debug: add secret env dump step + slim provision-secrets to diagnose SWARM_MANAGER_IP injection
ci/woodpecker/push/woodpecker Pipeline failed
ci/woodpecker/push/woodpecker Pipeline failed
This commit is contained in:
+13
-78
@@ -16,6 +16,19 @@ steps:
|
|||||||
&& echo " OK $f" || { echo " FAIL $f"; exit 1; }
|
&& echo " OK $f" || { echo " FAIL $f"; exit 1; }
|
||||||
done
|
done
|
||||||
|
|
||||||
|
debug-secrets:
|
||||||
|
image: alpine:latest
|
||||||
|
commands:
|
||||||
|
- echo "SSH_KEY length=$(echo -n $SSH_KEY | wc -c)"
|
||||||
|
- echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] length=$(echo -n $SWARM_MANAGER_IP | wc -c)"
|
||||||
|
- echo "All env vars matching known secret names (masked):"
|
||||||
|
- env | grep -Ei "^(SSH_KEY|SWARM|WOODPECKER|MEALIE|VAULTW)=" | sed 's/=.*/=***/'
|
||||||
|
secrets:
|
||||||
|
- ssh_key
|
||||||
|
- swarm_manager_ip
|
||||||
|
- mealie_db_password
|
||||||
|
- woodpecker_host
|
||||||
|
|
||||||
provision-secrets:
|
provision-secrets:
|
||||||
image: alpine:latest
|
image: alpine:latest
|
||||||
commands:
|
commands:
|
||||||
@@ -38,66 +51,6 @@ steps:
|
|||||||
echo " No secrets for $STACK";;
|
echo " No secrets for $STACK";;
|
||||||
woodpecker)
|
woodpecker)
|
||||||
echo " Manual only - skipping";;
|
echo " Manual only - skipping";;
|
||||||
3dprint)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
|
|
||||||
auth)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'auth_pg_password' '${AUTH_PG_PASSWORD}'
|
|
||||||
create_or_update_secret 'auth_secret_key' '${AUTH_SECRET_KEY}'
|
|
||||||
create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";;
|
|
||||||
gamma)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
|
|
||||||
git)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}'
|
|
||||||
create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
|
|
||||||
homeassistant)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
|
|
||||||
create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";;
|
|
||||||
guacamole)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
|
|
||||||
create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
|
|
||||||
create_or_update_secret 'guacamole_db_password' '${GUACAMOLE_DB_PASSWORD}'";;
|
|
||||||
mealie)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
|
|
||||||
meshcentral)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
|
|
||||||
n8n)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
|
|
||||||
postgresql)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}'
|
|
||||||
create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
|
|
||||||
traefik)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
|
|
||||||
productivity)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
|
|
||||||
create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
|
|
||||||
vaultwarden)
|
|
||||||
printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
|
|
||||||
printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
|
|
||||||
security)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}'
|
|
||||||
create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}'
|
|
||||||
create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
|
|
||||||
create_or_update_secret 'security_crowdsec_pgdsn' '${SECURITY_CROWDSEC_PGDSN}'
|
|
||||||
create_or_update_secret 'security_bouncer_key_traefik' '${SECURITY_BOUNCER_KEY_TRAEFIK}'
|
|
||||||
create_or_update_secret 'security_crowdsec_api_key' '${SECURITY_CROWDSEC_API_KEY}'
|
|
||||||
create_or_update_secret 'security_crowdsec_password' '${SECURITY_CROWDSEC_PASSWORD}'";;
|
|
||||||
*)
|
*)
|
||||||
echo " No secrets case for $STACK";;
|
echo " No secrets case for $STACK";;
|
||||||
esac
|
esac
|
||||||
@@ -106,27 +59,9 @@ steps:
|
|||||||
- ssh_key
|
- ssh_key
|
||||||
- swarm_manager_ip
|
- swarm_manager_ip
|
||||||
- 3dprint_db_password
|
- 3dprint_db_password
|
||||||
- ai_aws_access_key_id
|
|
||||||
- ai_aws_secret_access_key
|
|
||||||
- ai_litellm_master_key
|
|
||||||
- ai_litellm_salt_key
|
|
||||||
- ai_litellm_db_password
|
|
||||||
- ai_oauth_client_id
|
|
||||||
- ai_oauth_client_secret
|
|
||||||
- ai_webui_secret_key
|
|
||||||
- ai_open_webui_db_url
|
|
||||||
- ai_mcpo_api_key
|
|
||||||
- auth_pg_password
|
- auth_pg_password
|
||||||
- auth_secret_key
|
- auth_secret_key
|
||||||
- auth_pg_password2
|
- auth_pg_password2
|
||||||
- entertainment_discord_token
|
|
||||||
- entertainment_discord_client_secret
|
|
||||||
- entertainment_secret_key_base
|
|
||||||
- entertainment_basic_auth_password
|
|
||||||
- entertainment_sparky_db_password
|
|
||||||
- entertainment_sparky_app_db_password
|
|
||||||
- entertainment_sparky_encryption_key
|
|
||||||
- entertainment_better_auth_secret
|
|
||||||
- gamma_auth_token
|
- gamma_auth_token
|
||||||
- git_db_password
|
- git_db_password
|
||||||
- git_runner_token
|
- git_runner_token
|
||||||
|
|||||||
Reference in New Issue
Block a user