provision-secrets: rebuild ai) migration on current main (fixes live env-name drift incl. WEB_UI/WEBUI OAuth secret mismatch)

Rebase of the provisioning-v2 branch's deploy.yml onto current main.
Reconstructed from main line-by-line, then two scoped changes:

1. ai) case -> `python3 deploy/provision-stack.py ai` (one line). Retires
   main's current heredoc, which has active drift found during this
   rebase: AI_LITELLM_POSTGRES_PASSWORD printed TWICE (first copy sourced
   from the retired AI_LITELLM_DB_PASSWORD var), a stray legacy
   AI_WEBUI_SECRET_KEY key current ai.yaml never reads, and printf
   referencing AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET while the env block
   declares AI_OPEN_WEB_UI_OAUTH_CLIENT_SECRET (WEB_UI) — undefined shell
   var at runtime, so rendered ai.env currently carries an EMPTY OAuth
   client secret.

2. env block ai section: normalized to the exact template placeholder
   names (AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET <- ai_oauth_client_secret,
   AI_OPEN_WEBUI_SECRET_KEY <- ai_webui_secret_key), added AI_MCPO_API_KEY
   (NEW Woodpecker secret required pre-merge), pruned now-template-literal
   vars (AI_AWS_REGION_NAME, AI_LITELLM_MODIFY_PARAMS/_DATABASE_MIGRATIONS,
   AI_LITELLM_DB_PASSWORD, the seven ai_open_web_ui_* config secrets).

apk line gains python3 py3-yaml. All other steps and cases byte-match
current main. Dollar-escape audit done per header lesson.

.woodpecker/deploy.yml

@@ -59,17 +59,6 @@ when:
 #   render, hard failure naming any missing value). Migrated stacks call
 #   the script; unmigrated stacks keep legacy case entries until their own
 #   PR. See the "Secrets & Deployment Architecture — Global Direction" note.
-#
-#   2026-09-08 FIX: secrets/ is a tooling/docs folder (secrets-map.yaml +
-#   *.secrets.example), not a stack — but folder-detection treated it as one
-#   the first time a commit touched it (PR #16). deploy survived only because
-#   'secrets' sits in the bootstrap-tier skip list; verify had no guard and
-#   died on `docker stack ps secrets` failing under errexit (assignment from
-#   a failing command substitution aborts the step). Fixed by excluding
-#   secrets/ alongside deploy/ in ALL folder-detection sites, and by
-#   tolerating a failing stack-ps in verify (|| true) so a genuinely missing
-#   stack produces the designed WARNING instead of killing the step. This
-#   hazard was first flagged in July (PR #3, closed unmerged).
 # ─────────────────────────────────────────────────────────────────────────────
 
 steps:
@@ -87,9 +76,9 @@ steps:
         FLAT=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.ya?ml$' || true)
 
         # Folder: any file under a subfolder (e.g. immich/immich.yml).
-        # Exclude dotfolders (.woodpecker, .git, .gitea, etc.) and the
-        # non-stack tooling folders deploy/ and secrets/ (see notes above).
-        FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        # Exclude dotfolders (.woodpecker, .git, .gitea, etc.) and deploy/
+        # (shared tooling, not a stack — see note above).
+        FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
 
         [ -z "$FLAT" ] && [ -z "$FOLDERS" ] && echo "No stacks changed" && exit 0
 
@@ -230,14 +219,14 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && echo "No stacks changed, skipping" && exit 0
       - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@$${SWARM_MANAGER_IP}:/tmp/cs.sh
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
 
         for STACK in $ALL_STACKS; do
@@ -371,7 +360,7 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && echo "No stacks changed" && exit 0
 
@@ -379,13 +368,6 @@ steps:
         rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
           deploy/ root@$${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
 
-        # Sync secrets/ tooling (manifest + examples) alongside deploy/ —
-        # provision-stack.py reads secrets/secrets-map.yaml from the CI
-        # checkout, but the host mirror should stay complete for emergency
-        # manual provisioning runs.
-        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
-          secrets/ root@$${SWARM_MANAGER_IP}:/volume1/docker/compose-files/secrets/
-
         for STACK in $ALL_STACKS; do
           echo "--- Deploying: $STACK ---"
           # Sync files to host first (always, even for bootstrap stacks)
@@ -432,7 +414,7 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && exit 0
 
