From 201d8418ee5a01eb258be12acecfe1445b12f573 Mon Sep 17 00:00:00 2001 From: Bot Date: Fri, 11 Sep 2026 22:38:39 -0700 Subject: [PATCH] feat(traefik): register traefik in manifest-driven secrets provisioning --- secrets/secrets-map.yaml | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/secrets/secrets-map.yaml b/secrets/secrets-map.yaml index 3307c74..7b2232c 100644 --- a/secrets/secrets-map.yaml +++ b/secrets/secrets-map.yaml @@ -1,22 +1,22 @@ -# ───────────────────────────────────────────────────────────────────────────── +# ───────────────────────────────────────────────────────────────────────── # secrets-map.yaml — DATA-ONLY manifest for deploy/provision-stack.py # # RULES: # - This file contains NO code, NO shell, NO secret values — only names. # - Each stack entry declares: # env_template: repo path of the FULL env-file template (tracked). -# The template is authoritative: the COMPLETE env file is -# rendered from it on every provisioning run. Nothing is -# line-edited in place, so keys can never silently go -# missing. +# The template is authoritative: the COMPLETE env file is +# rendered from it on every provisioning run. Nothing is +# line-edited in place, so keys can never silently go +# missing. # env_dest: host path (relative to /volume1/docker/compose-files/) -# the rendered env file is shipped to. Rendered file -# exists ONLY on the host — never committed to git. +# the rendered env file is shipped to. Rendered file +# exists ONLY on the host — never committed to git. # docker_secrets: map of docker-swarm-secret-name -> CI ENV VAR NAME -# (Pattern C). The env var must be declared via -# from_secret: in .woodpecker/deploy.yml's -# provision-secrets step (Woodpecker v3 requires explicit -# per-secret declaration; there is no expose-all). +# (Pattern C). The env var must be declared via +# from_secret: in .woodpecker/deploy.yml's +# provision-secrets step (Woodpecker v3 requires explicit +# per-secret declaration; there is no expose-all). # # ADDING A NEW SECRET (3 small steps, no shell edits): # 1. Add the secret value in Woodpecker UI (repo Settings -> Secrets). @@ -27,7 +27,7 @@ # # Stacks not listed here fall through to deploy.yml's legacy case-entries # untouched. Migration is deliberately one stack per PR. -# ───────────────────────────────────────────────────────────────────────────── +# ───────────────────────────────────────────────────────────────────────── stacks: ai: env_template: ai/ai.env.template @@ -36,3 +36,6 @@ stacks: flowagent_azure_client_id: FLOWAGENT_AZURE_CLIENT_ID flowagent_azure_tenant_id: FLOWAGENT_AZURE_TENANT_ID flowagent_azure_client_secret: FLOWAGENT_AZURE_CLIENT_SECRET + traefik: + env_template: traefik/traefik.env.template + env_dest: traefik/traefik.env