deploy.yml: add temporary debug-secrets-all step declaring the identical 31-secret environment block as provision-secrets, printing byte length of every var (never values). Runs as its own step so it completes even when provision-secrets fails, telling us in one run whether all secrets are empty, only some, or only swarm_manager_ip.

.woodpecker/deploy.yml

@@ -3,6 +3,92 @@ when:
     branch: main
 
 steps:
+  debug-secrets-all:
+    image: alpine:latest
+    environment:
+      SSH_KEY:
+        from_secret: ssh_key
+      SWARM_MANAGER_IP:
+        from_secret: swarm_manager_ip
+      PRINT3D_DB_PASSWORD:
+        from_secret: 3dprint_db_password
+      GAMMA_AUTH_TOKEN:
+        from_secret: gamma_auth_token
+      GIT_DB_PASSWORD:
+        from_secret: git_db_password
+      GIT_RUNNER_TOKEN:
+        from_secret: git_runner_token
+      GIT_MCP_ACCESS_TOKEN:
+        from_secret: git_mcp_access_token
+      HOMEASSISTANT_FRIGATE_RTSP_PASSWORD:
+        from_secret: homeassistant_frigate_rtsp_password
+      HOMEASSISTANT_IMMICH_API_KEY:
+        from_secret: homeassistant_immich_api_key
+      IMMICH_DB_PASSWORD:
+        from_secret: immich_db_password
+      IMMICH_KIOSK_BASICAUTH:
+        from_secret: immich_kiosk_basicauth
+      MEALIE_DB_PASSWORD:
+        from_secret: mealie_db_password
+      MEALIE_LDAP_QUERY_PASSWORD:
+        from_secret: mealie_ldap_query_password
+      MESHCENTRAL_BACKUP_PASSWORD:
+        from_secret: meshcentral_backup_password
+      N8N_DB_PASSWORD:
+        from_secret: n8n_db_password
+      N8N_ENCRYPTION_KEY:
+        from_secret: n8n_encryption_key
+      POSTGRESQL_PASSWORD:
+        from_secret: postgresql_password
+      POSTGRESQL_PGADMIN_PASSWORD:
+        from_secret: postgresql_pgadmin_password
+      PRODUCTIVITY_PAPERLESS_SECRET_KEY:
+        from_secret: productivity_paperless_secret_key
+      PRODUCTIVITY_DB_PASSWORD:
+        from_secret: productivity_db_password
+      PRODUCTIVITY_OIDC_PROVIDERS:
+        from_secret: productivity_oidc_providers
+      VAULTWARDEN_ADMIN_TOKEN:
+        from_secret: vaultwarden_admin_token
+      VAULTWARDEN_DATABASE_URL:
+        from_secret: vaultwarden_database_url
+      ENTERTAINMENT_DISCORD_TOKEN:
+        from_secret: entertainment_discord_token
+      ENTERTAINMENT_DISCORD_CLIENT_SECRET:
+        from_secret: entertainment_discord_client_secret
+      ENTERTAINMENT_SECRET_KEY_BASE:
+        from_secret: entertainment_secret_key_base
+      ENTERTAINMENT_BASIC_AUTH_PASSWORD:
+        from_secret: entertainment_basic_auth_password
+      ENTERTAINMENT_SPARKY_DB_PASSWORD:
+        from_secret: entertainment_sparky_db_password
+      ENTERTAINMENT_SPARKY_APP_DB_PASSWORD:
+        from_secret: entertainment_sparky_app_db_password
+      ENTERTAINMENT_SPARKY_ENCRYPTION_KEY:
+        from_secret: entertainment_sparky_encryption_key
+      ENTERTAINMENT_BETTER_AUTH_SECRET:
+        from_secret: entertainment_better_auth_secret
+    commands:
+      - |
+        echo "=== DIAGNOSTIC: byte lengths of ALL provision-secrets vars (temporary, never prints values) ==="
+        for v in SSH_KEY SWARM_MANAGER_IP PRINT3D_DB_PASSWORD GAMMA_AUTH_TOKEN \
+                 GIT_DB_PASSWORD GIT_RUNNER_TOKEN GIT_MCP_ACCESS_TOKEN \
+                 HOMEASSISTANT_FRIGATE_RTSP_PASSWORD HOMEASSISTANT_IMMICH_API_KEY \
+                 IMMICH_DB_PASSWORD IMMICH_KIOSK_BASICAUTH \
+                 MEALIE_DB_PASSWORD MEALIE_LDAP_QUERY_PASSWORD \
+                 MESHCENTRAL_BACKUP_PASSWORD N8N_DB_PASSWORD N8N_ENCRYPTION_KEY \
+                 POSTGRESQL_PASSWORD POSTGRESQL_PGADMIN_PASSWORD \
+                 PRODUCTIVITY_PAPERLESS_SECRET_KEY PRODUCTIVITY_DB_PASSWORD PRODUCTIVITY_OIDC_PROVIDERS \
+                 VAULTWARDEN_ADMIN_TOKEN VAULTWARDEN_DATABASE_URL \
+                 ENTERTAINMENT_DISCORD_TOKEN ENTERTAINMENT_DISCORD_CLIENT_SECRET \
+                 ENTERTAINMENT_SECRET_KEY_BASE ENTERTAINMENT_BASIC_AUTH_PASSWORD \
+                 ENTERTAINMENT_SPARKY_DB_PASSWORD ENTERTAINMENT_SPARKY_APP_DB_PASSWORD \
+                 ENTERTAINMENT_SPARKY_ENCRYPTION_KEY ENTERTAINMENT_BETTER_AUTH_SECRET; do
+          eval "val=\$$v"
+          echo "$v length: $(echo -n "$val" | wc -c)"
+        done
+        echo "=== END DIAGNOSTIC ==="
+
   validate:
     image: alpine:latest
     commands: