provision-secrets: rebuild ai) migration on current main (fixes live env-name drift incl. WEB_UI/WEBUI OAuth secret mismatch)

Rebase of the provisioning-v2 branch's deploy.yml onto current main.
Reconstructed from main line-by-line, then two scoped changes:

1. ai) case -> `python3 deploy/provision-stack.py ai` (one line). Retires
   main's current heredoc, which has active drift found during this
   rebase: AI_LITELLM_POSTGRES_PASSWORD printed TWICE (first copy sourced
   from the retired AI_LITELLM_DB_PASSWORD var), a stray legacy
   AI_WEBUI_SECRET_KEY key current ai.yaml never reads, and printf
   referencing AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET while the env block
   declares AI_OPEN_WEB_UI_OAUTH_CLIENT_SECRET (WEB_UI) — undefined shell
   var at runtime, so rendered ai.env currently carries an EMPTY OAuth
   client secret.

2. env block ai section: normalized to the exact template placeholder
   names (AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET <- ai_oauth_client_secret,
   AI_OPEN_WEBUI_SECRET_KEY <- ai_webui_secret_key), added AI_MCPO_API_KEY
   (NEW Woodpecker secret required pre-merge), pruned now-template-literal
   vars (AI_AWS_REGION_NAME, AI_LITELLM_MODIFY_PARAMS/_DATABASE_MIGRATIONS,
   AI_LITELLM_DB_PASSWORD, the seven ai_open_web_ui_* config secrets).

apk line gains python3 py3-yaml. All other steps and cases byte-match
current main. Dollar-escape audit done per header lesson.

.woodpecker/deploy.yml

@@ -59,27 +59,6 @@ when:
 #   render, hard failure naming any missing value). Migrated stacks call
 #   the script; unmigrated stacks keep legacy case entries until their own
 #   PR. See the "Secrets & Deployment Architecture — Global Direction" note.
-#
-#   2026-09-08 FIX: secrets/ is a tooling/docs folder (secrets-map.yaml +
-#   *.secrets.example), not a stack — but folder-detection treated it as one
-#   the first time a commit touched it (PR #16). deploy survived only because
-#   'secrets' sits in the bootstrap-tier skip list; verify had no guard and
-#   died on `docker stack ps secrets` failing under errexit (assignment from
-#   a failing command substitution aborts the step). Fixed by excluding
-#   secrets/ alongside deploy/ in ALL folder-detection sites, and by
-#   tolerating a failing stack-ps in verify (|| true) so a genuinely missing
-#   stack produces the designed WARNING instead of killing the step. This
-#   hazard was first flagged in July (PR #3, closed unmerged).
-#
-#   2026-09-12 MIGRATION: traefik moved from Pattern B (secrets hand-typed
-#   into the host-only traefik.env, no CI involvement at all) to the same
-#   manifest-driven provisioning as ai) below. Root cause of the migration:
-#   traefik.env had been accidentally committed to git with a literal
-#   "***REDACTED***" placeholder as KEEPALIVED_PASSWORD; every git-guard
-#   resync/checkout silently restored that broken value, which diverged from
-#   keepalived-backup's stale-but-correct in-memory value and produced a
-#   continuous VRRP auth failure ("received an invalid passwd!") and VIP
-#   instability. The manifest-driven path never commits the rendered file.
 # ─────────────────────────────────────────────────────────────────────────────
 
 steps:
@@ -97,9 +76,9 @@ steps:
         FLAT=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.ya?ml$' || true)
 
         # Folder: any file under a subfolder (e.g. immich/immich.yml).
-        # Exclude dotfolders (.woodpecker, .git, .gitea, etc.) and the
+        # Exclude dotfolders (.woodpecker, .git, .gitea, etc.) and deploy/
-        # non-stack tooling folders deploy/ and secrets/ (see notes above).
+        # (shared tooling, not a stack — see note above).
-        FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
 
         [ -z "$FLAT" ] && [ -z "$FOLDERS" ] && echo "No stacks changed" && exit 0
 
@@ -226,11 +205,6 @@ steps:
         from_secret: flowagent_azure_tenant_id
       FLOWAGENT_AZURE_CLIENT_SECRET:
         from_secret: flowagent_azure_client_secret
-      # ── traefik stack (manifest-driven — secrets/secrets-map.yaml +
-      #    traefik/traefik.env.template + deploy/provision-stack.py).
-      #    Migrated 2026-09-12; see header note above for root cause. ──
-      TRAEFIK_KEEPALIVED_PASSWORD:
-        from_secret: traefik_keepalived_password
     commands:
       - apk add --no-cache openssh-client python3 py3-yaml
       - mkdir -p ~/.ssh
@@ -245,32 +219,21 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && echo "No stacks changed, skipping" && exit 0
       - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@$${SWARM_MANAGER_IP}:/tmp/cs.sh
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
 
         for STACK in $ALL_STACKS; do
           echo "Provisioning: $STACK"
           case "$STACK" in
-            maintenance|media|unifi|guacamole|security|auth|meshcentral|ddm)
+            maintenance|media|unifi|guacamole|security|auth|traefik|meshcentral|ddm)
               echo "  No Docker secrets for $STACK — secrets in host .env";;
-            traefik)
-              # MIGRATED (2026-09-12) to manifest-driven provisioning after
-              # discovering traefik.env was committed to git with a literal
-              # "***REDACTED***" placeholder as KEEPALIVED_PASSWORD — every
-              # git-guard resync/checkout restored the broken value, causing
-              # VRRP auth mismatch between keepalived-master/-backup and VIP
-              # instability. All logic lives in deploy/provision-stack.py;
-              # the authoritative key list lives in
-              # traefik/traefik.env.template; the mapping lives in
-              # secrets/secrets-map.yaml. This case is intentionally one line.
-              python3 deploy/provision-stack.py traefik;;
             immich)
               ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'immich_db_password'     '$${IMMICH_DB_PASSWORD}'
@@ -397,7 +360,7 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && echo "No stacks changed" && exit 0
 
@@ -405,13 +368,6 @@ steps:
         rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
           deploy/ root@$${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
 
-        # Sync secrets/ tooling (manifest + examples) alongside deploy/ —
-        # provision-stack.py reads secrets/secrets-map.yaml from the CI
-        # checkout, but the host mirror should stay complete for emergency
-        # manual provisioning runs.
-        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
-          secrets/ root@$${SWARM_MANAGER_IP}:/volume1/docker/compose-files/secrets/
-
         for STACK in $ALL_STACKS; do
           echo "--- Deploying: $STACK ---"
           # Sync files to host first (always, even for bootstrap stacks)
@@ -458,7 +414,7 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && exit 0
 
@@ -469,10 +425,6 @@ steps:
         # "nothing found in stack" output on ordinary deploys (e.g. vaultwarden,
         # 2026-08-25). Retry with backoff instead of a single fixed sleep, and
         # only warn (don't fail the pipeline) if tasks never show up.
-        # 2026-09-08: `|| true` inside the command substitution is REQUIRED —
-        # this step runs under errexit, and an assignment from a failing
-        # command substitution (e.g. `docker stack ps` on a stack that doesn't
-        # exist) kills the whole step before the WARNING path can run.
         ATTEMPTS=6
         DELAY=5
         for STACK in $ALL_STACKS; do
@@ -481,7 +433,7 @@ steps:
           while [ "$i" -le "$ATTEMPTS" ]; do
             OUTPUT=$(ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} \
               "docker stack ps $STACK --filter desired-state=running \
-              --format '  {{.Name}} {{.CurrentState}}'" 2>/dev/null || true)
+              --format '  {{.Name}} {{.CurrentState}}'" 2>/dev/null)
             if [ -n "$OUTPUT" ]; then
               echo "$OUTPUT"
               break

ai/ai.yaml

@@ -16,20 +16,20 @@ services:
       start_period: 60s
     environment:
     - OLLAMA_BASE_URL=http://ollama-intel-arc:11434
-    - WEBUI_SECRET_KEY=${AI_OPEN_WEBUI_SECRET_KEY}
+    - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
     - WEBUI_DB_HOST=postgresql
-    - DATABASE_URL=${AI_OPEN_WEBUI_DATABASE_URL}
+    - DATABASE_URL=${OPEN_WEBUI_DATABASE_URL}
     - ENABLE_TOOL_SERVER_CALLING=true
     - TOOL_SERVER_CALLING=true
-    - WEBUI_URL=${AI_OPEN_WEBUI_URL}
+    - WEBUI_URL=${WEBUI_URL}
-    - ENABLE_OAUTH_SIGNUP=${AI_OPEN_WEBUI_ENABLE_OAUTH_SIGNUP}
+    - ENABLE_OAUTH_SIGNUP=${ENABLE_OAUTH_SIGNUP}
-    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${AI_OPEN_WEBUI_OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
+    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
-    - OAUTH_PROVIDER_NAME=${AI_OPEN_WEBUI_OAUTH_PROVIDER_NAME}
+    - OAUTH_PROVIDER_NAME=${OAUTH_PROVIDER_NAME}
-    - OPENID_PROVIDER_URL=${AI_OPEN_WEBUI_OPENID_PROVIDER_URL}
+    - OPENID_PROVIDER_URL=${OPENID_PROVIDER_URL}
-    - OAUTH_CLIENT_ID=${AI_OPEN_WEBUI_OAUTH_CLIENT_ID}
+    - OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
-    - OAUTH_CLIENT_SECRET=${AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET}
+    - OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
-    - OAUTH_SCOPES=${AI_OPEN_WEBUI_OAUTH_SCOPES}
+    - OAUTH_SCOPES=${OAUTH_SCOPES}
-    - OPENID_REDIRECT_URI=${AI_OPEN_WEBUI_OPENID_REDIRECT_URI}
+    - OPENID_REDIRECT_URI=${OPENID_REDIRECT_URI}
     networks:
     - traefik_backend
     - postgresql_db-backend
@@ -62,13 +62,13 @@ services:
     environment:
     - AWS_ACCESS_KEY_ID=${AI_AWS_ACCESS_KEY_ID}
     - AWS_SECRET_ACCESS_KEY=${AI_AWS_SECRET_ACCESS_KEY}
-    - AWS_REGION_NAME=${AI_AWS_REGION_NAME}
+    - AWS_REGION_NAME=${AWS_REGION_NAME}
-    - LITELLM_MASTER_KEY=${AI_LITELLM_MASTER_KEY}
+    - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
-    - LITELLM_SALT_KEY=${AI_LITELLM_SALT_KEY}
+    - LITELLM_SALT_KEY=${LITELLM_SALT_KEY}
-    - DATABASE_URL=${AI_LITELLM_DATABASE_URL}
+    - DATABASE_URL=${DATABASE_URL}
-    - POSTGRES_PASSWORD=${AI_LITELLM_POSTGRES_PASSWORD}
+    - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
-    - LITELLM_MODIFY_PARAMS=${AI_LITELLM_MODIFY_PARAMS}
+    - LITELLM_MODIFY_PARAMS=${LITELLM_MODIFY_PARAMS}
-    - LITELLM_DATABASE_MIGRATIONS=${AI_LITELLM_DATABASE_MIGRATIONS}
+    - LITELLM_DATABASE_MIGRATIONS=${LITELLM_DATABASE_MIGRATIONS}
     networks:
     - traefik_backend
     - postgresql_db-backend
@@ -127,7 +127,7 @@ services:
       labels:
       - traefik.enable=false
   mcpo:
-    image: git.bryanmail.net/homelab/flowagent-mcpo:c5b22618404a
+    image: git.bryanmail.net/homelab/flowagent-mcpo:916164714429
     command:
     - --config
     - /app/config/config.json
@@ -141,7 +141,6 @@ services:
     - /volume1/docker/mcpo/data:/mcpo_data
     - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
     - /volume1/docker/mcpo/uv-cache:/app/uv-cache
-    - /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth
     secrets:
     - source: flowagent_azure_client_id
       target: flowagent_azure_client_id

deploy/git-guard.sh

@@ -5,149 +5,26 @@
 # Behavior:
 #   - Clean + up to date        -> pass silently
 #   - Clean + behind (ff-only)  -> auto `git pull --ff-only`, then pass
-#   - Clean + ahead only        -> interactive: offer to push; non-interactive: BLOCK
+#   - Ahead only (unpushed)     -> interactive: offer to push; non-interactive: BLOCK
-#     (unpushed)
+#   - Dirty tracked changes     -> offer to commit + push right now
-#   - Unresolved merge conflict -> REFUSE immediately. Never auto-commits over
+#                                   (auto in non-interactive/CI runs, after a
-#     markers present               conflict markers. Prints remediation options.
-#   - Dirty + local in sync     -> offer to commit + push right now
-#     with origin                 (auto in non-interactive/CI runs, after a
 #                                   secret-pattern scan of the staged diff)
-#   - Dirty + local STALE/      -> NEVER commit on top of a stale base. Stash
-#     diverged vs origin           the dirty changes first, resync main with
-#                                   origin using the same behind/ahead/diverged
-#                                   rules as the clean-tree case, then reapply
-#                                   the stash and re-run. On any failure the
-#                                   stash is preserved and remediation options
-#                                   (with exact commands) are printed.
 #   - Diverged (local AND       -> REFUSE. Never auto-resolves. Prints the
 #     remote both moved)           backup/stash/reset recovery steps and exits.
 #
 # Exit codes: 0 = safe to deploy, 1 = blocked, needs human intervention
-#
-# ── Flags (added 2026-09-12, circular-dependency bootstrap incident) ────────
-#
-#   -e, --emergency
-#     Before the normal fetch, tries each candidate Gitea endpoint in order
-#     (git.bryanmail.net -> 192.168.4.30 VIP -> .31 -> .32 -> .33 node IPs,
-#     each over plain http on port 3000, which is Gitea's direct ingress
-#     port — bypasses Traefik/VIP entirely) and switches `origin` to the
-#     first one that responds to `git ls-remote` within a short timeout.
-#     This solves the bootstrap circular dependency where Traefik is down,
-#     so HTTPS access to git.bryanmail.net is unreachable, so git-guard
-#     can't fetch, so stack-deploy.sh can't redeploy traefik to fix itself.
-#     Once a reachable endpoint is found, NORMAL sync logic still runs
-#     (behind/ahead/diverged handling is unchanged) — this flag only changes
-#     *which host* is used, never skips the safety checks themselves.
-#     Prints a loud reminder to restore the real origin URL afterward; never
-#     commits the swapped URL anywhere.
-#
-#   -f, --force
-#     Skips the sync check ENTIRELY — no fetch, no comparison, no commit/push
-#     offer. Deploys whatever is on disk right now, as-is. This is the last
-#     resort for a genuine emergency where NONE of the candidate hosts in
-#     --emergency are reachable (e.g. Gitea itself is down, not just
-#     routing). Prints a loud warning banner. Never use this for routine
-#     work — it defeats the entire purpose of this script and is the exact
-#     failure mode (deploying a stale/unreviewed tree) git-guard exists to
-#     prevent.
-#
-#   Both flags are passed through from stack-deploy.sh's own -e/-f flags;
-#   see that script's header for the calling convention.
-# ─────────────────────────────────────────────────────────────────────────
 
 set -euo pipefail
 
 DIR="/volume1/docker/compose-files"
 cd "$DIR"
 
-# ---- Flag parsing ----
-EMERGENCY=0
-FORCE=0
-for arg in "$@"; do
-  case "$arg" in
-    -e|--emergency) EMERGENCY=1 ;;
-    -f|--force)     FORCE=1 ;;
-  esac
-done
-
-# ---- Force mode: skip everything ----
-if [ "$FORCE" -eq 1 ]; then
-  echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-  echo "!! FORCE MODE (-f/--force): git-guard sync check SKIPPED ENTIRELY."
-  echo "!! Deploying whatever is on disk right now, as-is. No fetch, no"
-  echo "!! comparison with origin/main was performed. This is a LAST RESORT"
-  echo "!! for emergencies where origin is completely unreachable — verify"
-  echo "!! independently that the local tree is what you intend to deploy."
-  echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-  exit 0
-fi
-
 # Non-interactive detection (Woodpecker/cron have no TTY on stdin)
 INTERACTIVE=0
 [ -t 0 ] && INTERACTIVE=1
 
 echo "==> git-guard: checking repo sync state"
 
-# ---- Emergency mode: find a reachable Gitea endpoint before fetching ----
-# Candidate order: public hostname (normal path) -> VIP -> each node's direct
-# IP. Each is tried over plain http on port 3000 (Gitea's direct ingress
-# port, published outside Traefik — see traefik/traefik.yaml git service
-# port mapping), since the whole point is to bypass Traefik/VIP when THOSE
-# are what's broken. A short `git ls-remote` timeout keeps an unreachable
-# candidate from stalling the whole check for long.
-if [ "$EMERGENCY" -eq 1 ]; then
-  echo "!! EMERGENCY MODE (-e/--emergency): probing candidate Gitea endpoints"
-  echo "!! (bypassing the normal https://git.bryanmail.net path if needed)..."
-
-  ORIGINAL_URL="$(git remote get-url origin)"
-  CANDIDATES=(
-    "https://git.bryanmail.net/homelab/compose-files.git"
-    "http://192.168.4.30:3000/homelab/compose-files.git"
-    "http://192.168.4.31:3000/homelab/compose-files.git"
-    "http://192.168.4.32:3000/homelab/compose-files.git"
-    "http://192.168.4.33:3000/homelab/compose-files.git"
-  )
-
-  FOUND=""
-  for candidate in "${CANDIDATES[@]}"; do
-    echo -n "     trying $candidate ... "
-    if timeout 5 git ls-remote "$candidate" HEAD >/dev/null 2>&1; then
-      echo "OK"
-      FOUND="$candidate"
-      break
-    else
-      echo "unreachable"
-    fi
-  done
-
-  if [ -z "$FOUND" ]; then
-    echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-    echo "!! EMERGENCY MODE: none of the candidate endpoints responded."
-    echo "!! Gitea itself may be down (not just routing) — this is beyond what"
-    echo "!! an alternate host path can fix. Options:"
-    echo "!!   A) Diagnose Gitea directly: check the git_gitea-server service"
-    echo "!!      and container on docker-1."
-    echo "!!   B) If you are certain the on-disk tree is correct and Gitea is"
-    echo "!!      genuinely unreachable, re-run with -f/--force instead — but"
-    echo "!!      read that flag's warning carefully first."
-    echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-    exit 1
-  fi
-
-  if [ "$FOUND" != "$ORIGINAL_URL" ]; then
-    git remote set-url origin "$FOUND"
-    echo "==> origin temporarily switched to: $FOUND"
-    echo "!! REMINDER: once the normal path (git.bryanmail.net / Traefik) is"
-    echo "!! confirmed healthy again, restore the real origin URL:"
-    echo "!!   cd $DIR && git remote set-url origin \"$ORIGINAL_URL\""
-    echo "!! This swap is never committed anywhere and only affects this"
-    echo "!! local checkout's git config."
-  else
-    echo "==> Normal origin URL ($FOUND) is reachable — no swap needed."
-  fi
-  echo
-fi
-
 git fetch origin --quiet
 
 LOCAL="$(git rev-parse main)"
@@ -159,246 +36,12 @@ git status --porcelain | grep -q . && DIRTY=1
 
 SECRET_PATTERN='(-----BEGIN [A-Z]+ PRIVATE KEY-----|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9a-zA-Z-]+|password[[:space:]]*[:=][[:space:]]*[^$ ]|api[_-]?key[[:space:]]*[:=][[:space:]]*[^$ ])'
 
-# resync_with_origin <local_sha> <remote_sha> <base_sha>
-#
-# Handles the behind/ahead/diverged cases against a CLEAN working tree.
-# Shared by both the "tree was already clean" path and the new
-# "dirty tree turned out to be stale, so we stashed first" path, so the
-# two paths can never drift out of sync with each other.
-#
-# Returns 0 if it's now safe to deploy, 1 if it could not safely resolve
-# (guidance already printed to stdout in that case).
-resync_with_origin() {
-  local local_sha="$1" remote_sha="$2" base_sha="$3"
-
-  # ---- Case: fully in sync ----
-  if [ "$local_sha" = "$remote_sha" ]; then
-    echo "==> In sync with origin/main ($local_sha). OK to deploy."
-    return 0
-  fi
-
-  # ---- Case: behind only (fast-forwardable) ----
-  if [ "$local_sha" = "$base_sha" ]; then
-    echo "!! Local main is behind origin/main."
-    if [ "$INTERACTIVE" -eq 1 ]; then
-      read -rp "Fast-forward pull now? [y/N] " ans
-    else
-      ans="y"
-      echo "(non-interactive session — auto fast-forwarding)"
-    fi
-    if [[ "$ans" =~ ^[Yy]$ ]]; then
-      git pull --ff-only origin main
-      echo "==> Fast-forwarded to $(git rev-parse --short main). OK to deploy."
-      return 0
-    else
-      echo "Aborting - pull manually, then retry:"
-      echo "  cd $DIR && git pull --ff-only origin main"
-      return 1
-    fi
-  fi
-
-  # ---- Case: ahead only (local commits not yet pushed) ----
-  if [ "$remote_sha" = "$base_sha" ]; then
-    echo "!! Local main is AHEAD of origin/main (unpushed commits):"
-    git log --oneline "origin/main..main"
-    echo
-    if [ "$INTERACTIVE" -eq 1 ]; then
-      read -rp "Push local commits to origin/main now? [y/N] " ans
-    else
-      ans="n"
-      echo "(non-interactive session — will NOT auto-push ahead commits; needs human review)"
-    fi
-    if [[ "$ans" =~ ^[Yy]$ ]]; then
-      git push origin main
-      echo "==> Pushed. OK to deploy."
-      return 0
-    else
-      echo "Aborting. Review with:"
-      echo "  cd $DIR && git log origin/main..main"
-      echo "Then push manually when ready:"
-      echo "  git push origin main"
-      return 1
-    fi
-  fi
-
-  # ---- Case: true divergence (both ahead and behind) — NEVER auto-fix ----
-  echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-  echo "!! DIVERGED: local main and origin/main have both moved independently."
-  echo "!!"
-  echo "!!   Local-only commits:"
-  git log --oneline "$base_sha..main" | sed 's/^/!!     /'
-  echo "!!"
-  echo "!!   Remote-only commits:"
-  git log --oneline "$base_sha..origin/main" | sed 's/^/!!     /'
-  echo "!!"
-  echo "!! This requires a human decision - git-guard will NOT auto-resolve this."
-  echo "!!"
-  echo "!! Before stashing anything new, check whether a git-guard safety stash"
-  echo "!! ALREADY exists from this same run (avoids confusing duplicate stashes):"
-  echo "!!   git stash list"
-  echo "!!"
-  echo "!! Recommended recovery:"
-  echo "!!   1. tar backup:      tar czf /volume1/docker/compose-files-backup-\$(date +%Y%m%d-%H%M%S).tar.gz -C /volume1/docker compose-files"
-  echo "!!   2. name the branch: git branch backup/pre-reset-\$(date +%Y%m%d)"
-  echo "!!   3. stash any NEW uncommitted state only if 'git stash list' above"
-  echo "!!      didn't already show one for this run:"
-  echo "!!        git stash push -u -m 'pre-reset-snapshot'"
-  echo "!!   4. reset to origin: git reset --hard origin/main"
-  echo "!!   5. selectively restore needed files from the stash/backup branch:"
-  echo "!!        git stash list"
-  echo "!!        git stash show -p stash@{N}"
-  echo "!!        git stash apply stash@{N}   # 'apply' keeps the stash as a backup; use 'pop' to also drop it"
-  echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-  return 1
-}
-
-# ---- Case: unresolved merge conflict already present ----
-# Can happen if a PRIOR git-guard run's `git stash pop` conflicted and the
-# resulting conflict markers were never resolved before the next deploy
-# attempt. Must be checked BEFORE the dirty-tree commit flow below, because
-# an unmerged path shows up as "dirty" too, and `git add -A` would silently
-# stage the literal <<<<<<< / ======= / >>>>>>> markers into a real commit.
-if git ls-files -u | grep -q .; then
-  echo "ERROR: unresolved merge conflict markers present in the working tree."
-  echo "Refusing to auto-commit over a conflict — this would push literal"
-  echo "<<<<<<< / ======= / >>>>>>> markers to origin/main."
-  echo
-  echo "Conflicted paths:"
-  git diff --name-only --diff-filter=U | sed 's/^/  /'
-  echo
-  echo "Remediation options:"
-  echo "  A) Resolve the conflict by hand, then commit and push:"
-  echo "       cd $DIR"
-  echo "       git status                       # see conflicted paths"
-  echo "       git diff                          # inspect the conflict markers"
-  echo "       \$EDITOR <conflicted-file>          # remove markers, keep correct content"
-  echo "       git add <conflicted-file>"
-  echo "       git commit -m 'resolve git-guard stash-pop conflict'"
-  echo "       git push origin main"
-  echo "  B) Discard the conflicted merge attempt entirely and start clean from"
-  echo "     origin/main, then decide separately whether to re-apply anything"
-  echo "     from a prior safety stash:"
-  echo "       cd $DIR"
-  echo "       git checkout -- ."
-  echo "       git reset --hard origin/main"
-  echo "       git stash list                    # look for a git-guard-safety-stash-* entry"
-  echo "       git stash show -p stash@{N}         # inspect before deciding"
-  echo "  C) Once resolved (via A or B) and no longer needed, clean up the stash:"
-  echo "       git stash drop stash@{N}"
-  exit 1
-fi
-
 # ---- Case: dirty tracked changes ----
 if [ "$DIRTY" -eq 1 ]; then
   echo "!! WORKING TREE DIRTY — uncommitted changes detected:"
   git status --short
   echo
 
-  # If local is ALSO stale/diverged from origin, committing right now would
-  # create a doomed commit on top of a base that's about to be rejected on
-  # push (this is exactly what caused a real incident: a stray on-disk edit
-  # sat on a checkout that was 4 commits behind, git-guard auto-committed
-  # anyway, then the push bounced). Stash first, resync safely using the
-  # same rules as the clean-tree path, then reapply.
-  if [ "$LOCAL" != "$REMOTE" ]; then
-    echo "!! Local main is ALSO stale/diverged from origin/main."
-    echo "   Refusing to commit on top of a stale base — stashing the dirty"
-    echo "   changes safely first, then resyncing with origin."
-    echo
-
-    STASH_MSG="git-guard-safety-stash-$(date -u +%Y%m%dT%H%M%SZ)"
-    if ! git stash push -u -m "$STASH_MSG"; then
-      echo "ERROR: 'git stash push' itself failed (disk full, permissions, or"
-      echo "       some other git error). Your changes are still on disk,"
-      echo "       uncommitted — nothing has been lost, but git-guard cannot"
-      echo "       proceed safely until this is resolved."
-      echo
-      echo "Remediation options:"
-      echo "  A) Check disk space and permissions, then retry the deploy:"
-      echo "       df -h $DIR"
-      echo "       ls -la $DIR"
-      echo "  B) Identify and manually move aside whatever is blocking the stash,"
-      echo "     then retry:"
-      echo "       cd $DIR"
-      echo "       git status --short              # find the offending path(s)"
-      echo "       mv <path> <path>.bak-\$(date +%s)"
-      echo "  C) Inspect the raw git error above for specifics before proceeding."
-      exit 1
-    fi
-    echo "==> Stashed as: $STASH_MSG"
-
-    if resync_with_origin "$LOCAL" "$REMOTE" "$BASE"; then
-      echo "==> Resync succeeded. Reapplying stashed changes..."
-      if git stash pop; then
-        echo "==> Stash reapplied cleanly. Re-checking sync state..."
-        exec bash "$0" "$@"
-      else
-        echo "ERROR: 'git stash pop' did not complete successfully."
-        echo
-        if git ls-files -u | grep -q .; then
-          echo "This is a MERGE CONFLICT — your stashed changes were partially"
-          echo "applied and conflict markers (<<<<<<< / ======= / >>>>>>>) are now"
-          echo "in the working tree. The stash itself is still preserved as a backup."
-          echo
-          echo "Remediation options:"
-          echo "  A) Resolve the conflict by hand, then commit and push:"
-          echo "       cd $DIR"
-          echo "       git status                       # see conflicted paths"
-          echo "       git diff                          # inspect the markers"
-          echo "       \$EDITOR <conflicted-file>          # remove markers, keep correct content"
-          echo "       git add <conflicted-file>"
-          echo "       git commit -m 'resolve git-guard stash-pop conflict'"
-          echo "       git push origin main"
-          echo "       git stash list                    # confirm which entry is: $STASH_MSG"
-          echo "       git stash drop stash@{N}           # once confirmed no longer needed"
-          echo "  B) Abandon this merge attempt and fall back to a clean, resynced"
-          echo "     tree, then re-apply the change manually with full visibility:"
-          echo "       cd $DIR"
-          echo "       git checkout -- ."
-          echo "       git reset --hard origin/main      # now matches origin, no conflict"
-          echo "       git stash list                    # find: $STASH_MSG"
-          echo "       git stash show -p stash@{N}         # review the content"
-          echo "       git stash apply stash@{N}          # 'apply' keeps the backup; use 'pop' to also drop it"
-        else
-          echo "This looks like an UNTRACKED-FILE COLLISION, not a merge conflict"
-          echo "(a file added upstream shares a path with an untracked file in your"
-          echo "stash). No conflict markers were written; the stash was NOT applied"
-          echo "and remains fully intact."
-          echo
-          echo "Remediation options:"
-          echo "  A) Move the colliding upstream file aside, pop, then reconcile:"
-          echo "       cd $DIR"
-          echo "       git status --short                         # identify the colliding path"
-          echo "       mv <path> <path>.upstream-\$(date +%s)"
-          echo "       git stash pop"
-          echo "       diff <path> <path>.upstream-*               # reconcile manually, then remove the .upstream-* backup"
-          echo "  B) Inspect the stash without applying, and hand-merge the needed"
-          echo "     pieces instead:"
-          echo "       git stash list                              # find N"
-          echo "       git stash show -p stash@{N}"
-        fi
-        echo
-        echo "Your stash reference for this run: $STASH_MSG"
-        exit 1
-      fi
-    else
-      echo "ERROR: could not safely resync with origin/main."
-      echo "Your uncommitted changes are preserved in the stash: $STASH_MSG"
-      echo
-      echo "Remediation options:"
-      echo "  A) Follow the manual recovery steps printed above (from the"
-      echo "     behind/ahead/diverged case), THEN reapply your change:"
-      echo "       cd $DIR"
-      echo "       git stash list                 # find: $STASH_MSG"
-      echo "       git stash apply stash@{N}      # or 'pop' to also drop it once resynced"
-      echo "  B) If the stashed change is no longer needed (e.g. it's already"
-      echo "     represented in a since-merged PR), verify then drop it:"
-      echo "       git stash show -p stash@{N}"
-      echo "       git stash drop stash@{N}"
-      exit 1
-    fi
-  fi
-
   if [ "$INTERACTIVE" -eq 1 ]; then
     read -rp "Commit and push these changes to origin/main now? [y/N] " ans
   else
@@ -411,8 +54,7 @@ if [ "$DIRTY" -eq 1 ]; then
 
     if git diff --cached | grep -Eiq "$SECRET_PATTERN"; then
       echo "ERROR: possible secret detected in staged changes. Refusing to auto-commit."
-      echo "Review manually:"
+      echo "Review manually: git diff --cached"
-      echo "  cd $DIR && git diff --cached"
       git reset
       exit 1
     fi
@@ -421,25 +63,80 @@ if [ "$DIRTY" -eq 1 ]; then
 
     if git push origin main; then
       echo "==> Pushed. Re-checking sync state..."
-      exec bash "$0" "$@"
+      exec "$0" "$@"
     else
       echo "ERROR: push failed (likely diverged from origin). Aborting deploy."
-      echo "Run:"
+      echo "Run: cd $DIR && git status"
-      echo "  cd $DIR && git status"
       exit 1
     fi
   else
-    echo "Aborting deploy - commit or stash changes manually, then retry:"
+    echo "Aborting deploy - commit or stash changes manually, then retry."
-    echo "  cd $DIR"
-    echo "  git add -A && git commit -m 'your message' && git push origin main"
-    echo "  # or: git stash push -u -m 'manual-stash'"
     exit 1
   fi
 fi
 
-# ---- Clean tree: resync with origin using the shared logic above ----
+# ---- Case: fully in sync ----
-if resync_with_origin "$LOCAL" "$REMOTE" "$BASE"; then
+if [ "$LOCAL" = "$REMOTE" ]; then
+  echo "==> In sync with origin/main ($LOCAL). OK to deploy."
   exit 0
-else
-  exit 1
 fi
+
+# ---- Case: behind only (fast-forwardable) ----
+if [ "$LOCAL" = "$BASE" ]; then
+  echo "!! Local main is behind origin/main."
+  if [ "$INTERACTIVE" -eq 1 ]; then
+    read -rp "Fast-forward pull now? [y/N] " ans
+  else
+    ans="y"
+    echo "(non-interactive session — auto fast-forwarding)"
+  fi
+  if [[ "$ans" =~ ^[Yy]$ ]]; then
+    git pull --ff-only origin main
+    echo "==> Fast-forwarded to $(git rev-parse --short main). OK to deploy."
+    exit 0
+  else
+    echo "Aborting deploy - pull manually, then retry."
+    exit 1
+  fi
+fi
+
+# ---- Case: ahead only (local commits not yet pushed) ----
+if [ "$REMOTE" = "$BASE" ]; then
+  echo "!! Local main is AHEAD of origin/main (unpushed commits):"
+  git log --oneline "origin/main..main"
+  echo
+  if [ "$INTERACTIVE" -eq 1 ]; then
+    read -rp "Push local commits to origin/main now? [y/N] " ans
+  else
+    ans="n"
+    echo "(non-interactive session — will NOT auto-push ahead commits; needs human review)"
+  fi
+  if [[ "$ans" =~ ^[Yy]$ ]]; then
+    git push origin main
+    echo "==> Pushed. OK to deploy."
+    exit 0
+  else
+    echo "Aborting deploy. Review with: git log origin/main..main"
+    exit 1
+  fi
+fi
+
+# ---- Case: true divergence (both ahead and behind) — NEVER auto-fix ----
+echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+echo "!! DIVERGED: local main and origin/main have both moved independently."
+echo "!!"
+echo "!!   Local-only commits:"
+git log --oneline "$BASE..main" | sed 's/^/!!     /'
+echo "!!"
+echo "!!   Remote-only commits:"
+git log --oneline "$BASE..origin/main" | sed 's/^/!!     /'
+echo "!!"
+echo "!! This requires a human decision - git-guard will NOT auto-resolve this."
+echo "!! Recommended recovery:"
+echo "!!   1. tar backup:      tar czf /volume1/docker/compose-files-backup-\$(date +%Y%m%d-%H%M%S).tar.gz -C /volume1/docker compose-files"
+echo "!!   2. name the branch: git branch backup/pre-reset-\$(date +%Y%m%d)"
+echo "!!   3. stash all state: git stash push -u -m 'pre-reset-snapshot'"
+echo "!!   4. reset to origin: git reset --hard origin/main"
+echo "!!   5. selectively restore needed files from the stash/backup branch"
+echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+exit 1

deploy/stack-deploy.sh

@@ -38,36 +38,10 @@
 #     pre-escaping) or values get doubled twice. Getting this wrong
 #     silently corrupts any secret/hash containing '$' (confirmed impact:
 #     LITELLM keys truncated, IMMICH_KIOSK_BASICAUTH bcrypt hash mismatched).
-#
-# Usage: stack-deploy.sh [-e|--emergency] [-f|--force] <stack-name>
-#   Flags may appear before or after the stack name, e.g. both
-#   `stack-deploy.sh traefik -e` and `stack-deploy.sh -e traefik` work.
-#
-# -e/--emergency and -f/--force (added 2026-09-12, circular-dependency
-# bootstrap incident — see deploy/git-guard.sh header for full detail):
-#   Both are passed straight through to git-guard.sh unchanged; this script
-#   does not interpret them itself beyond stripping them from the stack-name
-#   argument list. -e tries alternate Gitea endpoints (VIP, then each node's
-#   direct IP) before falling back to normal sync logic against whichever
-#   one responds. -f skips the sync check entirely — last resort only, read
-#   the warning banner it prints. Neither flag changes anything about the
-#   render/mount-guard/deploy steps below; they only affect whether and how
-#   git-guard.sh's pre-flight check runs.
 
 set -euo pipefail
 
-# ── Flag parsing (stack name is whatever's left after flags are stripped) ──
+STACK="${1:?Usage: stack-deploy.sh <stack-name>}"
-GUARD_FLAGS=()
-STACK=""
-for arg in "$@"; do
-  case "$arg" in
-    -e|--emergency) GUARD_FLAGS+=(-e) ;;
-    -f|--force)     GUARD_FLAGS+=(-f) ;;
-    *)              STACK="$arg" ;;
-  esac
-done
-: "${STACK:?Usage: stack-deploy.sh [-e|--emergency] [-f|--force] <stack-name>}"
-
 DIR="/volume1/docker/compose-files"
 PY="$DIR/deploy/envparse.py"
 MOUNT_GUARD="$DIR/deploy/mount-guard.py"
@@ -76,7 +50,7 @@ GLOBAL_ENV="$DIR/deploy/global.env"
 # ── Pre-flight: ensure local checkout is in sync with Gitea ─────────────────
 # Prevents deploying from a stale/diverged local tree (see incident 2026-08-26).
 # Invoked via `bash` explicitly so the tracked file's exec bit doesn't matter.
-bash "$DIR/deploy/git-guard.sh" "${GUARD_FLAGS[@]:-}" || { echo "ERROR: git-guard check failed. Deploy aborted."; exit 1; }
+bash "$DIR/deploy/git-guard.sh" || { echo "ERROR: git-guard check failed. Deploy aborted."; exit 1; }
 
 # ── Locate compose file(s) ──────────────────────────────────────────────────
 

homeassistant/homeassistant.yaml

@@ -63,15 +63,6 @@ services:
       FRIGATE_RTSP_PASSWORD: "${FRIGATE_RTSP_PASSWORD}"
     networks:
       - traefik_backend
-    ports:
-      - target: 8555
-        published: 8555
-        protocol: udp
-        mode: ingress
-      - target: 8555
-        published: 8555
-        protocol: tcp
-        mode: ingress
     deploy:
       labels:
         - traefik.enable=true

secrets/README.md

@@ -6,9 +6,9 @@ This directory documents the secrets required for each Docker Swarm stack.
 
 ```
 Secret values live in Woodpecker (encrypted)
-    → pipeline reads them at deploy time
+    ↓ pipeline reads them at deploy time
 Docker Swarm secret store (encrypted Raft DB, replicated across all nodes)
-    → mounted into containers at runtime
+    ↓ mounted into containers at runtime
 /run/secrets/<secret_name>
 ```
 
@@ -38,10 +38,7 @@ Use the stack's `.secrets.example` file as your checklist.
 
