From a5d7e267276e21f6956c095de8a83e0f3b934a85 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 27 Jun 2026 06:26:35 -0700
Subject: [PATCH] refactor(.woodpecker.yml): move security to no-op provision
 case (Pattern B), remove unused SECURITY_* env vars from provision step

---
 .woodpecker.yml | 25 +------------------------
 1 file changed, 1 insertion(+), 24 deletions(-)

diff --git a/.woodpecker.yml b/.woodpecker.yml
index e59963c..2e586b3 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -63,20 +63,6 @@ steps:
         from_secret: productivity_db_password
       PRODUCTIVITY_OIDC_PROVIDERS:
         from_secret: productivity_oidc_providers
-      SECURITY_PG_PASS:
-        from_secret: security_pg_pass
-      SECURITY_AUTHENTIK_SECRET_KEY:
-        from_secret: security_authentik_secret_key
-      SECURITY_AUTHENTIK_PG_PASSWORD:
-        from_secret: security_authentik_pg_password
-      SECURITY_CROWDSEC_PGDSN:
-        from_secret: security_crowdsec_pgdsn
-      SECURITY_BOUNCER_KEY_TRAEFIK:
-        from_secret: security_bouncer_key_traefik
-      SECURITY_CROWDSEC_API_KEY:
-        from_secret: security_crowdsec_api_key
-      SECURITY_CROWDSEC_PASSWORD:
-        from_secret: security_crowdsec_password
       TRAEFIK_KEEPALIVED_PASSWORD:
         from_secret: traefik_keepalived_password
       VAULTWARDEN_ADMIN_TOKEN:
@@ -135,7 +121,7 @@ steps:
           STACK=$(basename "$f" .yaml)
           echo "Provisioning: $STACK"
           case "$STACK" in
-            maintenance|media|unifi|guacamole)
+            maintenance|media|unifi|guacamole|security)
               echo "  No Docker secrets for $STACK — secrets in host .env";;
             woodpecker)
               echo "  Manual only - skipping";;
@@ -185,15 +171,6 @@ steps:
             vaultwarden)
               printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
               printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
-            security)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'security_pg_pass'               '${SECURITY_PG_PASS}'
-                create_or_update_secret 'security_authentik_secret_key'  '${SECURITY_AUTHENTIK_SECRET_KEY}'
-                create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
-                create_or_update_secret 'security_crowdsec_pgdsn'        '${SECURITY_CROWDSEC_PGDSN}'
-                create_or_update_secret 'security_bouncer_key_traefik'   '${SECURITY_BOUNCER_KEY_TRAEFIK}'
-                create_or_update_secret 'security_crowdsec_api_key'      '${SECURITY_CROWDSEC_API_KEY}'
-                create_or_update_secret 'security_crowdsec_password'     '${SECURITY_CROWDSEC_PASSWORD}'";;
             *)
               echo "  No secrets case for $STACK";;
           esac