Merge pull request 'Provisioning v2 (take 2): data-only manifest + full-file env template + generic provisioner — replaces #15 ' (#16 ) from secrets-provisioning-v3 into main

Reviewed-on: #16 https://ai.bryanmail.net/c/9f4c84c7-7aa1-4b24-a27e-98be6a5e737e
provision-secrets: ai) case -> provision-stack.py + normalized env block (branch rebuilt on current main)
2026-09-07 22:06:03 -07:00 · 2026-09-07 21:47:04 -07:00 · 2026-09-07 21:43:57 -07:00 · 2026-09-07 21:43:05 -07:00 · 2026-09-07 21:43:04 -07:00 · 2026-09-06 20:33:56 -07:00
1 changed files with 19 additions and 19 deletions
@@ -16,20 +16,20 @@ services:
      start_period: 60s
    environment:
    - OLLAMA_BASE_URL=http://ollama-intel-arc:11434
-    - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
+    - WEBUI_SECRET_KEY=${AI_OPEN_WEBUI_SECRET_KEY}
    - WEBUI_DB_HOST=postgresql
-    - DATABASE_URL=${OPEN_WEBUI_DATABASE_URL}
+    - DATABASE_URL=${AI_OPEN_WEBUI_DATABASE_URL}
    - ENABLE_TOOL_SERVER_CALLING=true
    - TOOL_SERVER_CALLING=true
-    - WEBUI_URL=${WEBUI_URL}
+    - WEBUI_URL=${AI_OPEN_WEBUI_URL}
-    - ENABLE_OAUTH_SIGNUP=${ENABLE_OAUTH_SIGNUP}
+    - ENABLE_OAUTH_SIGNUP=${AI_OPEN_WEBUI_ENABLE_OAUTH_SIGNUP}
-    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
+    - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=${AI_OPEN_WEBUI_OAUTH_MERGE_ACCOUNTS_BY_EMAIL}
-    - OAUTH_PROVIDER_NAME=${OAUTH_PROVIDER_NAME}
+    - OAUTH_PROVIDER_NAME=${AI_OPEN_WEBUI_OAUTH_PROVIDER_NAME}
-    - OPENID_PROVIDER_URL=${OPENID_PROVIDER_URL}
+    - OPENID_PROVIDER_URL=${AI_OPEN_WEBUI_OPENID_PROVIDER_URL}
-    - OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
+    - OAUTH_CLIENT_ID=${AI_OPEN_WEBUI_OAUTH_CLIENT_ID}
-    - OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
+    - OAUTH_CLIENT_SECRET=${AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET}
-    - OAUTH_SCOPES=${OAUTH_SCOPES}
+    - OAUTH_SCOPES=${AI_OPEN_WEBUI_OAUTH_SCOPES}
-    - OPENID_REDIRECT_URI=${OPENID_REDIRECT_URI}
+    - OPENID_REDIRECT_URI=${AI_OPEN_WEBUI_OPENID_REDIRECT_URI}
    networks:
    - traefik_backend
    - postgresql_db-backend
@@ -62,13 +62,13 @@ services:
    environment:
    - AWS_ACCESS_KEY_ID=${AI_AWS_ACCESS_KEY_ID}
    - AWS_SECRET_ACCESS_KEY=${AI_AWS_SECRET_ACCESS_KEY}
-    - AWS_REGION_NAME=${AWS_REGION_NAME}
+    - AWS_REGION_NAME=${AI_AWS_REGION_NAME}
-    - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
+    - LITELLM_MASTER_KEY=${AI_LITELLM_MASTER_KEY}
-    - LITELLM_SALT_KEY=${LITELLM_SALT_KEY}
+    - LITELLM_SALT_KEY=${AI_LITELLM_SALT_KEY}
-    - DATABASE_URL=${DATABASE_URL}
+    - DATABASE_URL=${AI_LITELLM_DATABASE_URL}
-    - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    - POSTGRES_PASSWORD=${AI_LITELLM_POSTGRES_PASSWORD}
-    - LITELLM_MODIFY_PARAMS=${LITELLM_MODIFY_PARAMS}
+    - LITELLM_MODIFY_PARAMS=${AI_LITELLM_MODIFY_PARAMS}
-    - LITELLM_DATABASE_MIGRATIONS=${LITELLM_DATABASE_MIGRATIONS}
+    - LITELLM_DATABASE_MIGRATIONS=${AI_LITELLM_DATABASE_MIGRATIONS}
    networks:
    - traefik_backend
    - postgresql_db-backend
@@ -127,7 +127,7 @@ services:
      labels:
      - traefik.enable=false
  mcpo:
-    image: git.bryanmail.net/homelab/flowagent-mcpo:916164714429
+    image: git.bryanmail.net/homelab/flowagent-mcpo:c5b22618404a
    command:
    - --config
    - /app/config/config.json
Author	SHA1	Message	Date
