Bot
0869cd319d
Part 1/4 of the provisioning architecture redesign after the 2026-09-03 ai.env incident (line-surgery provisioning dropped keys; broken services; manual host-side recovery forked ai.yaml/ai.env). Design: plain-data manifest consumed by deploy/provision-stack.py. No code, no shell, no secret values, no value structure (e.g. no connection-string shapes) live in this file or in deploy.yml anymore.
39 lines
2.3 KiB
YAML
39 lines
2.3 KiB
YAML
# ─────────────────────────────────────────────────────────────────────────────
|
|
# secrets-map.yaml — DATA-ONLY manifest for deploy/provision-stack.py
|
|
#
|
|
# RULES:
|
|
# - This file contains NO code, NO shell, NO secret values — only names.
|
|
# - Each stack entry declares:
|
|
# env_template: repo path of the FULL env-file template (tracked).
|
|
# The template is authoritative: the COMPLETE env file is
|
|
# rendered from it on every provisioning run. Nothing is
|
|
# line-edited in place, so keys can never silently go
|
|
# missing.
|
|
# env_dest: host path (relative to /volume1/docker/compose-files/)
|
|
# the rendered env file is shipped to. Rendered file
|
|
# exists ONLY on the host — never committed to git.
|
|
# docker_secrets: map of docker-swarm-secret-name -> CI ENV VAR NAME
|
|
# (Pattern C). The env var must be declared via
|
|
# from_secret: in .woodpecker/deploy.yml's
|
|
# provision-secrets step (Woodpecker v3 requires explicit
|
|
# per-secret declaration; there is no expose-all).
|
|
#
|
|
# ADDING A NEW SECRET (3 small steps, no shell edits):
|
|
# 1. Add the secret value in Woodpecker UI (repo Settings -> Secrets).
|
|
# 2. Declare it in .woodpecker/deploy.yml provision-secrets environment:
|
|
# block (from_secret) — mechanical two-line addition.
|
|
# 3. Reference it here (docker_secrets:) and/or in the stack's
|
|
# .env.template as a dollar-brace placeholder.
|
|
#
|
|
# Stacks not listed here fall through to deploy.yml's legacy case-entries
|
|
# untouched. Migration is deliberately one stack per PR.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
stacks:
|
|
ai:
|
|
env_template: ai/ai.env.template
|
|
env_dest: ai/ai.env
|
|
docker_secrets:
|
|
flowagent_azure_client_id: FLOWAGENT_AZURE_CLIENT_ID
|
|
flowagent_azure_tenant_id: FLOWAGENT_AZURE_TENANT_ID
|
|
flowagent_azure_client_secret: FLOWAGENT_AZURE_CLIENT_SECRET
|