACL user will be briefly re-provisioned after that syncs; if you hit a transient Redis AUTH failure, retry before escalating.

[claude]

Claude finished @izzywdev's task in 2m 2s —— View job

---

I'll analyze this and get back to you.