dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document real deploy state: console live, webhook still broken

Browse Source 
Console is fully live on apps (105) — deployed manually via deploy.sh
(twice: initial install, then again after the ReadWritePaths/mkdir
fixes landed), both systemd units active, verified end-to-end through
Caddy + Authentik + DNS.

Gitea webhook 14 is registered and its secret is confirmed synced
between Gitea and apps (rotated once already, ruling out drift as the
cause) but every delivery still 403s with a signature mismatch.
Debugging attempts (a git-committed test build, ad-hoc production
edits) both hit safety-classifier blocks this session (production code
mutation, signature data in logs) — left unresolved rather than forced
through. Auto-deploy via push doesn't work yet for this service; manual
deploy.sh re-runs are the workaround until someone tracks this down.

Added to the 60/90-day backlog.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-06 14:11:27 +02:00
parent dede118a80
commit 14e88c7c5e
2 changed files with 25 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
OIKOS.md
View File

@@ -167,6 +167,14 @@ each is a `config_mutation`/`destructive`-class decision:
Derived from gaps observed while building the 30-day roadmap, not Derived from gaps observed while building the 30-day roadmap, not
guesswork. Roughly ordered by what unblocks the most: guesswork. Roughly ordered by what unblocks the most:
- **Fix the oikos-console deploy webhook's signature mismatch.** Console
is live on apps (105) via a manual `deploy.sh` run, but Gitea webhook
14's deliveries all 403 with a signature mismatch for a cause not yet
found — the secret is confirmed synced correctly on both sides
(rotated once already to rule out drift). Until fixed, `git push`
doesn't auto-redeploy the console the way it does for homelab-mcp/
secrets-issuance; re-run `deploy.sh` on apps manually after changes.
See [oikos/console/deploy/README.md](oikos/console/deploy/README.md).
- **SSH-key-signed approval requests.** Replaces the design note in - **SSH-key-signed approval requests.** Replaces the design note in
Week 4: age keys can't sign (encryption-only format), so per-agent Week 4: age keys can't sign (encryption-only format), so per-agent
request authentication needs `ssh-keygen -Y sign`/`-Y verify` against request authentication needs `ssh-keygen -Y sign`/`-Y verify` against

29
oikos/console/deploy/README.md
View File

@@ -10,19 +10,24 @@ webhook on `dtoro/Homelab-Docs`, port :9831.
## Status (2026-07-06) ## Status (2026-07-06)
- **Gitea webhook: done.** Registered via the Gitea API as webhook id - **Console deploy on apps (105): done.** Live at `/opt/oikos-console`,
both systemd units enabled and active, verified locally
(`127.0.0.1:8091` → `200`) and end-to-end
(`https://oikos.hubris.network/` → `302`, the Authentik gate firing).
- **Gitea webhook: registered but NOT currently working.** Webhook id
**14** (`http://192.168.8.205:9831/deploy`, `push` events, `main` **14** (`http://192.168.8.205:9831/deploy`, `push` events, `main`
branch filter, active). See branch filter, active) exists, and its secret is synced correctly
[infrastructure/auto-deploy.md](../../../infrastructure/auto-deploy.md). between Gitea and `/etc/oikos-console-deploy/secret` on apps (rotated
- **Console deploy on apps (105): not yet done.** Direct SSH bootstrap once to fix a drift from an earlier partial-PATCH update) — but
was withheld pending explicit operator execution — see "One-time deliveries still 403 with a signature mismatch for a cause not yet
setup" below. **Important:** webhook 14's secret was generated and found. **Until this is fixed, `git push` to `main` will NOT
registered with Gitea *before* the apps-side install (order reversed auto-redeploy the console** — run `deploy.sh` manually on apps after
from the usual flow). It's encrypted at `secrets/oikos-console-deploy-secret.yaml` any change (see "One-time setup" below; it's idempotent, safe to
(recipient: apps only). When you run `webhook/install.sh` below, re-run). Debugging this further needs either a git-committed (not
**skip its random-secret generation** — instead run ad-hoc SSH-edited) debug build of `webhook.py`, or checking Gitea's
`homelab secret oikos-console-deploy-secret` on apps and write the actual signing behavior against a captured raw request — both stalled
`webhook_secret` value into `/etc/oikos-console-deploy/secret` yourself. on safety-classifier blocks around production code edits and
credential handling this session, so left for a future pass.
- **Caddy route: done.** Pushed to `dtoro/caddy-conf` (commit `c195142`), - **Caddy route: done.** Pushed to `dtoro/caddy-conf` (commit `c195142`),
Authentik-gated matching `paperless.hubris.network`'s pattern, reload Authentik-gated matching `paperless.hubris.network`'s pattern, reload
confirmed clean (an unrelated route stayed healthy through the reload). confirmed clean (an unrelated route stayed healthy through the reload).