Change AWS_REGION_NAME variable

Add AWS Region Name variable
Update ai/ai.yaml
2026-09-06 20:33:56 -07:00 · 2026-09-06 20:33:08 -07:00 · 2026-09-06 10:59:05 -07:00 · 2026-09-06 10:53:55 -07:00 · 2026-09-06 10:44:53 -07:00 · 2026-09-06 10:29:27 -07:00
2 changed files with 122 additions and 36 deletions
@@ -173,12 +173,42 @@ steps:
        from_secret: ai_litellm_salt_key
      AI_LITELLM_DB_PASSWORD:
        from_secret: ai_litellm_db_password
-      AI_WEBUI_SECRET_KEY:
+      AI_LITELLM_DATABASE_MIGRATIONS:
+        from_secret: litellm_database_migrations
+      AI_LITELLM_MODIFY_PARAMS:
+        from_secret: litellm_modify_params
+      AI_OPEN_WEBUI_SECRET_KEY:
        from_secret: ai_webui_secret_key
      AI_OPEN_WEBUI_DATABASE_URL:
        from_secret: ai_open_webui_database_url
-      AI_OAUTH_CLIENT_SECRET:
+      AI_OPEN_WEB_UI_OAUTH_CLIENT_SECRET:
        from_secret: ai_oauth_client_secret
+      AI_OPEN_WEB_UI_ENABLE_OAUTH_SIGNUP:
+        from_secret: ai_open_web_ui_enable_oauth_signup
+      AI_OPEN_WEB_UI_OAUTH_MERGE_ACCOUNTS_BY_EMAIL:
+        from_secret: ai_open_web_ui_oauth_merge_accounts_by_email
+      AI_OPEN_WEB_UI_OAUTH_PROVIDER_NAME:
+        from_secret: ai_open_web_ui_oauth_provider_name
+      AI_OPEN_WEB_UI_OPENID_PROVIDER_URL:
+        from_secret: ai_open_web_ui_openid_provider_url
+      AI_OPEN_WEB_UI_OAUTH_CLIENT_ID:
+        from_secret: ai_open_web_ui_oauth_client_id
+      AI_OPEN_WEB_UI_OAUTH_SCOPES:
+        from_secret: ai_open_web_ui_oauth_scopes
+      AI_OPEN_WEB_UI_OPENID_REDIRECT_URI:
+        from_secret: ai_open_web_ui_openid_redirect_uri
+      AI_LITELLM_DATABASE_URL:
+        from_secret: ai_litellm_database_url
+      AI_LITELLM_POSTGRES_PASSWORD:
+        from_secret: ai_litellm_postgres_password
+      AI_AWS_REGION_NAME:
+        from_secret: ai_aws_region_name
+      FLOWAGENT_AZURE_CLIENT_ID:
+        from_secret: flowagent_azure_client_id
+      FLOWAGENT_AZURE_TENANT_ID:
+        from_secret: flowagent_azure_tenant_id
+      FLOWAGENT_AZURE_CLIENT_SECRET:
+        from_secret: flowagent_azure_client_secret
    commands:
      - apk add --no-cache openssh-client
      - mkdir -p ~/.ssh
@@ -221,10 +251,36 @@ steps:
              ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'gamma_auth_token' '$${GAMMA_AUTH_TOKEN}'";;
            git)
-              ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
-                create_or_update_secret 'git_db_password'       '$${GIT_DB_PASSWORD}'
-                create_or_update_secret 'git_runner_token'      '$${GIT_RUNNER_TOKEN}'
-                create_or_update_secret 'git_mcp_access_token'  '$${GIT_MCP_ACCESS_TOKEN}'";;
+              # PATTERN B, DELIBERATE (see decision notes) — git hosts the source
+              # of truth for every other stack's compose files, so it must be
+              # restorable from a flat git.yaml + git.env backup alone, with zero
+              # dependency on a running Swarm's Docker secret store. Native Docker
+              # secrets (Pattern C) can't satisfy that: they only exist inside an
+              # already-running Swarm, which is exactly the circular dependency
+              # this stack can't have. Mirrors the ai) case's grep -v + printf
+              # rewrite-in-place approach, never sed (values may contain slash,
+              # dollar sign, ampersand).
+              #
+              # TEST PHASE: target is git.env.pipelinetest, NOT the real git.env.
