security: move Infisical & Spaces secrets off argv (M2, fleet-wide)

CHANGELOG.md

@@ -30,6 +30,10 @@ Application-specific changes live in per-directory CHANGELOGs. See the index bel
 
 Changes in this section will be promoted to a dated release entry on merge to `main`.
 
+### Security
+
+- **M2 fleet-wide — Infisical Machine-Identity secrets & DO Spaces creds moved off command-line argv (2026-07-14)** — closes the AGENTS.md S2 finding that `infisical login --client-secret="$INFISICAL_CLIENT_SECRET"` and `tofu init -backend-config="secret_key=…"` exposed secrets on process argv (readable via `ps` / `/proc/<pid>/cmdline` on the droplet). **Infisical login** now uses env-var auth — `export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID/_SECRET` before a flagless `infisical login --method=universal-auth` (the CLI reads them natively), matching the pattern openclaw's entrypoint already used. **Tofu/OpenTofu** now exports `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` (the S3 backend reads them from env) and drops the two `-backend-config` access/secret lines; `sse_customer_key` stays on `-backend-config` (no env equivalent). Applied across every `*-docker` template and rendered site (anythingllm, keycloak, owncloud, wordpress, searxng, signoz, sandbox, openclaw, devbox) plus `otel-agent/` and the `scripts/*otel*` helpers, and the doc examples that showed the old form. Only `--plain`/`--silent` and non-secret flags remain on argv. **Compliance**: NIST CSF 2.0 PR.DS-1/PR.AC-4; CIS v8 3.11. **Verification**: `bash -n` + `shellcheck -S error` clean on all changed scripts; rendered ansible YAML parses; 0 remaining `--client-secret=`/`-backend-config="secret_key="` in tracked code. **Note**: needs a live deploy test (copier render → ansible/tofu path) before promotion — the human pre-merge gate.
+
 ### Added
 
 - **Open-branch consolidation — 10 branches integrated to `main`, 19 retired (2026-07-14)** — a single signed integration of every mergeable open branch, each individually code-reviewed (secrets/public-repo, correctness, template-standard), rebased onto current `main` so the latest template versions (incl. #78 Minimus fail-loud registry login) are preserved. **New:** `supabase-docker/` copier template (v0.1 — Postgres 15 + pgvector); `anythingllm-docker/sites/dev-weown-anythingllm/` (INT-P07/P08 do.weown.tools); `devbox-docker/sites/dev-weown-devbox/` (shared Zed remote-dev droplet, SSH-only, key-only sshd); `keycloak-docker/sites/sso.weown.dev/` migrated to Path-C serving `sso.weown.id`; `openclaw-docker/sites/claw-weown-dev/` + template hardening. **Changed/Fixed:** anythingllm template defaults per Jason (DeepSeek V4 Flash, SearXNG agent-search); searxng bound loopback-only; wordpress core-plugin-bundle fetch task; owncloud oCIS template hardening (backup-name injection guard, `ignore_changes=[user_data,tags]`, corrected security-model claims); smoke-test framework across all 7 templates (fails on unhealthy containers, correct auth-file path). **Security/public-repo scrubs:** real ProtonVPN egress IP → RFC5737; real Infisical project UUIDs → placeholders; offboarded-dev emails → `alerts@example.com`; openclaw ADR-006 auth file `0644`→`0600`/UID-1000; keycloak image pinned `:24.0` + cloud-init `{% raw %}` rotation-breaker fixed. **Retired (skipped + branches deleted):** branches already folded into `e8496d1`, the retired `sites/s004`, obsolete pre-copier flat layouts, and (owner-decided) the `zeroToHundred` webapp and the superseded `security-hardening-ssh` inventory. **Deferred:** M2 Infisical `--client-secret` argv pattern (pre-existing fleet-wide) tracked as a separate hardening pass.

anythingllm-docker/DEPLOYMENT_GUIDE.md

@@ -98,8 +98,8 @@ this split is the key to the whole flow.
   (mints v2, swaps the file, revokes v1) so the secret that briefly lived in
   Terraform state / droplet metadata is invalidated.
 - At every `docker compose up`, the deploy does
-  `export INFISICAL_TOKEN="$(infisical login --method=universal-auth
-  --client-id=… --client-secret=… --plain --silent)"` then
+  `export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=… INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=…;
+  export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"` then
   `infisical run --projectId=<app> --env=prod -- docker compose up -d`.
   Secrets are fetched fresh into the **container environment only** — never
   written to disk. Restart the container and rotated secrets flow in.

