homelab/compose-files
0
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(.woodpecker.yml): use lowercase secret names matching Woodpecker injection convention
ci/woodpecker/push/woodpecker Pipeline failed
Details

Browse Source
This commit is contained in:
admin
2026-06-25 23:22:52 -07:00
parent dae8e25bda
commit 922dd06c9b
1 changed files with 28 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.woodpecker.yml
+28 -28
View File
@@ -23,11 +23,11 @@ steps:
- mkdir -p ~/.ssh - mkdir -p ~/.ssh
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
- chmod 600 ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa
- ssh-keyscan -H ${DOCKER_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null - ssh-keyscan -H ${docker_manager_ip} >> ~/.ssh/known_hosts 2>/dev/null
- | - |
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true) YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
[ -z "$YAML_FILES" ] && echo "No stack yaml files changed, skipping" && exit 0 [ -z "$YAML_FILES" ] && echo "No stack yaml files changed, skipping" && exit 0
- scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${DOCKER_MANAGER_IP}:/tmp/cs.sh - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${docker_manager_ip}:/tmp/cs.sh
- | - |
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true) YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
for f in $YAML_FILES; do for f in $YAML_FILES; do
@@ -39,58 +39,58 @@ steps:
woodpecker) woodpecker)
echo " Manual only - skipping";; echo " Manual only - skipping";;
3dprint) 3dprint)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";; create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
auth) auth)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'auth_pg_password' '${AUTH_PG_PASSWORD}' create_or_update_secret 'auth_pg_password' '${AUTH_PG_PASSWORD}'
create_or_update_secret 'auth_secret_key' '${AUTH_SECRET_KEY}' create_or_update_secret 'auth_secret_key' '${AUTH_SECRET_KEY}'
create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";; create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";;
gamma) gamma)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";; create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
git) git)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}' create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}'
create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}' create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}'
create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";; create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
homeassistant) homeassistant)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}' create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";; create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";;
guacamole) guacamole)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}' create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}' create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
create_or_update_secret 'guacamole_db_password' '${GUACAMOLE_DB_PASSWORD}'";; create_or_update_secret 'guacamole_db_password' '${GUACAMOLE_DB_PASSWORD}'";;
mealie) mealie)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}' create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}'
create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";; create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
meshcentral) meshcentral)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";; create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
n8n) n8n)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}' create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}'
create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";; create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
postgresql) postgresql)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}' create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}'
create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";; create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
traefik) traefik)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";; create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
productivity) productivity)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}' create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}' create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";; create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
vaultwarden) vaultwarden)
printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -" printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";; printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
security) security)
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} "source /tmp/cs.sh ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} "source /tmp/cs.sh
create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}' create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}'
create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}' create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}'
create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}' create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
@@ -104,7 +104,7 @@ steps:
done done
secrets: secrets:
- ssh_key - ssh_key
- DOCKER_MANAGER_IP - docker_manager_ip
- 3dprint_db_password - 3dprint_db_password
- ai_aws_access_key_id - ai_aws_access_key_id
- ai_aws_secret_access_key - ai_aws_secret_access_key
@@ -164,23 +164,23 @@ steps:
- mkdir -p ~/.ssh - mkdir -p ~/.ssh
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
- chmod 600 ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa
- ssh-keyscan -H ${DOCKER_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null - ssh-keyscan -H ${docker_manager_ip} >> ~/.ssh/known_hosts 2>/dev/null
- | - |
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true) YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
[ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0 [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" deploy/ root@${DOCKER_MANAGER_IP}:/volume1/docker/compose-files/deploy/ rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" deploy/ root@${docker_manager_ip}:/volume1/docker/compose-files/deploy/
for f in $YAML_FILES; do for f in $YAML_FILES; do
[ -f "$f" ] || continue [ -f "$f" ] || continue
STACK=$(basename "$f" .yaml) STACK=$(basename "$f" .yaml)
rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \ rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
"$f" root@${DOCKER_MANAGER_IP}:/volume1/docker/compose-files/ "$f" root@${docker_manager_ip}:/volume1/docker/compose-files/
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} \ ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} \
"bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \ "bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
&& echo " OK $STACK" || { echo " FAIL $STACK"; exit 1; } && echo " OK $STACK" || { echo " FAIL $STACK"; exit 1; }
done done
secrets: secrets:
- ssh_key - ssh_key
- DOCKER_MANAGER_IP - docker_manager_ip
verify: verify:
image: alpine:latest image: alpine:latest
@@ -189,7 +189,7 @@ steps:
- mkdir -p ~/.ssh - mkdir -p ~/.ssh
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
- chmod 600 ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa
- ssh-keyscan -H ${DOCKER_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null - ssh-keyscan -H ${docker_manager_ip} >> ~/.ssh/known_hosts 2>/dev/null
- | - |
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true) YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
[ -z "$YAML_FILES" ] && exit 0 [ -z "$YAML_FILES" ] && exit 0
@@ -197,13 +197,13 @@ steps:
for f in $YAML_FILES; do for f in $YAML_FILES; do
STACK=$(basename "$f" .yaml) STACK=$(basename "$f" .yaml)
echo "--- $STACK ---" echo "--- $STACK ---"
ssh -o StrictHostKeyChecking=no root@${DOCKER_MANAGER_IP} \ ssh -o StrictHostKeyChecking=no root@${docker_manager_ip} \
"docker stack ps $STACK --filter desired-state=running \ "docker stack ps $STACK --filter desired-state=running \
--format ' {{.Name}} {{.CurrentState}}'" --format ' {{.Name}} {{.CurrentState}}'"
done done
secrets: secrets:
- ssh_key - ssh_key
- DOCKER_MANAGER_IP - docker_manager_ip
notify-success: notify-success:
image: alpine:latest image: alpine:latest
@@ -222,10 +222,10 @@ steps:
commands: commands:
- apk add --no-cache curl - apk add --no-cache curl
- | - |
PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://${WOODPECKER_HOST}","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE") PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://${woodpecker_host}","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE")
curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
secrets: secrets:
- teams_webhook - teams_webhook
- WOODPECKER_HOST - woodpecker_host
when: when:
- status: failure - status: failure