 ### Step 2 — Add the stack's case to `.woodpecker.yml`
 In the `provision-secrets` step, add a case for the stack that calls
-`create_or_update_secret` for each secret. (Or, preferred for new
+`create_or_update_secret` for each secret.
-migrations: add an entry to `secrets/secrets-map.yaml` + a
-`<stack>.env.template` and call `deploy/provision-stack.py <stack>`
-instead — see the `ai` and `traefik` entries for the current pattern.)
 
 ### Step 3 — Test by pushing a trivial change to the stack's yaml file
 Watch the pipeline run: provision-secrets → validate → deploy → verify → notify.
@@ -74,20 +71,10 @@ Examples:
 - **PostgreSQL is highest risk.** Its master password is used by nearly every
   other stack. Migrate it last.
 
-- **Never commit a rendered env file, even by accident.** `traefik/traefik.env`
-  was committed to git for a period (discovered/fixed 2026-09-12) with a
-  literal "***REDACTED***" placeholder as KEEPALIVED_PASSWORD, which was
-  silently restored every time the file was deleted or the checkout resynced
-  from git — causing a real VRRP auth outage. `.gitignore` blanket-excludes
-  `*.env`, but that rule does NOT retroactively untrack a file already
-  committed before the rule existed. If you ever see a stack's `.env` file
-  show up in `git status` as tracked, stop and untrack it (`git rm --cached`)
-  before doing anything else.
-
 ## Migration Status
 
 | Stack | Secrets in Woodpecker | Pipeline Step Added | .env Removed |
-|-------|------------------------|----------------------|---------------|
+|-------|----------------------|---------------------|--------------|
 | 3dprint | ⏳ | ⏳ | ⏳ |
 | ai | ⏳ | ⏳ | ⏳ |
 | auth | ⏳ | ⏳ | ⏳ |
@@ -104,7 +91,7 @@ Examples:
 | postgresql | ⏳ | ⏳ | ⏳ |
 | productivity | ⏳ | ⏳ | ⏳ |
 | security | ⏳ | ⏳ | ⏳ |
-| traefik | ✅ (manifest-driven, 2026-09-12) | ✅ (manifest-driven, 2026-09-12) | ⏳ |
+| traefik | ⏳ | ⏳ | ⏳ |
 | unifi | ✅ N/A (no secrets) | ✅ N/A | ⏳ |
 | vaultwarden | ⏳ | ⏳ | ⏳ |
 | woodpecker | ⏳ Manual only | ⏳ N/A | ⏳ |

secrets/secrets-map.yaml

@@ -1,4 +1,4 @@
-# ─────────────────────────────────────────────────────────────────────────
+# ─────────────────────────────────────────────────────────────────────────────
 # secrets-map.yaml — DATA-ONLY manifest for deploy/provision-stack.py
 #
 # RULES:
@@ -27,7 +27,7 @@
 #
 # Stacks not listed here fall through to deploy.yml's legacy case-entries
 # untouched. Migration is deliberately one stack per PR.
-# ─────────────────────────────────────────────────────────────────────────
+# ─────────────────────────────────────────────────────────────────────────────
 stacks:
   ai:
     env_template: ai/ai.env.template
@@ -36,6 +36,3 @@ stacks:
       flowagent_azure_client_id: FLOWAGENT_AZURE_CLIENT_ID
       flowagent_azure_tenant_id: FLOWAGENT_AZURE_TENANT_ID
       flowagent_azure_client_secret: FLOWAGENT_AZURE_CLIENT_SECRET
-  traefik:
-    env_template: traefik/traefik.env.template
-    env_dest: traefik/traefik.env

secrets/traefik.secrets.example

@@ -1,8 +1,5 @@
 # traefik Stack — Secrets Reference
-# Source: traefik.env.template (rendered by deploy/provision-stack.py per
+# Source: traefik.env
-#         secrets/secrets-map.yaml — see secrets-map.yaml header for how
-#         this works). traefik/traefik.env is rendered fresh on every
-#         provisioning run and is NEVER committed to git.
 #
 # Add SECRET values to Woodpecker at:
 #   https://woodpecker.bryanmail.net
@@ -11,44 +8,27 @@
 # ⚠️  HIGH RISK: Traefik is the entry point for all homelab services.
 #     If this stack fails, nothing is reachable from outside.
 #     Migrate carefully. The Keepalived VIP (192.168.4.30) depends on this stack.
-#
-# ⚠️  2026-09-12 INCIDENT: traefik.env was previously committed to git with a
-#     literal "***REDACTED***" placeholder as KEEPALIVED_PASSWORD. Every
-#     git-guard resync/checkout restored that broken value onto disk,
-#     diverging from keepalived-backup's stale-but-correct in-memory value
-#     and causing continuous VRRP auth failures + VIP instability. This was
-#     the trigger for migrating this stack to Pattern C. If you ever see
-#     KEEPALIVED_PASSWORD as a literal placeholder-looking string on disk
-#     again, do NOT hand-edit it — check `git log traefik/` for a stray
-#     commit and fix the template in Gitea instead.
 
-# ── SECRETS (add to Woodpecker) ─────────────────────────────────────────
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
 
 # Woodpecker secret name:  traefik_keepalived_password
 # Used for:               Keepalived VRRP authentication password
 #                         Must match across all 3 nodes (docker-1, docker-2, docker-3)
-#                          NOTE: classic VRRP simple-auth is silently
+# Env var in .env:        KEEPALIVED_PASSWORD
-#                          truncated to 8 chars by keepalived itself — keep
-#                          the value <= 8 characters, or be aware only the
-#                          first 8 are actually significant on the wire.
-# Env var in .env.template: KEEPALIVED_PASSWORD (via TRAEFIK_KEEPALIVED_PASSWORD)
 traefik_keepalived_password=
 
-# ── NON-SECRETS (safe in compose file or .env.template) ─────────────────
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
 
-# KEEPALIVED_VIRTUAL_IPS       Python2BASH list of VIP addresses (192.168.4.30) — literal in template
+# KEEPALIVED_UNICAST_PEERS     Python2BASH list of peer IPs
+# KEEPALIVED_VIRTUAL_IPS       Python2BASH list of VIP addresses (192.168.4.30)
 # ACME_EMAIL                   Let's Encrypt certificate email
 # TRUSTED_IPS                  Trusted proxy CIDR ranges
 # TRAEFIK_HOST                 Traefik dashboard hostname
 # SPEEDTEST_HOST               Speedtest Traefik hostname
 # WHOAMI_HOST                  Whoami Traefik hostname
 
