ic-builder
e15b170659
HA runtime template contexts (shell_command {{ }} rendering) cannot read
secrets.yaml; kuma_push_url rendered undefined every fire and the Kuma
push dead-man never sent a beat. Move the full curl command into the
secret (kuma_heartbeat_cmd) and reference it with !secret, which is
substituted at config parse where secrets work.
On-box fix applied + verified under GLPI CR 21; this commit makes the
git copy match the deployed state.
Ticket: https://projects.knownelement.com/issues/811
CR: https://cmdb.knownelement.com/front/change.form.php?id=21
29 lines
1.5 KiB
YAML
29 lines
1.5 KiB
YAML
# Deploy pipeline [#734]: gitea release-branch sha watcher. Feeds the
|
|
# sha-watch deploy automation (reload-only apply). The gitea webhook
|
|
# (gitea hook #10 -> pfv_deploy_git_webhook automation) is the fast path
|
|
# with full restart mapping, but gitea cannot deliver webhooks to
|
|
# CGNAT-range targets until its [webhook] ALLOWED_HOST_LIST is widened
|
|
# (founder action via Cloudron file manager); this watcher is the
|
|
# always-works safety net.
|
|
rest:
|
|
- resource: https://git.knownelement.com/api/v1/repos/KNEL/KNELBMS/commits?sha=release&limit=1
|
|
headers:
|
|
Authorization: !secret gitea_auth_header
|
|
User-Agent: pfv-bms-deploy-watch
|
|
scan_interval: 300
|
|
verify_ssl: true
|
|
sensor:
|
|
- name: PFV deploy gitea release head
|
|
unique_id: pfv_deploy_gitea_release_head
|
|
value_template: "{{ value_json[0].sha if value_json is list and value_json | length > 0 else (value_json | string | truncate(90)) }}"
|
|
|
|
# E2E self-deploy proof commit [#734] - if you can read this in /config,
|
|
# the sha-watch deployed it autonomously.
|
|
|
|
# Dead-man heartbeat (#792): pushes OK to the out-of-band Uptime Kuma
|
|
# (Cloudron, status.knownelement.com) every 5 minutes. If HA stops
|
|
# pushing — crash, wedge, power loss, network partition — Kuma pages
|
|
# the founder's phone directly. No HA in the alert loop.
|
|
shell_command:
|
|
kuma_ha_heartbeat: !secret kuma_heartbeat_cmd # CR21 2026-09-06: runtime template contexts cannot read secrets; the old {{ }} form rendered undefined and the dead-man never pushed
|