debug: add secret env dump step + slim provision-secrets to diagnose SWARM_MANAGER_IP injection

2026-06-26 06:47:29 -07:00
parent 028bda5e8e
commit e48caa643c
1 changed files with 13 additions and 78 deletions
@@ -16,6 +16,19 @@ steps:
            && echo "  OK $f" || { echo "  FAIL $f"; exit 1; }
        done

+  debug-secrets:
+    image: alpine:latest
+    commands:
+      - echo "SSH_KEY length=$(echo -n $SSH_KEY | wc -c)"
+      - echo "SWARM_MANAGER_IP=[${SWARM_MANAGER_IP}] length=$(echo -n $SWARM_MANAGER_IP | wc -c)"
+      - echo "All env vars matching known secret names (masked):"
+      - env | grep -Ei "^(SSH_KEY|SWARM|WOODPECKER|MEALIE|VAULTW)=" | sed 's/=.*/=***/'
+    secrets:
+      - ssh_key
+      - swarm_manager_ip
+      - mealie_db_password
+      - woodpecker_host
+
  provision-secrets:
    image: alpine:latest
    commands:
@@ -38,66 +51,6 @@ steps:
              echo "  No secrets for $STACK";;
            woodpecker)
              echo "  Manual only - skipping";;
-            3dprint)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
-            auth)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'auth_pg_password'  '${AUTH_PG_PASSWORD}'
-                create_or_update_secret 'auth_secret_key'   '${AUTH_SECRET_KEY}'
-                create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";;
-            gamma)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
-            git)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'git_db_password'      '${GIT_DB_PASSWORD}'
-                create_or_update_secret 'git_runner_token'     '${GIT_RUNNER_TOKEN}'
-                create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
-            homeassistant)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
-                create_or_update_secret 'homeassistant_immich_api_key'        '${HOMEASSISTANT_IMMICH_API_KEY}'";;
-            guacamole)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
-                create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
-                create_or_update_secret 'guacamole_db_password'        '${GUACAMOLE_DB_PASSWORD}'";;
-            mealie)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'mealie_db_password'         '${MEALIE_DB_PASSWORD}'
-                create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
-            meshcentral)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
-            n8n)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'n8n_db_password'    '${N8N_DB_PASSWORD}'
-                create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
-            postgresql)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'postgresql_password'         '${POSTGRESQL_PASSWORD}'
-                create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
-            traefik)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
-            productivity)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
-                create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
-                create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
-            vaultwarden)
-              printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
-              printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
-            security)
-              ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'security_pg_pass'               '${SECURITY_PG_PASS}'
-                create_or_update_secret 'security_authentik_secret_key'  '${SECURITY_AUTHENTIK_SECRET_KEY}'
-                create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
-                create_or_update_secret 'security_crowdsec_pgdsn'        '${SECURITY_CROWDSEC_PGDSN}'
-                create_or_update_secret 'security_bouncer_key_traefik'   '${SECURITY_BOUNCER_KEY_TRAEFIK}'
-                create_or_update_secret 'security_crowdsec_api_key'      '${SECURITY_CROWDSEC_API_KEY}'
-                create_or_update_secret 'security_crowdsec_password'     '${SECURITY_CROWDSEC_PASSWORD}'";;
            *)
              echo "  No secrets case for $STACK";;
          esac
@@ -106,27 +59,9 @@ steps:
      - ssh_key
      - swarm_manager_ip
      - 3dprint_db_password
-      - ai_aws_access_key_id
-      - ai_aws_secret_access_key
-      - ai_litellm_master_key
-      - ai_litellm_salt_key
-      - ai_litellm_db_password
-      - ai_oauth_client_id
-      - ai_oauth_client_secret
-      - ai_webui_secret_key
-      - ai_open_webui_db_url
-      - ai_mcpo_api_key
      - auth_pg_password
      - auth_secret_key
      - auth_pg_password2
-      - entertainment_discord_token
-      - entertainment_discord_client_secret
-      - entertainment_secret_key_base
-      - entertainment_basic_auth_password
-      - entertainment_sparky_db_password
-      - entertainment_sparky_app_db_password
-      - entertainment_sparky_encryption_key
-      - entertainment_better_auth_secret
      - gamma_auth_token
      - git_db_password
      - git_runner_token