From 0f26d31a02fb89b3448a729dce355ae7aa7fc8c2 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Tue, 28 Jul 2026 07:20:35 -0700
Subject: [PATCH] postgresql: add replication + patroni Woodpecker secrets to
 provision-secrets step (ADR-0001 Phase 1)

---
 .woodpecker/deploy.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.woodpecker/deploy.yml b/.woodpecker/deploy.yml
index 477626d..c921bbe 100644
--- a/.woodpecker/deploy.yml
+++ b/.woodpecker/deploy.yml
@@ -110,6 +110,10 @@ steps:
         from_secret: postgresql_password
       POSTGRESQL_PGADMIN_PASSWORD:
         from_secret: postgresql_pgadmin_password
+      POSTGRESQL_REPLICATION_PASSWORD:
+        from_secret: postgresql_replication_password
+      POSTGRESQL_PATRONI_PASSWORD:
+        from_secret: postgresql_patroni_password
       PRODUCTIVITY_PAPERLESS_SECRET_KEY:
         from_secret: productivity_paperless_secret_key
       PRODUCTIVITY_DB_PASSWORD:
@@ -195,9 +199,14 @@ steps:
                 create_or_update_secret 'n8n_db_password'     '$${N8N_DB_PASSWORD}'
                 create_or_update_secret 'n8n_encryption_key'  '$${N8N_ENCRYPTION_KEY}'";;
             postgresql)
+              # NOTE: bootstrap-tier stack (manual deploy only via stack-deploy.sh).
+              # Secrets are still auto-provisioned here so they exist on the host
+              # before the manual `stack-deploy.sh postgresql` run picks them up.
               ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'postgresql_password'         '$${POSTGRESQL_PASSWORD}'
-                create_or_update_secret 'postgresql_pgadmin_password' '$${POSTGRESQL_PGADMIN_PASSWORD}'";;
+                create_or_update_secret 'postgresql_password'             '$${POSTGRESQL_PASSWORD}'
+                create_or_update_secret 'postgresql_pgadmin_password'     '$${POSTGRESQL_PGADMIN_PASSWORD}'
+                create_or_update_secret 'postgresql_replication_password' '$${POSTGRESQL_REPLICATION_PASSWORD}'
+                create_or_update_secret 'postgresql_patroni_password'     '$${POSTGRESQL_PATRONI_PASSWORD}'";;
             productivity)
               ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'productivity_paperless_secret_key' '$${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'