-# ── Provisioning (manifest-driven, deploy/provision-stack.py) ───────────
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
 #
-# This stack is migrated — provisioning happens automatically via:
+#   traefik)
-#   secrets/secrets-map.yaml (traefik: entry)
+#     create_or_update_secret "traefik_keepalived_password" "$TRAEFIK_KEEPALIVED_PASSWORD"
-#   traefik/traefik.env.template (authoritative key list)
+#     ;;
-#   deploy/provision-stack.py (renders + ships traefik/traefik.env)
-#
-# The .woodpecker/deploy.yml provision-secrets step calls this with a
-# single line: `python3 deploy/provision-stack.py traefik`

traefik/logrotate/README.md

@@ -1,120 +0,0 @@
-# Traefik Log Rotation
-
-## Why this exists
-
-`traefik/traefik.yaml` runs Traefik with:
-- `--accesslog.filePath=/traefik/logs/access.log`
-- `--log.filePath=/traefik/logs/traefik.log`
-- `--log.level=DEBUG`
-
-Neither file has any built-in rotation -- Traefik has no native rotate-on-size
-nor a SIGUSR1/reopen handler. Docker's `json-file` log-driver rotation
-(`max-size`/`max-file`) only applies to stdout, not to files Traefik writes
-directly via `--accesslog.filePath`/`--log.filePath`. Result: `access.log` grew
-to **~15.5GB unrotated** before this was caught, on a CephFS volume
-(`/volume1/docker-root`) already at 82-84% used. Both the disk pressure and
-the ongoing write latency of appending to a 15GB file on a network filesystem
-on every request through Traefik were flagged as a real risk factor during
-troubleshooting (Uptime Kuma WebSocket flapping investigation, Sep 2026).
-
-**Note:** during that investigation, the actual root cause of the WebSocket
-flapping turned out to be Uptime Kuma monitor misconfigurations (a Postgres
-monitor throwing a null-reference error, and several monitors failing TLS
-validation against self-signed/internal-IP certs) -- not this log file. This
-rotation fix is still worth doing as general disk/IO hygiene, just not
-causally tied to that incident.
-
-## Architecture constraint this design accounts for
-
-`traefik_reverse-proxy` runs Swarm *`mode: global`* -- one instance on **each**
-of docker-1, docker-2, docker-3. All three write to the **same physical file**
-via the shared CephFS bind mount `/volume1/docker/traefik -> /traefik`
-(identical mount, visible identically from any node). That rules out:
-
-- **Signal-based rotation** (classic `create` + `postrotate` sending SIGUSR1):
-  Traefik doesn't implement a reopen signal, and even if it did, you'd need to
-  signal 3 separate per-node containers in lockstep.
-- **Running logrotate on just one node**: works until that node is down, then
-  rotation silently stops with no alert.
-
-So this setup uses:
-1. **`copytruncate`** (see `traefik-logs.conf`) -- all three Traefik processes
-   keep writing to the same inode, no signaling needed. Tradeoff: a few log
-   lines written in the exact copy/truncate instant can be lost -- fine for
-   diagnostic logs.
-2. **Cron on all three nodes**, coordinated via a shared `flock` + shared
-   logrotate state file, both also on the CephFS mount (see
-   `traefik-logrotate.sh`). Whichever node's cron fires first grabs the lock,
-   rotates if due, and updates the shared state so the other two nodes' cron
-   runs see it's already done. No single node is a rotation SPOF.
-3. **Size-triggered** (`size 250M`) rather than calendar-triggered (`daily`) --
-   this file can grow fast under bursts (see incident background above); a
-   purely daily interval would still let it balloon between runs. Cron checks
-   every 15 minutes, so it cannot grow much past the 250M threshold in practice.
-
-## Install (one-time, per node)
-
-Must run on **all three** docker LXCs -- this is host-level cron/logrotate
-config, not something `stack-deploy.sh` can reach (it only touches Swarm
-services, not host cron jobs).
-
-```bash
-# On each of docker-1 (192.168.4.31), docker-2 (192.168.4.32), docker-3 (192.168.4.33):
-ssh root@<192.168.4.31|.32|.33>
-cd /volume1/docker/compose-files
-bash deploy/git-guard.sh         # confirm sync first, as always
-sudo bash traefik/logrotate/install.sh
-```
-
-Verify on each node:
-```bash
-cat /etc/cron.d/traefik-logrotate
-logrotate -d /etc/logrotate.d/traefik-logs   # dry-run, confirms syntax
-```
-
-## Bootstrapping -- shrinking the *existing* oversized log file
-
-**Not done automatically by `install.sh`.** The new size-triggered config only
-prevents *future* unbounded growth -- it won't touch the current 15.5GB file
-until the next time it crosses 250M (i.e. never, since it's already well past
-that and logrotate only acts on crossing the threshold going forward from its
-recorded size at last check).
-
-`copytruncate` always copies the full current file before truncating it --
-that's inherent to how it works, not a bug. Forcing a rotation of the current
-15.5GB file would momentarily need roughly another 15-GB-sized chunk of free
-space -- and `/volume1/docker-root` only had **~14G free** at last check.
-Doing this blindly could tip the volume to 100% mid-operation.
-
-**Recommended manual step (operator-run, on any one node -- it's the same
-CephFS file from all three)**: these are diagnostic access/debug logs, not
-something worth preserving in full, so just truncate directly rather than
-compress-then-truncate:
-
-```bash
-# Optional: keep a small tail sample for reference before truncating
-tail -c 50000000 /volume1/docker/traefik/logs/access.log > \
-  /volume1/docker/traefik-access-log-archive-$(date +%Y%m%d).log
-
-# Then truncate in place (safe -- Traefik's existing file handles on all 3
-# nodes stay valid, same as copytruncate's own mechanism):
-: > /volume1/docker/traefik/logs/access.log
-: > /volume1/docker/traefik/logs/traefik.log
-
-# Confirm:
-df -h /volume1/docker-root
-ls -la /volume1/docker/traefik/logs/
-```
-
-After this one-time bootstrap, the cron+logrotate setup keeps it bounded
-(rotates at 250M, keeps 48 compressed generations, prunes anything over 14
-days old) going forward without needing any further manual intervention.
-
-## Related, NOT included in this change (follow-up to consider separately)
-
-`traefik.yaml` currently runs `--log.level=DEBUG` -- verbose debug logging in
-production, which is a meaningful contributor to how fast these files grow.
-Lowering to `INFO` would reduce volume significantly but requires a real
-modification + redeploy of the high-blast-radius `traefik` stack (all
-HTTP/HTTPS routing depends on it), so it's intentionally left out of this PR
-and should be its own reviewed change if wanted.

traefik/logrotate/install.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-# One-time installer for Traefik log rotation.
-#
-# MUST be run manually, once, on EACH of docker-1, docker-2, docker-3.
-# This is intentionally NOT part of stack-deploy.sh / the Woodpecker
-# pipeline: it installs a host-level cron.d entry and /etc/logrotate.d
-# config, and `docker stack deploy` has no mechanism to reach outside the
-# Swarm/container boundary onto host cron. See README.md for why this needs
-# to run on all three nodes.
-#
-# Usage (from a checkout of this repo, on each node):
-#   sudo bash traefik/logrotate/install.sh
-set -euo pipefail
-
-if [[ $EUID -ne 0 ]]; then
-  echo "Run as root (sudo)." >&2
-  exit 1
-fi
-
-REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-echo "Installing logrotate config..."
-install -m 0644 "$REPO_DIR/traefik-logs.conf" /etc/logrotate.d/traefik-logs
-
-echo "Installing rotation wrapper..."
-install -m 0755 "$REPO_DIR/traefik-logrotate.sh" /usr/local/sbin/traefik-logrotate.sh
-
-echo "Installing cron.d schedule (every 15 minutes)..."
-cat > /etc/cron.d/traefik-logrotate << 'EOF'
-# Managed by homelab/compose-files traefik/logrotate/install.sh -- do not
-# hand-edit; update traefik/logrotate/*.{conf,sh} in Gitea and re-run
-# install.sh instead.
-*/15 * * * * root /usr/local/sbin/traefik-logrotate.sh
-EOF
-chmod 0644 /etc/cron.d/traefik-logrotate
-
-echo "Verifying logrotate config syntax..."
-logrotate -d /etc/logrotate.d/traefik-logs
-
-echo "Done. First rotation check runs on the next cron tick (up to 15 min)."
-echo "This only rotates going forward once the file crosses the size threshold."
-echo "To shrink the EXISTING already-large log file, see README.md -- that is"
-echo "a separate, deliberate manual step (not done by this script) because it"
-echo "needs disk headroom awareness first."