+              # The real file is never opened for writing by this step. First run
+              # seeds the test file from the real git.env (carries over all
+              # non-secret lines untouched); every push after that only refreshes
+              # the 3 secret lines below. Also strips the legacy GITEA_ACCESS_TOKEN
+              # key name so the test file converges on the git.env.example-
+              # documented GITEA_MCP_ACCESS_TOKEN key. Cutover to the real file —
+              # and pointing git.yaml/stack-deploy at it — is a deliberate,
+              # separate follow-up after manually diffing this render.
+              ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "FILE=/volume1/docker/compose-files/git.env.pipelinetest
+                TMP=\$FILE.tmp.\$\$
+                [ -f \$FILE ] || cp /volume1/docker/compose-files/git.env \$FILE
+                grep -vE '^(GITEA__database__PASSWD|GITEA_RUNNER_REGISTRATION_TOKEN|GITEA_MCP_ACCESS_TOKEN|GITEA_ACCESS_TOKEN)=' \$FILE > \$TMP 2>/dev/null || touch \$TMP
+                { cat \$TMP
+                  printf 'GITEA__database__PASSWD=%s\n' '$${GIT_DB_PASSWORD}'
+                  printf 'GITEA_RUNNER_REGISTRATION_TOKEN=%s\n' '$${GIT_RUNNER_TOKEN}'
+                  printf 'GITEA_MCP_ACCESS_TOKEN=%s\n' '$${GIT_MCP_ACCESS_TOKEN}'
+                } > \$FILE
+                rm -f \$TMP
+                echo '  [OK] git.env.pipelinetest updated - real git.env untouched'";;
            homeassistant)
              ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'homeassistant_frigate_rtsp_password' '$${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
@@ -279,22 +335,38 @@ steps:
              # unresolved at compose-render time (empty), silently breaking Bedrock auth.
              # All other migrated vars in ai.yaml use plain (unprefixed) names, so only
              # these two lines need the AI_ prefix.
+              #
+              # FLOWAGENT NOTE (added alongside the ai.yaml mcpo image/secrets cutover):
+              # the 3 flowagent_azure_* values are provisioned as native Docker secrets
+              # below (Pattern C, matches every other _FILE-convention stack), NOT written
+              # into ai/ai.env — mcpo's flowagent entry reads them via
+              # /run/secrets/flowagent_azure_* (see mcp-config/flowagent/entrypoint.sh),
+              # not via env var, so they don't belong in this stack's Pattern B .env block.
              ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "FILE=/volume1/docker/compose-files/ai/ai.env
                TMP=\$FILE.tmp.\$\$
-                grep -vE '^(AI_AWS_ACCESS_KEY_ID|AI_AWS_SECRET_ACCESS_KEY|LITELLM_MASTER_KEY|LITELLM_SALT_KEY|POSTGRES_PASSWORD|DATABASE_URL|WEBUI_SECRET_KEY|OPEN_WEBUI_DATABASE_URL|OAUTH_CLIENT_SECRET)=' \$FILE > \$TMP 2>/dev/null || touch \$TMP
+                grep -vE '^(AI_AWS_ACCESS_KEY_ID|AI_AWS_SECRET_ACCESS_KEY|AI_LITELLM_MASTER_KEY|AI_LITELLM_SALT_KEY|AI_LITELLM_POSTGRES_PASSWORD|AI_LITELLM_DATABASE_URL|AI_OPEN_WEBUI_SECRET_KEY|AI_OPEN_WEBUI_DATABASE_URL|AI_OPEN_WEB_UI_OAUTH_CLIENT_SECRET)=' \$FILE > \$TMP 2>/dev/null || touch \$TMP
