fix(cli) handle unsupported sops backend and log unknown backends

commit: 48b313f3f6a30b83ffd46ffa80dcad56c873d574
author: bnema · 8mo ago · 2026-02-06 20:43 UTC
parent: 180389f
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +9 -2

M internal/adapters/in/cli/local.go +8 -2


@@ -101,10 +101,14 @@ func GetLocalServices(configPath string) (*LocalServices, error) {
101	101
102	102		func createLocalDomainSecretStore(v *viper.Viper, envDir string, log zerowrap.Logger) (out.DomainSecretStore, error) {
103	103		backend := resolveLocalSecretsBackend(v)
104		-	if backend == domain.SecretsBackendPass {
	104	+	switch backend {
	105	+	case domain.SecretsBackendPass:
105	106		return domainsecrets.NewPassStore(log)
	107	+	case domain.SecretsBackendSops:
	108	+	return nil, fmt.Errorf("sops backend not yet supported for domain secrets")
	109	+	default:
	110	+	return domainsecrets.NewFileStore(envDir, log)
106	111		}
107		-	return domainsecrets.NewFileStore(envDir, log)
108	112		}
109	113
110	114		func resolveLocalSecretsBackend(v *viper.Viper) domain.SecretsBackend {

@@ -122,6 +126,8 @@ func resolveLocalSecretsBackend(v *viper.Viper) domain.SecretsBackend {
122	126		case "unsafe", "":
123	127		return domain.SecretsBackendUnsafe
124	128		default:
	129	+	log := zerowrap.Default()
	130	+	log.Warn().Str("backend", backend).Msg("unrecognized secrets backend, falling back to unsafe")
125	131		return domain.SecretsBackendUnsafe
126	132		}
127	133		}

 func createLocalDomainSecretStore(v *viper.Viper, envDir string, log zerowrap.Logger) (out.DomainSecretStore, error) {
 	backend := resolveLocalSecretsBackend(v)
-	if backend == domain.SecretsBackendPass {
+	switch backend {
+	case domain.SecretsBackendPass:
 		return domainsecrets.NewPassStore(log)
+	case domain.SecretsBackendSops:
+		return nil, fmt.Errorf("sops backend not yet supported for domain secrets")
+	default:
+		return domainsecrets.NewFileStore(envDir, log)
 	}
-	return domainsecrets.NewFileStore(envDir, log)
 }
 func resolveLocalSecretsBackend(v *viper.Viper) domain.SecretsBackend {
 	case "unsafe", "":
 		return domain.SecretsBackendUnsafe
 	default:
+		log := zerowrap.Default()
+		log.Warn().Str("backend", backend).Msg("unrecognized secrets backend, falling back to unsafe")
 		return domain.SecretsBackendUnsafe
 	}
 }

M internal/adapters/in/cli/remote/config.go +1 -0


@@ -231,6 +231,7 @@ func resolveInsecureTLS(flagInsecure bool, config ClientConfig, remotes Client
231	231		if value, err := strconv.ParseBool(env); err == nil {
232	232		return value
233	233		}
	234	+	fmt.Fprintf(os.Stderr, "WARNING: invalid GORDON_INSECURE value %q, ignoring\n", env)
234	235		}
235	236
236	237		if config != nil && config.Client.InsecureTLS {


@@ -231,6 +231,7 @@ func resolveInsecureTLS(flagInsecure bool, config ClientConfig, remotes Client
231	if value, err := strconv.ParseBool(env); err == nil {	231		if value, err := strconv.ParseBool(env); err == nil {
232	return value	232		return value
233	}	233		}
		234	+	fmt.Fprintf(os.Stderr, "WARNING: invalid GORDON_INSECURE value %q, ignoring\n", env)
234	}	235		}
235		236
236	if config != nil && config.Client.InsecureTLS {	237		if config != nil && config.Client.InsecureTLS {