From 0dc7e915f3f72459baf616edd131206d45db2c48 Mon Sep 17 00:00:00 2001 From: admin Date: Sat, 25 Jul 2026 22:00:57 -0700 Subject: [PATCH] chore(ci): remove root .woodpecker.yml, superseded by .woodpecker/deploy.yml Woodpecker ignores this file entirely once .woodpecker/ folder exists (config resolution: .woodpecker/ > .woodpecker.yaml > .woodpecker.yml). Content preserved verbatim in .woodpecker/deploy.yml. --- .woodpecker.yml | 295 ------------------------------------------------ 1 file changed, 295 deletions(-) delete mode 100644 .woodpecker.yml diff --git a/.woodpecker.yml b/.woodpecker.yml deleted file mode 100644 index 93a2bdf..0000000 --- a/.woodpecker.yml +++ /dev/null @@ -1,295 +0,0 @@ -when: - - event: push - branch: main - -steps: - validate: - image: alpine:latest - commands: - - apk add --no-cache docker-cli docker-cli-compose - - | - # Collect changed stacks — both flat files and folder-based - CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n') - - # Flat: any root-level *.yaml - FLAT=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.ya?ml$' || true) - - # Folder: any file under a subfolder (e.g. immich/immich.yml) - FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true) - - [ -z "$FLAT" ] && [ -z "$FOLDERS" ] && echo "No stacks changed" && exit 0 - - for f in $FLAT; do - [ -f "$f" ] || continue - docker compose -f "$f" --no-interpolate config -q \ - && echo " OK $f" || { echo " FAIL $f"; exit 1; } - done - - for d in $FOLDERS; do - [ -d "$d" ] || continue - # Build -f flags for all compose files in folder, main first - MAIN="" - EXTRAS="" - for ext in yml yaml; do - [ -f "$d/$d.$ext" ] && MAIN="$d/$d.$ext" && break - done - [ -z "$MAIN" ] && echo " SKIP $d (no main compose file)" && continue - for cf in $(find "$d" -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) | sort); do - [ "$cf" = "$MAIN" ] && continue - EXTRAS="$EXTRAS -f $cf" - done - docker compose -f "$MAIN" $EXTRAS --no-interpolate config -q \ - && echo " OK $d/" || { echo " FAIL $d/"; exit 1; } - done - - provision-secrets: - image: alpine:latest - environment: - SSH_KEY: - from_secret: ssh_key - SWARM_MANAGER_IP: - from_secret: swarm_manager_ip - 3DPRINT_DB_PASSWORD: - from_secret: 3dprint_db_password - GAMMA_AUTH_TOKEN: - from_secret: gamma_auth_token - GIT_DB_PASSWORD: - from_secret: git_db_password - GIT_RUNNER_TOKEN: - from_secret: git_runner_token - GIT_MCP_ACCESS_TOKEN: - from_secret: git_mcp_access_token - HOMEASSISTANT_FRIGATE_RTSP_PASSWORD: - from_secret: homeassistant_frigate_rtsp_password - HOMEASSISTANT_IMMICH_API_KEY: - from_secret: homeassistant_immich_api_key - IMMICH_DB_PASSWORD: - from_secret: immich_db_password - IMMICH_KIOSK_BASICAUTH: - from_secret: immich_kiosk_basicauth - MEALIE_DB_PASSWORD: - from_secret: mealie_db_password - MEALIE_LDAP_QUERY_PASSWORD: - from_secret: mealie_ldap_query_password - MESHCENTRAL_BACKUP_PASSWORD: - from_secret: meshcentral_backup_password - N8N_DB_PASSWORD: - from_secret: n8n_db_password - N8N_ENCRYPTION_KEY: - from_secret: n8n_encryption_key - POSTGRESQL_PASSWORD: - from_secret: postgresql_password - POSTGRESQL_PGADMIN_PASSWORD: - from_secret: postgresql_pgadmin_password - PRODUCTIVITY_PAPERLESS_SECRET_KEY: - from_secret: productivity_paperless_secret_key - PRODUCTIVITY_DB_PASSWORD: - from_secret: productivity_db_password - PRODUCTIVITY_OIDC_PROVIDERS: - from_secret: productivity_oidc_providers - VAULTWARDEN_ADMIN_TOKEN: - from_secret: vaultwarden_admin_token - VAULTWARDEN_DATABASE_URL: - from_secret: vaultwarden_database_url - ENTERTAINMENT_DISCORD_TOKEN: - from_secret: entertainment_discord_token - ENTERTAINMENT_DISCORD_CLIENT_SECRET: - from_secret: entertainment_discord_client_secret - ENTERTAINMENT_SECRET_KEY_BASE: - from_secret: entertainment_secret_key_base - ENTERTAINMENT_BASIC_AUTH_PASSWORD: - from_secret: entertainment_basic_auth_password - ENTERTAINMENT_SPARKY_DB_PASSWORD: - from_secret: entertainment_sparky_db_password - ENTERTAINMENT_SPARKY_APP_DB_PASSWORD: - from_secret: entertainment_sparky_app_db_password - ENTERTAINMENT_SPARKY_ENCRYPTION_KEY: - from_secret: entertainment_sparky_encryption_key - ENTERTAINMENT_BETTER_AUTH_SECRET: - from_secret: entertainment_better_auth_secret - commands: - - apk add --no-cache openssh-client - - mkdir -p ~/.ssh - - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa - - chmod 600 ~/.ssh/id_rsa - - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true - - | - CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n') - FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true) - FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true) - ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u) - [ -z "$ALL_STACKS" ] && echo "No stacks changed, skipping" && exit 0 - - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${SWARM_MANAGER_IP}:/tmp/cs.sh - - | - CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n') - FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true) - FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true) - ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u) - - for STACK in $ALL_STACKS; do - echo "Provisioning: $STACK" - case "$STACK" in - maintenance|media|unifi|guacamole|security|auth|traefik|meshcentral|ddm) - echo " No Docker secrets for $STACK — secrets in host .env";; - immich) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'immich_db_password' '${IMMICH_DB_PASSWORD}' - create_or_update_secret 'immich_kiosk_basicauth' '${IMMICH_KIOSK_BASICAUTH}'";; - woodpecker) - echo " Manual only — skipping";; - 