Environment & Secrets Configuration

Agent Directive: Environment & Secrets Configuration

Objective

Automate the creation of local environment variable files for Terraform and Wrangler. Confirm these files are strictly excluded from version control to prevent credential leaks. Onboarding must be script-only with zero manual file edits.

Key Lifecycle Requirement

During onboarding scripts must enforce this lifecycle for managed keys:

1. check for key value in local environment context
2. if key value does not exist, check Azure Key Vault
3. if key value does not exist in Key Vault and key policy is generated, create value
4. store created value in Key Vault
5. store resolved value in settings/.env..local
6. if key exists in Key Vault, use Key Vault value in settings/.env..local

Current implementation entry points:

• configure-project-workspace.cmd
• join-project.ps1
• scripts/join-project.ps1
• scripts/sync-local-keyvault-secrets.ps1

Execution Sequence

1. Secure Version Control

• Read the root .gitignore file.
• Confirm the following lines are present; append them if they are missing:
  • settings/
  • *.tfvars

2. Secrets & Variables Configuration

• Create a directory named settings/ in the repository root.

• Create a file named settings/.env.local to store global environment parameters (such as ADO_ORG_URL, ADO_PROJECT_NAME, ADO_PAT, and GEMINI_API_KEY).

• Create a file named settings/.dev.vars to store local Wrangler secrets (such as GEMINI_API_KEY).

• Navigate to the infra/ directory and create terraform.tfvars with:

  cloudflare_account_id = "cc132fd667eecfca3f27f1bdf523e503"
  cloudflare_api_token = "<INSERT_YOUR_API_TOKEN_HERE>"