[infra] vault + chsettle + aurora for dev

.woodpecker/vault.yml

@@ -0,0 +1,31 @@
+when:
+  - event: push
+    branch: main
+    path:
+      exclude: ['**']
+      ignore_message: '[infra]'
+
+steps:
+  - name: secrets
+    image: alpine:latest
+    environment:
+      VAULT_ADDR: { from_secret: VAULT_ADDR }
+      VAULT_ROLE_ID:   { from_secret: VAULT_APP_ROLE }
+      VAULT_SECRET_ID: { from_secret: VAULT_SECRET_ID }
+    commands:
+      - set -euo pipefail
+      - apk add --no-cache bash coreutils openssh-keygen curl sed python3
+      - sh ci/scripts/common/fetch_deploy_ssh_key.sh secrets/SSH_KEY
+
+  - name: deploy
+    image: alpine:latest
+    depends_on: [ secrets ]
+    commands:
+      - set -euo pipefail
+      - apk add --no-cache bash openssh-client rsync coreutils curl sed python3
+      - mkdir -p /root/.ssh
+      - install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
+      - . ./ci/scripts/common/runtime_env.sh
+      - load_runtime_env_bundle "$(resolve_runtime_env_name)"
+      - bash ci/prod/scripts/bootstrap/network.sh
+      - sh ci/scripts/vault/deploy.sh