#15's branch was cut 2026-09-03; main's deploy.yml has since been heavily hand-edited (AI_* renames, Proxmox parameterization), moving the merge base too far for git's three-way merge even though the content was manually reconciled. This branch is cut from today's main with the same 4 files applied fresh — merges clean.
What this delivers (provisioning v2, ai stack first)
File
Role
secrets/secrets-map.yaml
Data-only manifest: stack → env template + Docker-secret name mappings. No code, no values
ai/ai.env.template
Authoritative full env file — AI_<SERVICE>_* names matching current ai.yaml exactly; config as literals, secrets as placeholders
deploy/provision-stack.py
Generic provisioner: whole-file render, hard-fails NAMING missing vars, ships env + Docker secrets via ssh stdin only, never prints values
.woodpecker/deploy.yml
ai) case → one line. Everything else byte-identical to current main
⚠️ Fixes LIVE bugs in main's current ai) heredoc
AI_LITELLM_POSTGRES_PASSWORD printed twice (one copy from the retired AI_LITELLM_DB_PASSWORD secret)
Stray legacy AI_WEBUI_SECRET_KEY key current ai.yaml never reads
printf references shell var AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET but the env block declares AI_OPEN_WEB_UI_... (WEB_UI) → undefined at runtime → rendered ai.env currently carries an EMPTY OAuth client secret. Authentik SSO to Open WebUI breaks on the next ai redeploy from main unless this merges first. Do not push any ai/** change to main before this PR.
Pre-merge checklist
Woodpecker secret ai_mcpo_api_key created (value = current MCPO_API_KEY from host ai.env)
These hold full correct values: ai_litellm_database_url, ai_litellm_postgres_password, ai_oauth_client_secret, ai_webui_secret_key, ai_open_webui_database_url
After merge: provision-stack.py output shows complete render (names only); all 6 ai_* services healthy; Authentik SSO login to ai.bryanmail.net works
Deletable Woodpecker secrets after merge: litellm_database_migrations, litellm_modify_params, ai_aws_region_name, ai_litellm_db_password, the seven ai_open_web_ui_* config secrets.
Rollback
Revert the merge commit — legacy heredoc returns (with its bugs), ai.env on the host is untouched until the next provisioning run.
## Replaces PR #15 (unmergeable — stale merge base)
#15's branch was cut 2026-09-03; main's `deploy.yml` has since been heavily hand-edited (AI_* renames, Proxmox parameterization), moving the merge base too far for git's three-way merge even though the content was manually reconciled. This branch is cut from **today's main** with the same 4 files applied fresh — merges clean.
## What this delivers (provisioning v2, ai stack first)
| File | Role |
|---|---|
| `secrets/secrets-map.yaml` | Data-only manifest: stack → env template + Docker-secret name mappings. No code, no values |
| `ai/ai.env.template` | **Authoritative full env file** — `AI_<SERVICE>_*` names matching current ai.yaml exactly; config as literals, secrets as placeholders |
| `deploy/provision-stack.py` | Generic provisioner: whole-file render, hard-fails NAMING missing vars, ships env + Docker secrets via ssh stdin only, never prints values |
| `.woodpecker/deploy.yml` | `ai)` case → one line. Everything else byte-identical to current main |
## ⚠️ Fixes LIVE bugs in main's current `ai)` heredoc
1. `AI_LITELLM_POSTGRES_PASSWORD` printed **twice** (one copy from the retired `AI_LITELLM_DB_PASSWORD` secret)
2. Stray legacy `AI_WEBUI_SECRET_KEY` key current ai.yaml never reads
3. `printf` references shell var `AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET` but the env block declares `AI_OPEN_WEB_UI_...` (WEB_UI) → undefined at runtime → **rendered ai.env currently carries an EMPTY OAuth client secret**. Authentik SSO to Open WebUI breaks on the next ai redeploy from main unless this merges first. **Do not push any `ai/**` change to main before this PR.**
## Pre-merge checklist
- [ ] Woodpecker secret **`ai_mcpo_api_key`** created (value = current MCPO_API_KEY from host ai.env)
- [ ] These hold full correct values: `ai_litellm_database_url`, `ai_litellm_postgres_password`, `ai_oauth_client_secret`, `ai_webui_secret_key`, `ai_open_webui_database_url`
- [ ] After merge: provision-stack.py output shows complete render (names only); all 6 ai_* services healthy; Authentik SSO login to ai.bryanmail.net works
Deletable Woodpecker secrets after merge: `litellm_database_migrations`, `litellm_modify_params`, `ai_aws_region_name`, `ai_litellm_db_password`, the seven `ai_open_web_ui_*` config secrets.
