Stop managing Codex auth.json from the vault #73

Merged

scruffydude merged 2 commits from fix/codex-auth-seed-only into main 2026-10-13 22:06:00 -04:00

Conversation 0 Commits 2 Files changed 5 +244 -486

Nimby commented 2026-10-13 21:40:43 -04:00

Collaborator

Copy link

Summary

The vault code_server_secret.codex_auth_json snapshot was copied over the live /config/.codex/auth.json on every code_server/cloudcli deploy, which could log Codex out after token rotation. It is no longer needed at all:

• both instances hold live, self-refreshing logins
• the management backup already archives /config/.codex/auth.json for recovery
• an old snapshot has a rotated refresh token and would not authenticate a fresh host anyway

Changes: remove the seed tasks from code_server and cloudcli, remove codex_auth_json from dev.vault.yml (all other vault values verified byte-identical), drop it from the example vault, and update README to use codex login.

Validation

• syntax-check: deploy_code_server, deploy_cloudcli
• --check on optibcc and deskpi: no Codex auth task, 0 failures (remaining changes are pre-existing drift)
• git grep codex_auth_json: no references

🤖 Generated with Claude Code

## Summary The vault `code_server_secret.codex_auth_json` snapshot was copied over the live `/config/.codex/auth.json` on every code_server/cloudcli deploy, which could log Codex out after token rotation. It is no longer needed at all: - both instances hold live, self-refreshing logins - the management backup already archives `/config/.codex/auth.json` for recovery - an old snapshot has a rotated refresh token and would not authenticate a fresh host anyway Changes: remove the seed tasks from `code_server` and `cloudcli`, remove `codex_auth_json` from `dev.vault.yml` (all other vault values verified byte-identical), drop it from the example vault, and update README to use `codex login`. ## Validation - syntax-check: deploy_code_server, deploy_cloudcli - `--check` on optibcc and deskpi: no Codex auth task, 0 failures (remaining changes are pre-existing drift) - `git grep codex_auth_json`: no references 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Nimby added 1 commit 2026-10-13 21:40:43 -04:00

Seed Codex auth.json only when missing ... 390ae3e797

Both code_server and cloudcli copied the vault Codex auth.json snapshot over
the live file on every deploy. Codex rotates tokens in that file, so a stale
snapshot could log the session out after any redeploy. Use force: false so
the vault copy only seeds a missing login.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Nimby changed title from Seed Codex auth.json only when missing to Stop managing Codex auth.json from the vault 2026-10-13 21:49:00 -04:00

Nimby added 1 commit 2026-10-13 21:49:00 -04:00

Stop managing Codex auth.json from the vault ... 965e8bd41f

The vault codex_auth_json snapshot is no longer useful: both code-server
and CloudCLI hold live, self-refreshing logins, the management backup
already archives /config/.codex/auth.json for recovery, and an old
snapshot's rotated refresh token would not authenticate a fresh host
anyway. Drop the seed tasks from both roles and the key from the vault;
log in with `codex login` instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scruffydude merged commit d9ae93f996 into main 2026-10-13 22:06:00 -04:00

scruffydude deleted branch fix/codex-auth-seed-only 2026-10-13 22:06:01 -04:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

scruffydude/homelab!73

No description provided.