anythingllm-docker/sites/ai.weown.agency/ansible/deploy.yml

@@ -111,10 +111,9 @@
           set -euo pipefail
           # shellcheck disable=SC1091
           source {{ app_dir }}/.infisical-auth.env
-          export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-            --client-id="$INFISICAL_CLIENT_ID" \
-            --client-secret="$INFISICAL_CLIENT_SECRET" \
-            --plain --silent)"
+          export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+          export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+          export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
           infisical run \
             --projectId={{ infisical_project_id }} \
             --env={{ infisical_env }} \
@@ -171,10 +170,9 @@
         set -euo pipefail
         # shellcheck disable=SC1091
         source {{ app_dir }}/.infisical-auth.env
-        export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-          --client-id="$INFISICAL_CLIENT_ID" \
-          --client-secret="$INFISICAL_CLIENT_SECRET" \
-          --plain --silent)"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+        export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
         cd {{ app_dir }}
         infisical run \
           --projectId={{ infisical_project_id }} \
@@ -233,10 +231,9 @@
         set -euo pipefail
         # shellcheck disable=SC1091
         source {{ app_dir }}/.infisical-auth.env
-        export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-          --client-id="$INFISICAL_CLIENT_ID" \
-          --client-secret="$INFISICAL_CLIENT_SECRET" \
-          --plain --silent)"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+        export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
         cd {{ app_dir }}
         infisical run \
           --projectId={{ infisical_project_id }} \

anythingllm-docker/sites/ai.weown.agency/scripts/backup.sh

@@ -159,10 +159,9 @@ SCRIPT
       "INFISICAL_PROJECT_ID='$INFISICAL_PROJECT_ID' INFISICAL_ENV='$INFISICAL_ENV' PROJECT_NAME='$PROJECT_NAME' bash -s" <<'EOF'
 set -euo pipefail
 source "/opt/$PROJECT_NAME/.infisical-auth.env"
-export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET" \
-  --plain --silent)"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
 exec infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" \
   -- "/opt/$PROJECT_NAME/backup.sh"
 EOF

anythingllm-docker/sites/ai.weown.agency/scripts/restore.sh

@@ -192,10 +192,9 @@ SCRIPT
       "INFISICAL_PROJECT_ID='$INFISICAL_PROJECT_ID' INFISICAL_ENV='$INFISICAL_ENV' PROJECT_NAME='int_p01_anythingllm' BACKUP_NAME='$BACKUP_NAME' bash -s" <<'EOF'
 set -euo pipefail
 source "/opt/$PROJECT_NAME/.infisical-auth.env"
-export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET" \
-  --plain --silent)"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
 exec infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" \
   -- "/opt/$PROJECT_NAME/restore.sh" "$BACKUP_NAME"
 EOF

anythingllm-docker/sites/ai.weown.agency/terraform/init.sh

@@ -46,9 +46,9 @@ if [[ -z "$SPACES_ACCESS_KEY" ]] || [[ -z "$SPACES_SECRET_KEY" ]] || [[ -z "$SPA
 fi
 
 echo "==> Initializing OpenTofu with DO Spaces backend..."
+export AWS_ACCESS_KEY_ID="${SPACES_ACCESS_KEY}"
+export AWS_SECRET_ACCESS_KEY="${SPACES_SECRET_KEY}"
 tofu init \
-  -backend-config="access_key=${SPACES_ACCESS_KEY}" \
-  -backend-config="secret_key=${SPACES_SECRET_KEY}" \
   -backend-config="sse_customer_key=${SPACES_ENCRYPTION_KEY}"
 
 echo ""

