From 7b1f2da613dbb8866b7ad0b928b2993b019822ef Mon Sep 17 00:00:00 2001 From: chemavx Date: Fri, 19 Jun 2026 20:28:30 +0000 Subject: [PATCH] Add InfisicalStaticSecret for telegram-notify in n8n/portfolio/openclaw/polymarket-bot (parallel) Phase 3a of telegram-notify migration: each syncs TELEGRAM_BOT_TOKEN/ TELEGRAM_CHAT_ID from shared homelab/prod /telegram via read-only infisical-operator/infisical-auth, into parallel-name telegram-notify-infisical. Old plaintext secrets + hooks untouched (repoint=3b, removal=3c). polymarket-bot: standalone secret only; bot-secrets copy is migration #3. Co-Authored-By: Claude Opus 4.8 --- n8n/infisical-telegram-notify.yaml | 22 +++++++++++++++++ openclaw/infisical-telegram-notify.yaml | 22 +++++++++++++++++ polymarket-bot/infisical-telegram-notify.yaml | 24 +++++++++++++++++++ portfolio/infisical-telegram-notify.yaml | 22 +++++++++++++++++ 4 files changed, 90 insertions(+) create mode 100644 n8n/infisical-telegram-notify.yaml create mode 100644 openclaw/infisical-telegram-notify.yaml create mode 100644 polymarket-bot/infisical-telegram-notify.yaml create mode 100644 portfolio/infisical-telegram-notify.yaml diff --git a/n8n/infisical-telegram-notify.yaml b/n8n/infisical-telegram-notify.yaml new file mode 100644 index 0000000..cdf1604 --- /dev/null +++ b/n8n/infisical-telegram-notify.yaml @@ -0,0 +1,22 @@ +apiVersion: secrets.infisical.com/v1beta1 +kind: InfisicalStaticSecret +metadata: + name: telegram-notify + namespace: n8n +spec: + # Shared, read-only machine identity (no write grant, no PushSecret). + infisicalAuthRef: + name: infisical-auth + namespace: infisical-operator + sources: + - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab" + environmentSlug: prod + secretPath: /telegram # shared across all 5 namespaces + syncOptions: + refreshInterval: 60s + targets: + - kind: Secret + name: telegram-notify-infisical # parallel name — old telegram-notify stays live until 3c + namespace: n8n + creationPolicy: Owner + # key passthrough: synced Secret carries TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID verbatim diff --git a/openclaw/infisical-telegram-notify.yaml b/openclaw/infisical-telegram-notify.yaml new file mode 100644 index 0000000..502e4a6 --- /dev/null +++ b/openclaw/infisical-telegram-notify.yaml @@ -0,0 +1,22 @@ +apiVersion: secrets.infisical.com/v1beta1 +kind: InfisicalStaticSecret +metadata: + name: telegram-notify + namespace: openclaw +spec: + # Shared, read-only machine identity (no write grant, no PushSecret). + infisicalAuthRef: + name: infisical-auth + namespace: infisical-operator + sources: + - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab" + environmentSlug: prod + secretPath: /telegram # shared across all 5 namespaces + syncOptions: + refreshInterval: 60s + targets: + - kind: Secret + name: telegram-notify-infisical # parallel name — old telegram-notify stays live until 3c + namespace: openclaw + creationPolicy: Owner + # key passthrough: synced Secret carries TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID verbatim diff --git a/polymarket-bot/infisical-telegram-notify.yaml b/polymarket-bot/infisical-telegram-notify.yaml new file mode 100644 index 0000000..0d84f8c --- /dev/null +++ b/polymarket-bot/infisical-telegram-notify.yaml @@ -0,0 +1,24 @@ +apiVersion: secrets.infisical.com/v1beta1 +kind: InfisicalStaticSecret +metadata: + name: telegram-notify + namespace: polymarket-bot +spec: + # Shared, read-only machine identity (no write grant, no PushSecret). + # NOTE: this migrates only the STANDALONE telegram-notify secret. The same + # Telegram token also embedded in bot-secrets is migration #3 — not touched here. + infisicalAuthRef: + name: infisical-auth + namespace: infisical-operator + sources: + - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab" + environmentSlug: prod + secretPath: /telegram # shared across all 5 namespaces + syncOptions: + refreshInterval: 60s + targets: + - kind: Secret + name: telegram-notify-infisical # parallel name — old telegram-notify stays live until 3c + namespace: polymarket-bot + creationPolicy: Owner + # key passthrough: synced Secret carries TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID verbatim diff --git a/portfolio/infisical-telegram-notify.yaml b/portfolio/infisical-telegram-notify.yaml new file mode 100644 index 0000000..b516296 --- /dev/null +++ b/portfolio/infisical-telegram-notify.yaml @@ -0,0 +1,22 @@ +apiVersion: secrets.infisical.com/v1beta1 +kind: InfisicalStaticSecret +metadata: + name: telegram-notify + namespace: portfolio +spec: + # Shared, read-only machine identity (no write grant, no PushSecret). + infisicalAuthRef: + name: infisical-auth + namespace: infisical-operator + sources: + - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab" + environmentSlug: prod + secretPath: /telegram # shared across all 5 namespaces + syncOptions: + refreshInterval: 60s + targets: + - kind: Secret + name: telegram-notify-infisical # parallel name — old telegram-notify stays live until 3c + namespace: portfolio + creationPolicy: Owner + # key passthrough: synced Secret carries TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID verbatim