diff --git a/.sops.yaml b/.sops.yaml index 0c37343..c036174 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -123,4 +123,14 @@ creation_rules: age: >- age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6, age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 + + - path_regex: ^secrets/oikos-console-deploy-secret\.yaml$ + # Shared HMAC secret for the Gitea deploy webhook (id 14) -> + # oikos-console-deploy.service on apps (105). Generated + registered + # with Gitea before the apps-side install ran (see + # oikos/console/deploy/README.md "Status") — write this exact value + # into /etc/oikos-console-deploy/secret rather than letting + # webhook/install.sh generate a fresh one. + age: >- + age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 # webhook noop 2026-05-20T18:16:57+02:00 diff --git a/infrastructure/auto-deploy.md b/infrastructure/auto-deploy.md index d5ff553..f8fa9e6 100644 --- a/infrastructure/auto-deploy.md +++ b/infrastructure/auto-deploy.md @@ -44,7 +44,7 @@ The app repo at `/opt/` is the working tree, but the deploy tooling (`web | `dtoro/Homelab-Docs` → homelab-mcp | [apps (105)](../containers/105-apps.md) `/opt/homelab-mcp/` | B | `http://192.168.8.205:9811/deploy` | 10 | reinstalls `homelab-mcp.service` + restart | | `dtoro/Homelab-Docs` → secrets-issuance | [apps (105)](../containers/105-apps.md) `/opt/secrets-issuance/` | B | `http://192.168.8.205:9821/deploy` | 11 | reinstalls `secrets-issuance.service` + restart | | `dtoro/terminalito` | [trmnl (128)](../containers/128-trmnl.md) `/opt/terminalito/` | B | `http://192.168.8.211:9797/deploy` | 12 | reinstalls units + `systemctl restart trmnl-plugins` | -| `dtoro/Homelab-Docs` → oikos-console | [apps (105)](../containers/105-apps.md) `/opt/oikos-console/` | B | `http://192.168.8.205:9831/deploy` | (not yet registered) | reinstalls `oikos-console.service` + restart — see [oikos/console/deploy/README.md](../oikos/console/deploy/README.md) | +| `dtoro/Homelab-Docs` → oikos-console | [apps (105)](../containers/105-apps.md) `/opt/oikos-console/` | B | `http://192.168.8.205:9831/deploy` | 14 | reinstalls `oikos-console.service` + restart — see [oikos/console/deploy/README.md](../oikos/console/deploy/README.md) | > Note: `dtoro/Homelab-Docs` has **three webhooks** firing on the same push. > Each owns its own clone on LXC 105. They don't conflict because each diff --git a/ledger/2026-07.jsonl b/ledger/2026-07.jsonl index 717b034..f56f394 100644 --- a/ledger/2026-07.jsonl +++ b/ledger/2026-07.jsonl @@ -1 +1,2 @@ {"ts": "2026-07-06T11:05:35+00:00", "agent": "mac-mini", "entity": "host:teddycloud", "action": "activate", "risk": "config_mutation", "verification": "homelab node teddycloud relations", "result": "ok"} +{"ts": "2026-07-06T11:15:04+00:00", "agent": "mac-mini", "entity": "repo:Homelab-Docs", "action": "register-webhook", "risk": "config_mutation", "result": "ok", "notes": "webhook id 14 for oikos-console deploy"} diff --git a/oikos/console/deploy/README.md b/oikos/console/deploy/README.md index 0de4db3..9be98d8 100644 --- a/oikos/console/deploy/README.md +++ b/oikos/console/deploy/README.md @@ -8,33 +8,48 @@ for the general pattern; webhook ids 10 (homelab-mcp, :9811) and 11 (secrets-issuance, :9821) are the direct precedent — this is a third webhook on `dtoro/Homelab-Docs`, port :9831. +## Status (2026-07-06) + +- **Gitea webhook: done.** Registered via the Gitea API as webhook id + **14** (`http://192.168.8.205:9831/deploy`, `push` events, `main` + branch filter, active). See + [infrastructure/auto-deploy.md](../../../infrastructure/auto-deploy.md). +- **Console deploy on apps (105): not yet done.