[Purple10101]

What

retina-gui reads CARTO_API_KEY to stop the setup wizard's tower map coming back watermarked (retina-gui#100), and nothing supplies it. CARTO does not refuse an unkeyed request: it answers HTTP 200 with every tile stamped "API KEY REQUIRED", which is the state every node is in today.

The key is not in this repo, and cannot be

This repository is public, and a key in its history outlives every rotation.

• configuration/retina-gui/retina-gui.yml carries carto_api_key: "" — committed, empty on purpose.
• CI writes the real value from a repository secret into retina-gui_custom.yml beside it, which is gitignored.
• with_first_found in radar_data_bootstrap prefers the CI-written file.

That is exactly the arrangement configuration/mender/ already uses for the tenant token, and the same reasoning retina-server states in its own deploy/env.prod.example. It is also the same key at the other end.

Needs one thing before merge: a CARTO_API_KEY repository secret. Without it the build still succeeds and produces the watermarked map it produces today.

Why /etc and not /data

This is the part worth pausing on, because the obvious choice is wrong.

/data survives an OS update by design. That means a file the image writes there only ever reaches a freshly flashed node, and never the existing fleet. /etc is on the rootfs, which every A/B update replaces wholesale, so it reaches existing nodes on the next release and rotates with it.

retina-gui's unit reads /etc/retina-gui/carto.env first and then /data/retina-gui/carto.env, so a node handed its own key by hand keeps it across updates. Later assignment wins in systemd.

No key means no file

Rather than a file assigning an empty string. The rootfs is rebuilt for every image, so "absent" cannot be a stale leftover, while an empty assignment would read as a key that had stopped working.

Verification

8 tests in tests/deployment-values/, covering the empty default, the gitignore entry, the CI step, the with_first_found ordering, the /etc path, the skip-when-empty guard and the 0600 mode.

Two of them fail if a key is ever pasted into the committed default — verified by doing exactly that and watching them go red, then restoring.

All four changed/added YAML files parse, and the full suite passes in a venv built the way CI builds one (pip install 'pytest>=8.0' and nothing else).

The first push of this branch failed CI: the new test imported yaml, which CI does not install. Fixed by asserting the line directly instead, rather than adding a dependency to a deliberately lean CI.

tests/contact-email shows two failures in my local environment. They are not a problem with this branch or with main — the Tests workflow is green on every recent main push — so they look environmental and nothing here touches them.

Companion change

This is inert on its own. retina-gui's systemd/retina-gui.service currently reads only /data/retina-gui/carto.env and needs the /etc line added above it. One line, not in this PR.

🤖 Generated with Claude Code