jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(deploy-services): keep the caller's authkey over .env, and don't blank the app-skeleton key #23

Merged
jfraeys merged 3 commits from jfraeys/fix/deploy-services-authkey-env into main 2026-10-08 20:21:54 -04:00 AGit
Conversation 0 Commits 3 Files changed 3 +23 -2
jfraeys commented 2026-10-08 20:20:50 -04:00
Owner
Copy link

scripts/deploy-services.sh sourced .env after the caller exports, so a stale CI_EPHEMERAL_TAILSCALE_AUTHKEY line there overrode a freshly minted key and every deploy kept writing the expired one. The script now keeps the caller values, ignores (with a warning) any .env/vault value for these two secrets, and mints 168h keys instead of 4h. Also: the app-skeleton deploy key task in ci_ephemeral_provisioner used to overwrite the installed key with an empty file when the key was not exported; it now uses force only when a key is supplied (the file must still exist, the provisioner opens it every cycle). Tested with a stubbed script run and a local Ansible run of the three file cases; not run against services. -- Generated with Claude Code

scripts/deploy-services.sh sourced .env after the caller exports, so a stale CI_EPHEMERAL_TAILSCALE_AUTHKEY line there overrode a freshly minted key and every deploy kept writing the expired one. The script now keeps the caller values, ignores (with a warning) any .env/vault value for these two secrets, and mints 168h keys instead of 4h. Also: the app-skeleton deploy key task in ci_ephemeral_provisioner used to overwrite the installed key with an empty file when the key was not exported; it now uses force only when a key is supplied (the file must still exist, the provisioner opens it every cycle). Tested with a stubbed script run and a local Ansible run of the three file cases; not run against services. -- Generated with [Claude Code](https://claude.com/claude-code)
The script sourced .env after the caller's exports, so a stale
CI_EPHEMERAL_TAILSCALE_AUTHKEY line there overrode a freshly minted key and
the deploy kept writing the expired one. Snapshot the caller's
CI_EPHEMERAL_TAILSCALE_AUTHKEY / FORGEJO_RUNNER_APP_SKELETON_DEPLOY_KEY,
drop whatever .env or vault set for them (with a warning), then restore the
caller's. The self-minted key now lasts 168h instead of 4h: the provisioner
reuses it for every VM cycle until the next deploy.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The install task wrote the exported key unconditionally, so a deploy run
without FORGEJO_RUNNER_APP_SKELETON_DEPLOY_KEY replaced the installed key
with an empty file. force is now true only when a key was supplied; the file
is still created when absent because the provisioner script opens it every
cycle.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
docs(ci_ephemeral_provisioner): note why the deploy key task uses force, not when
All checks were successful
Lint / lint (pull_request) Successful in 1m22s
Details
52126669c7
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!23
No description provided.