31 lines
1.4 KiB
Markdown
31 lines
1.4 KiB
Markdown
---
|
|
created: '2026-05-17'
|
|
path: Sources/Homelab
|
|
project: postgres-consolidation-reflection-layer
|
|
tags:
|
|
- mcp
|
|
- automation
|
|
- git
|
|
type: session-notes
|
|
---
|
|
|
|
## Outcome
|
|
|
|
Final verification of the vault MCP write path after wiring `VAULT_PUSH_TOKEN` + `VAULT_GIT_HTTPS_URL` and rewriting the vault repo's origin to HTTPS at first push. If this artifact returns `pushed: true`, the end-to-end write surface (filesystem + git commit + git push + Postgres dual-write + chunked embeddings) is operational.
|
|
|
|
## Topics Covered
|
|
|
|
The full push fix:
|
|
- gitea PAT generated for lovebug user with write:repository scope
|
|
- VAULT_PUSH_TOKEN + VAULT_GIT_HTTPS_URL added to deployed .env
|
|
- `_ensure_https_remote` helper in git_writer.py rewrites origin URL + configures credential.helper on first push
|
|
- Credential helper reads $VAULT_PUSH_TOKEN at push time — token never lands in .git/config
|
|
|
|
## Key Learnings
|
|
|
|
The credential helper pattern keeps the secret out of any persisted file while still letting git push work non-interactively. The helper string in .git/config is just the recipe (`!f() { echo "username=..."; echo "password=$VAULT_PUSH_TOKEN"; }; f`); the env var resolves at runtime.
|
|
|
|
## Follow-ons
|
|
|
|
- [ ] If pushed: true: vault MCP write surface complete, the previous pending commit (5fb0ce2) plus this new one should both be on origin
|
|
- [ ] If pushed: false: surface the actual git push error from vault container logs |