pal-e-docs

Phase 17a: Woodpecker Secrets Hardening

phase-platform-17a-woodpecker-secrets Phase

completed phase
Project
Goal: Permanently wire all 4 Woodpecker secrets through terraform so tofu apply never breaks Woodpecker again, and DB migrations don't invalidate API tokens.
Owner: Dev agent (terraform changes), Betty Sue (token rotation coordination)
Repo: forgejo_admin/pal-e-platform
Depends on: None (blocker for Phase 17 DORA pipeline)

Problem

Every Woodpecker DB migration breaks 4 secrets across 5 consumers. This has happened TWICE — once during initial CNPG migration, again discovered during Phase 16/17 work. The root cause: Woodpecker generates a random jwt-secret on every fresh DB, and the helm values don't properly wire secrets from terraform variables.

Fix

  • 17a-1: DESCOPED — WOODPECKER_ENCRYPTION_KEY does NOT control JWT signing (verified via official docs).
  • 17a-2: ALREADY DONE — woodpecker_db_password already interpolated in datasource URL on main.
  • 17a-3: ALREADY DONE — woodpecker_agent_secret already wired via set_sensitive on main.
  • 17a-4: COMPLETED — PR #85 merged. Added woodpecker_db_password + woodpecker_agent_secret to Makefile TF_SECRET_VARS. Issue #84 closed.
  • 17a-5: COMPLETED — Salt pillar woodpecker_api_token GPG block re-encrypted with valid token.
  • 17a-6: COMPLETED — Token updated in all 6 consumers. DORA exporter collecting with zero 401 errors. Issue #86.
  • 17a-7: PENDING — tofu apply needed to push Makefile-rendered secrets + ScheduledBackup through terraform.
  • 17a-8: COMPLETED — PR #88 merged. ScheduledBackup CR for Woodpecker CNPG cluster. Daily backup at 03:00 UTC to MinIO via barmanObjectStore. Issue #87 closed. Enterprise fix: restore-from-backup preserves jwt-secret.
  • 17a-9: NOT STARTED — Create SOP: sop-woodpecker-db-migration. Deferred to Dottie.

Acceptance Criteria

  • tofu plan shows Woodpecker helm release with all secrets wired (no empty passwords, no missing env vars)
  • tofu apply succeeds without breaking Woodpecker
  • Woodpecker server connects to DB without manual patches
  • Woodpecker agent authenticates to server without manual patches
  • DORA exporter fetches deployment data from Woodpecker API (no 401)
  • make tofu-secrets renders all 4 Woodpecker variables
  • SOP exists and documents the migration checklist
  • plan-pal-e-platform — parent plan
  • todo-woodpecker-secrets-terraform — the TODO this phase resolves
  • phase-platform-16-alert-tuning — where the issue was first discovered