fix(.woodpecker.yml): migrate from deprecated secrets: list to from_secret syntax (Woodpecker v3 requires environment: VAR: from_secret: name)
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
This commit is contained in:
+186
-59
@@ -16,26 +16,121 @@ steps:
|
||||
&& echo " OK $f" || { echo " FAIL $f"; exit 1; }
|
||||
done
|
||||
|
||||
debug-secrets:
|
||||
image: alpine:latest
|
||||
commands:
|
||||
- echo "SSH_KEY length=$(echo -n $SSH_KEY | wc -c)"
|
||||
- echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] length=$(echo -n $SWARM_MANAGER_IP | wc -c)"
|
||||
- echo "All env vars matching known secret names (masked):"
|
||||
- env | grep -Ei "^(SSH_KEY|SWARM|WOODPECKER|MEALIE|VAULTW)=" | sed 's/=.*/=***/'
|
||||
secrets:
|
||||
- ssh_key
|
||||
- swarm_manager_ip
|
||||
- mealie_db_password
|
||||
- woodpecker_host
|
||||
|
||||
provision-secrets:
|
||||
image: alpine:latest
|
||||
environment:
|
||||
SSH_KEY:
|
||||
from_secret: ssh_key
|
||||
SWARM_MANAGER_IP:
|
||||
from_secret: swarm_manager_ip
|
||||
3DPRINT_DB_PASSWORD:
|
||||
from_secret: 3dprint_db_password
|
||||
AUTH_PG_PASSWORD:
|
||||
from_secret: auth_pg_password
|
||||
AUTH_SECRET_KEY:
|
||||
from_secret: auth_secret_key
|
||||
AUTH_PG_PASSWORD2:
|
||||
from_secret: auth_pg_password2
|
||||
GAMMA_AUTH_TOKEN:
|
||||
from_secret: gamma_auth_token
|
||||
GIT_DB_PASSWORD:
|
||||
from_secret: git_db_password
|
||||
GIT_RUNNER_TOKEN:
|
||||
from_secret: git_runner_token
|
||||
GIT_MCP_ACCESS_TOKEN:
|
||||
from_secret: git_mcp_access_token
|
||||
GUACAMOLE_LDAP_BIND_PASSWORD:
|
||||
from_secret: guacamole_ldap_bind_password
|
||||
GUACAMOLE_OIDC_CLIENT_SECRET:
|
||||
from_secret: guacamole_oidc_client_secret
|
||||
GUACAMOLE_DB_PASSWORD:
|
||||
from_secret: guacamole_db_password
|
||||
HOMEASSISTANT_FRIGATE_RTSP_PASSWORD:
|
||||
from_secret: homeassistant_frigate_rtsp_password
|
||||
HOMEASSISTANT_IMMICH_API_KEY:
|
||||
from_secret: homeassistant_immich_api_key
|
||||
MEALIE_DB_PASSWORD:
|
||||
from_secret: mealie_db_password
|
||||
MEALIE_LDAP_QUERY_PASSWORD:
|
||||
from_secret: mealie_ldap_query_password
|
||||
MESHCENTRAL_BACKUP_PASSWORD:
|
||||
from_secret: meshcentral_backup_password
|
||||
N8N_DB_PASSWORD:
|
||||
from_secret: n8n_db_password
|
||||
N8N_ENCRYPTION_KEY:
|
||||
from_secret: n8n_encryption_key
|
||||
POSTGRESQL_PASSWORD:
|
||||
from_secret: postgresql_password
|
||||
POSTGRESQL_PGADMIN_PASSWORD:
|
||||
from_secret: postgresql_pgadmin_password
|
||||
PRODUCTIVITY_PAPERLESS_SECRET_KEY:
|
||||
from_secret: productivity_paperless_secret_key
|
||||
PRODUCTIVITY_DB_PASSWORD:
|
||||
from_secret: productivity_db_password
|
||||
PRODUCTIVITY_OIDC_PROVIDERS:
|
||||
from_secret: productivity_oidc_providers
|
||||
SECURITY_PG_PASS:
|
||||
from_secret: security_pg_pass
|
||||
SECURITY_AUTHENTIK_SECRET_KEY:
|
||||
from_secret: security_authentik_secret_key
|
||||
SECURITY_AUTHENTIK_PG_PASSWORD:
|
||||
from_secret: security_authentik_pg_password
|
||||
SECURITY_CROWDSEC_PGDSN:
|
||||
from_secret: security_crowdsec_pgdsn
|
||||
SECURITY_BOUNCER_KEY_TRAEFIK:
|
||||
from_secret: security_bouncer_key_traefik
|
||||
SECURITY_CROWDSEC_API_KEY:
|
||||
from_secret: security_crowdsec_api_key
|
||||
SECURITY_CROWDSEC_PASSWORD:
|
||||
from_secret: security_crowdsec_password
|
||||
TRAEFIK_KEEPALIVED_PASSWORD:
|
||||
from_secret: traefik_keepalived_password
|
||||
VAULTWARDEN_ADMIN_TOKEN:
|
||||
from_secret: vaultwarden_admin_token
|
||||
VAULTWARDEN_DATABASE_URL:
|
||||
from_secret: vaultwarden_database_url
|
||||
AI_AWS_ACCESS_KEY_ID:
|
||||
from_secret: ai_aws_access_key_id
|
||||
AI_AWS_SECRET_ACCESS_KEY:
|
||||
from_secret: ai_aws_secret_access_key
|
||||
AI_LITELLM_MASTER_KEY:
|
||||
from_secret: ai_litellm_master_key
|