traefik/logrotate/traefik-logrotate.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-# Wrapper invoked by cron on docker-1/docker-2/docker-3 to rotate the shared
-# Traefik access/error logs (see traefik-logs.conf for the "full why").
-#
-# Because /volume1/docker/traefik/logs is the SAME physical CephFS path on
-# all three nodes, and cron on all three nodes runs this independently, we
-# use a shared flock (also on the CephFS mount, so it's visible cluster-wide)
-# to guarantee only one node actually executes logrotate at a time, and a
-# SHARED state file so whichever node runs it knows the true last-rotated
-# time regardless of which node rotated it last. If a node is down, the
-# other two still cover the schedule -- none of this relies on a specific
-# node being up.
-set -euo pipefail
-
-LOCK_DIR="/volume1/docker/traefik/logrotate-state"
-LOCK_FILE="$LOCK_DIR/rotate.lock"
-STATE_FILE="$LOCK_DIR/status"
-CONF_FILE="/etc/logrotate.d/traefik-logs"
-
-mkdir -p "$LOCK_DIR"
-touch "$STATE_FILE"
-
-exec 200>"$LOCK_FILE"
-if ! flock -n 200; then
-  # Another node already holds the lock this cycle -- normal, not an error.
-  exit 0
-fi
-
-/usr/sbin/logrotate -s "$STATE_FILE" "$CONF_FILE"

traefik/logrotate/traefik-logs.conf

@@ -1,43 +0,0 @@
-# Traefik access/error log rotation
-#
-# CONTEXT: traefik_reverse-proxy runs in Swarm `mode: global` (traefik.yaml),
-# meaning one instance runs on EACH of docker-1/docker-2/docker-3. All three
-# write to the SAME physical file via the shared CephFS bind mount
-# /volume1/docker/traefik/logs -> /traefik (identical path from any node --
-# see infra context: /volume1/docker is a shared CephFS mount).
-#
-# `copytruncate` is REQUIRED here (not the default create+signal approach):
-# Traefik has no SIGUSR1/SIGHUP "reopen log file" handling, and even if it
-# did, coordinating a reopen signal across 3 independent per-node containers
-# writing to one shared inode is unnecessary complexity. copytruncate keeps
-# every writer's existing file descriptor valid (truncates in place) so all
-# three Traefik processes keep appending to the same inode with zero
-# signaling. Tradeoff: a handful of log lines written in the exact
-# copy/truncate instant can be lost -- acceptable for diagnostic access/error
-# logs, not used for anything transactional.
-#
-# Size-triggered (not calendar-triggered) on purpose: this file can grow fast
-# under bursts (see incident that prompted this -- 15.5GB accumulated with
-# --log.level=DEBUG set). `size` is checked every time the wrapper script runs
-# (cron, every 15 minutes -- see install.sh), so it cannot balloon unbounded
-# between checks the way a plain `daily` interval would.
-#
-# Installed via install.sh on ALL THREE docker LXCs (docker-1, docker-2,
-# docker-3) -- see README.md. This is a HOST-level cron/logrotate config,
-# outside the Woodpecker/stack-deploy.sh pipeline (docker stack deploy has no
-# mechanism to touch host cron), so it must be applied manually once per node,
-# not via a stack redeploy.
-
-/volume1/docker/traefik/logs/*.log {
-    size 250M
-    rotate 48
-    maxage 14
-    compress
-    delaycompress
-    missingok
-    notifempty
-    copytruncate
-    dateext
-    dateformat -%Y%m%d-%H%M%S
-    su root root
-}

traefik/traefik.env

@@ -0,0 +1,2 @@
+KEEPALIVED_PASSWORD=***REDACTED***
+KEEPALIVED_VIRTUAL_IPS="#PYTHON2BASH:['192.168.4.30']"

traefik/traefik.env.template

@@ -1,52 +0,0 @@
-# ─────────────────────────────────────────────────────────────────────────
-# traefik.env.template — AUTHORITATIVE template for traefik/traefik.env
-# (rendered by deploy/provision-stack.py per secrets/secrets-map.yaml)
-#
-#   - This file IS the complete key list for traefik.env. The whole file is
-#     rendered on every provisioning run — no line surgery, so a key can
-#     never silently go missing.
-#   - Non-secret config lives here as LITERAL values (visible, reviewable).
-#   - Secret values are dollar-brace placeholders resolved from the CI env
-#     (Woodpecker from_secret vars) at provisioning time. provision-stack.py
-#     FAILS HARD if any placeholder is missing/empty.
-#   - The rendered traefik/traefik.env exists only on the host (gitignored).
-#   - Rendered by provision-stack.py, NOT Woodpecker's yaml preprocessor —
-#     single-dollar placeholders are safe here (deploy.yml's double-dollar
-#     rule does NOT apply to this file).
-#
-# Consumed by traefik/traefik.yaml (KEEPALIVED_PASSWORD, KEEPALIVED_VIRTUAL_IPS).
-# DOMAIN comes from deploy/global.env, not here.
-#
-# ⚠️ HIGH RISK: Traefik is the entry point for all homelab services, and the
-#    Keepalived VIP (192.168.4.30) depends on this stack. KEEPALIVED_PASSWORD
-#    MUST be identical across keepalived-master and keepalived-backup — both
-#    consume this same rendered value — or VRRP auth fails and the VIP
-#    becomes unstable (this is exactly what the 2026-09-12 incident was:
-#    a committed literal "***REDACTED***" placeholder in git, restored every
-#    time the file was deleted/re-synced, diverging from -backup's stale but
-#    correct in-memory value).
-#
-#    Classic VRRP simple-auth is silently truncated to 8 characters by
-#    keepalived itself. Set TRAEFIK_KEEPALIVED_PASSWORD in Woodpecker to a
-#    value 8 characters or fewer (or accept that only the first 8 chars are
-#    actually significant) so the effective negotiated value is unambiguous.
-#
-#   2026-09-12 RE-TRIGGER: traefik.env was found MISSING on disk after the
-#   Pattern C migration merged — the manifest-driven provisioning render only
-#   happens on a push that changes traefik/, and traefik is bootstrap-tier
-#   (stack-deploy.sh must be run manually; the pipeline never auto-deploys
-#   this stack). A manual `stack-deploy.sh traefik` had apparently been run
-#   while traefik.env was absent, causing Swarm's own interpolation to
-#   silently render KEEPALIVED_PASSWORD/KEEPALIVED_VIRTUAL_IPS as EMPTY
-#   STRINGS on keepalived-master (not missing — empty, which is worse,
-#   since it's a valid-looking VRRP auth string that mismatches everything).
-#   This comment-only change re-triggers provision-secrets to re-render and
-#   re-ship traefik.env; a manual `stack-deploy.sh traefik` must still be run
-#   afterward to actually apply it to the running services.
-# ─────────────────────────────────────────────────────────────────────────
-
-# ── Keepalived (non-secret config) ────────────────────────────────────────
-KEEPALIVED_VIRTUAL_IPS="#PYTHON2BASH:['192.168.4.30']"
-
-# ── Keepalived (secret) ────────────────────────────────────────────────────
-KEEPALIVED_PASSWORD=${TRAEFIK_KEEPALIVED_PASSWORD}