Bot
89a1e030c0
Carried over from secrets-provisioning-v2 (PR #15), content identical. Whole-file template render (hard-fail naming missing vars), env + Docker secrets shipped via ssh stdin only, sha256-checksum skip-if-unchanged, never prints a value. Stacks absent from the manifest exit 0 so legacy case-entries keep handling them.
199 lines
7.5 KiB
Python
199 lines
7.5 KiB
Python
#!/usr/bin/env python3
|
|
"""provision-stack.py — manifest-driven env-file rendering + Docker secret
|
|
provisioning for one stack.
|
|
|
|
Usage (from the CI workspace root, inside the provision-secrets step):
|
|
python3 deploy/provision-stack.py <stack>
|
|
|
|
Reads secrets/secrets-map.yaml (data only — no code, no values) and, for the
|
|
named stack:
|
|
|
|
1. env_template -> renders the COMPLETE env file. Placeholders of the form
|
|
dollar-brace VARNAME are resolved from this process's environment (the
|
|
Woodpecker from_secret-backed vars). The whole file is rendered every
|
|
run; nothing is line-edited in place, so keys can never silently go
|
|
missing (root cause of the 2026-09-03 ai.env incident).
|
|
2. env_dest -> ships the rendered file to the Swarm manager over ssh stdin
|
|
(write-to-temp + atomic mv, mode 600). The rendered file never touches
|
|
the CI workspace disk under the repo (no chance of being committed) and
|
|
never appears on a command line.
|
|
3. docker_secrets -> for each swarm-secret-name -> ENV_VAR mapping, creates
|
|
or rotates the Docker secret. Values are passed via ssh stdin only.
|
|
Rotation uses the same sha256-checksum-label convention as
|
|
deploy/create-secrets.sh (unchanged secrets are skipped silently).
|
|
|
|
Safety properties:
|
|
- FAILS HARD (non-zero) if any referenced env var is missing or empty, and
|
|
lists the missing NAMES. A partial/broken render can never ship.
|
|
- FAILS HARD if any unresolved placeholder remains after rendering.
|
|
- NEVER prints a secret value — names and counts only.
|
|
- Requires SWARM_MANAGER_IP in the environment and a usable ssh identity
|
|
(both already set up by the provision-secrets step).
|
|
|
|
Stacks not present in the manifest exit 0 with a notice, so this script is
|
|
safe to call unconditionally; legacy case-entries in deploy.yml keep handling
|
|
unmigrated stacks.
|
|
"""
|
|
|
|
import hashlib
|
|
import os
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
|
|
REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
MANIFEST_PATH = os.path.join(REPO_ROOT, "secrets", "secrets-map.yaml")
|
|
REMOTE_BASE = "/volume1/docker/compose-files"
|
|
PLACEHOLDER_RE = re.compile(r"\$\{([A-Za-z_][A-Za-z0-9_]*)\}")
|
|
|
|
SSH_OPTS = ["-o", "StrictHostKeyChecking=no"]
|
|
|
|
|
|
def die(msg: str) -> None:
|
|
print(f"ERROR: {msg}", file=sys.stderr)
|
|
sys.exit(1)
|
|
|
|
|
|
def load_manifest() -> dict:
|
|
try:
|
|
import yaml # py3-yaml, installed by the provision-secrets step
|
|
except ImportError:
|
|
die("PyYAML not available — provision-secrets step must apk add py3-yaml")
|
|
if not os.path.isfile(MANIFEST_PATH):
|
|
die(f"manifest not found: {MANIFEST_PATH}")
|
|
with open(MANIFEST_PATH, "r", encoding="utf-8") as fh:
|
|
data = yaml.safe_load(fh) or {}
|
|
stacks = data.get("stacks")
|
|
if not isinstance(stacks, dict):
|
|
die("manifest has no 'stacks:' mapping")
|
|
return stacks
|
|
|
|
|
|
def ssh_target() -> str:
|
|
ip = os.environ.get("SWARM_MANAGER_IP", "").strip()
|
|
if not ip:
|
|
die("SWARM_MANAGER_IP is empty — check Woodpecker repo secrets")
|
|
return f"root@{ip}"
|
|
|
|
|
|
def ssh_run(target: str, remote_cmd: str, stdin_data: bytes | None = None,
|
|
check: bool = True) -> subprocess.CompletedProcess:
|
|
proc = subprocess.run(
|
|
["ssh", *SSH_OPTS, target, remote_cmd],
|
|
input=stdin_data, capture_output=True,
|
|
)
|
|
if check and proc.returncode != 0:
