From 6ff6260b2fd848a5dbba5368b36a7f7727635c02 Mon Sep 17 00:00:00 2001 From: admin Date: Mon, 27 Jul 2026 08:50:16 -0700 Subject: [PATCH] deploy.yml: fix vaultwarden secret provisioning (was bypassing shared helper, silently failing on rm-while-in-use). Provision under versioned name vaultwarden_database_url_v2; compose-side remap happens in a follow-up commit. --- .woodpecker/deploy.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.woodpecker/deploy.yml b/.woodpecker/deploy.yml index 93a2bdf..87d302f 100644 --- a/.woodpecker/deploy.yml +++ b/.woodpecker/deploy.yml @@ -170,8 +170,14 @@ steps: create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}' create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";; vaultwarden) - printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -" - printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";; + # NOTE: vaultwarden_database_url cannot be rotated in-place — Swarm refuses + # to `docker secret rm` a secret referenced by a running service's spec. + # We provision under a versioned name (_v2) instead; vaultwarden.yaml maps + # it back to the same in-container filename via `target:`. The old secret + # is removed manually once the compose file cutover is confirmed healthy. + ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh + create_or_update_secret 'vaultwarden_admin_token' '${VAULTWARDEN_ADMIN_TOKEN}' + create_or_update_secret 'vaultwarden_database_url_v2' '${VAULTWARDEN_DATABASE_URL}'";; ai) echo " No Docker secrets for ai -- secrets in host .env";; entertainment)