Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Bot
|
a15e0100df | ||
|
Bot
|
bcfb24b16d | ||
|
Bot
|
42d31e38e4 | ||
 AVB
|
16a01a9ea5 |
+49
-6
@@ -179,6 +179,12 @@ steps:
|
||||
from_secret: ai_open_webui_database_url
|
||||
AI_OAUTH_CLIENT_SECRET:
|
||||
from_secret: ai_oauth_client_secret
|
||||
FLOWAGENT_AZURE_CLIENT_ID:
|
||||
from_secret: flowagent_azure_client_id
|
||||
FLOWAGENT_AZURE_TENANT_ID:
|
||||
from_secret: flowagent_azure_tenant_id
|
||||
FLOWAGENT_AZURE_CLIENT_SECRET:
|
||||
from_secret: flowagent_azure_client_secret
|
||||
commands:
|
||||
- apk add --no-cache openssh-client
|
||||
- mkdir -p ~/.ssh
|
||||
@@ -221,10 +227,36 @@ steps:
|
||||
ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'gamma_auth_token' '$${GAMMA_AUTH_TOKEN}'";;
|
||||
git)
|
||||
ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'git_db_password' '$${GIT_DB_PASSWORD}'
|
||||
create_or_update_secret 'git_runner_token' '$${GIT_RUNNER_TOKEN}'
|
||||
create_or_update_secret 'git_mcp_access_token' '$${GIT_MCP_ACCESS_TOKEN}'";;
|
||||
# PATTERN B, DELIBERATE (see decision notes) — git hosts the source
|
||||
# of truth for every other stack's compose files, so it must be
|
||||
# restorable from a flat git.yaml + git.env backup alone, with zero
|
||||
# dependency on a running Swarm's Docker secret store. Native Docker
|
||||
# secrets (Pattern C) can't satisfy that: they only exist inside an
|
||||
# already-running Swarm, which is exactly the circular dependency
|
||||
# this stack can't have. Mirrors the ai) case's grep -v + printf
|
||||
# rewrite-in-place approach, never sed (values may contain slash,
|
||||
# dollar sign, ampersand).
|
||||
#
|
||||
# TEST PHASE: target is git.env.pipelinetest, NOT the real git.env.
|
||||
# The real file is never opened for writing by this step. First run
|
||||
# seeds the test file from the real git.env (carries over all
|
||||
# non-secret lines untouched); every push after that only refreshes
|
||||
# the 3 secret lines below. Also strips the legacy GITEA_ACCESS_TOKEN
|
||||
# key name so the test file converges on the git.env.example-
|
||||
# documented GITEA_MCP_ACCESS_TOKEN key. Cutover to the real file —
|
||||
# and pointing git.yaml/stack-deploy at it — is a deliberate,
|
||||
# separate follow-up after manually diffing this render.
|
||||
ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "FILE=/volume1/docker/compose-files/git.env.pipelinetest
|
||||
TMP=\$FILE.tmp.\$\$
|
||||
[ -f \$FILE ] || cp /volume1/docker/compose-files/git.env \$FILE
|
||||
grep -vE '^(GITEA__database__PASSWD|GITEA_RUNNER_REGISTRATION_TOKEN|GITEA_MCP_ACCESS_TOKEN|GITEA_ACCESS_TOKEN)=' \$FILE > \$TMP 2>/dev/null || touch \$TMP
|
||||
{ cat \$TMP
|
||||
printf 'GITEA__database__PASSWD=%s\n' '$${GIT_DB_PASSWORD}'
|
||||
printf 'GITEA_RUNNER_REGISTRATION_TOKEN=%s\n' '$${GIT_RUNNER_TOKEN}'
|
||||
printf 'GITEA_MCP_ACCESS_TOKEN=%s\n' '$${GIT_MCP_ACCESS_TOKEN}'
|
||||
} > \$FILE
|
||||
rm -f \$TMP
|
||||
echo ' [OK] git.env.pipelinetest updated - real git.env untouched'";;
|
||||
homeassistant)
|
||||
ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'homeassistant_frigate_rtsp_password' '$${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
|
||||
@@ -279,6 +311,13 @@ steps:
