Keep environment variants and account configuration private

This commit is contained in:
Matt Isenhower
2026-09-07 13:22:14 -07:00
parent a87855644d
commit 8aa90337fd
2 changed files with 8 additions and 2 deletions

3
.gitignore vendored
View File

@@ -1,8 +1,11 @@
node_modules
.env
.env.*
!.env.example
/dist
logs
test-screenshot-*
/storage
.wrangler
.dev.vars
.dev.vars.*

View File

@@ -121,11 +121,14 @@ in the middle of a run: a busy pause request returns 409 so the caller can retry
Secrets: `NINTENDO_SESSION_ID_NA`, `NINTENDO_SESSION_ID_EU`,
`NINTENDO_SESSION_ID_JP`, optional `SPLATNET_USER_AGENT`, `RUN_TOKEN`,
`CLOUDFLARE_BROWSER_RUN_API_TOKEN`, optional `SENTRY_DSN`, and at cutover
`CLOUDFLARE_BROWSER_RUN_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`, optional `SENTRY_DSN`, and at cutover
`BLUESKY_SERVICE`, `BLUESKY_IDENTIFIER`, `BLUESKY_PASSWORD`.
Use `wrangler secret put NAME --config workers/updater/wrangler.jsonc` for a
secret. `SITE_URL` and `CLOUDFLARE_ACCOUNT_ID` are non-secret vars in the config.
secret. `SITE_URL` is a non-secret var in the config. The account ID is stored
as a secret to keep this account identifier out of the public repository; it
is not an authentication credential. Before deploying this change, configure
`CLOUDFLARE_ACCOUNT_ID` with the secret command above.
For local development, use gitignored `workers/updater/.dev.vars`. The existing
shared code reads these values through Workers' populated `process.env`.
Sentry wrappers route shared updater errors to Sentry when `SENTRY_DSN` is set.