|
|
# stderr may be verbose but must never contain our secret values —
|
|
# we only ever send values via stdin, never embed them in remote_cmd.
|
|
die(f"remote command failed (rc={proc.returncode}): {remote_cmd}\n"
|
|
f"{proc.stderr.decode(errors='replace').strip()}")
|
|
return proc
|
|
|
|
|
|
def render_template(template_path: str) -> str:
|
|
if not os.path.isfile(template_path):
|
|
die(f"env_template not found: {template_path}")
|
|
with open(template_path, "r", encoding="utf-8") as fh:
|
|
raw = fh.read()
|
|
|
|
referenced = sorted(set(PLACEHOLDER_RE.findall(raw)))
|
|
missing = [v for v in referenced
|
|
if not os.environ.get(v, "").strip()]
|
|
if missing:
|
|
die("template references vars that are MISSING or EMPTY in the CI "
|
|
"environment (add them via from_secret in "
|
|
".woodpecker/deploy.yml provision-secrets, and as Woodpecker "
|
|
"secrets):\n " + "\n ".join(missing))
|
|
|
|
rendered = PLACEHOLDER_RE.sub(lambda m: os.environ[m.group(1)], raw)
|
|
|
|
# Belt-and-braces: nothing placeholder-shaped may survive the render.
|
|
leftover = sorted(set(PLACEHOLDER_RE.findall(rendered)))
|
|
if leftover:
|
|
die("unresolved placeholders remain after rendering: "
|
|
+ ", ".join(leftover))
|
|
|
|
print(f" [render] {template_path}: {len(referenced)} secret placeholder(s) "
|
|
f"resolved: {', '.join(referenced)}")
|
|
return rendered
|
|
|
|
|
|
def ship_env_file(target: str, rendered: str, dest_rel: str) -> None:
|
|
dest = f"{REMOTE_BASE}/{dest_rel}"
|
|
tmp = f"{dest}.provision-tmp"
|
|
# Value travels over ssh stdin; never on a command line; atomic mv.
|
|
ssh_run(target,
|
|
f"umask 077 && cat > {tmp} && chmod 600 {tmp} && mv {tmp} {dest}",
|
|
stdin_data=rendered.encode())
|
|
keys = [ln.split("=", 1)[0] for ln in rendered.splitlines()
|
|
if "=" in ln and not ln.lstrip().startswith("#") and ln.strip()]
|
|
print(f" [env] shipped {dest} ({len(keys)} keys): {', '.join(keys)}")
|
|
|
|
|
|
def provision_docker_secret(target: str, name: str, env_var: str) -> None:
|
|
value = os.environ.get(env_var, "")
|
|
if not value.strip():
|
|
die(f"docker secret '{name}': env var {env_var} is missing/empty")
|
|
|
|
new_hash = hashlib.sha256(value.encode()).hexdigest()
|
|
probe = ssh_run(
|
|
target,
|
|
f"docker secret inspect {name} "
|
|
"--format '{{index .Spec.Labels \"checksum\"}}' 2>/dev/null || true",
|
|
check=True)
|
|
old_hash = probe.stdout.decode().strip()
|
|
|
|
if old_hash == new_hash:
|
|
print(f" [skip] docker secret {name} (unchanged)")
|
|
return
|
|
|
|
if old_hash:
|
|
rm = ssh_run(target, f"docker secret rm {name}", check=False)
|
|
if rm.returncode != 0:
|
|
die(f"docker secret {name}: value changed but removal failed — "
|
|
"it is probably referenced by a running service. Provision "
|
|
"under a versioned name (see vaultwarden_database_url_v2 "
|
|
"precedent) or scale the service down first.")
|
|
action = "update"
|
|
else:
|
|
action = "create"
|
|
|
|
ssh_run(target,
|
|
f"docker secret create --label checksum={new_hash} "
|
|
f"--label managed-by=woodpecker {name} -",
|
|
stdin_data=value.encode())
|
|
print(f" [{action}] docker secret {name} (value via stdin)")
|
|
|
|
|
|
def main() -> None:
|
|
if len(sys.argv) != 2:
|
|
die("usage: provision-stack.py <stack>")
|
|
stack = sys.argv[1]
|
|
|
|
stacks = load_manifest()
|
|
cfg = stacks.get(stack)
|
|
if cfg is None:
|
|
print(f" [info] stack '{stack}' not in secrets-map.yaml — "
|
|
"legacy provisioning (deploy.yml case-entry) applies. Nothing to do.")
|
|
return
|
|
|
|
target = ssh_target()
|
|
print(f"==> provision-stack: {stack}")
|
|
|
|
template_rel = cfg.get("env_template")
|
|
dest_rel = cfg.get("env_dest")
|
|
if template_rel and not dest_rel:
|
|
die("env_template set but env_dest missing in manifest")
|
|
if template_rel:
|
|
rendered = render_template(os.path.join(REPO_ROOT, template_rel))
|
|
ship_env_file(target, rendered, dest_rel)
|
|
|
|
for name, env_var in (cfg.get("docker_secrets") or {}).items():
|
|
provision_docker_secret(target, name, env_var)
|
|
|
|
print(f"==> provision-stack: {stack} done")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|