From 1a9684067a7c3f7ae285408d5c082b49076a028c Mon Sep 17 00:00:00 2001 From: admin Date: Fri, 26 Jun 2026 06:54:41 -0700 Subject: [PATCH] fix(.woodpecker.yml): migrate from deprecated secrets: list to from_secret syntax (Woodpecker v3 requires environment: VAR: from_secret: name) --- .woodpecker.yml | 245 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 186 insertions(+), 59 deletions(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index 9356c40..59916ec 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -16,26 +16,121 @@ steps: && echo " OK $f" || { echo " FAIL $f"; exit 1; } done - debug-secrets: - image: alpine:latest - commands: - - echo "SSH_KEY length=$(echo -n $SSH_KEY | wc -c)" - - echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] length=$(echo -n $SWARM_MANAGER_IP | wc -c)" - - echo "All env vars matching known secret names (masked):" - - env | grep -Ei "^(SSH_KEY|SWARM|WOODPECKER|MEALIE|VAULTW)=" | sed 's/=.*/=***/' - secrets: - - ssh_key - - swarm_manager_ip - - mealie_db_password - - woodpecker_host - provision-secrets: image: alpine:latest + environment: + SSH_KEY: + from_secret: ssh_key + SWARM_MANAGER_IP: + from_secret: swarm_manager_ip + 3DPRINT_DB_PASSWORD: + from_secret: 3dprint_db_password + AUTH_PG_PASSWORD: + from_secret: auth_pg_password + AUTH_SECRET_KEY: + from_secret: auth_secret_key + AUTH_PG_PASSWORD2: + from_secret: auth_pg_password2 + GAMMA_AUTH_TOKEN: + from_secret: gamma_auth_token + GIT_DB_PASSWORD: + from_secret: git_db_password + GIT_RUNNER_TOKEN: + from_secret: git_runner_token + GIT_MCP_ACCESS_TOKEN: + from_secret: git_mcp_access_token + GUACAMOLE_LDAP_BIND_PASSWORD: + from_secret: guacamole_ldap_bind_password + GUACAMOLE_OIDC_CLIENT_SECRET: + from_secret: guacamole_oidc_client_secret + GUACAMOLE_DB_PASSWORD: + from_secret: guacamole_db_password + HOMEASSISTANT_FRIGATE_RTSP_PASSWORD: + from_secret: homeassistant_frigate_rtsp_password + HOMEASSISTANT_IMMICH_API_KEY: + from_secret: homeassistant_immich_api_key + MEALIE_DB_PASSWORD: + from_secret: mealie_db_password + MEALIE_LDAP_QUERY_PASSWORD: + from_secret: mealie_ldap_query_password + MESHCENTRAL_BACKUP_PASSWORD: + from_secret: meshcentral_backup_password + N8N_DB_PASSWORD: + from_secret: n8n_db_password + N8N_ENCRYPTION_KEY: + from_secret: n8n_encryption_key + POSTGRESQL_PASSWORD: + from_secret: postgresql_password + POSTGRESQL_PGADMIN_PASSWORD: + from_secret: postgresql_pgadmin_password + PRODUCTIVITY_PAPERLESS_SECRET_KEY: + from_secret: productivity_paperless_secret_key + PRODUCTIVITY_DB_PASSWORD: + from_secret: productivity_db_password + PRODUCTIVITY_OIDC_PROVIDERS: + from_secret: productivity_oidc_providers + SECURITY_PG_PASS: + from_secret: security_pg_pass + SECURITY_AUTHENTIK_SECRET_KEY: + from_secret: security_authentik_secret_key + SECURITY_AUTHENTIK_PG_PASSWORD: + from_secret: security_authentik_pg_password + SECURITY_CROWDSEC_PGDSN: + from_secret: security_crowdsec_pgdsn + SECURITY_BOUNCER_KEY_TRAEFIK: + from_secret: security_bouncer_key_traefik + SECURITY_CROWDSEC_API_KEY: + from_secret: security_crowdsec_api_key + SECURITY_CROWDSEC_PASSWORD: + from_secret: security_crowdsec_password + TRAEFIK_KEEPALIVED_PASSWORD: + from_secret: traefik_keepalived_password + VAULTWARDEN_ADMIN_TOKEN: + from_secret: vaultwarden_admin_token + VAULTWARDEN_DATABASE_URL: + from_secret: vaultwarden_database_url + AI_AWS_ACCESS_KEY_ID: + from_secret: ai_aws_access_key_id + AI_AWS_SECRET_ACCESS_KEY: + from_secret: ai_aws_secret_access_key + AI_LITELLM_MASTER_KEY: + from_secret: ai_litellm_master_key + AI_LITELLM_SALT_KEY: + from_secret: ai_litellm_salt_key + AI_LITELLM_DB_PASSWORD: + from_secret: ai_litellm_db_password + AI_OAUTH_CLIENT_ID: + from_secret: ai_oauth_client_id + AI_OAUTH_CLIENT_SECRET: + from_secret: ai_oauth_client_secret + AI_WEBUI_SECRET_KEY: + from_secret: ai_webui_secret_key + AI_OPEN_WEBUI_DB_URL: + from_secret: ai_open_webui_db_url + AI_MCPO_API_KEY: + from_secret: ai_mcpo_api_key + ENTERTAINMENT_DISCORD_TOKEN: + from_secret: entertainment_discord_token + ENTERTAINMENT_DISCORD_CLIENT_SECRET: + from_secret: entertainment_discord_client_secret + ENTERTAINMENT_SECRET_KEY_BASE: + from_secret: entertainment_secret_key_base + ENTERTAINMENT_BASIC_AUTH_PASSWORD: + from_secret: entertainment_basic_auth_password + ENTERTAINMENT_SPARKY_DB_PASSWORD: + from_secret: entertainment_sparky_db_password + ENTERTAINMENT_SPARKY_APP_DB_PASSWORD: + from_secret: entertainment_sparky_app_db_password + ENTERTAINMENT_SPARKY_ENCRYPTION_KEY: + from_secret: entertainment_sparky_encryption_key + ENTERTAINMENT_BETTER_AUTH_SECRET: + from_secret: entertainment_better_auth_secret commands: - apk add --no-cache openssh-client - mkdir -p ~/.ssh - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa + - echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] len=$(echo -n $SWARM_MANAGER_IP | wc -c)" - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null - | YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true) @@ -51,49 +146,78 @@ steps: echo " No secrets for $STACK";; woodpecker) echo " Manual only - skipping";; + 3dprint) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";; + auth) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'auth_pg_password' '${AUTH_PG_PASSWORD}' + create_or_update_secret 'auth_secret_key' '${AUTH_SECRET_KEY}' + create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";; + gamma) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";; + git) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}' + create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}' + create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";; + homeassistant) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}' + create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";; + guacamole) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}' + create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}' + create_or_update_secret 'guacamole_db_password' '${GUACAMOLE_DB_PASSWORD}'";; + mealie) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}' + create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";; + meshcentral) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";; + n8n) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}' + create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";; + postgresql) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}' + create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";; + traefik) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";; + productivity) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}' + create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}' + create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";; + vaultwarden) + printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -" + printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";; + security) + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}' + create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}' + create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}' + create_or_update_secret 'security_crowdsec_pgdsn' '${SECURITY_CROWDSEC_PGDSN}' + create_or_update_secret 'security_bouncer_key_traefik' '${SECURITY_BOUNCER_KEY_TRAEFIK}' + create_or_update_secret 'security_crowdsec_api_key' '${SECURITY_CROWDSEC_API_KEY}' + create_or_update_secret 'security_crowdsec_password' '${SECURITY_CROWDSEC_PASSWORD}'";; *) echo " No secrets case for $STACK";; esac done - secrets: - - ssh_key - - swarm_manager_ip - - 3dprint_db_password - - auth_pg_password - - auth_secret_key - - auth_pg_password2 - - gamma_auth_token - - git_db_password - - git_runner_token - - git_mcp_access_token - - guacamole_ldap_bind_password - - guacamole_oidc_client_secret - - guacamole_db_password - - homeassistant_frigate_rtsp_password - - homeassistant_immich_api_key - - mealie_db_password - - mealie_ldap_query_password - - meshcentral_backup_password - - n8n_db_password - - n8n_encryption_key - - postgresql_password - - postgresql_pgadmin_password - - productivity_paperless_secret_key - - productivity_db_password - - productivity_oidc_providers - - security_pg_pass - - security_authentik_secret_key - - security_authentik_pg_password - - security_crowdsec_pgdsn - - security_bouncer_key_traefik - - security_crowdsec_api_key - - security_crowdsec_password - - traefik_keepalived_password - - vaultwarden_admin_token - - vaultwarden_database_url deploy: image: alpine:latest + environment: + SSH_KEY: + from_secret: ssh_key + SWARM_MANAGER_IP: + from_secret: swarm_manager_ip commands: - apk add --no-cache openssh-client rsync - mkdir -p ~/.ssh @@ -113,12 +237,14 @@ steps: "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \ && echo " OK $STACK" || { echo " FAIL $STACK"; exit 1; } done - secrets: - - ssh_key - - swarm_manager_ip verify: image: alpine:latest + environment: + SSH_KEY: + from_secret: ssh_key + SWARM_MANAGER_IP: + from_secret: swarm_manager_ip commands: - apk add --no-cache openssh-client - mkdir -p ~/.ssh @@ -136,31 +262,32 @@ steps: "docker stack ps $STACK --filter desired-state=running \ --format ' {{.Name}} {{.CurrentState}}'" done - secrets: - - ssh_key - - swarm_manager_ip notify-success: image: alpine:latest + environment: + TEAMS_WEBHOOK: + from_secret: teams_webhook commands: - apk add --no-cache curl - | CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ') PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE") curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true - secrets: [ teams_webhook ] when: - status: success notify-failure: image: alpine:latest + environment: + TEAMS_WEBHOOK: + from_secret: teams_webhook + WOODPECKER_HOST: + from_secret: woodpecker_host commands: - apk add --no-cache curl - | PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://${WOODPECKER_HOST}","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE") curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true - secrets: - - teams_webhook - - woodpecker_host when: - status: failure