## Rollback
Revert the merge commit — legacy heredoc returns (with its bugs), ai.env on the host is untouched until the next provisioning run.
Carried over from secrets-provisioning-v2 (PR #15), which became
unmergeable after heavy parallel hand-edits to main moved the merge base
too far. Content identical to v2.
Carried over from secrets-provisioning-v2 (PR #15) post-rebase. Key names
match exactly what current ai/ai.yaml references; MCPO_API_KEY stays
unprefixed (ai.yaml consumes it unprefixed for both mcpo services).
Placeholder names match the CI env vars declared in deploy.yml's
provision-secrets block, including the normalized
AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET (fixing main's WEB_UI/WEBUI mismatch
that currently renders an EMPTY OAuth client secret into ai.env).
NEW Woodpecker secret required before merge: ai_mcpo_api_key.
Carried over from secrets-provisioning-v2 (PR #15), content identical.
Whole-file template render (hard-fail naming missing vars), env + Docker
secrets shipped via ssh stdin only, sha256-checksum skip-if-unchanged,
never prints a value. Stacks absent from the manifest exit 0 so legacy
case-entries keep handling them.
Same two scoped changes as PR #15's rebase, now applied on a branch cut
from TODAY's main so the merge base is current (PR #15 became
unmergeable — its 09-03 merge base predated main's heavy hand-edits):
1. ai) case -> `python3 deploy/provision-stack.py ai` (one line). Retires
main's heredoc with its live drift: AI_LITELLM_POSTGRES_PASSWORD
printed twice (one copy from retired AI_LITELLM_DB_PASSWORD), stray
legacy AI_WEBUI_SECRET_KEY, and the WEB_UI/WEBUI shell-var mismatch
that renders an EMPTY OAuth client secret into ai.env.
2. env block ai section: normalized to exact template placeholder names,
added AI_MCPO_API_KEY (NEW Woodpecker secret required pre-merge),
pruned now-template-literal vars.
apk gains python3 py3-yaml. Everything else byte-matches current main.
Dollar-escape audit done per header lesson.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Replaces PR #15 (unmergeable — stale merge base)
#15's branch was cut 2026-09-03; main's
deploy.ymlhas since been heavily hand-edited (AI_* renames, Proxmox parameterization), moving the merge base too far for git's three-way merge even though the content was manually reconciled. This branch is cut from today's main with the same 4 files applied fresh — merges clean.What this delivers (provisioning v2, ai stack first)
secrets/secrets-map.yamlai/ai.env.templateAI_<SERVICE>_*names matching current ai.yaml exactly; config as literals, secrets as placeholdersdeploy/provision-stack.py.woodpecker/deploy.ymlai)case → one line. Everything else byte-identical to current main⚠️ Fixes LIVE bugs in main's current
ai)heredocAI_LITELLM_POSTGRES_PASSWORDprinted twice (one copy from the retiredAI_LITELLM_DB_PASSWORDsecret)AI_WEBUI_SECRET_KEYkey current ai.yaml never readsprintfreferences shell varAI_OPEN_WEBUI_OAUTH_CLIENT_SECRETbut the env block declaresAI_OPEN_WEB_UI_...(WEB_UI) → undefined at runtime → rendered ai.env currently carries an EMPTY OAuth client secret. Authentik SSO to Open WebUI breaks on the next ai redeploy from main unless this merges first. Do not push anyai/**change to main before this PR.Pre-merge checklist
ai_mcpo_api_keycreated (value = current MCPO_API_KEY from host ai.env)ai_litellm_database_url,ai_litellm_postgres_password,ai_oauth_client_secret,ai_webui_secret_key,ai_open_webui_database_urlDeletable Woodpecker secrets after merge:
litellm_database_migrations,litellm_modify_params,ai_aws_region_name,ai_litellm_db_password, the sevenai_open_web_ui_*config secrets.Rollback
Revert the merge commit — legacy heredoc returns (with its bugs), ai.env on the host is untouched until the next provisioning run.