another key..

.github/workflows/cicd.yml

@@ -10,4 +10,4 @@ jobs:
       NO_TEST: true
     secrets:
       NOMAD_TOKEN_EXT: ${{ secrets.NOMAD_TOKEN_EXT }}
-      NOMAD_SECRETS: '{ "APP_ID"="${{ secrets.APP_ID }}", "RSA"="${{ secrets.RSA }}" }'
+      NOMAD_SECRETS: '{ "APP_ID"="${{ secrets.APP_ID }}", "RSA"="${{ secrets.RSA }}", "RSA_PKEY"="${{ secrets.RSA_PKEY }}" }'

entrypoint.sh

@@ -2,13 +2,16 @@
 
 # create our config on-demand from our runtime-only environment variables passed in to us
 
-# the key env var needs to be base64 encoded for transport, and we'll unpack it to:
+# the key env vars need to be base64 encoded for transport, and we'll unpack it to:
 #   "-----BEGIN RSA PRIVATE KEY-----\n[..KEY..]\n-----END RSA PRIVATE KEY-----"
 
 export NODE_ENV=production
 export PORT=80
-export GITHUB_PRIVATE_KEY=$(echo "$RSA" |base64 -d|sed ':a;N;$!ba;s/\n/\\n/g')
 export GITHUB_APP_ID=$APP_ID
+# for this first one, eg: https://travistidwell.com/jsencrypt/demo/
+export RSA_PRIVATE_KEY=$(echo "$RSA_PKEY" |base64 -d|sed ':a;N;$!ba;s/\n/\\n/g')
+export GITHUB_PRIVATE_KEY=$(echo "$RSA" |base64 -d|sed ':a;N;$!ba;s/\n/\\n/g')
+
 
 # cat >| config.production.json <<EOF
 # {