** Direct SSH bootstrap + was withheld pending explicit operator execution — see "One-time + setup" below. **Important:** webhook 14's secret was generated and + registered with Gitea *before* the apps-side install (order reversed + from the usual flow). It's encrypted at `secrets/oikos-console-deploy-secret.yaml` + (recipient: apps only). When you run `webhook/install.sh` below, + **skip its random-secret generation** — instead run + `homelab secret oikos-console-deploy-secret` on apps and write the + `webhook_secret` value into `/etc/oikos-console-deploy/secret` yourself. +- **Caddy route: not yet done.** +- **DNS entry: not yet done.** + ## One-time setup on apps (105) ```bash git clone https://git.hubris.network/dtoro/Homelab-Docs.git /opt/oikos-console cd /opt/oikos-console ./oikos/console/deploy/deploy.sh # first install -./oikos/console/deploy/webhook/install.sh # generates the deploy secret, prints it +./oikos/console/deploy/webhook/install.sh # generates a NEW secret by default — + # see "Status" above before running this systemctl enable --now oikos-console.service oikos-console-deploy.service ``` -Then register the Gitea webhook (`dtoro/Homelab-Docs` → Settings → -Webhooks) with the URL/secret `install.sh` printed, same as webhooks 10/11. - ## Caddy route — NOT in this repo, needs manual addition to `dtoro/caddy-conf` -The console binds `127.0.0.1:8091` only (see `oikos-console.service` — -`ProtectSystem=strict`, no LAN listener). Caddy on LXC 121 needs a new -site block proxying to it, forward-auth gated the same way -`paperless`/other LAN-only services are (via the shared `(authentik)` -snippet referenced in -[containers/106-auth-outpost.md](../../../containers/106-auth-outpost.md)). -Confirm the exact snippet name/import syntax against the live -`dtoro/caddy-conf` repo — this is the shape, not verified against it: +The console binds `127.0.0.1:8091` on apps only (see `oikos-console.service` — +`ProtectSystem=strict`, no LAN listener); Caddy on LXC 121 reaches it via +apps' **LAN IP**, not loopback (they're different hosts). Site block, +forward-auth gated the same way other LAN-only services are (confirmed +syntax per `containers/121-caddy.md`: `import authentik`, no parens in +the import statement itself — the snippet is *defined* as `(authentik)` +but *imported* as `authentik`): ```caddyfile oikos.hubris.network { - import (authentik) + import authentik reverse_proxy 192.168.8.205:8091 } ``` diff --git a/secrets/oikos-console-deploy-secret.yaml b/secrets/oikos-console-deploy-secret.yaml new file mode 100644 index 0000000..4e9695c --- /dev/null +++ b/secrets/oikos-console-deploy-secret.yaml @@ -0,0 +1,16 @@ +webhook_secret: ENC[AES256_GCM,data:xo9I443vTtLvQesuyEOmfduLbljaVSQeWf6B7d9Vjp6HoP92BJiogsrPXQ==,iv:HI6Q7OzS0dNjJVXfmxNbetjxOE5nAWQoaXSki0fiItE=,tag:bfnR5RmVmVd0ahRXIRV1yg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdzl3Z0dwU09aWjVBcHcx + ZE4rWHJ0aXhueXZmZ2NhSWlSaHdzUnRYR3hZClRVZVY4WDBTOHFnM251L2M5R1dp + T0ZQWmQrK09Uck5laksrVTZuckRqVU0KLS0tIGxKZ2ZUa09jdklWT2JPWW1KTVZr + cGFiZHk3YWtxLzFCS011cHpjdE1JTXMKCJXHZn7akExja+Xy9SeHjFoc1h/ctuQP + s1CUPsnZXPwOkxWSyqx+YEeilxwWlGgmWT4EZXAz/JcSRPyq8u+flg== + -----END AGE ENCRYPTED FILE----- + recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 + lastmodified: "2026-07-06T11:14:22Z" + mac: ENC[AES256_GCM,data:J4KRkno5xwfs1za0PqGR7MKSuve9tTv5zBIb02nvD+pXTBuW5CzhnQM4YPTtq8NhSngEGJbVA0o5iK5aG3ezXFyG/m3JzACooN/3XHh3zvEvm/ZuubiV+mVhJYNv/+3/nK+jCeIJNrpmw8opAEE2+sy2cKryNUV1jRlw1GGFE2k=,iv:7PDWchlXYpDde3WsBiZ7UbO+XtMfeqPQO6JDf+/QXLU=,tag:HhfSVbDqtU31I5qLG/dMMQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1