3dprint) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";; - gamma) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";; - git) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}' - create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}' - create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";; - homeassistant) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}' - create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";; - mealie) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}' - create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";; - n8n) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}' - create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";; - postgresql) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}' - create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";; - productivity) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}' - create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}' - create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";; - vaultwarden) - printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -" - printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";; - ai) - echo " No Docker secrets for ai -- secrets in host .env";; - entertainment) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'entertainment_discord_token' '${ENTERTAINMENT_DISCORD_TOKEN}' - create_or_update_secret 'entertainment_discord_client_secret' '${ENTERTAINMENT_DISCORD_CLIENT_SECRET}' - create_or_update_secret 'entertainment_secret_key_base' '${ENTERTAINMENT_SECRET_KEY_BASE}' - create_or_update_secret 'entertainment_basic_auth_password' '${ENTERTAINMENT_BASIC_AUTH_PASSWORD}' - create_or_update_secret 'entertainment_sparky_db_password' '${ENTERTAINMENT_SPARKY_DB_PASSWORD}' - create_or_update_secret 'entertainment_sparky_app_db_password' '${ENTERTAINMENT_SPARKY_APP_DB_PASSWORD}' - create_or_update_secret 'entertainment_sparky_encryption_key' '${ENTERTAINMENT_SPARKY_ENCRYPTION_KEY}' - create_or_update_secret 'entertainment_better_auth_secret' '${ENTERTAINMENT_BETTER_AUTH_SECRET}'";; - *) - echo " No secrets case for $STACK";; - esac - done - - deploy: - image: alpine:latest - environment: - SSH_KEY: - from_secret: ssh_key - SWARM_MANAGER_IP: - from_secret: swarm_manager_ip - commands: - - apk add --no-cache openssh-client rsync - - mkdir -p ~/.ssh - - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa - - chmod 600 ~/.ssh/id_rsa - - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true - - | - CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n') - FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true) - FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true) - ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u) - [ -z "$ALL_STACKS" ] && echo "No stacks changed" && exit 0 - - # Always sync deploy/ scripts first - rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \ - deploy/ root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/ - - for STACK in $ALL_STACKS; do - echo "--- Deploying: $STACK ---" - # Sync files to host first (always, even for bootstrap stacks) - if [ -d "$STACK" ]; then - rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \ - "$STACK/" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/$STACK/ - elif [ -f "${STACK}.yaml" ]; then - rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \ - "${STACK}.yaml" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/ - fi - - # Bootstrap-tier guard: file synced to host, deploy is MANUAL - case "$STACK" in - traefik|woodpecker|postgresql) - echo " [BOOTSTRAP] $STACK: file synced. Deploy is MANUAL." - echo " Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" - continue ;; - esac - - # Tier 2: auto-deploy - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \ - "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \ - && echo " OK $STACK" || { echo " FAIL $STACK"; exit 1; } - done - - verify: - image: alpine:latest - environment: - SSH_KEY: - from_secret: ssh_key - SWARM_MANAGER_IP: - from_secret: swarm_manager_ip - commands: - - apk add --no-cache openssh-client - - mkdir -p ~/.ssh - - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa - - chmod 600 ~/.ssh/id_rsa - - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true - - | - CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n') - FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true) - FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true) - ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u) - [ -z "$ALL_STACKS" ] && exit 0 - sleep 5 - for STACK in $ALL_STACKS; do - echo "--- $STACK ---" - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \ - "docker stack ps $STACK --filter desired-state=running \ - --format ' {{.Name}} {{.CurrentState}}'" - done - - notify-success: - image: alpine:latest - environment: - TEAMS_WEBHOOK: - from_secret: teams_webhook - commands: - - apk add --no-cache curl - - | - CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ') - PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE") - curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true - when: - - status: success - - notify-failure: - image: alpine:latest - environment: - TEAMS_WEBHOOK: - from_secret: teams_webhook - WOODPECKER_HOST: - from_secret: woodpecker_host - commands: - - apk add --no-cache curl - - | - PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://%s","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE" "$WOODPECKER_HOST") - curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true - when: - - status: failure