|
||||
# unresolved at compose-render time (empty), silently breaking Bedrock auth.
|
||||
# All other migrated vars in ai.yaml use plain (unprefixed) names, so only
|
||||
# these two lines need the AI_ prefix.
|
||||
#
|
||||
# FLOWAGENT NOTE (added alongside the ai.yaml mcpo image/secrets cutover):
|
||||
# the 3 flowagent_azure_* values are provisioned as native Docker secrets
|
||||
# below (Pattern C, matches every other _FILE-convention stack), NOT written
|
||||
# into ai/ai.env — mcpo's flowagent entry reads them via
|
||||
# /run/secrets/flowagent_azure_* (see mcp-config/flowagent/entrypoint.sh),
|
||||
# not via env var, so they don't belong in this stack's Pattern B .env block.
|
||||
ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "FILE=/volume1/docker/compose-files/ai/ai.env
|
||||
TMP=\$FILE.tmp.\$\$
|
||||
grep -vE '^(AI_AWS_ACCESS_KEY_ID|AI_AWS_SECRET_ACCESS_KEY|LITELLM_MASTER_KEY|LITELLM_SALT_KEY|POSTGRES_PASSWORD|DATABASE_URL|WEBUI_SECRET_KEY|OPEN_WEBUI_DATABASE_URL|OAUTH_CLIENT_SECRET)=' \$FILE > \$TMP 2>/dev/null || touch \$TMP
|
||||
@@ -294,7 +333,11 @@ steps:
|
||||
printf 'OAUTH_CLIENT_SECRET=%s\n' '$${AI_OAUTH_CLIENT_SECRET}'
|
||||
} > \$FILE
|
||||
rm -f \$TMP
|
||||
echo ' [OK] ai/ai.env secrets updated'";;
|
||||
echo ' [OK] ai/ai.env secrets updated'
|
||||
source /tmp/cs.sh
|
||||
create_or_update_secret 'flowagent_azure_client_id' '$${FLOWAGENT_AZURE_CLIENT_ID}'
|
||||
create_or_update_secret 'flowagent_azure_tenant_id' '$${FLOWAGENT_AZURE_TENANT_ID}'
|
||||
create_or_update_secret 'flowagent_azure_client_secret' '$${FLOWAGENT_AZURE_CLIENT_SECRET}'";;
|
||||
entertainment)
|
||||
ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
||||
create_or_update_secret 'entertainment_discord_token' '$${ENTERTAINMENT_DISCORD_TOKEN}'
|
||||
@@ -352,7 +395,7 @@ steps:
|
||||
|
||||
# Bootstrap-tier guard: file synced to host, deploy is MANUAL
|
||||
case "$STACK" in
|
||||
traefik|woodpecker|postgresql|secrets)
|
||||
traefik|woodpecker|postgresql|secrets|git)
|
||||
echo " [BOOTSTRAP] $STACK: file synced. Deploy is MANUAL."
|
||||
echo " Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
|
||||
continue ;;
|
||||
|
||||
+15
-1
@@ -127,7 +127,7 @@ services:
|
||||
labels:
|
||||
- traefik.enable=false
|
||||
mcpo:
|
||||
image: ghcr.io/open-webui/mcpo:main
|
||||
image: git.bryanmail.net/homelab/flowagent-mcpo:916164714429
|
||||
command:
|
||||
- --config
|
||||
- /app/config/config.json
|
||||
@@ -141,6 +141,13 @@ services:
|
||||
- /volume1/docker/mcpo/data:/mcpo_data
|
||||
- /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
|
||||
- /volume1/docker/mcpo/uv-cache:/app/uv-cache
|
||||
secrets:
|
||||
- source: flowagent_azure_client_id
|
||||
target: flowagent_azure_client_id
|
||||
- source: flowagent_azure_tenant_id
|
||||
target: flowagent_azure_tenant_id
|
||||
- source: flowagent_azure_client_secret
|
||||
target: flowagent_azure_client_secret
|
||||
networks:
|
||||
- traefik_backend
|
||||
deploy:
|
||||
@@ -173,6 +180,13 @@ services:
|
||||
- traefik.http.middlewares.n8n.headers.STSPreload=true
|
||||
- traefik.http.routers.n8n.middlewares=forwardAuth-authentik@file, crowdsec@file
|
||||
- traefik.swarm.network=traefik_backend
|
||||
secrets:
|
||||
flowagent_azure_client_id:
|
||||
external: true
|
||||
flowagent_azure_tenant_id:
|
||||
external: true
|
||||
flowagent_azure_client_secret:
|
||||
external: true
|
||||
networks:
|
||||
traefik_backend:
|
||||
external: true
|
||||
|
||||
Reference in New Issue
Block a user