---
description: Sync Docker secrets from the test server into recipe-info/testsecrets/
argument-hint: [recipe-name]
allowed-tools: [Bash, Read, Grep, Glob]
---

# Sync Secrets

Deploy each app on the current test instance one at a time, read its Docker secrets from the running containers, update the local `recipe-info/testsecrets/` file, then undeploy the app before moving on to the next.

The optional recipe name is: $ARGUMENTS

Read and follow the instructions in `.claude/commands/includes/logging.md`.

## Background

Each recipe's Docker secrets are mounted at `/run/secrets/` inside containers. The `recipe-info/testsecrets/<domain>` files store these values locally so that setup scripts (via `lib/secrets.py`) can look them up dynamically. When secrets are regenerated on the server or you switch test instances, the local files become stale — this skill re-syncs them by deploying each app temporarily to read its secrets.

## Steps

1. **Check prerequisites**:
   - Read `settings.toml` to confirm the active test instance (or run `python3 scripts/get_test_instance.py` to check).
   - Verify SSH connectivity to the server: `ssh <server> echo ok`
   - Ensure the ssh-agent has the key loaded. If SSH fails, run:
     ```bash
     eval "$(ssh-agent -s)" && ssh-add /workspace/test-ssh/test-ssh-keys/nptest
     ```

2. **Build the recipe list**:
   - If a recipe name was provided in `$ARGUMENTS`, use only that recipe.
   - Otherwise, find all recipes that have a `recipe-info/<recipe>/recipe.toml` file.
   - Get the domain for each recipe by running: `python3 scripts/get_test_instance.py --recipe <recipe>`

3. **Check which apps are already running** — run:
   ```bash
   abra app ls --server <instance>.commoninternet.net -S -m
   ```
   Parse the output to build a list of apps that are already deployed. These will NOT be undeployed after syncing (we leave them as we found them).

4. **For each recipe, sequentially**:

   a. **Deploy** the app (if not already running):
      ```bash
      abra app deploy <domain> --chaos --force --no-input
      ```
      Wait for it to converge. If the deploy fails, log the error, skip this recipe, and continue to the next.

   b. **Wait for containers** — give services a moment to start (10-15 seconds), then verify at least one container is running:
      ```bash
      ssh <server> "docker ps -q --filter 'name=<stack>_' | head -1"
      ```
      The stack name is the domain with dots replaced by underscores (e.g. `<recipe>.<DOMAIN_SUFFIX>` → `<recipe>_<DOMAIN_SUFFIX_WITH_UNDERSCORES>`).

   c. **Read secrets** — run the sync script for this recipe:
      ```bash
      python3 scripts/sync_secrets.py --recipe <recipe>
      ```

   d. **Undeploy** (only if the app was NOT already running before step 3):
      ```bash
      abra app undeploy <domain> --no-input
      ```

   e. Log the result for this recipe before moving to the next.

5. **Verify** — spot-check one or two updated testsecrets files by reading them and confirming the values look like real secrets (not empty or error messages).

6. **Summarise** — tell the user:
   - Which instance was synced (`<instance>.commoninternet.net`).
   - How many recipes were synced vs failed.
   - Which apps were left running (because they were already deployed before the sync).