pal-e-docs

Phase 14a: Webhook Token Fix + Probe URL Nits

phase-pal-e-platform-14a-webhook-fix Phase

phase
Project

Phase 14a: Webhook Token Fix + Probe URL Nits

Goal: Restore merge=deploy automation by fixing Woodpecker webhook token signatures, fix Blackbox Exporter probe URLs, and restore Woodpecker MCP access.
Owner: Betty Sue
Repo: forgejo_admin/pal-e-platform
Depends on: phase-pal-e-platform-14-synthetic-monitoring

Problem

WOODPECKER_AGENT_SECRET was not set. Woodpecker generated a random JWT signing key at every pod restart, silently invalidating all webhook tokens, API tokens, and agent auth. Merge=deploy broken across all 28 repos since initial deployment.

Fix

  • 14a-1 DONE: Added persistent WOODPECKER_AGENT_SECRET to server + agent Helm values via set_sensitive
  • 14a-2 DONE: API token regenerated. Updated ~/.mcp.json, k3s.tfvars, ~/secrets/pal-e-services/forgejo.env
  • 14a-3 DONE: Probe URL fixes — Forgejo port 80, Keycloak port 9000, pal-e-docs /healthz, basketball-api /
  • Cleanup DONE: 56 stale webhooks deleted across 28 repos. All repos deactivated/re-activated with fresh webhooks signed by persistent key.

Deliverables

  • DONE: Pipeline #18 triggered automatically from PR push — webhook chain verified end-to-end
  • DONE: Woodpecker MCP API returns data (not 401)
  • DONE: Woodpecker server logs clean — no "token signature is invalid" errors
  • Probe verification pending next scrape cycle

PR

PR #68: forgejo_admin/pal-e-platform#68 — merged 2026-03-14 (squash)
  • incident-2026-03-14-woodpecker-webhook-signatures — the incident this resolves
  • phase-pal-e-platform-14-synthetic-monitoring — parent phase
  • plan-pal-e-platform — parent plan