Bot
85734f4601
Carried over from secrets-provisioning-v2 (PR #15), which became unmergeable after heavy parallel hand-edits to main moved the merge base too far. Content identical to v2.
39 lines
2.3 KiB
YAML
39 lines
2.3 KiB
YAML
# ─────────────────────────────────────────────────────────────────────────────
|
|
# secrets-map.yaml — DATA-ONLY manifest for deploy/provision-stack.py
|
|
#
|
|
# RULES:
|
|
# - This file contains NO code, NO shell, NO secret values — only names.
|
|
# - Each stack entry declares:
|
|
# env_template: repo path of the FULL env-file template (tracked).
|
|
# The template is authoritative: the COMPLETE env file is
|
|
# rendered from it on every provisioning run. Nothing is
|
|
# line-edited in place, so keys can never silently go
|
|
# missing.
|
|
# env_dest: host path (relative to /volume1/docker/compose-files/)
|
|
# the rendered env file is shipped to. Rendered file
|
|
# exists ONLY on the host — never committed to git.
|
|
# docker_secrets: map of docker-swarm-secret-name -> CI ENV VAR NAME
|
|
# (Pattern C). The env var must be declared via
|
|
# from_secret: in .woodpecker/deploy.yml's
|
|
# provision-secrets step (Woodpecker v3 requires explicit
|
|
# per-secret declaration; there is no expose-all).
|
|
#
|
|
# ADDING A NEW SECRET (3 small steps, no shell edits):
|
|
# 1. Add the secret value in Woodpecker UI (repo Settings -> Secrets).
|
|
# 2. Declare it in .woodpecker/deploy.yml provision-secrets environment:
|
|
# block (from_secret) — mechanical two-line addition.
|
|
# 3. Reference it here (docker_secrets:) and/or in the stack's
|
|
# .env.template as a dollar-brace placeholder.
|
|
#
|
|
# Stacks not listed here fall through to deploy.yml's legacy case-entries
|
|
# untouched. Migration is deliberately one stack per PR.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
stacks:
|
|
ai:
|
|
env_template: ai/ai.env.template
|
|
env_dest: ai/ai.env
|
|
docker_secrets:
|
|
flowagent_azure_client_id: FLOWAGENT_AZURE_CLIENT_ID
|
|
flowagent_azure_tenant_id: FLOWAGENT_AZURE_TENANT_ID
|
|
flowagent_azure_client_secret: FLOWAGENT_AZURE_CLIENT_SECRET
|