# runner secrets diff

Compara os secrets decriptados de duas apps e lista divergências: chaves exclusivas de cada lado, chaves com o mesmo nome mas valores diferentes, e chaves idênticas. Disponível desde v2.30.6.

Use quando: N apps compartilham um repo upstream (docker-compose multi-service) e você precisa reconciliar valores conflitantes antes de unificar as ckeys via ckeys copy. Ver guia → ../../recuperar/multi-service-shared-repo.md.

# Sintaxe

runner secrets diff [OPTIONS] <APP_A> <APP_B>

# Flags

# Exemplo

$ runner secrets diff meet-api meet-worker
Secrets diff: meet-api vs meet-worker

  Only in meet-api (2):
    API_RATE_LIMIT
    CORS_ORIGINS

  Only in meet-worker (1):
    QUEUE_CONCURRENCY

  CONFLICT — same key, different values (1):
    DATABASE_URL
      meet-api:    postgres://api_user:xxx@db:5432/meet
      meet-worker: postgres://worker_user:yyy@db:5432/meet

  Same in both (4):
    JWT_SECRET, REDIS_URL, APP_ENV, LOG_LEVEL

# O que o output indica

# Fluxo típico: unificar ckeys em multi-service

# 1. Ver o que diverge
runner secrets diff meet-api meet-worker

# 2. Resolver conflitos manualmente (ex: unificar DATABASE_URL)
runner secrets set meet-worker DATABASE_URL "postgres://shared_user:yyy@db:5432/meet"

# 3. Copiar chaves exclusivas para o outro lado, se necessário
runner secrets set meet-api QUEUE_CONCURRENCY "4"

# 4. Confirmar que não há mais conflitos
runner secrets diff meet-api meet-worker

# 5. Copiar a ckey de uma app para a outra
runner ckeys copy --from meet-api --to meet-worker

# 6. Rebuild do bundle de meet-worker com a nova ckey
runner secrets reset-bundle meet-worker

# Output JSON

$ runner secrets diff meet-api meet-worker --json

{
  "app_a": "meet-api",
  "app_b": "meet-worker",
  "only_in_a": ["API_RATE_LIMIT", "CORS_ORIGINS"],
  "only_in_b": ["QUEUE_CONCURRENCY"],
  "conflicts": [
    {
      "key": "DATABASE_URL",
      "value_a": "postgres://api_user:xxx@db:5432/meet",
      "value_b": "postgres://worker_user:yyy@db:5432/meet"
    }
  ],
  "same": ["JWT_SECRET", "REDIS_URL", "APP_ENV", "LOG_LEVEL"]
}

# Erros comuns

• app_not_found: meet-api — app não registrada neste servidor; verifique com runner list.
• decryption_failed — ckey de uma das apps está errada ou o bundle corrompido; rode runner secrets show <app> em cada app separadamente para isolar qual falha.
• no_bundle — uma das apps não tem .runner/secrets.enc; rode runner secrets pull <app> ou runner secrets reset-bundle <app> primeiro.

# Veja também

• `runner ckeys copy` — unifica ckeys entre apps após resolver conflitos
• `runner secrets reset-bundle` — reconstrói bundle após mudar ckey
• `runner secrets show` — exibe conteúdo de uma app individual
• Multi-service shared repo