From 4d683075a1637d4adb1a86d70c2dd5e546344610 Mon Sep 17 00:00:00 2001 From: Shaun Campbell Date: Thu, 17 Sep 2026 10:29:36 -0400 Subject: [PATCH] docs: describe TreatVault service bootstrap --- README.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 61a5276..f2bc5bb 100644 --- a/README.md +++ b/README.md @@ -25,6 +25,7 @@ The current schema defines one `pawsql` block with a listener, an optional TLS ` - `upstream ` for an external PostgreSQL server. - `postgres { ... }` for a managed PostgreSQL container. Its `image`, `volume`, and `password_secret` directives are required. `password_secret` is a short lowercase reference resolved to the Docker secret `barkstack_`. `idle_timeout` and `traffic_idle_timeout` accept Go duration strings. +- `treatvault { ... }` (optional, top-level) configures TreatVault: `file` is the path to the age-encrypted secret source of truth, and `identity_secret` is a short reference for the Docker secret holding the age identity (`barkstack_`). ```text pawsql { @@ -48,11 +49,7 @@ pawsql { } ``` -Create the referenced secret before deploying PawSQL: - -```sh -docker secret create barkstack_application_postgres_password /secure/path/application-postgres-password -``` +With TreatVault configured, create the referenced password through the TreatVault page in the Barkstack Console. `barkstack init` creates the identity Docker secret when absent; the TreatVault service initializes the encrypted file and creates the Docker secret on sync. ## Watch validated changes