From 85734f4601d8e8136e3543fb2c32141f9e0a48d3 Mon Sep 17 00:00:00 2001 From: Bot Date: Mon, 7 Sep 2026 21:43:04 -0700 Subject: [PATCH] =?UTF-8?q?Add=20secrets/secrets-map.yaml=20=E2=80=94=20da?= =?UTF-8?q?ta-only=20provisioning=20manifest=20(ai=20stack=20first)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Carried over from secrets-provisioning-v2 (PR #15), which became unmergeable after heavy parallel hand-edits to main moved the merge base too far. Content identical to v2. --- secrets/secrets-map.yaml | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 secrets/secrets-map.yaml diff --git a/secrets/secrets-map.yaml b/secrets/secrets-map.yaml new file mode 100644 index 0000000..3307c74 --- /dev/null +++ b/secrets/secrets-map.yaml @@ -0,0 +1,38 @@ +# ───────────────────────────────────────────────────────────────────────────── +# secrets-map.yaml — DATA-ONLY manifest for deploy/provision-stack.py +# +# RULES: +# - This file contains NO code, NO shell, NO secret values — only names. +# - Each stack entry declares: +# env_template: repo path of the FULL env-file template (tracked). +# The template is authoritative: the COMPLETE env file is +# rendered from it on every provisioning run. Nothing is +# line-edited in place, so keys can never silently go +# missing. +# env_dest: host path (relative to /volume1/docker/compose-files/) +# the rendered env file is shipped to. Rendered file +# exists ONLY on the host — never committed to git. +# docker_secrets: map of docker-swarm-secret-name -> CI ENV VAR NAME +# (Pattern C). The env var must be declared via +# from_secret: in .woodpecker/deploy.yml's +# provision-secrets step (Woodpecker v3 requires explicit +# per-secret declaration; there is no expose-all). +# +# ADDING A NEW SECRET (3 small steps, no shell edits): +# 1. Add the secret value in Woodpecker UI (repo Settings -> Secrets). +# 2. Declare it in .woodpecker/deploy.yml provision-secrets environment: +# block (from_secret) — mechanical two-line addition. +# 3. Reference it here (docker_secrets:) and/or in the stack's +# .env.template as a dollar-brace placeholder. +# +# Stacks not listed here fall through to deploy.yml's legacy case-entries +# untouched. Migration is deliberately one stack per PR. +# ───────────────────────────────────────────────────────────────────────────── +stacks: + ai: + env_template: ai/ai.env.template + env_dest: ai/ai.env + docker_secrets: + flowagent_azure_client_id: FLOWAGENT_AZURE_CLIENT_ID + flowagent_azure_tenant_id: FLOWAGENT_AZURE_TENANT_ID + flowagent_azure_client_secret: FLOWAGENT_AZURE_CLIENT_SECRET