From fe0930688d2c2028cd012d584e273a9656c40723 Mon Sep 17 00:00:00 2001 From: Jacob Prall Date: Wed, 28 Oct 2026 13:03:04 -0700 Subject: [PATCH] Move factory secrets into environment groups and unpin the workflow repo The secrets move into two environment groups: vibe-factory-shared holds RENDER_API_KEY for both services, and vibe-factory-workflow-secrets holds the model key, GitHub credential, APPS_REPO, and workspace ID for the workflow service only. The workflow service drops its repo field, so it builds the repository that holds the Blueprint, as the gateway does. Closes #48 Closes #69 Co-authored-by: Cursor --- AGENTS.md | 5 ++-- README.md | 5 ++-- docs/0_QUICKSTART.md | 16 +++++++++--- docs/1_EXTENSION.md | 5 +++- render.yaml | 61 ++++++++++++++++++++++++++------------------ 5 files changed, 57 insertions(+), 35 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 333dcfd..0924ffe 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -40,8 +40,9 @@ Environment gotchas: host also loads `.env` and must use the real Render API. - Keep network isolation off in the factory's environment. An isolated workflow cannot reach the database on the private network. -- The workflow service in `render.yaml` sets `repo:` to the upstream - repository. A fork must change it. +- Secrets in `render.yaml` live in two environment groups. Attach + `vibe-factory-workflow-secrets` only to the workflow service: it holds the + model key and the GitHub credential. ## Module map diff --git a/README.md b/README.md index 45231bf..09b8051 100644 --- a/README.md +++ b/README.md @@ -110,9 +110,8 @@ paid plans and bill until you delete the app. Click **Deploy to Render** above, or create a Blueprint from this repository's `render.yaml`. It creates the gateway, the workflow service, and their database -in a `vibe-factory` project, and prompts you for the secrets. If you deploy -from a fork, first change the `repo:` field of the workflow service in -`render.yaml` to your fork's URL. [docs/0_QUICKSTART.md](docs/0_QUICKSTART.md#deploy-the-factory-to-render) +in a `vibe-factory` project, and prompts you once for each secret. +[docs/0_QUICKSTART.md](docs/0_QUICKSTART.md#deploy-the-factory-to-render) has the full steps. ## Documentation diff --git a/docs/0_QUICKSTART.md b/docs/0_QUICKSTART.md index 98acbe8..9fea129 100644 --- a/docs/0_QUICKSTART.md +++ b/docs/0_QUICKSTART.md @@ -172,9 +172,16 @@ the [README](../README.md). Fill in the prompted values listed under [Prerequisites](#prerequisites). `UI_PASSWORD` must contain at least 16 characters or the gateway will refuse to start. -If you deploy a fork, first change the workflow service's `repo:` field in -`render.yaml` to the fork URL. Otherwise Render builds the upstream workflow -code even though the Blueprint came from your fork. +The secrets live in two environment groups, so you enter each one once: + +- `vibe-factory-shared` holds `RENDER_API_KEY` and is attached to both + services. +- `vibe-factory-workflow-secrets` holds `APPS_REPO`, `RENDER_WORKSPACE_ID`, + `ANTHROPIC_API_KEY`, and the GitHub credential, and is attached only to the + workflow service. + +To rotate a key, change it in its group. Both services build from the +repository that holds the Blueprint, so a fork runs its own code. Keep these deployment constraints: @@ -210,7 +217,8 @@ create a local `.env` from the deployed resources: 1. Copy `.env.example` to `.env`. 2. From `vibe-factory-gateway`, copy `FACTORY_API_KEY`, `UI_USERNAME`, `UI_PASSWORD`, and `RENDER_WORKFLOW_SLUG`. -3. From `vibe-factory-workflows`, copy `APPS_REPO`, `RENDER_API_KEY`, +3. From the `vibe-factory-shared` environment group, copy `RENDER_API_KEY`. + From `vibe-factory-workflow-secrets`, copy `APPS_REPO`, `RENDER_WORKSPACE_ID`, `ANTHROPIC_API_KEY`, and either `GITHUB_TOKEN` or the three `GITHUB_APP_*` values. 