From 4309a633710440238f3bcabe828e421ddefe4d12 Mon Sep 17 00:00:00 2001
From: Grant Slater <github@firefishy.com>
Date: Thu, 6 Nov 2025 23:39:40 +0000
Subject: [PATCH] web: use aws databag

---
 cookbooks/web/recipes/rails.rb    | 5 +++--
 test/data_bags/web/aws.json       | 5 +++++
 test/data_bags/web/passwords.json | 2 --
 3 files changed, 8 insertions(+), 4 deletions(-)
 create mode 100644 test/data_bags/web/aws.json

diff --git a/cookbooks/web/recipes/rails.rb b/cookbooks/web/recipes/rails.rb
index 598b4bfab..3f1163f2c 100644
--- a/cookbooks/web/recipes/rails.rb
+++ b/cookbooks/web/recipes/rails.rb
@@ -29,6 +29,7 @@ include_recipe "web::base"
 
 web_passwords = data_bag_item("web", "passwords")
 db_passwords = data_bag_item("db", "passwords")
+aws_credentials = data_bag_item("web", "aws")
 
 ssl_certificate "www.openstreetmap.org" do
   domains ["www.openstreetmap.org", "www.osm.org", "www.openstreetmap.com",
@@ -45,8 +46,8 @@ rails_directory = "#{node[:web][:base_directory]}/rails"
 
 matomo = data_bag_item("web", "matomo")
 
-aws_access_key_id = web_passwords["aws_access_key_id"]
-aws_secret_access_key = web_passwords["aws_secret_access_key"]
+aws_access_key_id = aws_credentials["web_access_key_id"]
+aws_secret_access_key = aws_credentials["web_secret_access_key"]
 
 storage = {
   "avatars" => {
diff --git a/test/data_bags/web/aws.json b/test/data_bags/web/aws.json
new file mode 100644
index 000000000..dea5ee85b
--- /dev/null
+++ b/test/data_bags/web/aws.json
@@ -0,0 +1,5 @@
+{
+  "id": "aws",
+  "web_access_key_id": "WEB_ACCESS_KEY_ID",
+  "web_secret_access_key": "WEB_SECRET_ACCESS_KEY",
+}
diff --git a/test/data_bags/web/passwords.json b/test/data_bags/web/passwords.json
index 31519db5e..a7af0b084 100644
--- a/test/data_bags/web/passwords.json
+++ b/test/data_bags/web/passwords.json
@@ -21,8 +21,6 @@
   "thunderforest_key": "thunderforest",
   "tracestrack_key": "tracestrack",
   "totp_key": "totp",
-  "aws_access_key_id": "WEB_ACCESS_KEY_ID",
-  "aws_secret_access_key": "WEB_SECRET_ACCESS_KEY",
   "openid_connect_key": [
     "-----BEGIN PRIVATE KEY-----",
     "MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC1yJqM4c0bJNVN",
-- 
2.39.5