docs: archive entra materials and simplify deployment docs

scripts/deploy/phase8-secrets.sh

@@ -1,8 +1,7 @@
 #!/bin/bash
 #
 # Phase 8: Secrets Configuration
-# Store secrets in Azure Key Vault
-# Note: Some secrets may need to be set manually
+# Store deployment secrets in a local operator-controlled env file.
 #
 
 set -euo pipefail
@@ -14,75 +13,46 @@ log_info "=========================================="
 log_info "Phase 8: Secrets Configuration"
 log_info "=========================================="
 
-# Verify Key Vault exists
-log_step "8.1 Verifying Azure Key Vault..."
+SECRETS_DIR="${STATE_DIR}/secrets"
+SECRETS_FILE="${SECRETS_DIR}/${ENVIRONMENT}.env"
 
-KV_EXISTS=$(az keyvault show \
-  --name "${KEY_VAULT_NAME}" \
-  --resource-group "${AKS_RESOURCE_GROUP}" \
-  --query name -o tsv 2>/dev/null || echo "")
+log_step "8.1 Preparing local secrets file..."
+mkdir -p "${SECRETS_DIR}"
 
-if [ -z "${KV_EXISTS}" ]; then
-  error_exit "Key Vault ${KEY_VAULT_NAME} not found. Create it first with Terraform."
+if [ ! -f "${SECRETS_FILE}" ]; then
+  touch "${SECRETS_FILE}"
+  chmod 600 "${SECRETS_FILE}"
+  log_success "Created ${SECRETS_FILE}"
+else
+  chmod 600 "${SECRETS_FILE}"
+  log_success "Using existing ${SECRETS_FILE}"
 fi
 
-log_success "Key Vault found: ${KEY_VAULT_NAME}"
-
-# Store database URL if provided
-if [ -n "${DATABASE_URL:-}" ]; then
-  log_step "8.2 Storing database URL..."
-  az keyvault secret set \
-    --vault-name "${KEY_VAULT_NAME}" \
-    --name "database-url-${ENVIRONMENT}" \
-    --value "${DATABASE_URL}" \
-    || log_warning "Failed to store database URL"
-  log_success "Database URL stored"
+log_step "8.2 Writing known secrets..."
+if [ -n "${DATABASE_URL:-}" ] && ! grep -q '^DATABASE_URL=' "${SECRETS_FILE}" 2>/dev/null; then
+  printf 'DATABASE_URL=%s\n' "${DATABASE_URL}" >> "${SECRETS_FILE}"
+  log_success "Stored DATABASE_URL in ${SECRETS_FILE}"
 fi
 
-# Check for Entra secrets
-log_step "8.3 Checking Entra ID secrets..."
+if ! grep -q '^JWT_SECRET=' "${SECRETS_FILE}" 2>/dev/null; then
+  JWT_SECRET=$(openssl rand -base64 32)
+  printf 'JWT_SECRET=%s\n' "${JWT_SECRET}" >> "${SECRETS_FILE}"
+  log_success "Generated JWT_SECRET in ${SECRETS_FILE}"
+else
+  log_success "JWT_SECRET already present in ${SECRETS_FILE}"
+fi
 
-ENTRA_SECRETS=("entra-tenant-id" "entra-client-id" "entra-client-secret" "entra-credential-manifest-id")
-MISSING_SECRETS=()
-
-for secret in "${ENTRA_SECRETS[@]}"; do
-  if ! az keyvault secret show \
-    --vault-name "${KEY_VAULT_NAME}" \
-    --name "${secret}" \
-    --query value -o tsv &> /dev/null; then
-    MISSING_SECRETS+=("${secret}")
+log_step "8.3 Checking identity provider placeholders..."
+for key in OIDC_ISSUER OIDC_CLIENT_ID OIDC_CLIENT_SECRET VC_ISSUER_DID VC_ISSUER_DOMAIN; do
+  if grep -q "^${key}=" "${SECRETS_FILE}" 2>/dev/null; then
+    log_success "${key} found in ${SECRETS_FILE}"
+  else
+    log_warning "${key} is not present in ${SECRETS_FILE}"
   fi
 done
 
-if [ ${#MISSING_SECRETS[@]} -gt 0 ]; then
-  log_warning "Missing Entra ID secrets: ${MISSING_SECRETS[*]}"
-  log_info "Run: ./scripts/deploy/store-entra-secrets.sh"
-else
-  log_success "All Entra ID secrets found"
-fi
-
-# Store JWT secret if not exists
-log_step "8.4 Storing JWT secret..."
-
-if ! az keyvault secret show \
-  --vault-name "${KEY_VAULT_NAME}" \
-  --name "jwt-secret" \
-  --query value -o tsv &> /dev/null; then
-  
-  JWT_SECRET=$(openssl rand -base64 32)
-  az keyvault secret set \
-    --vault-name "${KEY_VAULT_NAME}" \
-    --name "jwt-secret" \
-    --value "${JWT_SECRET}" \
-    || error_exit "Failed to store JWT secret"
-  log_success "JWT secret generated and stored"
-else
-  log_success "JWT secret already exists"
-fi
-
 log_info "Secrets configuration complete"
-log_info "Note: Additional secrets may need to be set manually"
-log_info "See docs/deployment/DEPLOYMENT_GUIDE.md Phase 8 for complete list"
+log_info "Keep ${SECRETS_FILE} out of version control and merge it into the runtime env on the target CT when needed."
 
 # Save state
 save_state "phase8" "complete"
@@ -90,4 +60,3 @@ save_state "phase8" "complete"
 log_success "=========================================="
 log_success "Phase 8: Secrets Configuration - COMPLETE"
 log_success "=========================================="
-