4. Open `vibe-factory-db` in the Dashboard and copy its **external** diff --git a/docs/1_EXTENSION.md b/docs/1_EXTENSION.md index cd2c7bf..17988ee 100644 --- a/docs/1_EXTENSION.md +++ b/docs/1_EXTENSION.md @@ -272,7 +272,10 @@ The demo script reads `FACTORY_GATEWAY_URL` and `FACTORY_USER`. `PORT` configures the gateway and defaults to `3000`. Keep model and GitHub credentials off the gateway. Keep the GitHub credential -out of every task input and every Sandbox an agent can use. +out of every task input and every Sandbox an agent can use. In +[`render.yaml`](../render.yaml), a new secret for both services goes in the +`vibe-factory-shared` environment group, and a workflow-only secret goes in +`vibe-factory-workflow-secrets`. ## Change checklist diff --git a/render.yaml b/render.yaml index ce89716..4cecfe9 100644 --- a/render.yaml +++ b/render.yaml @@ -13,6 +13,36 @@ projects: networking: isolation: disabled + # Secrets you enter once when the Blueprint is created, and rotate in + # one place. The gateway gets only vibe-factory-shared: the model key + # and the GitHub credential must never reach it. + envVarGroups: + - name: vibe-factory-shared + envVars: + # The gateway starts workflow tasks with it. The workflows host + # uses it for Sandboxes, the Render MCP server, Blueprint reads, + # and the deletes of a deleted app's resources. + - key: RENDER_API_KEY + sync: false + - name: vibe-factory-workflow-secrets + envVars: + - key: APPS_REPO + sync: false + - key: RENDER_WORKSPACE_ID + sync: false + - key: ANTHROPIC_API_KEY + sync: false + # Set the three GitHub App variables or GITHUB_TOKEN. Each option + # needs Contents: write on APPS_REPO. + - key: GITHUB_APP_ID + sync: false + - key: GITHUB_APP_PRIVATE_KEY + sync: false + - key: GITHUB_APP_INSTALLATION_ID + sync: false + - key: GITHUB_TOKEN + sync: false + databases: - name: vibe-factory-db plan: 0.1c-256mb @@ -43,16 +73,15 @@ projects: type: workflow name: vibe-factory-workflows property: slug - # Used by the Render SDK to start the workflow task. - - key: RENDER_API_KEY - sync: false + - fromGroup: vibe-factory-shared # Runs every task that app/host.ts registers. The model key and the - # GitHub credential are set only here, never on the gateway. + # GitHub credential are set only here, never on the gateway. With no + # repo field, it builds the repository that holds this Blueprint, so + # a fork's workflow runs the fork's code. - type: workflow name: vibe-factory-workflows runtime: node - repo: https://github.com/render-examples/vibe-coding-app # A workflow must set its region. Task runs connect to the database # on the private network, and that network does not cross regions. # Use the same region as the database, which is oregon by default. @@ -64,23 +93,5 @@ projects: fromDatabase: name: vibe-factory-db property: connectionString - - key: APPS_REPO - sync: false - # Sandboxes, the Render MCP server, Blueprint reads, and the - # deletes of a deleted app's resources. - - key: RENDER_API_KEY - sync: false - - key: RENDER_WORKSPACE_ID - sync: false - - key: ANTHROPIC_API_KEY - sync: false - # Set the three GitHub App variables or GITHUB_TOKEN. Each option - # needs Contents: write on APPS_REPO. - - key: GITHUB_APP_ID - sync: false - - key: GITHUB_APP_PRIVATE_KEY - sync: false - - key: GITHUB_APP_INSTALLATION_ID - sync: false - - key: GITHUB_TOKEN - sync: false + - fromGroup: vibe-factory-shared + - fromGroup: vibe-factory-workflow-secrets