@@ -443,10 +425,6 @@ steps:
         # "nothing found in stack" output on ordinary deploys (e.g. vaultwarden,
         # 2026-08-25). Retry with backoff instead of a single fixed sleep, and
         # only warn (don't fail the pipeline) if tasks never show up.
-        # 2026-09-08: `|| true` inside the command substitution is REQUIRED —
-        # this step runs under errexit, and an assignment from a failing
-        # command substitution (e.g. `docker stack ps` on a stack that doesn't
-        # exist) kills the whole step before the WARNING path can run.
         ATTEMPTS=6
         DELAY=5
         for STACK in $ALL_STACKS; do
@@ -455,7 +433,7 @@ steps:
           while [ "$i" -le "$ATTEMPTS" ]; do
             OUTPUT=$(ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} \
               "docker stack ps $STACK --filter desired-state=running \
-              --format '  {{.Name}} {{.CurrentState}}'" 2>/dev/null || true)
+              --format '  {{.Name}} {{.CurrentState}}'" 2>/dev/null)
             if [ -n "$OUTPUT" ]; then
               echo "$OUTPUT"
               break

ai/ai.yaml

@@ -16,20 +16,20 @@ services:
       start_period: 60s
     environment:
     - OLLAMA_BASE_URL=http://ollama-intel-arc:11434
-    - WEBUI_SECRET_KEY=${AI_OPEN_WEBUI_SECRET_KEY}
+    - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
     - WEBUI_DB_HOST=postgresql
-    - DATABASE_URL=${AI_OPEN_WEBUI_DATABASE_URL}
+    - DATABASE_URL=${OPEN_WEBUI_DATABASE_URL}
     - ENABLE_TOOL_SERVER_CALLING=true
     - TOOL_SERVER_CALLING=true
-    - WEBUI_URL=${AI_OPEN_WEBUI_URL}
-    - ENABLE_OAUTH_SIGNUP=${AI_OPEN_WEBUI_ENABLE_OAUTH_SIGNUP}
-    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${AI_OPEN_WEBUI_OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
-    - OAUTH_PROVIDER_NAME=${AI_OPEN_WEBUI_OAUTH_PROVIDER_NAME}
-    - OPENID_PROVIDER_URL=${AI_OPEN_WEBUI_OPENID_PROVIDER_URL}
-    - OAUTH_CLIENT_ID=${AI_OPEN_WEBUI_OAUTH_CLIENT_ID}
-    - OAUTH_CLIENT_SECRET=${AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET}
-    - OAUTH_SCOPES=${AI_OPEN_WEBUI_OAUTH_SCOPES}
-    - OPENID_REDIRECT_URI=${AI_OPEN_WEBUI_OPENID_REDIRECT_URI}
+    - WEBUI_URL=${WEBUI_URL}
+    - ENABLE_OAUTH_SIGNUP=${ENABLE_OAUTH_SIGNUP}
+    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
+    - OAUTH_PROVIDER_NAME=${OAUTH_PROVIDER_NAME}
+    - OPENID_PROVIDER_URL=${OPENID_PROVIDER_URL}
+    - OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
+    - OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
+    - OAUTH_SCOPES=${OAUTH_SCOPES}
+    - OPENID_REDIRECT_URI=${OPENID_REDIRECT_URI}
     networks:
     - traefik_backend
     - postgresql_db-backend
@@ -62,13 +62,13 @@ services:
     environment:
     - AWS_ACCESS_KEY_ID=${AI_AWS_ACCESS_KEY_ID}
     - AWS_SECRET_ACCESS_KEY=${AI_AWS_SECRET_ACCESS_KEY}
-    - AWS_REGION_NAME=${AI_AWS_REGION_NAME}
-    - LITELLM_MASTER_KEY=${AI_LITELLM_MASTER_KEY}
-    - LITELLM_SALT_KEY=${AI_LITELLM_SALT_KEY}
-    - DATABASE_URL=${AI_LITELLM_DATABASE_URL}
-    - POSTGRES_PASSWORD=${AI_LITELLM_POSTGRES_PASSWORD}
-    - LITELLM_MODIFY_PARAMS=${AI_LITELLM_MODIFY_PARAMS}
-    - LITELLM_DATABASE_MIGRATIONS=${AI_LITELLM_DATABASE_MIGRATIONS}
+    - AWS_REGION_NAME=${AWS_REGION_NAME}
+    - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
+    - LITELLM_SALT_KEY=${LITELLM_SALT_KEY}
+    - DATABASE_URL=${DATABASE_URL}
+    - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    - LITELLM_MODIFY_PARAMS=${LITELLM_MODIFY_PARAMS}
+    - LITELLM_DATABASE_MIGRATIONS=${LITELLM_DATABASE_MIGRATIONS}
     networks:
     - traefik_backend
     - postgresql_db-backend
@@ -127,7 +127,7 @@ services:
       labels:
       - traefik.enable=false
   mcpo:
-    image: git.bryanmail.net/homelab/flowagent-mcpo:c5b22618404a
+    image: git.bryanmail.net/homelab/flowagent-mcpo:916164714429
     command:
     - --config
     - /app/config/config.json
@@ -141,7 +141,6 @@ services:
     - /volume1/docker/mcpo/data:/mcpo_data
     - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
     - /volume1/docker/mcpo/uv-cache:/app/uv-cache
-    - /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth
     secrets:
     - source: flowagent_azure_client_id
       target: flowagent_azure_client_id