test secrets

.env.sample

@@ -9,12 +9,19 @@ CRON_SCHEDULE='30 */1 * * *'
 RENOVATE_ENDPOINT="https://gitea.example.com/api/v1/"
 RENOVATE_GIT_AUTHOR="Renovate Bot <renovate@your-domain.example.com>"
 RENOVATE_PLATFORM="gitea"
+
+## This controls the contents of the initial renovate.json file created in onboarding PRs.
+RENOVATE_ONBOARDING_CONFIG='{"$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["config:recommended"] }'
+
 ## Autodiscover repos
 #RENOVATE_AUTODISCOVER="true"
 #RENOVATE_AUTODISCOVER_FILTER="my-org/*,my-org2/*"
+
 ## If not using autodiscover, you can supply a space-separated list of repos.
 ## Ex: "coop-cloud/renovate coop-cloud/keycloak"
 RENOVATE_REPOSITORIES=""
-RENOVATE_TOKEN="token for your git forge"
-RENOVATE_GITHUB_COM_TOKEN="token-for-github.com"
-RENOVATE_ONBOARDING_CONFIG='{"$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["config:recommended"] }'
+
+## Here's how to set assignees for pull requests. You can also configure this in each repo's renovate.json.
+#RENOVATE_ASSIGNEES="example-user1 example-user2"
+## Or you could do this to set different assignees per path:
+#RENOVATE_ASSIGNEES_FROM_CODE_OWNERS=true

compose.yml

@@ -15,3 +15,14 @@ services:
         - "swarm.cronjob.schedule=${CRON_SCHEDULE}"
       restart_policy:
         condition: none
+    secrets:
+      - renovate_token
+      - github_token
+
+secrets:
+  renovate_token:
+    name: ${STACK_NAME}_renovate_token_${RENOVATE_TOKEN_VERSION}
+    external: true
+  github_token:
+    name: ${STACK_NAME}_github_token_${GITHUB_TOKEN_VERSION}
+    external: true

entrypoint.sh.tmpl

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+set -e
+
+# Inspiration: https://git.coopcloud.tech/coop-cloud/peertube/src/branch/main/entrypoint.sh.tmpl
+file_env() {
+   local var="$1"
+   local fileVar="${var}_FILE"
+   local def="${2:-}"
+
+   if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+      echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+      exit 1
+   fi
+
+   local val="$def"
+
+   if [ "${!var:-}" ]; then
+      val="${!var}"
+   elif [ "${!fileVar:-}" ]; then
+      val="$(< "${!fileVar}")"
+   fi
+
+   export "$var"="$val"
+   unset "$fileVar"
+}
+
+file_env "RENOVATE_TOKEN"
+
+{{ if eq (env "RENOVATE_GITHUB_COM_TOKEN") "1" }}
+file_env "RENOVATE_GITHUB_COM_TOKEN"
+{{ end }}
+
+/usr/local/sbin/renovate-entrypoint.sh "$@"