homelab/compose-files
0
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(.woodpecker.yml): move security to no-op provision case (Pattern B), remove unused SECURITY_* env vars from provision step
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
admin
2026-06-27 06:26:35 -07:00
parent 5c0f59f00c
commit a5d7e26727
1 changed files with 1 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.woodpecker.yml
+1 -24
View File
@@ -63,20 +63,6 @@ steps:
from_secret: productivity_db_password from_secret: productivity_db_password
PRODUCTIVITY_OIDC_PROVIDERS: PRODUCTIVITY_OIDC_PROVIDERS:
from_secret: productivity_oidc_providers from_secret: productivity_oidc_providers
SECURITY_PG_PASS:
from_secret: security_pg_pass
SECURITY_AUTHENTIK_SECRET_KEY:
from_secret: security_authentik_secret_key
SECURITY_AUTHENTIK_PG_PASSWORD:
from_secret: security_authentik_pg_password
SECURITY_CROWDSEC_PGDSN:
from_secret: security_crowdsec_pgdsn
SECURITY_BOUNCER_KEY_TRAEFIK:
from_secret: security_bouncer_key_traefik
SECURITY_CROWDSEC_API_KEY:
from_secret: security_crowdsec_api_key
SECURITY_CROWDSEC_PASSWORD:
from_secret: security_crowdsec_password
TRAEFIK_KEEPALIVED_PASSWORD: TRAEFIK_KEEPALIVED_PASSWORD:
from_secret: traefik_keepalived_password from_secret: traefik_keepalived_password
VAULTWARDEN_ADMIN_TOKEN: VAULTWARDEN_ADMIN_TOKEN:
@@ -135,7 +121,7 @@ steps:
STACK=$(basename "$f" .yaml) STACK=$(basename "$f" .yaml)
echo "Provisioning: $STACK" echo "Provisioning: $STACK"
case "$STACK" in case "$STACK" in
maintenance|media|unifi|guacamole) maintenance|media|unifi|guacamole|security)
echo " No Docker secrets for $STACK — secrets in host .env";; echo " No Docker secrets for $STACK — secrets in host .env";;
woodpecker) woodpecker)
echo " Manual only - skipping";; echo " Manual only - skipping";;
@@ -185,15 +171,6 @@ steps:
vaultwarden) vaultwarden)
printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -" printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";; printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
security)
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}'
create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}'
create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
create_or_update_secret 'security_crowdsec_pgdsn' '${SECURITY_CROWDSEC_PGDSN}'
create_or_update_secret 'security_bouncer_key_traefik' '${SECURITY_BOUNCER_KEY_TRAEFIK}'
create_or_update_secret 'security_crowdsec_api_key' '${SECURITY_CROWDSEC_API_KEY}'
create_or_update_secret 'security_crowdsec_password' '${SECURITY_CROWDSEC_PASSWORD}'";;
*) *)
echo " No secrets case for $STACK";; echo " No secrets case for $STACK";;
esac esac