diff --git a/.woodpecker.yml b/.woodpecker.yml
index 8bd84a1..519026d 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -8,17 +8,153 @@ steps:
     commands:
       - apk add --no-cache docker-cli docker-cli-compose
       - |
-        echo "Changed files: ${CI_COMMIT_CHANGED_FILES}"
         YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
-        [ -z "$YAML_FILES" ] && echo "No yaml files changed, skipping" && exit 0
+        [ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
         for f in $YAML_FILES; do
           [ -f "$f" ] || continue
-          echo "Validating $f..."
           docker compose -f "$f" --no-interpolate config -q \
-            && echo "  OK $f" \
-            || { echo "  FAIL $f"; exit 1; }
+            && echo "  OK $f" || { echo "  FAIL $f"; exit 1; }
         done
 
+  provision-secrets:
+    image: alpine:latest
+    commands:
+      - apk add --no-cache openssh-client
+      - mkdir -p ~/.ssh
+      - echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
+      - chmod 600 ~/.ssh/id_rsa
+      - ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
+      - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@192.168.4.32:/tmp/cs.sh
+      - |
+        YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
+        [ -z "$YAML_FILES" ] && echo "No stacks changed" && exit 0
+        for f in $YAML_FILES; do
+          STACK=$(basename "$f" .yaml)
+          echo "Provisioning: $STACK"
+          case "$STACK" in
+            maintenance|media|unifi)
+              echo "  No secrets for $STACK";;
+            woodpecker)
+              echo "  Manual only - skipping";;
+            3dprint)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
+            auth)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'auth_pg_password'  '${AUTH_PG_PASSWORD}'
+                create_or_update_secret 'auth_secret_key'   '${AUTH_SECRET_KEY}'
+                create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";;
+            gamma)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
+            git)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'git_db_password'      '${GIT_DB_PASSWORD}'
+                create_or_update_secret 'git_runner_token'     '${GIT_RUNNER_TOKEN}'
+                create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
+            homeassistant)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
+                create_or_update_secret 'homeassistant_immich_api_key'        '${HOMEASSISTANT_IMMICH_API_KEY}'";;
+            guacamole)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
+                create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
+                create_or_update_secret 'guacamole_db_password'        '${GUACAMOLE_DB_PASSWORD}'";;
+            mealie)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'mealie_db_password'         '${MEALIE_DB_PASSWORD}'
+                create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
+            meshcentral)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
+            n8n)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'n8n_db_password'    '${N8N_DB_PASSWORD}'
+                create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
+            postgresql)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'postgresql_password'         '${POSTGRESQL_PASSWORD}'
+                create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
+            traefik)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
+            productivity)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
+                create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
+                create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
+            vaultwarden)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'vaultwarden_admin_token'  '${VAULTWARDEN_ADMIN_TOKEN}'
+                create_or_update_secret 'vaultwarden_database_url' '${VAULTWARDEN_DATABASE_URL}'";;
+            security)
+              ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
+                create_or_update_secret 'security_pg_pass'               '${SECURITY_PG_PASS}'
+                create_or_update_secret 'security_authentik_secret_key'  '${SECURITY_AUTHENTIK_SECRET_KEY}'
+                create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
+                create_or_update_secret 'security_crowdsec_pgdsn'        '${SECURITY_CROWDSEC_PGDSN}'
+                create_or_update_secret 'security_bouncer_key_traefik'   '${SECURITY_BOUNCER_KEY_TRAEFIK}'
+                create_or_update_secret 'security_crowdsec_api_key'      '${SECURITY_CROWDSEC_API_KEY}'
+                create_or_update_secret 'security_crowdsec_password'     '${SECURITY_CROWDSEC_PASSWORD}'";;
+            *)
+              echo "  No secrets case for $STACK";;
+          esac
+        done
+    secrets:
+      - ssh_key
+      - 3dprint_db_password
+      - ai_aws_access_key_id
+      - ai_aws_secret_access_key
+      - ai_litellm_master_key
+      - ai_litellm_salt_key
+      - ai_litellm_db_password
+      - ai_oauth_client_id
+      - ai_oauth_client_secret
+      - ai_webui_secret_key
+      - ai_open_webui_db_url
+      - ai_mcpo_api_key
+      - auth_pg_password
+      - auth_secret_key
+      - auth_pg_password2
+      - entertainment_discord_token
+      - entertainment_discord_client_secret
+      - entertainment_secret_key_base
+      - entertainment_basic_auth_password
+      - entertainment_sparky_db_password
+      - entertainment_sparky_app_db_password
+      - entertainment_sparky_encryption_key
+      - entertainment_better_auth_secret
+      - gamma_auth_token
+      - git_db_password
+      - git_runner_token
+      - git_mcp_access_token
+      - guacamole_ldap_bind_password
+      - guacamole_oidc_client_secret
+      - guacamole_db_password
+      - homeassistant_frigate_rtsp_password
+      - homeassistant_immich_api_key
+      - mealie_db_password
+      - mealie_ldap_query_password
+      - meshcentral_backup_password
+      - n8n_db_password
+      - n8n_encryption_key
+      - postgresql_password
+      - postgresql_pgadmin_password
+      - productivity_paperless_secret_key
+      - productivity_db_password
+      - productivity_oidc_providers
+      - security_pg_pass
+      - security_authentik_secret_key
+      - security_authentik_pg_password
+      - security_crowdsec_pgdsn
+      - security_bouncer_key_traefik
+      - security_crowdsec_api_key
+      - security_crowdsec_password
+      - traefik_keepalived_password
+      - vaultwarden_admin_token
+      - vaultwarden_database_url
+
   deploy:
     image: alpine:latest
     commands: