From c20fd7322bc665cb7f81b233a301cb08d514a21b Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 20 Jun 2026 23:20:24 -0700
Subject: [PATCH] Add ai secrets reference

---
 secrets/ai.secrets.example | 88 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)
 create mode 100644 secrets/ai.secrets.example

diff --git a/secrets/ai.secrets.example b/secrets/ai.secrets.example
new file mode 100644
index 0000000..22fd58d
--- /dev/null
+++ b/secrets/ai.secrets.example
@@ -0,0 +1,88 @@
+# ai Stack — Secrets Reference
+# Source: ai.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+#
+# NON-SECRET values can be hardcoded in ai.yaml or left in ai.env
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  ai_aws_access_key_id
+# Used for:               AWS credentials for Amazon Bedrock
+# Env var in .env:        AWS_ACCESS_KEY_ID
+ai_aws_access_key_id=
+
+# Woodpecker secret name:  ai_aws_secret_access_key
+# Used for:               AWS credentials for Amazon Bedrock
+# Env var in .env:        AWS_SECRET_ACCESS_KEY
+ai_aws_secret_access_key=
+
+# Woodpecker secret name:  ai_litellm_master_key
+# Used for:               LiteLLM proxy API key (must start with sk-)
+# Env var in .env:        LITELLM_MASTER_KEY
+ai_litellm_master_key=
+
+# Woodpecker secret name:  ai_litellm_salt_key
+# Used for:               LiteLLM DB encryption key — DO NOT change after first run
+# Env var in .env:        LITELLM_SALT_KEY
+ai_litellm_salt_key=
+
+# Woodpecker secret name:  ai_litellm_db_password
+# Used for:               LiteLLM PostgreSQL password (embedded in DATABASE_URL)
+# Env var in .env:        POSTGRES_PASSWORD / DATABASE_URL
+ai_litellm_db_password=
+
+# Woodpecker secret name:  ai_oauth_client_id
+# Used for:               Authentik OAuth2 client ID for Open-WebUI
+# Env var in .env:        OAUTH_CLIENT_ID
+ai_oauth_client_id=
+
+# Woodpecker secret name:  ai_oauth_client_secret
+# Used for:               Authentik OAuth2 client secret for Open-WebUI
+# Env var in .env:        OAUTH_CLIENT_SECRET
+ai_oauth_client_secret=
+
+# Woodpecker secret name:  ai_webui_secret_key
+# Used for:               Open-WebUI session signing key
+# Env var in .env:        WEBUI_SECRET_KEY
+ai_webui_secret_key=
+
+# Woodpecker secret name:  ai_open_webui_db_url
+# Used for:               Open-WebUI PostgreSQL connection string (contains password)
+# Env var in .env:        OPEN_WEBUI_DATABASE_URL
+ai_open_webui_db_url=
+
+# Woodpecker secret name:  ai_mcpo_api_key
+# Used for:               MCPO MCP proxy API key
+# Env var in .env:        MCPO_API_KEY
+ai_mcpo_api_key=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# AWS_REGION_NAME                    AWS region (us-east-2)
+# LITELLM_MODIFY_PARAMS              Boolean flag (True)
+# WEBUI_URL                          Open-WebUI public URL
+# ENABLE_OAUTH_SIGNUP                Boolean flag
+# OAUTH_MERGE_ACCOUNTS_BY_EMAIL      Boolean flag
+# OAUTH_PROVIDER_NAME                Display name (Authentik)
+# OPENID_PROVIDER_URL                Authentik OIDC discovery URL
+# OAUTH_SCOPES                       OIDC scopes
+# OPENID_REDIRECT_URI                OAuth callback URL
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+# Add this to the provision-secrets step in .woodpecker.yml:
+#
+#   ai)
+#     create_or_update_secret "ai_aws_access_key_id"     "$AI_AWS_ACCESS_KEY_ID"
+#     create_or_update_secret "ai_aws_secret_access_key" "$AI_AWS_SECRET_ACCESS_KEY"
+#     create_or_update_secret "ai_litellm_master_key"    "$AI_LITELLM_MASTER_KEY"
+#     create_or_update_secret "ai_litellm_salt_key"      "$AI_LITELLM_SALT_KEY"
+#     create_or_update_secret "ai_litellm_db_password"   "$AI_LITELLM_DB_PASSWORD"
+#     create_or_update_secret "ai_oauth_client_id"       "$AI_OAUTH_CLIENT_ID"
+#     create_or_update_secret "ai_oauth_client_secret"   "$AI_OAUTH_CLIENT_SECRET"
+#     create_or_update_secret "ai_webui_secret_key"      "$AI_WEBUI_SECRET_KEY"
+#     create_or_update_secret "ai_open_webui_db_url"     "$AI_OPEN_WEBUI_DB_URL"
+#     create_or_update_secret "ai_mcpo_api_key"          "$AI_MCPO_API_KEY"
+#     ;;