Runtime secrets are not committed to Git. They live as Kubernetes secrets (and local .env / .env.local for developers).
Examples (names only)
| Secret / area | Used by |
|---|---|
halort-platform-runtime-env | Surfaces/Platform API (DB, OAuth, JWT, …) |
halort-web-runtime-env | Surfaces/Marketing Web contact → notifications |
halort-notification-runtime-env | Notifications |
ghcr-io-pull | All GHCR image pulls |
Helpers in halort-infra include make sync-ghcr-pull, make sync-platform-secrets, make sync-notification-secrets. Local platform DB may use npm run sync:platform-db / Docker MariaDB — see Architecture/Local Development.
Never put credential values in this public vault; use content/private/ (ignored by Quartz) for personal notes if needed — see SCHEMA.