---
id: w4/m5/t006
title: "Docs: index entry, env tables, prod deploy path"
worker: worker4
status: done
estimate: 25m
depends_on: [w4/m5/t005]
---

## Objective

Close the documentation and prod loop: finalize `docs/ADR013-secrets.md` with the verification section (what `bao-verify.sh` proves) and local bring-up order, add the docs-index line and env-table rows to `CLAUDE.md`, and wire the prod path — the new `BAO_*` env vars pushed via `scripts/gh-secrets.sh` and `deploy.yml` running `bao-init.sh` against the Hetzner cluster on every deploy (mirroring the "apply auth secrets" step).

## Context

- Pattern: docs/ADR012-auth.md §Verification + §4-5 (GitOps shape, secrets out-of-band, prod path via gh-secrets.sh + deploy.yml).
- Repo rules: `.env.example`/`.env.template` sync; prettier on all touched markdown.
- Note the consequence already flagged in the ADR: OpenBao's storage joins the w1/m7 backup obligations.

## Steps

1. Add §Verification + bring-up order to `docs/ADR013-secrets.md`; cross-link from `docs/ADR012-auth.md` if natural.
2. `CLAUDE.md`: docs index line + env var rows.
3. `scripts/gh-secrets.sh`: include the `BAO_*` keys; `deploy.yml`: add the `bao-init.sh` step after Argo sync.
4. `npx prettier@3.4.2 --write "**/*.md"`.

## Files

- `docs/ADR013-secrets.md`, `docs/ADR012-auth.md` (cross-link), `CLAUDE.md`
- `scripts/gh-secrets.sh`, `.github/workflows/deploy.yml`

## Acceptance criteria

- [ ] Docs index + env tables current; prettier-clean.
- [ ] Prod deploy runs `bao-init.sh` with secrets sourced from GH Actions secrets.
- [ ] Backup obligation recorded (pointer to w1/m7).

## Out of scope

- Product wiring docs (m6 t007).
