# flowagent (Power Automate MCP, via mcpo service) — Secrets Reference
# Source: mcpo/flowagent — built into a custom image, consumed by the
# "mcpo" service in ai.yaml (NEVER mcpo-critical).
#
# Add SECRET values to Woodpecker at:
#   https://woodpecker.bryanmail.net
#   homelab/compose-files → Settings → Secrets
#
# Prerequisite (manual, outside GitOps — Azure Portal):
#   1. Entra ID → App registrations → New registration
#      Name: flowagent-mcp-homelab, single tenant
#   2. API permissions → add Power Automate / Flow Service application
#      permissions + Dynamics CRM user_impersonation (Dataverse access)
#   3. Grant admin consent
#   4. Certificates & secrets → new client secret → copy value immediately
#   5. Power Platform Admin Center → target environment → S2S apps →
#      register the application user for this app ID (required for
#      Dataverse/environment access by a service principal)
#
# NOTE: the OLD "powerautomate" mcpo/config.json entry (npm package
# powerautomate-mcp, client_id 84b431ed-..., tenant_id 0f6cf991-...) was
# never onboarded to this secrets pipeline and is being replaced by this.
# Do not reuse those IDs unless you've independently confirmed in Azure
# Portal that the old App Registration still exists, still has valid
# permissions/consent, and you intend to reuse it — otherwise register new.

# ── SECRETS (add to Woodpecker) ──────────────────────────────────────────

# Woodpecker secret name:  flowagent_azure_client_id
# Used for:                Azure AD App Registration client ID
# Env var in entrypoint:   FLOWAGENT_AZURE_CLIENT_ID_FILE (Docker secret _FILE)
flowagent_azure_client_id=

# Woodpecker secret name:  flowagent_azure_tenant_id
# Used for:                Azure AD tenant ID
# Env var in entrypoint:   FLOWAGENT_AZURE_TENANT_ID_FILE (Docker secret _FILE)
flowagent_azure_tenant_id=

# Woodpecker secret name:  flowagent_azure_client_secret
# Used for:                Azure AD App Registration client secret (rotate if leaked)
# Env var in entrypoint:   FLOWAGENT_AZURE_CLIENT_SECRET_FILE (Docker secret _FILE)
flowagent_azure_client_secret=

# ── Woodpecker provision-secrets case entry ──────────────────────────────
# Add this to the provision-secrets step in .woodpecker/deploy.yml
# (separate follow-up PR — this file only documents it):
#
#   ai)
#     ... existing ai-stack secret provisioning ...
#     create_or_update_secret "flowagent_azure_client_id"     "$FLOWAGENT_AZURE_CLIENT_ID"
#     create_or_update_secret "flowagent_azure_tenant_id"     "$FLOWAGENT_AZURE_TENANT_ID"
#     create_or_update_secret "flowagent_azure_client_secret" "$FLOWAGENT_AZURE_CLIENT_SECRET"
#     ;;