334 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	5c0f59f00c	Add security.yaml — Pattern B migration, no env_file, domain parameterized, secrets in host .env	2026-06-27 06:24:07 -07:00
admin	e7842fda6b	refactor(.woodpecker.yml): add guacamole to no-op provision case (Pattern B — secrets in host .env), remove unused guacamole env vars from provision step	2026-06-26 23:15:23 -07:00
admin	2f1685f5a9	Add guacamole.yaml — Pattern B migration, all secrets/OIDC via host .env vars	2026-06-26 23:13:45 -07:00
admin	d48b64cc9a	fix(.woodpecker.yml): add || true to ssh-keyscan — from_secret injection confirmed working (SWARM_MANAGER_IP len=12)	2026-06-26 06:59:36 -07:00
admin	1a9684067a	fix(.woodpecker.yml): migrate from deprecated secrets: list to from_secret syntax (Woodpecker v3 requires environment: VAR: from_secret: name)	2026-06-26 06:54:41 -07:00
admin	e48caa643c	debug: add secret env dump step + slim provision-secrets to diagnose SWARM_MANAGER_IP injection	2026-06-26 06:47:29 -07:00
admin	028bda5e8e	ci: trigger fresh pipeline to verify SWARM_MANAGER_IP injection after DB fix	2026-06-26 06:29:46 -07:00
admin	729065e66b	fix(.woodpecker.yml): restore SWARM_MANAGER_IP — root cause was corrupted value '192_168_4_32' in DB (id=88), now fixed to '192.168.4.32'	2026-06-26 06:25:18 -07:00
admin	369255490b	fix(.woodpecker.yml): revert to hardcoded IP — new repo-level secret injection broken in Woodpecker v3 (TODO: investigate)	2026-06-25 23:54:30 -07:00
admin	16b358cc52	fix(.woodpecker.yml): rename docker_manager_ip -> swarm_manager_ip (avoid DOCKER_ prefix reserved by Docker runtime)	2026-06-25 23:36:55 -07:00
admin	9dd97a5fcc	ci: trigger pipeline to verify DOCKER_MANAGER_IP injection after server restart	2026-06-25 23:34:19 -07:00
admin	cae2e1bc0c	fix(.woodpecker.yml): uppercase env var refs match Woodpecker injection (secret docker_manager_ip -> $DOCKER_MANAGER_IP)	2026-06-25 23:25:53 -07:00
admin	922dd06c9b	fix(.woodpecker.yml): use lowercase secret names matching Woodpecker injection convention	2026-06-25 23:22:52 -07:00
admin	dae8e25bda	fix(.woodpecker.yml): add DOCKER_MANAGER_IP and WOODPECKER_HOST to step secrets lists	2026-06-25 23:17:09 -07:00
admin	1096cf5586	refactor(.woodpecker.yml): replace hardcoded 192.168.4.32 with DOCKER_MANAGER_IP and woodpecker URL with WOODPECKER_HOST	2026-06-25 23:00:54 -07:00
admin	25f9bab3b0	refactor(woodpecker.env.example): replace hardcoded URLs with variable references	2026-06-25 22:58:02 -07:00
admin	82c3dfb6d1	refactor(git.env.example): parameterize POSTGRES_HOST, POSTGRES_PORT, and GITEA_HOST	2026-06-25 22:58:02 -07:00
admin	4fe91f001c	refactor(git): parameterize Traefik Host() rule and MCP GITEA_HOST via GITEA_HOST variable	2026-06-25 22:58:01 -07:00
admin	bb25482df0	refactor(woodpecker): parameterize WOODPECKER_HOST, GITEA_HOST, and DB connection string	2026-06-25 22:58:01 -07:00
admin	39f781e1d0	refactor(vaultwarden): parameterize domain and alt_domain in Traefik rule and commented URL	2026-06-25 22:57:13 -07:00
admin	e376ea74a5	refactor(unifi): replace hardcoded domain in commented rule with ALT_DOMAIN variable	2026-06-25 22:57:13 -07:00
admin	a2f480bdaf	refactor(meshcentral): parameterize HOSTNAME and Traefik Host() rule via MESHCENTRAL_HOST	2026-06-25 22:57:13 -07:00
admin	43329a0caa	refactor(homeassistant): parameterize domain references and frigate cert paths	2026-06-25 22:57:12 -07:00