||||
AI_LITELLM_SALT_KEY:
|
||||
from_secret: ai_litellm_salt_key
|
||||
AI_LITELLM_DB_PASSWORD:
|
||||
from_secret: ai_litellm_db_password
|
||||
AI_OAUTH_CLIENT_ID:
|
||||
from_secret: ai_oauth_client_id
|
||||
AI_OAUTH_CLIENT_SECRET:
|
||||
from_secret: ai_oauth_client_secret
|
||||
AI_WEBUI_SECRET_KEY:
|
||||
from_secret: ai_webui_secret_key
|
||||
AI_OPEN_WEBUI_DB_URL:
|
||||
from_secret: ai_open_webui_db_url
|
||||
AI_MCPO_API_KEY:
|
||||
from_secret: ai_mcpo_api_key
|
||||
ENTERTAINMENT_DISCORD_TOKEN:
|
||||
from_secret: entertainment_discord_token
|
||||
ENTERTAINMENT_DISCORD_CLIENT_SECRET:
|
||||
from_secret: entertainment_discord_client_secret
|
||||
ENTERTAINMENT_SECRET_KEY_BASE:
|
||||
from_secret: entertainment_secret_key_base
|
||||
ENTERTAINMENT_BASIC_AUTH_PASSWORD:
|
||||
from_secret: entertainment_basic_auth_password
|
||||
ENTERTAINMENT_SPARKY_DB_PASSWORD:
|
||||
from_secret: entertainment_sparky_db_password
|
||||
ENTERTAINMENT_SPARKY_APP_DB_PASSWORD:
|
||||
from_secret: entertainment_sparky_app_db_password
|
||||
ENTERTAINMENT_SPARKY_ENCRYPTION_KEY:
|
||||
from_secret: entertainment_sparky_encryption_key
|
||||
ENTERTAINMENT_BETTER_AUTH_SECRET:
|
||||
from_secret: entertainment_better_auth_secret
|
||||
commands:
|
||||
- apk add --no-cache openssh-client
|
||||
- mkdir -p ~/.ssh
|
||||
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
|
||||
- chmod 600 ~/.ssh/id_rsa
|
||||
- echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] len=$(echo -n $SWARM_MANAGER_IP | wc -c)"
|
||||
- ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null
|
||||
- |
|
||||
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
|
||||
@@ -51,49 +146,78 @@ steps:
|
||||
echo " No secrets for $STACK";;
|
||||
woodpecker)
|
||||
echo " Manual only - skipping";;
|
||||
3dprint)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
|
||||
auth)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'auth_pg_password' '${AUTH_PG_PASSWORD}'
|
||||
create_or_update_secret 'auth_secret_key' '${AUTH_SECRET_KEY}'
|
||||
create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";;
|
||||
gamma)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
|
||||
git)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}'
|
||||
create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}'
|
||||
create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
|
||||
homeassistant)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
|
||||
create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";;
|
||||
guacamole)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
|
||||
create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
|
||||
create_or_update_secret 'guacamole_db_password' '${GUACAMOLE_DB_PASSWORD}'";;
|
||||
mealie)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}'
|
||||
create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
|
||||
meshcentral)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
|
||||
n8n)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}'
|
||||
create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
|
||||
postgresql)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}'
|
||||
create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
|
||||
traefik)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
|
||||
productivity)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
|
||||
create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
|
||||
create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
|
||||
vaultwarden)
|
||||
printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
|
||||
printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
|
||||
security)
|
||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}'
|
||||
