diff --git a/.woodpecker.yml b/.woodpecker.yml
index 3f61db3..20baf26 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -23,11 +23,11 @@ steps:
       - mkdir -p ~/.ssh
       - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
       - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
+      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null
       - |
         YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
         [ -z "$YAML_FILES" ] && echo "No stack yaml files changed, skipping" && exit 0
-      - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@192.168.4.32:/tmp/cs.sh
+      - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${SWARM_MANAGER_IP}:/tmp/cs.sh
       - |
         YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
         for f in $YAML_FILES; do
@@ -39,58 +39,58 @@ steps:
             woodpecker)
               echo "  Manual only - skipping";;
             3dprint)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
             auth)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'auth_pg_password'  '${AUTH_PG_PASSWORD}'
                 create_or_update_secret 'auth_secret_key'   '${AUTH_SECRET_KEY}'
                 create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";;
             gamma)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
             git)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'git_db_password'      '${GIT_DB_PASSWORD}'
                 create_or_update_secret 'git_runner_token'     '${GIT_RUNNER_TOKEN}'
                 create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
             homeassistant)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
                 create_or_update_secret 'homeassistant_immich_api_key'        '${HOMEASSISTANT_IMMICH_API_KEY}'";;
             guacamole)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
                 create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
                 create_or_update_secret 'guacamole_db_password'        '${GUACAMOLE_DB_PASSWORD}'";;
             mealie)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'mealie_db_password'         '${MEALIE_DB_PASSWORD}'
                 create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
             meshcentral)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
             n8n)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'n8n_db_password'    '${N8N_DB_PASSWORD}'
                 create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
             postgresql)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'postgresql_password'         '${POSTGRESQL_PASSWORD}'
                 create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
             traefik)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
             productivity)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
                 create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
                 create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
             vaultwarden)
-              printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@192.168.4.32 "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
-              printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@192.168.4.32 "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
+              printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
+              printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
             security)
-              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'security_pg_pass'               '${SECURITY_PG_PASS}'
                 create_or_update_secret 'security_authentik_secret_key'  '${SECURITY_AUTHENTIK_SECRET_KEY}'
                 create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
@@ -104,6 +104,7 @@ steps:
         done
     secrets:
       - ssh_key
+      - swarm_manager_ip
       - 3dprint_db_password
       - ai_aws_access_key_id
       - ai_aws_secret_access_key
@@ -163,21 +164,23 @@ steps:
       - mkdir -p ~/.ssh
       - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
       - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
+      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null
       - |
         YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
         [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
-        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" deploy/ root@192.168.4.32:/volume1/docker/compose-files/deploy/
+        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" deploy/ root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
         for f in $YAML_FILES; do
           [ -f "$f" ] || continue
           STACK=$(basename "$f" .yaml)
           rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
-            "$f" root@192.168.4.32:/volume1/docker/compose-files/
-          ssh -o StrictHostKeyChecking=no root@192.168.4.32 \
+            "$f" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/
+          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
             "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
             && echo "  OK $STACK" || { echo "  FAIL $STACK"; exit 1; }
         done
-    secrets: [ ssh_key ]
+    secrets:
+      - ssh_key
+      - swarm_manager_ip
 
   verify:
     image: alpine:latest
@@ -186,7 +189,7 @@ steps:
       - mkdir -p ~/.ssh
       - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
       - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
+      - ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null
       - |
         YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
         [ -z "$YAML_FILES" ] && exit 0
@@ -194,11 +197,13 @@ steps:
         for f in $YAML_FILES; do
           STACK=$(basename "$f" .yaml)
           echo "--- $STACK ---"
-          ssh -o StrictHostKeyChecking=no root@192.168.4.32 \
+          ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
             "docker stack ps $STACK --filter desired-state=running \
              --format '  {{.Name}} {{.CurrentState}}'"
         done
-    secrets: [ ssh_key ]
+    secrets:
+      - ssh_key
+      - swarm_manager_ip
 
   notify-success:
     image: alpine:latest
@@ -217,8 +222,10 @@ steps:
     commands:
       - apk add --no-cache curl
       - |
-        PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://woodpecker.bryanmail.net","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE")
+        PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://${WOODPECKER_HOST}","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE")
         curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
-    secrets: [ teams_webhook ]
+    secrets:
+      - teams_webhook
+      - woodpecker_host
     when:
       - status: failure