dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Register Gitea webhook 14 for oikos-console deploy

Browse Source 
Created via the Gitea API (POST /repos/dtoro/Homelab-Docs/hooks) rather
than the UI, since the existing PAT turned out to have sufficient scope.
Webhook id 14: http://192.168.8.205:9831/deploy, push events, main branch
filter, active.

The shared secret was generated and registered with Gitea before the
apps-side bootstrap ran (order reversed from the usual install.sh-first
flow, since direct SSH deploy to apps is still pending operator
execution — see oikos/console/deploy/README.md). Stored as
secrets/oikos-console-deploy-secret.yaml (SOPS, recipient: apps only)
rather than left as a local plaintext file, with explicit operator
sign-off. When the apps-side install runs, skip webhook/install.sh's
random-secret generation and write this exact value into
/etc/oikos-console-deploy/secret instead.

infrastructure/auto-deploy.md updated with the real webhook id (was
"not yet registered").

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-06 13:18:46 +02:00
parent c6fedb38c1
commit 493ae50f37
5 changed files with 56 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.sops.yaml
View File

@@ -123,4 +123,14 @@ creation_rules:
age: >-
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
- path_regex: ^secrets/oikos-console-deploy-secret\.yaml$
# Shared HMAC secret for the Gitea deploy webhook (id 14) ->
# oikos-console-deploy.service on apps (105). Generated + registered
# with Gitea before the apps-side install ran (see
# oikos/console/deploy/README.md "Status") — write this exact value
# into /etc/oikos-console-deploy/secret rather than letting
# webhook/install.sh generate a fresh one.
age: >-
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
# webhook noop 2026-05-20T18:16:57+02:00

2
infrastructure/auto-deploy.md
View File

@@ -44,7 +44,7 @@ The app repo at `/opt/<thing>` is the working tree, but the deploy tooling (`web
| `dtoro/Homelab-Docs` → homelab-mcp | [apps (105)](../containers/105-apps.md) `/opt/homelab-mcp/` | B | `http://192.168.8.205:9811/deploy` | 10 | reinstalls `homelab-mcp.service` + restart |
| `dtoro/Homelab-Docs` → secrets-issuance | [apps (105)](../containers/105-apps.md) `/opt/secrets-issuance/` | B | `http://192.168.8.205:9821/deploy` | 11 | reinstalls `secrets-issuance.service` + restart |
| `dtoro/terminalito` | [trmnl (128)](../containers/128-trmnl.md) `/opt/terminalito/` | B | `http://192.168.8.211:9797/deploy` | 12 | reinstalls units + `systemctl restart trmnl-plugins` |
| `dtoro/Homelab-Docs` → oikos-console | [apps (105)](../containers/105-apps.md) `/opt/oikos-console/` | B | `http://192.168.8.205:9831/deploy` | (not yet registered) | reinstalls `oikos-console.service` + restart — see [oikos/console/deploy/README.md](../oikos/console/deploy/README.md) |
| `dtoro/Homelab-Docs` → oikos-console | [apps (105)](../containers/105-apps.md) `/opt/oikos-console/` | B | `http://192.168.8.205:9831/deploy` | 14 | reinstalls `oikos-console.service` + restart — see [oikos/console/deploy/README.md](../oikos/console/deploy/README.md) |
> Note: `dtoro/Homelab-Docs` has **three webhooks** firing on the same push.
> Each owns its own clone on LXC 105. They don't conflict because each

1
ledger/2026-07.jsonl
View File

@@ -1 +1,2 @@
{"ts": "2026-07-06T11:05:35+00:00", "agent": "mac-mini", "entity": "host:teddycloud", "action": "activate", "risk": "config_mutation", "verification": "homelab node teddycloud relations", "result": "ok"}
{"ts": "2026-07-06T11:15:04+00:00", "agent": "mac-mini", "entity": "repo:Homelab-Docs", "action": "register-webhook", "risk": "config_mutation", "result": "ok", "notes": "webhook id 14 for oikos-console deploy"}

