55 lines
2.7 KiB
Plaintext
55 lines
2.7 KiB
Plaintext
# woodpecker Stack — Secrets Reference
|
|
# Source: woodpecker.env
|
|
#
|
|
# ⚠️ MANUAL MANAGEMENT ONLY — Woodpecker cannot provision its own secrets.
|
|
# This would be a circular dependency: the pipeline that provisions secrets
|
|
# depends on Woodpecker running, which depends on these secrets existing.
|
|
#
|
|
# These secrets must always be managed manually on the host at:
|
|
# /volume1/docker/compose-files/woodpecker.env
|
|
#
|
|
# Do NOT add these to Woodpecker's secret store for use in pipelines.
|
|
# They are documented here only for reference and disaster recovery.
|
|
|
|
# ── SECRETS (manual management on host only) ──────────────────────────────────
|
|
|
|
# Variable: WOODPECKER_GITEA_CLIENT
|
|
# Used for: Gitea OAuth2 application client ID
|
|
# Find in: Gitea → Settings → Applications → OAuth2 Applications → Woodpecker
|
|
# NOTE: This is a UUID, not a password, but treat as sensitive
|
|
|
|
# Variable: WOODPECKER_GITEA_SECRET
|
|
# Used for: Gitea OAuth2 application client secret
|
|
# Find in: Gitea → Settings → Applications → OAuth2 Applications → Woodpecker
|
|
# NOTE: Regenerate in Gitea if compromised, then update woodpecker.env + redeploy
|
|
|
|
# Variable: WOODPECKER_AGENT_SECRET
|
|
# Used for: Shared secret between Woodpecker server and agents (gRPC auth)
|
|
# Generate: openssl rand -hex 32
|
|
# NOTE: Must match between server and all agent containers. Changing requires
|
|
# redeploying the entire woodpecker stack simultaneously.
|
|
|
|
# Variable: DB_USER
|
|
# Used for: Woodpecker PostgreSQL username (woodpecker)
|
|
# NOTE: Not sensitive, but kept in .env for consistency
|
|
|
|
# Variable: DB_PASS
|
|
# Used for: Woodpecker PostgreSQL password
|
|
# NOTE: Must be URL-encoded when used in DATABASE_DATASOURCE
|
|
# Use: python3 -c "import urllib.parse; print(urllib.parse.quote('yourpass', safe=''))"
|
|
|
|
# ── NON-SECRETS ───────────────────────────────────────────────────────────────
|
|
|
|
# DB_USER Database username (woodpecker) — not sensitive
|
|
|
|
# ── Recovery procedure ────────────────────────────────────────────────────────
|
|
#
|
|
# If woodpecker.env is lost:
|
|
#
|
|
# 1. Regenerate WOODPECKER_GITEA_SECRET in Gitea UI
|
|
# 2. Generate new WOODPECKER_AGENT_SECRET: openssl rand -hex 32
|
|
# 3. Retrieve DB_PASS from postgresql.env (woodpecker user password)
|
|
# 4. Recreate woodpecker.env on host
|
|
# 5. Redeploy: docker stack deploy -c woodpecker.yaml woodpecker
|
|
# 6. Re-add secrets to Woodpecker UI for all pipelines
|