fix: mount age key directory into agents containers #32

New issue

Closed

opened 2026-03-28 18:08:34 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-03-28 18:08:34 +00:00

Collaborator

Part of #25 (credentials at rest).

What

Mount ~/.config/sops/age/ read-only into agents and agents-llama containers so they can decrypt .env.enc at startup.

Implementation

Add to compose template in bin/disinto and to running docker-compose.yml:

volumes:
  - ${HOME}/.config/sops/age:/home/agent/.config/sops/age:ro

Add to both agents and agents-llama services.

Affected files

bin/disinto (compose template, agents service volumes)
docker-compose.yml (running config)

Acceptance criteria

Age key accessible inside agents containers
Mount is read-only
Works for both agents and agents-llama

Part of #25 (credentials at rest). ## What Mount `~/.config/sops/age/` read-only into agents and agents-llama containers so they can decrypt `.env.enc` at startup. ## Implementation Add to compose template in `bin/disinto` and to running `docker-compose.yml`: ```yaml volumes: - ${HOME}/.config/sops/age:/home/agent/.config/sops/age:ro ``` Add to both `agents` and `agents-llama` services. ## Affected files - `bin/disinto` (compose template, agents service volumes) - `docker-compose.yml` (running config) ## Acceptance criteria - [ ] Age key accessible inside agents containers - [ ] Mount is read-only - [ ] Works for both agents and agents-llama