                { cat \$TMP
                  printf 'AI_AWS_ACCESS_KEY_ID=%s\n' '$${AI_AWS_ACCESS_KEY_ID}'
                  printf 'AI_AWS_SECRET_ACCESS_KEY=%s\n' '$${AI_AWS_SECRET_ACCESS_KEY}'
-                  printf 'LITELLM_MASTER_KEY=%s\n' '$${AI_LITELLM_MASTER_KEY}'
-                  printf 'LITELLM_SALT_KEY=%s\n' '$${AI_LITELLM_SALT_KEY}'
-                  printf 'POSTGRES_PASSWORD=%s\n' '$${AI_LITELLM_DB_PASSWORD}'
-                  printf 'DATABASE_URL=postgresql://LiteLLM:%s@postgresql:5432/litellm\n' '$${AI_LITELLM_DB_PASSWORD}'
-                  printf 'WEBUI_SECRET_KEY=%s\n' '$${AI_WEBUI_SECRET_KEY}'
-                  printf 'OPEN_WEBUI_DATABASE_URL=%s\n' '$${AI_OPEN_WEBUI_DATABASE_URL}'
-                  printf 'OAUTH_CLIENT_SECRET=%s\n' '$${AI_OAUTH_CLIENT_SECRET}'
+                  printf 'AI_AWS_REGION_NAME=%s\n' '$${AI_AWS_REGION_NAME}'
+                  printf 'AI_LITELLM_MASTER_KEY=%s\n' '$${AI_LITELLM_MASTER_KEY}'
+                  printf 'AI_LITELLM_SALT_KEY=%s\n' '$${AI_LITELLM_SALT_KEY}'
+                  printf 'AI_LITELLM_POSTGRES_PASSWORD=%s\n' '$${AI_LITELLM_DB_PASSWORD}'
+                  printf 'AI_LITELLM_DATABASE_URL=%s\n' '$${AI_LITELLM_DATABASE_URL}'
+                  printf 'AI_LITELLM_POSTGRES_PASSWORD=%s\n' '$${AI_LITELLM_POSTGRES_PASSWORD}'
+                  printf 'AI_LITELLM_MODIFY_PARAMS=%s\n' '$${AI_LITELLM_MODIFY_PARAMS}'
+                  printf 'AI_LITELLM_DATABASE_MIGRATIONS=%s\n' '$${AI_LITELLM_DATABASE_MIGRATIONS}'
+                  printf 'AI_OPEN_WEBUI_SECRET_KEY=%s\n' '$${AI_OPEN_WEBUI_SECRET_KEY}'
+                  printf 'AI_OPEN_WEBUI_DATABASE_URL=%s\n' '$${AI_OPEN_WEBUI_DATABASE_URL}'
+                  printf 'AI_WEBUI_SECRET_KEY=%s\n' '$${AI_OPEN_WEBUI_SECRET_KEY}'
+                  printf 'AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET=%s\n' '$${AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET}'
                } > \$FILE
                rm -f \$TMP
-                echo '  [OK] ai/ai.env secrets updated'";;
+                echo '  [OK] ai/ai.env secrets updated'
+                source /tmp/cs.sh
+                create_or_update_secret 'flowagent_azure_client_id'     '$${FLOWAGENT_AZURE_CLIENT_ID}'
+                create_or_update_secret 'flowagent_azure_tenant_id'     '$${FLOWAGENT_AZURE_TENANT_ID}'
+                create_or_update_secret 'flowagent_azure_client_secret' '$${FLOWAGENT_AZURE_CLIENT_SECRET}'";;
            entertainment)
              ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                create_or_update_secret 'entertainment_discord_token'          '$${ENTERTAINMENT_DISCORD_TOKEN}'
@@ -352,7 +424,7 @@ steps:

          # Bootstrap-tier guard: file synced to host, deploy is MANUAL
          case "$STACK" in
-            traefik|woodpecker|postgresql|secrets)
+            traefik|woodpecker|postgresql|secrets|git)
              echo "  [BOOTSTRAP] $STACK: file synced. Deploy is MANUAL."
