3 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Bot	a15e0100df	provision-secrets: add flowagent_* case-entry to the ai) stack (matched pair with ai.yaml's mcpo cutover) ... Surgical addition to the existing case "ai)" block only — every other case, comment, and line in this ~26KB pipeline file is byte-for-byte unchanged from main. Given this file's documented incident history from prior full-file rewrites (see header comment), this was hand-verified against the current main content line-by-line before writing, not generated fresh. Adds: - 3 new environment: entries (FLOWAGENT_AZURE_CLIENT_ID/TENANT_ID/ CLIENT_SECRET) via from_secret, alongside the existing ai_* secrets - Inside the existing `ai)` case, after the ai.env rewrite block: three create_or_update_secret calls provisioning flowagent_azure_client_id, flowagent_azure_tenant_id, flowagent_azure_client_secret as native Docker Swarm secrets (Pattern C, _FILE convention) — NOT written into ai/ai.env, since mcpo's flowagent entry reads them via /run/secrets/flowagent_azure_* per flowagent/entrypoint.sh, not env vars - A short comment explaining why these three are Pattern C secrets inside an otherwise Pattern-B (host .env) stack case This is the matched-pair companion to the ai.yaml commit in this same PR, per the FlowAgent progress note's explicit sequencing requirement (both land together, reviewed, not auto-merged to main).	2026-09-02 16:53:10 -07:00
Bot	bcfb24b16d	ai.yaml: cut mcpo over to the confirmed-working flowagent-mcpo image + wire flowagent Docker secrets (never touches mcpo-critical) ... Image pinned to git.bryanmail.net/homelab/flowagent-mcpo:916164714429 — the exact sha-tagged image built and smoke-tested clean in mcp-config pipeline #22 (build-and-push-flowagent + smoke-test-flowagent-image both success). NOT :latest, for reproducible deploys. Adds a secrets: block to the mcpo service only, referencing the 3 flowagent_azure_* Docker Swarm secrets (Pattern C, _FILE convention, consumed by flowagent/entrypoint.sh via /run/secrets/flowagent_azure_*). Declares those 3 secrets as external at top level, mirroring the existing vaultwarden_admin_token_v2 pattern in vaultwarden.yaml. Companion secret-provisioning change lands in the same PR as a separate commit in .woodpecker/deploy.yml's provision-secrets step (case "ai)"). mcpo-critical (lines defining Proxmox access) is completely untouched — still stock ghcr.io/open-webui/mcpo:main, no secrets: block, unchanged. Per FlowAgent MCP progress note: Azure AD App Registration is reported created with real secrets already in Woodpecker (both mcp-config and compose-files repos) as of this PR. This is a reviewed PR against a feature branch, NOT auto-merged to main — deploy only happens after manual review/merge, per user's explicit request for a manual-revert safety net on this high-blast-radius shared stack (LiteLLM, Open WebUI, n8n also live here).	2026-09-02 16:51:31 -07:00
Bot	42d31e38e4	git stack: switch provision-secrets to Pattern B .env rewrite (test phase) + add git to bootstrap-tier guard ... Context: git hosts the source of truth for every other stack's compose files, so in a disaster-recovery scenario it must be restorable from a flat git.yaml + git.env backup alone, with zero dependency on a running Swarm's Docker secret store (native Docker secrets can't be resolved until Swarm already exists, which is the circular dependency git.yaml would otherwise create). Path 2 (documented decision): Pattern B for git specifically, same mechanism the ai stack already uses. provision-secrets / git) case: - Previously created native Docker secrets (git_db_password, git_runner_token, git_mcp_access_token) via create-secrets.sh — leftover from an earlier, abandoned Pattern C attempt. - Now rewrites only the secret-bearing lines (GITEA__database__PASSWD, GITEA_RUNNER_REGISTRATION_TOKEN, GITEA_MCP_ACCESS_TOKEN) via grep -v + printf, mirroring the ai) case exactly. Also strips the legacy GITEA_ACCESS_TOKEN key name so the test file converges on the git.env.example-documented key. - TEST PHASE: target is git.env.pipelinetest, NOT git.env. The real git.env is never opened for writing by this step. First run seeds the test file from the real git.env (to carry over all non-secret lines), then only the 3 secret lines are refreshed on every push. - Real cutover (pointing git.yaml/stack-deploy at the generated file, then retiring git.env.pipelinetest) is a deliberate follow-up step after manually diffing the rendered output. deploy / bootstrap-tier guard: - Added git to the traefik|woodpecker|postgresql|secrets guard list. git.yaml changes now sync to the host but require a manual `stack-deploy.sh git` run, same as the other foundational stacks — prevents an auto-deploy of a bad git.yaml change from taking down Gitea before a human can look at it (Gitea itself is what every other pipeline needs to trigger a fix).	2026-09-02 00:02:36 -07:00