41
oikos/console/deploy/README.md
View File

@@ -8,33 +8,48 @@ for the general pattern; webhook ids 10 (homelab-mcp, :9811) and 11
(secrets-issuance, :9821) are the direct precedent — this is a third
webhook on `dtoro/Homelab-Docs`, port :9831.
## Status (2026-07-06)
- **Gitea webhook: done.** Registered via the Gitea API as webhook id
**14** (`http://192.168.8.205:9831/deploy`, `push` events, `main`
branch filter, active). See
[infrastructure/auto-deploy.md](../../../infrastructure/auto-deploy.md).
- **Console deploy on apps (105): not yet done.** Direct SSH bootstrap
was withheld pending explicit operator execution — see "One-time
setup" below. **Important:** webhook 14's secret was generated and
registered with Gitea *before* the apps-side install (order reversed
from the usual flow). It's encrypted at `secrets/oikos-console-deploy-secret.yaml`
(recipient: apps only). When you run `webhook/install.sh` below,
**skip its random-secret generation** — instead run
`homelab secret oikos-console-deploy-secret` on apps and write the
`webhook_secret` value into `/etc/oikos-console-deploy/secret` yourself.
- **Caddy route: not yet done.**
- **DNS entry: not yet done.**
## One-time setup on apps (105)
```bash
git clone https://git.hubris.network/dtoro/Homelab-Docs.git /opt/oikos-console
cd /opt/oikos-console
./oikos/console/deploy/deploy.sh # first install
./oikos/console/deploy/webhook/install.sh # generates the deploy secret, prints it
./oikos/console/deploy/webhook/install.sh # generates a NEW secret by default —
# see "Status" above before running this
systemctl enable --now oikos-console.service oikos-console-deploy.service
```
Then register the Gitea webhook (`dtoro/Homelab-Docs` → Settings →
Webhooks) with the URL/secret `install.sh` printed, same as webhooks 10/11.
## Caddy route — NOT in this repo, needs manual addition to `dtoro/caddy-conf`
The console binds `127.0.0.1:8091` only (see `oikos-console.service` —
`ProtectSystem=strict`, no LAN listener). Caddy on LXC 121 needs a new
site block proxying to it, forward-auth gated the same way
`paperless`/other LAN-only services are (via the shared `(authentik)`
snippet referenced in
[containers/106-auth-outpost.md](../../../containers/106-auth-outpost.md)).
Confirm the exact snippet name/import syntax against the live
`dtoro/caddy-conf` repo — this is the shape, not verified against it:
The console binds `127.0.0.1:8091` on apps only (see `oikos-console.service` —
`ProtectSystem=strict`, no LAN listener); Caddy on LXC 121 reaches it via
apps' **LAN IP**, not loopback (they're different hosts). Site block,
forward-auth gated the same way other LAN-only services are (confirmed
syntax per `containers/121-caddy.md`: `import authentik`, no parens in
the import statement itself — the snippet is *defined* as `(authentik)`
but *imported* as `authentik`):
```caddyfile
oikos.hubris.network {
import (authentik)
import authentik
reverse_proxy 192.168.8.205:8091
}
```

16
secrets/oikos-console-deploy-secret.yaml Normal file
View File

@@ -0,0 +1,16 @@
webhook_secret: ENC[AES256_GCM,data:xo9I443vTtLvQesuyEOmfduLbljaVSQeWf6B7d9Vjp6HoP92BJiogsrPXQ==,iv:HI6Q7OzS0dNjJVXfmxNbetjxOE5nAWQoaXSki0fiItE=,tag:bfnR5RmVmVd0ahRXIRV1yg==,type:str]
sops:
age:
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdzl3Z0dwU09aWjVBcHcx
ZE4rWHJ0aXhueXZmZ2NhSWlSaHdzUnRYR3hZClRVZVY4WDBTOHFnM251L2M5R1dp
T0ZQWmQrK09Uck5laksrVTZuckRqVU0KLS0tIGxKZ2ZUa09jdklWT2JPWW1KTVZr
cGFiZHk3YWtxLzFCS011cHpjdE1JTXMKCJXHZn7akExja+Xy9SeHjFoc1h/ctuQP
s1CUPsnZXPwOkxWSyqx+YEeilxwWlGgmWT4EZXAz/JcSRPyq8u+flg==
-----END AGE ENCRYPTED FILE-----
recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
lastmodified: "2026-07-06T11:14:22Z"
mac: ENC[AES256_GCM,data:J4KRkno5xwfs1za0PqGR7MKSuve9tTv5zBIb02nvD+pXTBuW5CzhnQM4YPTtq8NhSngEGJbVA0o5iK5aG3ezXFyG/m3JzACooN/3XHh3zvEvm/ZuubiV+mVhJYNv/+3/nK+jCeIJNrpmw8opAEE2+sy2cKryNUV1jRlw1GGFE2k=,iv:7PDWchlXYpDde3WsBiZ7UbO+XtMfeqPQO6JDf+/QXLU=,tag:HhfSVbDqtU31I5qLG/dMMQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.1