---
id: w4/m6.5/t005
title: "E2E with beancount-cms: set its env vars from the dashboard, confirm the running app uses them"
worker: worker4
status: done
estimate: 40m
depends_on: [w4/m6.5/t004]
---

## Objective

Prove the whole loop against a real app: deploy **beancount-cms** on the local mock cluster, open its Environment tab in the dashboard, set its real env vars (its actual configuration keys — the "beancount-cms env var setup"), Save, and confirm the value lands in OpenBao, materializes into `beancount-cms-env`, rolls the pods, and the running app actually picks it up (serves/behaves per the new config).

## Context

- Stack: `scripts/mock-cluster.sh` + GitOps (OpenBao/m5) + bex-api with `BEX_OPENBAO_URL` set + operator + the dashboard dev server (`BEX_API_CORS_ORIGIN=http://localhost:5173`, docs/ADR006-bex-api.md#auth). The API side is already proven by `scripts/secrets-verify.sh` (w4/m6); this task exercises the same path **through the UI** with a real app's config.
- beancount-cms is the reference app the dashboard was scaffolded from; deploy it as an App CR (prebuilt image or build-from-git) and use its genuine env vars, not synthetic ones.
- Capture the run (Playwright screenshots to `.playwright-mcp/`, or a scripted check) so it is repeatable, in the mold of the other verify flows.

## Steps

1. Deploy beancount-cms as an App on the mock cluster.
2. Through the dashboard Environment tab, set its env vars; Save.
3. Confirm in OpenBao (`bao kv get`) + the materialized `beancount-cms-env` Secret + the rolled pods; confirm the running app uses the value.

## Files

- `examples/` (beancount-cms App manifest if one is needed)
- verification notes / capture in the milestone

## Acceptance criteria

- [ ] A value set from the dashboard is present in OpenBao and materialized, the pods roll, and beancount-cms uses it.
- [ ] The run is captured/repeatable.

## Out of scope

- Prod (Hetzner) run — the standard deploy pipeline covers it once merged.
