From e48caa643c6674584b09d63a1d39e16b9c196b99 Mon Sep 17 00:00:00 2001 From: admin Date: Fri, 26 Jun 2026 06:47:29 -0700 Subject: [PATCH] debug: add secret env dump step + slim provision-secrets to diagnose SWARM_MANAGER_IP injection --- .woodpecker.yml | 91 +++++++------------------------------------------ 1 file changed, 13 insertions(+), 78 deletions(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index 20baf26..9356c40 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -16,6 +16,19 @@ steps: && echo " OK $f" || { echo " FAIL $f"; exit 1; } done + debug-secrets: + image: alpine:latest + commands: + - echo "SSH_KEY length=$(echo -n $SSH_KEY | wc -c)" + - echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] length=$(echo -n $SWARM_MANAGER_IP | wc -c)" + - echo "All env vars matching known secret names (masked):" + - env | grep -Ei "^(SSH_KEY|SWARM|WOODPECKER|MEALIE|VAULTW)=" | sed 's/=.*/=***/' + secrets: + - ssh_key + - swarm_manager_ip + - mealie_db_password + - woodpecker_host + provision-secrets: image: alpine:latest commands: @@ -38,66 +51,6 @@ steps: echo " No secrets for $STACK";; woodpecker) echo " Manual only - skipping";; - 3dprint) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";; - auth) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'auth_pg_password' '${AUTH_PG_PASSWORD}' - create_or_update_secret 'auth_secret_key' '${AUTH_SECRET_KEY}' - create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";; - gamma) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";; - git) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}' - create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}' - create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";; - homeassistant) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}' - create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";; - guacamole) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}' - create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}' - create_or_update_secret 'guacamole_db_password' '${GUACAMOLE_DB_PASSWORD}'";; - mealie) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}' - create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";; - meshcentral) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";; - n8n) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}' - create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";; - postgresql) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}' - create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";; - traefik) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";; - productivity) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}' - create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}' - create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";; - vaultwarden) - printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -" - printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";; - security) - ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh - create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}' - create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}' - create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}' - create_or_update_secret 'security_crowdsec_pgdsn' '${SECURITY_CROWDSEC_PGDSN}' - create_or_update_secret 'security_bouncer_key_traefik' '${SECURITY_BOUNCER_KEY_TRAEFIK}' - create_or_update_secret 'security_crowdsec_api_key' '${SECURITY_CROWDSEC_API_KEY}' - create_or_update_secret 'security_crowdsec_password' '${SECURITY_CROWDSEC_PASSWORD}'";; *) echo " No secrets case for $STACK";; esac @@ -106,27 +59,9 @@ steps: - ssh_key - swarm_manager_ip - 3dprint_db_password - - ai_aws_access_key_id - - ai_aws_secret_access_key - - ai_litellm_master_key - - ai_litellm_salt_key - - ai_litellm_db_password - - ai_oauth_client_id - - ai_oauth_client_secret - - ai_webui_secret_key - - ai_open_webui_db_url - - ai_mcpo_api_key - auth_pg_password - auth_secret_key - auth_pg_password2 - - entertainment_discord_token - - entertainment_discord_client_secret - - entertainment_secret_key_base - - entertainment_basic_auth_password - - entertainment_sparky_db_password - - entertainment_sparky_app_db_password - - entertainment_sparky_encryption_key - - entertainment_better_auth_secret - gamma_auth_token - git_db_password - git_runner_token