Rebase of the provisioning-v2 branch's deploy.yml onto current main.
Reconstructed from main line-by-line, then two scoped changes:
1. ai) case -> `python3 deploy/provision-stack.py ai` (one line). Retires
main's current heredoc, which has active drift found during this
rebase: AI_LITELLM_POSTGRES_PASSWORD printed TWICE (first copy sourced
from the retired AI_LITELLM_DB_PASSWORD var), a stray legacy
AI_WEBUI_SECRET_KEY key current ai.yaml never reads, and printf
referencing AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET while the env block
declares AI_OPEN_WEB_UI_OAUTH_CLIENT_SECRET (WEB_UI) — undefined shell
var at runtime, so rendered ai.env currently carries an EMPTY OAuth
client secret.
2. env block ai section: normalized to the exact template placeholder
names (AI_OPEN_WEBUI_OAUTH_CLIENT_SECRET <- ai_oauth_client_secret,
AI_OPEN_WEBUI_SECRET_KEY <- ai_webui_secret_key), added AI_MCPO_API_KEY
(NEW Woodpecker secret required pre-merge), pruned now-template-literal
vars (AI_AWS_REGION_NAME, AI_LITELLM_MODIFY_PARAMS/_DATABASE_MIGRATIONS,
AI_LITELLM_DB_PASSWORD, the seven ai_open_web_ui_* config secrets).
apk line gains python3 py3-yaml. All other steps and cases byte-match
current main. Dollar-escape audit done per header lesson.
Bot
cb10c2e22d