              echo "  Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
              continue ;;
@@ -1,6 +1,6 @@
 services:
  open-webui:
-    image: ghcr.io/open-webui/open-webui:0.11.1
+    image: ghcr.io/open-webui/open-webui:0.11.3 #
    entrypoint:
    - /bin/bash
    - /app/tools/startup.sh
@@ -16,20 +16,20 @@ services:
      start_period: 60s
    environment:
    - OLLAMA_BASE_URL=http://ollama-intel-arc:11434
-    - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
+    - WEBUI_SECRET_KEY=${AI_OPEN_WEBUI_SECRET_KEY}
    - WEBUI_DB_HOST=postgresql
-    - DATABASE_URL=${OPEN_WEBUI_DATABASE_URL}
+    - DATABASE_URL=${AI_OPEN_WEBUI_DATABASE_URL}
    - ENABLE_TOOL_SERVER_CALLING=true
    - TOOL_SERVER_CALLING=true
-    - WEBUI_URL=${WEBUI_URL}
-    - ENABLE_OAUTH_SIGNUP=${ENABLE_OAUTH_SIGNUP}
-    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
-    - OAUTH_PROVIDER_NAME=${OAUTH_PROVIDER_NAME}
-    - OPENID_PROVIDER_URL=${OPENID_PROVIDER_URL}
-    - OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
-    - OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
-    - OAUTH_SCOPES=${OAUTH_SCOPES}
-    - OPENID_REDIRECT_URI=${OPENID_REDIRECT_URI}
+    - WEBUI_URL=${AI_OPEN_WEBUI_URL}
+    - ENABLE_OAUTH_SIGNUP=${AI_OPEN_WEBUI_ENABLE_OAUTH_SIGNUP}
+    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${AI_OPEN_WEBUI_OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
+    - OAUTH_PROVIDER_NAME=${AI_OPEN_WEBUI_OAUTH_PROVIDER_NAME}
+    - OPENID_PROVIDER_URL=${AI_OPEN_WEBUI_OPENID_PROVIDER_URL}
+    - OAUTH_CLIENT_ID=${AI_OPEN_WEBUI_OAUTH_CLIENT_ID}
+    - OAUTH_CLIENT_SECRET=${AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET}
+    - OAUTH_SCOPES=${AI_OPEN_WEBUI_OAUTH_SCOPES}
+    - OPENID_REDIRECT_URI=${AI_OPEN_WEBUI_OPENID_REDIRECT_URI}
    networks:
    - traefik_backend
    - postgresql_db-backend
@@ -62,13 +62,13 @@ services:
    environment:
    - AWS_ACCESS_KEY_ID=${AI_AWS_ACCESS_KEY_ID}
    - AWS_SECRET_ACCESS_KEY=${AI_AWS_SECRET_ACCESS_KEY}
-    - AWS_REGION_NAME=${AWS_REGION_NAME}
-    - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
-    - LITELLM_SALT_KEY=${LITELLM_SALT_KEY}
-    - DATABASE_URL=${DATABASE_URL}
-    - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
-    - LITELLM_MODIFY_PARAMS=${LITELLM_MODIFY_PARAMS}
-    - LITELLM_DATABASE_MIGRATIONS=${LITELLM_DATABASE_MIGRATIONS}
+    - AWS_REGION_NAME=${AI_AWS_REGION_NAME}
+    - LITELLM_MASTER_KEY=${AI_LITELLM_MASTER_KEY}
+    - LITELLM_SALT_KEY=${AI_LITELLM_SALT_KEY}
+    - DATABASE_URL=${AI_LITELLM_DATABASE_URL}
+    - POSTGRES_PASSWORD=${AI_LITELLM_POSTGRES_PASSWORD}
+    - LITELLM_MODIFY_PARAMS=${AI_LITELLM_MODIFY_PARAMS}
+    - LITELLM_DATABASE_MIGRATIONS=${AI_LITELLM_DATABASE_MIGRATIONS}
    networks:
    - traefik_backend
    - postgresql_db-backend
@@ -127,7 +127,7 @@ services:
      labels:
      - traefik.enable=false
  mcpo:
-    image: ghcr.io/open-webui/mcpo:main
+    image: git.bryanmail.net/homelab/flowagent-mcpo:c5b22618404a
    command:
    - --config
    - /app/config/config.json
@@ -141,6 +141,13 @@ services:
    - /volume1/docker/mcpo/data:/mcpo_data
    - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
    - /volume1/docker/mcpo/uv-cache:/app/uv-cache
+    secrets:
+    - source: flowagent_azure_client_id
+      target: flowagent_azure_client_id
+    - source: flowagent_azure_tenant_id
+      target: flowagent_azure_tenant_id
+    - source: flowagent_azure_client_secret
+      target: flowagent_azure_client_secret
    networks:
    - traefik_backend
    deploy:
@@ -173,6 +180,13 @@ services:
      - traefik.http.middlewares.n8n.headers.STSPreload=true
      - traefik.http.routers.n8n.middlewares=forwardAuth-authentik@file, crowdsec@file
      - traefik.swarm.network=traefik_backend
+secrets:
+  flowagent_azure_client_id:
+    external: true
+  flowagent_azure_tenant_id:
+    external: true
+  flowagent_azure_client_secret:
+    external: true