AVB	be587de5be	Merge pull request 'Provisioning v2 (take 2): data-only manifest + full-file env template + generic provisioner — replaces #15 ' (#16 ) from secrets-provisioning-v3 into main ci/woodpecker/push/deploy Pipeline failed Details Reviewed-on: #16 https://ai.bryanmail.net/c/9f4c84c7-7aa1-4b24-a27e-98be6a5e737e	2026-09-07 22:06:03 -07:00
Bot	ef7e3d015e	provision-secrets: ai) case -> provision-stack.py + normalized env block (branch rebuilt on current main) Same two scoped changes as PR #15's rebase, now applied on a branch cut from TODAY's main so the merge base is current (PR #15 became unmergeable — its 09-03 merge base predated main's heavy hand-edits): 1. ai) case -> `python3 deploy/provision-stack.py ai` (one line). Retires main's heredoc with its live drift: AI_LITELLM_POSTGRES_PASSWORD printed twice (one copy from retired AI_LITELLM_DB_PASSWORD), stray legacy AI_WEBUI_SECRET_KEY, and the WEB_UI/WEBUI shell-var mismatch that renders an EMPTY OAuth client secret into ai.env. 2. env block ai section: normalized to exact template placeholder names, added AI_MCPO_API_KEY (NEW Woodpecker secret required pre-merge), pruned now-template-literal vars. apk gains python3 py3-yaml. Everything else byte-matches current main. Dollar-escape audit done per header lesson.	2026-09-07 21:47:04 -07:00
Bot	89a1e030c0	Add deploy/provision-stack.py — generic manifest-driven provisioner Carried over from secrets-provisioning-v2 (PR #15), content identical. Whole-file template render (hard-fail naming missing vars), env + Docker secrets shipped via ssh stdin only, sha256-checksum skip-if-unchanged, never prints a value. Stacks absent from the manifest exit 0 so legacy case-entries keep handling them.	2026-09-07 21:43:57 -07:00
Bot	e82b754386	Add ai/ai.env.template — full-file authoritative env template (AI_<SERVICE>_* naming) Carried over from secrets-provisioning-v2 (PR #15) post-rebase. Key names match exactly what current ai/ai.yaml references; MCPO_API_KEY stays unprefixed (ai.yaml consumes it unprefixed for both mcpo services). Placeholder names match the CI env vars declared in deploy.yml's provision-secrets block, including the normalized AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET (fixing main's WEB_UI/WEBUI mismatch that currently renders an EMPTY OAuth client secret into ai.env). NEW Woodpecker secret required before merge: ai_mcpo_api_key.	2026-09-07 21:43:05 -07:00
Bot	85734f4601	Add secrets/secrets-map.yaml — data-only provisioning manifest (ai stack first) Carried over from secrets-provisioning-v2 (PR #15), which became unmergeable after heavy parallel hand-edits to main moved the merge base too far. Content identical to v2.	2026-09-07 21:43:04 -07:00
AVB	264f4e7379	Change AWS_REGION_NAME variable ci/woodpecker/push/deploy Pipeline was successful Details ci/woodpecker/cron/renovate Pipeline was successful Details	2026-09-06 20:33:56 -07:00
AVB	9bbbd5fae3	Add AWS Region Name variable ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 20:33:08 -07:00
AVB	e33fd8695f	Update ai/ai.yaml ci/woodpecker/push/deploy Pipeline was successful Details ci/woodpecker/cron/renovate Pipeline was successful Details	2026-09-06 10:59:05 -07:00
AVB	1828c89194	Update .woodpecker/deploy.yml ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 10:53:55 -07:00
AVB	9ec5353d7e	Fixed LITELLM Database URL ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 10:44:53 -07:00
AVB	dfa0d34a83	Update ai/ai.yaml ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 10:29:27 -07:00
AVB	66638dd743	Update ai/ai.yaml ci/woodpecker/push/deploy Pipeline was successful Details	2026-09-06 01:29:02 -07:00