From 2a3f2bdd1eb538f8131d0d3731daef727514c141 Mon Sep 17 00:00:00 2001 From: Bot Date: Fri, 11 Sep 2026 22:42:04 -0700 Subject: [PATCH] docs(traefik): update secrets reference for manifest-driven Pattern C migration --- secrets/traefik.secrets.example | 46 +++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 13 deletions(-) diff --git a/secrets/traefik.secrets.example b/secrets/traefik.secrets.example index 37c2820..790f092 100644 --- a/secrets/traefik.secrets.example +++ b/secrets/traefik.secrets.example @@ -1,5 +1,8 @@ # traefik Stack — Secrets Reference -# Source: traefik.env +# Source: traefik.env.template (rendered by deploy/provision-stack.py per +# secrets/secrets-map.yaml — see secrets-map.yaml header for how +# this works). traefik/traefik.env is rendered fresh on every +# provisioning run and is NEVER committed to git. # # Add SECRET values to Woodpecker at: # https://woodpecker.bryanmail.net @@ -8,27 +11,44 @@ # ⚠️ HIGH RISK: Traefik is the entry point for all homelab services. # If this stack fails, nothing is reachable from outside. # Migrate carefully. The Keepalived VIP (192.168.4.30) depends on this stack. +# +# ⚠️ 2026-09-12 INCIDENT: traefik.env was previously committed to git with a +# literal "***REDACTED***" placeholder as KEEPALIVED_PASSWORD. Every +# git-guard resync/checkout restored that broken value onto disk, +# diverging from keepalived-backup's stale-but-correct in-memory value +# and causing continuous VRRP auth failures + VIP instability. This was +# the trigger for migrating this stack to Pattern C. If you ever see +# KEEPALIVED_PASSWORD as a literal placeholder-looking string on disk +# again, do NOT hand-edit it — check `git log traefik/` for a stray +# commit and fix the template in Gitea instead. -# ── SECRETS (add to Woodpecker) ─────────────────────────────────────────────── +# ── SECRETS (add to Woodpecker) ───────────────────────────────────────── # Woodpecker secret name: traefik_keepalived_password -# Used for: Keepalived VRRP authentication password -# Must match across all 3 nodes (docker-1, docker-2, docker-3) -# Env var in .env: KEEPALIVED_PASSWORD +# Used for: Keepalived VRRP authentication password +# Must match across all 3 nodes (docker-1, docker-2, docker-3) +# NOTE: classic VRRP simple-auth is silently +# truncated to 8 chars by keepalived itself — keep +# the value <= 8 characters, or be aware only the +# first 8 are actually significant on the wire. +# Env var in .env.template: KEEPALIVED_PASSWORD (via TRAEFIK_KEEPALIVED_PASSWORD) traefik_keepalived_password= -# ── NON-SECRETS (safe in compose file or .env) ──────────────────────────────── +# ── NON-SECRETS (safe in compose file or .env.template) ───────────────── -# KEEPALIVED_UNICAST_PEERS Python2BASH list of peer IPs -# KEEPALIVED_VIRTUAL_IPS Python2BASH list of VIP addresses (192.168.4.30) +# KEEPALIVED_VIRTUAL_IPS Python2BASH list of VIP addresses (192.168.4.30) — literal in template # ACME_EMAIL Let's Encrypt certificate email # TRUSTED_IPS Trusted proxy CIDR ranges # TRAEFIK_HOST Traefik dashboard hostname -# SPEEDTEST_HOST Speedtest Traefik hostname +# SPEEDTEST_HOST Speedtest Traefik hostname # WHOAMI_HOST Whoami Traefik hostname -# ── Woodpecker provision-secrets case entry ─────────────────────────────────── +# ── Provisioning (manifest-driven, deploy/provision-stack.py) ─────────── # -# traefik) -# create_or_update_secret "traefik_keepalived_password" "$TRAEFIK_KEEPALIVED_PASSWORD" -# ;; +# This stack is migrated — provisioning happens automatically via: +# secrets/secrets-map.yaml (traefik: entry) +# traefik/traefik.env.template (authoritative key list) +# deploy/provision-stack.py (renders + ships traefik/traefik.env) +# +# The .woodpecker/deploy.yml provision-secrets step calls this with a +# single line: `python3 deploy/provision-stack.py traefik`