 networks:
  traefik_backend:
    external: true
Author	SHA1	Message	Date
AVB	264f4e7379	Change AWS_REGION_NAME variable ci/woodpecker/push/deploy Pipeline was successful Details ci/woodpecker/cron/renovate Pipeline was successful Details	2026-09-06 20:33:56 -07:00
AVB	9bbbd5fae3	Add AWS Region Name variable ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 20:33:08 -07:00
AVB	e33fd8695f	Update ai/ai.yaml ci/woodpecker/push/deploy Pipeline was successful Details ci/woodpecker/cron/renovate Pipeline was successful Details	2026-09-06 10:59:05 -07:00
AVB	1828c89194	Update .woodpecker/deploy.yml ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 10:53:55 -07:00
AVB	9ec5353d7e	Fixed LITELLM Database URL ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 10:44:53 -07:00
AVB	dfa0d34a83	Update ai/ai.yaml ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 10:29:27 -07:00
AVB	66638dd743	Update ai/ai.yaml ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 01:29:02 -07:00
Bot	355ccada8c	Update ai/ai.yaml ci/woodpecker/push/deploy Pipeline failed Details ci/woodpecker/cron/renovate Pipeline was successful Details	2026-09-03 00:15:38 -07:00
Bot	096ebd6de5	Update .woodpecker/deploy.yml ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-02 23:28:25 -07:00
Bot	980c54f84e	Update .woodpecker/deploy.yml	2026-09-02 23:27:19 -07:00
Bot	324a06ed2d	Update .woodpecker/deploy.yml	2026-09-02 23:26:30 -07:00
Bot	cee47822ec	Update .woodpecker/deploy.yml	2026-09-02 23:25:39 -07:00
Bot	68365746a6	Update .woodpecker/deploy.yml	2026-09-02 23:24:37 -07:00
Bot	eecfcf9367	Update .woodpecker/deploy.yml	2026-09-02 23:23:57 -07:00
Bot	d01c763354	Update .woodpecker/deploy.yml Redeploy after adding secret: secret "ai_open_web_ui_openid_provider_url" not found	2026-09-02 23:17:48 -07:00
Bot	0baee47b67	Fixed duplicate env: "AI_OPEN_WEB_UI_ENABLE_OAUTH_SIG" yaml: construct errors: line 190: mapping key "AI_OPEN_WEB_UI_ENABLE_OAUTH_SIGNUP" already defined at line 186	2026-09-02 23:02:51 -07:00
Bot	0435def8a0	Update .woodpecker/deploy.yml Added Open WebUI and LiteLLM secrets	2026-09-02 23:01:44 -07:00
Bot	ded255decc	Upgrade to open-webui:0.11.3 ci/woodpecker/push/deploy Pipeline was successful Details open-webui:0.11.1 > open-webui:0.11.3	2026-09-02 22:26:15 -07:00
Bot	ac091999b4	Merge pull request 'FlowAgent MCP cutover: point ai.yaml's mcpo at flowagent-mcpo image + wire Azure secrets (matched pair)' (#14 ) from flowagent-ai-cutover into main ci/woodpecker/push/deploy Pipeline failed Details Reviewed-on: #14 https://ai.bryanmail.net/c/9f4c84c7-7aa1-4b24-a27e-98be6a5e737e	2026-09-02 21:43:18 -07:00
Bot	a15e0100df	provision-secrets: add flowagent_* case-entry to the ai) stack (matched pair with ai.yaml's mcpo cutover) Surgical addition to the existing case "ai)" block only — every other case, comment, and line in this ~26KB pipeline file is byte-for-byte unchanged from main. Given this file's documented incident history from prior full-file rewrites (see header comment), this was hand-verified against the current main content line-by-line before writing, not generated fresh. Adds: - 3 new environment: entries (FLOWAGENT_AZURE_CLIENT_ID/TENANT_ID/ CLIENT_SECRET) via from_secret, alongside the existing ai_* secrets - Inside the existing `ai)` case, after the ai.env rewrite block: three create_or_update_secret calls provisioning flowagent_azure_client_id, flowagent_azure_tenant_id, flowagent_azure_client_secret as native Docker Swarm secrets (Pattern C, _FILE convention) — NOT written into ai/ai.env, since mcpo's flowagent entry reads them via /run/secrets/flowagent_azure_* per flowagent/entrypoint.sh, not env vars - A short comment explaining why these three are Pattern C secrets inside an otherwise Pattern-B (host .env) stack case This is the matched-pair companion to the ai.yaml commit in this same PR, per the FlowAgent progress note's explicit sequencing requirement (both land together, reviewed, not auto-merged to main).	2026-09-02 16:53:10 -07:00