create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}'
|
||||
create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
|
||||
create_or_update_secret 'security_crowdsec_pgdsn' '${SECURITY_CROWDSEC_PGDSN}'
|
||||
create_or_update_secret 'security_bouncer_key_traefik' '${SECURITY_BOUNCER_KEY_TRAEFIK}'
|
||||
create_or_update_secret 'security_crowdsec_api_key' '${SECURITY_CROWDSEC_API_KEY}'
|
||||
create_or_update_secret 'security_crowdsec_password' '${SECURITY_CROWDSEC_PASSWORD}'";;
|
||||
*)
|
||||
echo " No secrets case for $STACK";;
|
||||
esac
|
||||
done
|
||||
secrets:
|
||||
- ssh_key
|
||||
- swarm_manager_ip
|
||||
- 3dprint_db_password
|
||||
- auth_pg_password
|
||||
- auth_secret_key
|
||||
- auth_pg_password2
|
||||
- gamma_auth_token
|
||||
- git_db_password
|
||||
- git_runner_token
|
||||
- git_mcp_access_token
|
||||
- guacamole_ldap_bind_password
|
||||
- guacamole_oidc_client_secret
|
||||
- guacamole_db_password
|
||||
- homeassistant_frigate_rtsp_password
|
||||
- homeassistant_immich_api_key
|
||||
- mealie_db_password
|
||||
- mealie_ldap_query_password
|
||||
- meshcentral_backup_password
|
||||
- n8n_db_password
|
||||
- n8n_encryption_key
|
||||
- postgresql_password
|
||||
- postgresql_pgadmin_password
|
||||
- productivity_paperless_secret_key
|
||||
- productivity_db_password
|
||||
- productivity_oidc_providers
|
||||
- security_pg_pass
|
||||
- security_authentik_secret_key
|
||||
- security_authentik_pg_password
|
||||
- security_crowdsec_pgdsn
|
||||
- security_bouncer_key_traefik
|
||||
- security_crowdsec_api_key
|
||||
- security_crowdsec_password
|
||||
- traefik_keepalived_password
|
||||
- vaultwarden_admin_token
|
||||
- vaultwarden_database_url
|
||||
|
||||
deploy:
|
||||
image: alpine:latest
|
||||
environment:
|
||||
SSH_KEY:
|
||||
from_secret: ssh_key
|
||||
SWARM_MANAGER_IP:
|
||||
from_secret: swarm_manager_ip
|
||||
commands:
|
||||
- apk add --no-cache openssh-client rsync
|
||||
- mkdir -p ~/.ssh
|
||||
@@ -113,12 +237,14 @@ steps:
|
||||
"bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
|
||||
&& echo " OK $STACK" || { echo " FAIL $STACK"; exit 1; }
|
||||
done
|
||||
secrets:
|
||||
- ssh_key
|
||||
- swarm_manager_ip
|
||||
|
||||
verify:
|
||||
image: alpine:latest
|
||||
environment:
|
||||
SSH_KEY:
|
||||
from_secret: ssh_key
|
||||
SWARM_MANAGER_IP:
|
||||
from_secret: swarm_manager_ip
|
||||
commands:
|
||||
- apk add --no-cache openssh-client
|
||||
- mkdir -p ~/.ssh
|
||||
@@ -136,31 +262,32 @@ steps:
|
||||
"docker stack ps $STACK --filter desired-state=running \
|
||||
--format ' {{.Name}} {{.CurrentState}}'"
|
||||
done
|
||||
secrets:
|
||||
- ssh_key
|
||||
- swarm_manager_ip
|
||||
|
||||
notify-success:
|
||||
image: alpine:latest
|
||||
environment:
|
||||
TEAMS_WEBHOOK:
|
||||
from_secret: teams_webhook
|
||||
commands:
|
||||
- apk add --no-cache curl
|
||||
- |
|
||||
CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ')
|
||||
PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE")
|
||||
curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
|
||||
secrets: [ teams_webhook ]
|
||||
when:
|
||||
- status: success
|
||||
|
||||
notify-failure:
|
||||
image: alpine:latest
|
||||
environment:
|
||||
TEAMS_WEBHOOK:
|
||||
from_secret: teams_webhook
|
||||
WOODPECKER_HOST:
|
||||
from_secret: woodpecker_host
|
||||
commands:
|
||||
- apk add --no-cache curl
|
||||
- |
|
||||
PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://${WOODPECKER_HOST}","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE")
|
||||
curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
|
||||
secrets:
|
||||
- teams_webhook
|
||||
- woodpecker_host
|
||||
when:
|
||||
- status: failure
|
||||
|
||||
Reference in New Issue
Block a user