admin	ad0f8067bc	refactor(maintenance): parameterize all bryanmail.net domain references	2026-06-25 22:55:33 -07:00
admin	a1cf764dc5	refactor(media): parameterize all bryanmail.net domain references	2026-06-25 22:55:33 -07:00
admin	80002d1a48	refactor(mealie): parameterize domain, LDAP, and DB connection values	2026-06-25 22:55:32 -07:00
admin	a23a399ff6	Fix provision-secrets: use printf pipe for vaultwarden secrets (argon2id and URL break inline SSH quoting)	2026-06-25 17:03:19 -07:00
admin	1b45835015	Add vaultwarden.yaml - ADMIN_TOKEN_FILE + DATABASE_URL_FILE via Docker secrets, inline Traefik rule	2026-06-25 16:58:05 -07:00
admin	2b259dec3b	Add homeassistant.yaml + stack-deploy.sh hint for secret not found errors	2026-06-25 16:53:23 -07:00
admin	c6f9d5e455	Fix provision-secrets: scp was using conflicting SSH options causing silent failure	2026-06-25 16:36:21 -07:00
admin	4efe4a96e1	Add mealie.yaml - inline all config, POSTGRES_PASSWORD + LDAP_QUERY_PASSWORD via Docker secrets (_FILE)	2026-06-25 16:33:43 -07:00
admin	5f372d0cf7	mealie: provision Docker secrets and redeploy with _FILE convention	2026-06-25 16:32:04 -07:00
admin	9224f029e4	Add mealie.yaml - remove env_file, inline config, POSTGRES_PASSWORD_FILE + LDAP_QUERY_PASSWORD_FILE via Docker secrets	2026-06-25 16:31:06 -07:00
admin	988acd88ba	demote: move gamma to compose-files-staging (not in prod)	2026-06-22 23:40:46 -07:00
admin	748bb720a5	gamma: remove ports:3000 - conflicts with gitea, Traefik handles routing via overlay	2026-06-22 23:08:45 -07:00
admin	ae47cd55bb	Add gamma.yaml - remove env_file, inline TRAFFIC_HOST, tokens via stack-deploy.sh	2026-06-22 23:07:03 -07:00
admin	8468e900b6	Add unifi.yaml to repo - test new stack-deploy.sh with env file containing special chars	2026-06-22 22:58:30 -07:00
admin	3990ae8535	Add stack-deploy.sh + envparse.py: safe env loading via Python for all stacks	2026-06-22 22:57:51 -07:00
admin	81c97125ef	Fix deploy step: use rsync for safe-deploy.sh upload (no bare scp), clean up pipeline. Test with media.yaml redeploy.	2026-06-22 22:56:54 -07:00
admin	6883a3f688	Fix pipeline: add -i and UserKnownHostsFile=/dev/null to all scp commands for reliable SSH auth in agent containers	2026-06-22 22:53:50 -07:00
admin	ff574aa710	Add safe-deploy.sh: Python-based env parser, handles special chars in .env values safely. Remove legacy shell deploy scripts superseded by pipeline.	2026-06-22 22:51:53 -07:00
admin	67174d6104	Fix pipeline env-file sourcing: use if/then to handle special chars in .env files	2026-06-22 22:44:45 -07:00
admin	a43e0924eb	Remove env_file from meshcentral - inline non-secrets, BACKUPS_PW sourced from host .env at deploy time	2026-06-22 22:41:58 -07:00
admin	b84fae335d	Remove env_file dependencies from media and maintenance stacks - inline all non-secret values directly in compose files	2026-06-21 22:34:45 -07:00
admin	a651848f48	Fix provision-secrets: check for yaml changes before scp to avoid failure on non-stack commits	2026-06-21 22:20:42 -07:00
admin	ed9253fa61	Add provision-secrets step: pipeline now manages all Docker Swarm secrets from Woodpecker store	2026-06-21 22:15:59 -07:00
admin	d8b628cd63	Add woodpecker secrets reference (manual management only)	2026-06-20 23:23:35 -07:00
admin	7aa42042f1	Add vaultwarden secrets reference	2026-06-20 23:23:35 -07:00
admin	858f465263	Add unifi secrets reference (no secrets)	2026-06-20 23:23:34 -07:00
admin	8300381623	Add traefik secrets reference	2026-06-20 23:23:34 -07:00