Bot	bcfb24b16d	ai.yaml: cut mcpo over to the confirmed-working flowagent-mcpo image + wire flowagent Docker secrets (never touches mcpo-critical) Image pinned to git.bryanmail.net/homelab/flowagent-mcpo:916164714429 — the exact sha-tagged image built and smoke-tested clean in mcp-config pipeline #22 (build-and-push-flowagent + smoke-test-flowagent-image both success). NOT :latest, for reproducible deploys. Adds a secrets: block to the mcpo service only, referencing the 3 flowagent_azure_* Docker Swarm secrets (Pattern C, _FILE convention, consumed by flowagent/entrypoint.sh via /run/secrets/flowagent_azure_*). Declares those 3 secrets as external at top level, mirroring the existing vaultwarden_admin_token_v2 pattern in vaultwarden.yaml. Companion secret-provisioning change lands in the same PR as a separate commit in .woodpecker/deploy.yml's provision-secrets step (case "ai)"). mcpo-critical (lines defining Proxmox access) is completely untouched — still stock ghcr.io/open-webui/mcpo:main, no secrets: block, unchanged. Per FlowAgent MCP progress note: Azure AD App Registration is reported created with real secrets already in Woodpecker (both mcp-config and compose-files repos) as of this PR. This is a reviewed PR against a feature branch, NOT auto-merged to main — deploy only happens after manual review/merge, per user's explicit request for a manual-revert safety net on this high-blast-radius shared stack (LiteLLM, Open WebUI, n8n also live here).	2026-09-02 16:51:31 -07:00
Bot	42d31e38e4	git stack: switch provision-secrets to Pattern B .env rewrite (test phase) + add git to bootstrap-tier guard ci/woodpecker/push/deploy Pipeline was successful Details ci/woodpecker/cron/renovate Pipeline was successful Details Context: git hosts the source of truth for every other stack's compose files, so in a disaster-recovery scenario it must be restorable from a flat git.yaml + git.env backup alone, with zero dependency on a running Swarm's Docker secret store (native Docker secrets can't be resolved until Swarm already exists, which is the circular dependency git.yaml would otherwise create). Path 2 (documented decision): Pattern B for git specifically, same mechanism the ai stack already uses. provision-secrets / git) case: - Previously created native Docker secrets (git_db_password, git_runner_token, git_mcp_access_token) via create-secrets.sh — leftover from an earlier, abandoned Pattern C attempt. - Now rewrites only the secret-bearing lines (GITEA__database__PASSWD, GITEA_RUNNER_REGISTRATION_TOKEN, GITEA_MCP_ACCESS_TOKEN) via grep -v + printf, mirroring the ai) case exactly. Also strips the legacy GITEA_ACCESS_TOKEN key name so the test file converges on the git.env.example-documented key. - TEST PHASE: target is git.env.pipelinetest, NOT git.env. The real git.env is never opened for writing by this step. First run seeds the test file from the real git.env (to carry over all non-secret lines), then only the 3 secret lines are refreshed on every push. - Real cutover (pointing git.yaml/stack-deploy at the generated file, then retiring git.env.pipelinetest) is a deliberate follow-up step after manually diffing the rendered output. deploy / bootstrap-tier guard: - Added git to the traefik\|woodpecker\|postgresql\|secrets guard list. git.yaml changes now sync to the host but require a manual `stack-deploy.sh git` run, same as the other foundational stacks — prevents an auto-deploy of a bad git.yaml change from taking down Gitea before a human can look at it (Gitea itself is what every other pipeline needs to trigger a fix).	2026-09-02 00:02:36 -07:00
AVB	16a01a9ea5	Merge pull request 'Remove orphaned mcpo/ mirror (migrated to homelab/mcp-config)' (#13 ) from remove-orphaned-mcpo-mirror into main ci/woodpecker/push/deploy Pipeline failed Details ci/woodpecker/cron/renovate Pipeline was successful Details Reviewed-on: #13	2026-08-29 20:57:58 -07:00