feat: wire WOODPECKER_ENCRYPTION_KEY through Terraform

forgejo_admin commented

2026-03-17 04:01:35 +00:00

Owner

Lineage

todo-woodpecker-secrets-terraform (no plan ancestry)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want the Woodpecker encryption key managed by Terraform
So that stored secrets survive CNPG database migrations without becoming undecryptable

Context

Every time CNPG rebuilds the Woodpecker database, the encryption key stored in the DB is lost. This makes all stored secrets (repo secrets, global secrets) undecryptable, requiring manual re-entry of every secret. The fix is to pass WOODPECKER_ENCRYPTION_KEY as an externally-managed env var via Helm values so Woodpecker uses that key instead of generating one internally. The key then lives in terraform state (sourced from Salt pillar), not the DB.

File Targets

Files the agent should modify:

terraform/variables.tf -- add woodpecker_encryption_key variable (sensitive)
terraform/main.tf -- add set_sensitive block for the encryption key in the Woodpecker helm_release
Makefile -- add woodpecker_encryption_key to TF_SECRET_VARS
.woodpecker.yaml -- add TF_VAR_woodpecker_encryption_key to plan and apply step environments

Files the agent should NOT touch:

salt/pillar/secrets/platform.sls -- the actual secret value is added by the operator separately

Acceptance Criteria

woodpecker_encryption_key variable exists in terraform/variables.tf as a sensitive string
set_sensitive block passes the key to server.env.WOODPECKER_ENCRYPTION_KEY in the Woodpecker helm_release
Makefile TF_SECRET_VARS includes woodpecker_encryption_key
.woodpecker.yaml plan step includes TF_VAR_woodpecker_encryption_key from secret
.woodpecker.yaml apply step includes TF_VAR_woodpecker_encryption_key from secret
tofu fmt -check passes
tofu validate shows no syntax errors (missing variable value is expected)

Test Expectations

tofu fmt -check -recursive exits 0
tofu validate fails only with "No value for required variable" (not syntax error)
Run command: cd terraform && tofu fmt -check -recursive && tofu validate

Constraints

Follow existing set_sensitive pattern (lines 755-777 of main.tf) -- do NOT put sensitive values in the yamlencode block
Follow existing TF_SECRET_VARS naming convention in Makefile
Follow existing Woodpecker CI env var pattern in .woodpecker.yaml

Checklist

PR opened
Tests pass
No unrelated changes

pal-e-platform -- project this affects

### Lineage `todo-woodpecker-secrets-terraform` (no plan ancestry) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want the Woodpecker encryption key managed by Terraform So that stored secrets survive CNPG database migrations without becoming undecryptable ### Context Every time CNPG rebuilds the Woodpecker database, the encryption key stored in the DB is lost. This makes all stored secrets (repo secrets, global secrets) undecryptable, requiring manual re-entry of every secret. The fix is to pass `WOODPECKER_ENCRYPTION_KEY` as an externally-managed env var via Helm values so Woodpecker uses that key instead of generating one internally. The key then lives in terraform state (sourced from Salt pillar), not the DB. ### File Targets Files the agent should modify: - `terraform/variables.tf` -- add `woodpecker_encryption_key` variable (sensitive) - `terraform/main.tf` -- add `set_sensitive` block for the encryption key in the Woodpecker helm_release - `Makefile` -- add `woodpecker_encryption_key` to `TF_SECRET_VARS` - `.woodpecker.yaml` -- add `TF_VAR_woodpecker_encryption_key` to plan and apply step environments Files the agent should NOT touch: - `salt/pillar/secrets/platform.sls` -- the actual secret value is added by the operator separately ### Acceptance Criteria - [ ] `woodpecker_encryption_key` variable exists in `terraform/variables.tf` as a sensitive string - [ ] `set_sensitive` block passes the key to `server.env.WOODPECKER_ENCRYPTION_KEY` in the Woodpecker helm_release - [ ] `Makefile` `TF_SECRET_VARS` includes `woodpecker_encryption_key` - [ ] `.woodpecker.yaml` plan step includes `TF_VAR_woodpecker_encryption_key` from secret - [ ] `.woodpecker.yaml` apply step includes `TF_VAR_woodpecker_encryption_key` from secret - [ ] `tofu fmt -check` passes - [ ] `tofu validate` shows no syntax errors (missing variable value is expected) ### Test Expectations - [ ] `tofu fmt -check -recursive` exits 0 - [ ] `tofu validate` fails only with "No value for required variable" (not syntax error) - Run command: `cd terraform && tofu fmt -check -recursive && tofu validate` ### Constraints - Follow existing `set_sensitive` pattern (lines 755-777 of main.tf) -- do NOT put sensitive values in the `yamlencode` block - Follow existing `TF_SECRET_VARS` naming convention in Makefile - Follow existing Woodpecker CI env var pattern in `.woodpecker.yaml` ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `pal-e-platform` -- project this affects