From f7c8ebc05ef02093014a3c8d331f0e3235f2f9c8 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 29 Aug 2026 20:31:11 -0700
Subject: [PATCH] Add flowagent secrets reference doc (placeholders only, no
 real values)

Documents the Pattern C secrets needed once mcpo/config.json + ai.yaml are
updated in a follow-up PR to actually wire FlowAgent into the mcpo service.
---
 secrets/flowagent.secrets.example | 53 +++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 secrets/flowagent.secrets.example

diff --git a/secrets/flowagent.secrets.example b/secrets/flowagent.secrets.example
new file mode 100644
index 0000000..171205b
--- /dev/null
+++ b/secrets/flowagent.secrets.example
@@ -0,0 +1,53 @@
+# flowagent (Power Automate MCP, via mcpo service) — Secrets Reference
+# Source: mcpo/flowagent — built into a custom image, consumed by the
+# "mcpo" service in ai.yaml (NEVER mcpo-critical).
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+#
+# Prerequisite (manual, outside GitOps — Azure Portal):
+#   1. Entra ID → App registrations → New registration
+#      Name: flowagent-mcp-homelab, single tenant
+#   2. API permissions → add Power Automate / Flow Service application
+#      permissions + Dynamics CRM user_impersonation (Dataverse access)
+#   3. Grant admin consent
+#   4. Certificates & secrets → new client secret → copy value immediately
+#   5. Power Platform Admin Center → target environment → S2S apps →
+#      register the application user for this app ID (required for
+#      Dataverse/environment access by a service principal)
+#
+# NOTE: the OLD "powerautomate" mcpo/config.json entry (npm package
+# powerautomate-mcp, client_id 84b431ed-..., tenant_id 0f6cf991-...) was
+# never onboarded to this secrets pipeline and is being replaced by this.
+# Do not reuse those IDs unless you've independently confirmed in Azure
+# Portal that the old App Registration still exists, still has valid
+# permissions/consent, and you intend to reuse it — otherwise register new.
+
+# ── SECRETS (add to Woodpecker) ──────────────────────────────────────────
+
+# Woodpecker secret name:  flowagent_azure_client_id
+# Used for:                Azure AD App Registration client ID
+# Env var in entrypoint:   FLOWAGENT_AZURE_CLIENT_ID_FILE (Docker secret _FILE)
+flowagent_azure_client_id=
+
+# Woodpecker secret name:  flowagent_azure_tenant_id
+# Used for:                Azure AD tenant ID
+# Env var in entrypoint:   FLOWAGENT_AZURE_TENANT_ID_FILE (Docker secret _FILE)
+flowagent_azure_tenant_id=
+
+# Woodpecker secret name:  flowagent_azure_client_secret
+# Used for:                Azure AD App Registration client secret (rotate if leaked)
+# Env var in entrypoint:   FLOWAGENT_AZURE_CLIENT_SECRET_FILE (Docker secret _FILE)
+flowagent_azure_client_secret=
+
+# ── Woodpecker provision-secrets case entry ──────────────────────────────
+# Add this to the provision-secrets step in .woodpecker/deploy.yml
+# (separate follow-up PR — this file only documents it):
+#
+#   ai)
+#     ... existing ai-stack secret provisioning ...
+#     create_or_update_secret "flowagent_azure_client_id"     "$FLOWAGENT_AZURE_CLIENT_ID"
+#     create_or_update_secret "flowagent_azure_tenant_id"     "$FLOWAGENT_AZURE_TENANT_ID"
+#     create_or_update_secret "flowagent_azure_client_secret" "$FLOWAGENT_AZURE_CLIENT_SECRET"
+#     ;;