anythingllm-docker/sites/dev-weown-anythingllm/ansible/deploy.yml

@@ -185,10 +185,9 @@
           set -euo pipefail
           # shellcheck disable=SC1091
           source {{ app_dir }}/.infisical-auth.env
-          export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-            --client-id="$INFISICAL_CLIENT_ID" \
-            --client-secret="$INFISICAL_CLIENT_SECRET" \
-            --plain --silent)"
+          export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+          export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+          export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
           infisical run \
             --projectId={{ infisical_project_id }} \
             --env={{ infisical_env }} \
@@ -241,10 +240,9 @@
         set -euo pipefail
         # shellcheck disable=SC1091
         source {{ app_dir }}/.infisical-auth.env
-        export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-          --client-id="$INFISICAL_CLIENT_ID" \
-          --client-secret="$INFISICAL_CLIENT_SECRET" \
-          --plain --silent)"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+        export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
         install -d -m 0700 -o root -g root /root/.ssh
         infisical run --projectId={{ infisical_project_id }} --env={{ infisical_env }} -- bash -c '
           keys="${OPS_AUTHORIZED_KEYS:-}"
@@ -282,10 +280,9 @@
         set -euo pipefail
         # shellcheck disable=SC1091
         source {{ app_dir }}/.infisical-auth.env
-        export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-          --client-id="$INFISICAL_CLIENT_ID" \
-          --client-secret="$INFISICAL_CLIENT_SECRET" \
-          --plain --silent)"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+        export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
         infisical run \
           --projectId={{ infisical_project_id }} \
           --env={{ infisical_env }} \

anythingllm-docker/sites/dev-weown-anythingllm/scripts/backup.sh

@@ -166,10 +166,9 @@ SCRIPT
       "INFISICAL_PROJECT_ID='$INFISICAL_PROJECT_ID' INFISICAL_ENV='$INFISICAL_ENV' PROJECT_NAME='$PROJECT_NAME' bash -s" <<'EOF'
 set -euo pipefail
 source "/opt/$PROJECT_NAME/.infisical-auth.env"
-export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET" \
-  --plain --silent)"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
 exec infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" \
   -- "/opt/$PROJECT_NAME/backup.sh"
 EOF

anythingllm-docker/sites/dev-weown-anythingllm/scripts/entrypoint-infisical.sh

@@ -36,10 +36,9 @@ fi
 
 # Step 2: Login to Infisical
 export INFISICAL_TOKEN
-INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET" \
-  --plain --silent)"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
 
 if [ -z "$INFISICAL_TOKEN" ]; then
   echo "ERROR: Failed to authenticate with Infisical" >&2

anythingllm-docker/sites/dev-weown-anythingllm/scripts/restore.sh

@@ -192,10 +192,9 @@ SCRIPT
       "INFISICAL_PROJECT_ID='$INFISICAL_PROJECT_ID' INFISICAL_ENV='$INFISICAL_ENV' PROJECT_NAME='dev_weown_anythingllm_anythingllm' BACKUP_NAME='$BACKUP_NAME' bash -s" <<'EOF'
 set -euo pipefail
 source "/opt/$PROJECT_NAME/.infisical-auth.env"
-export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET" \
-  --plain --silent)"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
 exec infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" \
   -- "/opt/$PROJECT_NAME/restore.sh" "$BACKUP_NAME"
 EOF

anythingllm-docker/sites/dev-weown-anythingllm/terraform/itofu.sh

@@ -53,9 +53,7 @@ case "$1" in
     # from the Infisical-injected env to -backend-config. Single quotes are
     # intentional - these expand inside `infisical run`, not here.
     # shellcheck disable=SC2016
-    irun bash -c 'exec tofu init -reconfigure \
-      -backend-config="access_key=$TF_VAR_spaces_access_key" \
-      -backend-config="secret_key=$TF_VAR_spaces_secret_key" \
+    irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key"; export AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu init -reconfigure \
       -backend-config="sse_customer_key=$TF_VAR_spaces_encryption_key" "$@"' itofu "$@"
     ;;
   plan)

anythingllm-docker/sites/s004.ccc.bot/ansible/deploy.yml

@@ -121,10 +121,9 @@
           set -euo pipefail
           # shellcheck disable=SC1091
           source {{ app_dir }}/.infisical-auth.env
-          export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-            --client-id="$INFISICAL_CLIENT_ID" \
-            --client-secret="$INFISICAL_CLIENT_SECRET" \
-            --plain --silent)"
+          export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+          export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+          export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
           infisical run \
             --projectId={{ infisical_project_id }} \
             --env={{ infisical_env }} \
@@ -177,10 +176,9 @@
         set -euo pipefail
         # shellcheck disable=SC1091
         source {{ app_dir }}/.infisical-auth.env
-        export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-          --client-id="$INFISICAL_CLIENT_ID" \
-          --client-secret="$INFISICAL_CLIENT_SECRET" \
-          --plain --silent)"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+        export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
         install -d -m 0700 -o root -g root /root/.ssh
         infisical run --projectId={{ infisical_project_id }} --env={{ infisical_env }} -- bash -c '
           keys="${OPS_AUTHORIZED_KEYS:-}"
@@ -237,10 +235,9 @@
         set -euo pipefail
         # shellcheck disable=SC1091
         source {{ app_dir }}/.infisical-auth.env
-        export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-          --client-id="$INFISICAL_CLIENT_ID" \
-          --client-secret="$INFISICAL_CLIENT_SECRET" \
-          --plain --silent)"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+        export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
         cd {{ app_dir }}
         infisical run \
           --projectId={{ infisical_project_id }} \
@@ -299,10 +296,9 @@
         set -euo pipefail
         # shellcheck disable=SC1091
         source {{ app_dir }}/.infisical-auth.env
-        export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-          --client-id="$INFISICAL_CLIENT_ID" \
-          --client-secret="$INFISICAL_CLIENT_SECRET" \
-          --plain --silent)"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+        export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+        export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
         cd {{ app_dir }}
         infisical run \
           --projectId={{ infisical_project_id }} \

anythingllm-docker/sites/s004.ccc.bot/scripts/backup.sh

@@ -166,10 +166,9 @@ SCRIPT
       "INFISICAL_PROJECT_ID='$INFISICAL_PROJECT_ID' INFISICAL_ENV='$INFISICAL_ENV' PROJECT_NAME='$PROJECT_NAME' bash -s" <<'EOF'
 set -euo pipefail
 source "/opt/$PROJECT_NAME/.infisical-auth.env"
-export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET" \
-  --plain --silent)"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
 exec infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" \
   -- "/opt/$PROJECT_NAME/backup.sh"
 EOF

anythingllm-docker/sites/s004.ccc.bot/scripts/restore.sh

@@ -192,10 +192,9 @@ SCRIPT
       "INFISICAL_PROJECT_ID='$INFISICAL_PROJECT_ID' INFISICAL_ENV='$INFISICAL_ENV' PROJECT_NAME='int_s004_anythingllm' BACKUP_NAME='$BACKUP_NAME' bash -s" <<'EOF'
 set -euo pipefail
 source "/opt/$PROJECT_NAME/.infisical-auth.env"
-export INFISICAL_TOKEN="$(infisical login --method=universal-auth \
-  --client-id="$INFISICAL_CLIENT_ID" \
-  --client-secret="$INFISICAL_CLIENT_SECRET" \
-  --plain --silent)"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="$INFISICAL_CLIENT_ID"
+export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="$INFISICAL_CLIENT_SECRET"
+export INFISICAL_TOKEN="$(infisical login --method=universal-auth --plain --silent)"
 exec infisical run --projectId="$INFISICAL_PROJECT_ID" --env="$INFISICAL_ENV" \
   -- "/opt/$PROJECT_NAME/restore.sh" "$BACKUP_NAME"
 EOF

anythingllm-docker/sites/s004.ccc.bot/terraform/init.sh

@@ -47,9 +47,9 @@ if [[ -z "$SPACES_ACCESS_KEY" ]] || [[ -z "$SPACES_SECRET_KEY" ]] || [[ -z "$SPA
 fi
 
 echo "==> Initializing OpenTofu with DO Spaces backend..."
+export AWS_ACCESS_KEY_ID="${SPACES_ACCESS_KEY}"
+export AWS_SECRET_ACCESS_KEY="${SPACES_SECRET_KEY}"
 tofu init \
-  -backend-config="access_key=${SPACES_ACCESS_KEY}" \
-  -backend-config="secret_key=${SPACES_SECRET_KEY}" \
   -backend-config="sse_customer_key=${SPACES_ENCRYPTION_KEY}"
 
 echo ""

anythingllm-docker/sites/s004.ccc.bot/terraform/itofu.sh

@@ -49,9 +49,7 @@ case "$1" in
     # from the Infisical-injected env to -backend-config. Single quotes are
     # intentional - these expand inside `infisical run`, not here.
     # shellcheck disable=SC2016
-    irun bash -c 'exec tofu init -reconfigure \
-      -backend-config="access_key=$TF_VAR_spaces_access_key" \
-      -backend-config="secret_key=$TF_VAR_spaces_secret_key" \
+    irun bash -c 'export AWS_ACCESS_KEY_ID="$TF_VAR_spaces_access_key"; export AWS_SECRET_ACCESS_KEY="$TF_VAR_spaces_secret_key"; exec tofu init -reconfigure \
       -backend-config="sse_customer_key=$TF_VAR_spaces_encryption_key" "$@"' itofu "$@"
     ;;
   plan)