From 5ab1ae1e8ba90639b5f797b4cad629e62385814a Mon Sep 17 00:00:00 2001 From: Bot Date: Fri, 11 Sep 2026 23:17:13 -0700 Subject: [PATCH] =?UTF-8?q?chore(traefik):=20re-trigger=20provision-secret?= =?UTF-8?q?s=20=E2=80=94=20traefik.env=20was=20found=20missing=20on=20disk?= =?UTF-8?q?=20post-migration?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit traefik/traefik.env did not exist on the host after PR #21 merged. Root cause: provisioning only renders on a push touching traefik/, and traefik is bootstrap-tier (stack-deploy.sh runs manually, never via the pipeline). A manual stack-deploy.sh traefik run apparently happened while the env file was absent, causing Swarm's own interpolation to render KEEPALIVED_PASSWORD/KEEPALIVED_VIRTUAL_IPS as empty strings on keepalived-master. This comment-only change re-triggers provision-secrets; a manual stack-deploy.sh traefik run is still required afterward to apply the freshly-rendered env to the running services. --- traefik/traefik.env.template | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/traefik/traefik.env.template b/traefik/traefik.env.template index b95d019..d604d4a 100644 --- a/traefik/traefik.env.template +++ b/traefik/traefik.env.template @@ -30,6 +30,19 @@ # keepalived itself. Set TRAEFIK_KEEPALIVED_PASSWORD in Woodpecker to a # value 8 characters or fewer (or accept that only the first 8 chars are # actually significant) so the effective negotiated value is unambiguous. +# +# 2026-09-12 RE-TRIGGER: traefik.env was found MISSING on disk after the +# Pattern C migration merged — the manifest-driven provisioning render only +# happens on a push that changes traefik/, and traefik is bootstrap-tier +# (stack-deploy.sh must be run manually; the pipeline never auto-deploys +# this stack). A manual `stack-deploy.sh traefik` had apparently been run +# while traefik.env was absent, causing Swarm's own interpolation to +# silently render KEEPALIVED_PASSWORD/KEEPALIVED_VIRTUAL_IPS as EMPTY +# STRINGS on keepalived-master (not missing — empty, which is worse, +# since it's a valid-looking VRRP auth string that mismatches everything). +# This comment-only change re-triggers provision-secrets to re-render and +# re-ship traefik.env; a manual `stack-deploy.sh traefik` must still be run +# afterward to actually apply it to the running services. # ───────────────────────────────────────────────────────────────────────── # ── Keepalived (non-secret config) ────────────────────────────────────────