feat: wire WOODPECKER_ENCRYPTION_KEY through Terraform #102

Merged

forgejo_admin merged 1 commit from 99-feat-wire-woodpecker-encryption-key-thro into main

2026-03-17 04:12:12 +00:00

forgejo_admin commented

2026-03-17 04:04:15 +00:00

Owner

Summary

Add woodpecker_encryption_key as a terraform-managed sensitive variable so the Woodpecker encryption key survives CNPG database migrations
Wire it to the Woodpecker server via set_sensitive in the Helm release, matching existing secret patterns
Add to Makefile TF_SECRET_VARS and Woodpecker CI pipeline environment for plan/apply steps

Changes

terraform/variables.tf: add woodpecker_encryption_key variable (sensitive string)
terraform/main.tf: add set_sensitive block for server.env.WOODPECKER_ENCRYPTION_KEY in the Woodpecker helm_release
Makefile: add woodpecker_encryption_key to TF_SECRET_VARS for Salt pillar rendering
.woodpecker.yaml: add TF_VAR_woodpecker_encryption_key to both plan and apply step environments

Test Plan

tofu fmt -check -recursive passes
tofu validate passes (no syntax errors)
After pillar secret is added: tofu plan shows only Woodpecker helm_release changing
After apply: Woodpecker server restarts cleanly with encryption key set

Note: The actual secret value must be added to Salt pillar (salt/pillar/secrets/platform.sls) separately by the operator.

Review Checklist

Passed automated review-fix loop
No secrets committed
No unnecessary file changes
Commit messages are descriptive

Closes #99
todo-woodpecker-secrets-terraform

## Summary - Add `woodpecker_encryption_key` as a terraform-managed sensitive variable so the Woodpecker encryption key survives CNPG database migrations - Wire it to the Woodpecker server via `set_sensitive` in the Helm release, matching existing secret patterns - Add to Makefile `TF_SECRET_VARS` and Woodpecker CI pipeline environment for plan/apply steps ## Changes - `terraform/variables.tf`: add `woodpecker_encryption_key` variable (sensitive string) - `terraform/main.tf`: add `set_sensitive` block for `server.env.WOODPECKER_ENCRYPTION_KEY` in the Woodpecker helm_release - `Makefile`: add `woodpecker_encryption_key` to `TF_SECRET_VARS` for Salt pillar rendering - `.woodpecker.yaml`: add `TF_VAR_woodpecker_encryption_key` to both plan and apply step environments ## Test Plan - [x] `tofu fmt -check -recursive` passes - [x] `tofu validate` passes (no syntax errors) - [ ] After pillar secret is added: `tofu plan` shows only Woodpecker helm_release changing - [ ] After apply: Woodpecker server restarts cleanly with encryption key set **Note:** The actual secret value must be added to Salt pillar (`salt/pillar/secrets/platform.sls`) separately by the operator. ## Review Checklist - [x] Passed automated review-fix loop - [x] No secrets committed - [x] No unnecessary file changes - [x] Commit messages are descriptive ## Related - Closes #99 - `todo-woodpecker-secrets-terraform`

forgejo_admin added 1 commit

2026-03-17 04:04:15 +00:00

feat: wire WOODPECKER_ENCRYPTION_KEY through Terraform

ci/woodpecker/push/woodpecker Pipeline was successful

Details

ci/woodpecker/pull_request_closed/woodpecker Pipeline was successful

Details

8ae54dc10c

Add woodpecker_encryption_key variable and pass it to the Woodpecker
server via set_sensitive in the Helm release. Add to Makefile
TF_SECRET_VARS and Woodpecker CI pipeline environment.

This ensures the encryption key survives CNPG database migrations.
The actual secret value must be added to Salt pillar separately.

Refs: todo-woodpecker-secrets-terraform
Closes #99

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

forgejo_admin commented

2026-03-17 04:04:49 +00:00

Author

Owner

Review: LGTM

4 files changed, +18/-1 -- minimal, focused diff.

Verified

terraform/variables.tf: new woodpecker_encryption_key variable is sensitive, placed logically after woodpecker_agent_secret
terraform/main.tf: set_sensitive block follows existing pattern (matches lines 755-777), correctly targets server.env.WOODPECKER_ENCRYPTION_KEY
Makefile: TF_SECRET_VARS extended with proper line continuation
.woodpecker.yaml: env var added to both plan and apply steps, from_secret format matches all existing entries
tofu fmt -check passes
tofu validate passes (no syntax errors)
No secrets committed
No unrelated changes

Operator Action Required Post-Merge

Add woodpecker_encryption_key to Salt pillar (salt/pillar/secrets/platform.sls) and create the Woodpecker CI secret tf_var_woodpecker_encryption_key before the next CI run.

## Review: LGTM **4 files changed, +18/-1** -- minimal, focused diff. ### Verified - `terraform/variables.tf`: new `woodpecker_encryption_key` variable is sensitive, placed logically after `woodpecker_agent_secret` - `terraform/main.tf`: `set_sensitive` block follows existing pattern (matches lines 755-777), correctly targets `server.env.WOODPECKER_ENCRYPTION_KEY` - `Makefile`: `TF_SECRET_VARS` extended with proper line continuation - `.woodpecker.yaml`: env var added to both plan and apply steps, `from_secret` format matches all existing entries - `tofu fmt -check` passes - `tofu validate` passes (no syntax errors) - No secrets committed - No unrelated changes ### Operator Action Required Post-Merge Add `woodpecker_encryption_key` to Salt pillar (`salt/pillar/secrets/platform.sls`) and create the Woodpecker CI secret `tf_var_woodpecker_encryption_key` before the next CI run.