From 5ffcc0acb0aa789bef9416d7409a798055cf5566 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 15:38:53 -0300 Subject: [PATCH 01/11] fix: secrets management --- .env.sample | 18 +++++++----------- compose.gitea.yml | 5 ++--- compose.github.yml | 5 ++--- compose.yml | 14 -------------- woodpecker.env.tmpl | 7 ------- 5 files changed, 11 insertions(+), 38 deletions(-) delete mode 100644 woodpecker.env.tmpl diff --git a/.env.sample b/.env.sample index e3cbe8f..d1f2949 100644 --- a/.env.sample +++ b/.env.sample @@ -10,20 +10,16 @@ LETS_ENCRYPT_ENV=production WOODPECKER_OPEN=true WOODPECKER_ADMIN= -## Gitea +# Gitea +# https://woodpecker-ci.org/docs/administration/configuration/forges/gitea COMPOSE_FILE="compose.yml:compose.gitea.yml" WOODPECKER_GITEA_URL=https://git.example.org -WOODPECKER_GITEA_CLIENT= -# see: https://woodpecker-ci.org/docs/administration/vcs/gitea +SECRET_CLIENT_SECRET_VERSION=v1 # generate=false -## Github -# COMPOSE_FILE="compose.yml:compose.github.yml" -# WOODPECKER_GITHUB_CLIENT= -# WOODPECKER_GITHUB_SECRET= - -## SECRETS -SECRET_AGENT_SECRET_VERSION=v1 -CLIENT_SECRET_VERSION=v1 +# Github +#COMPOSE_FILE="compose.yml:compose.github.yml" +#WOODPECKER_GITHUB_CLIENT= +#SECRET_CLIENT_SECRET_VERSION=v1 # generate=false ## Agent diff --git a/compose.gitea.yml b/compose.gitea.yml index 43089b1..4ba281a 100644 --- a/compose.gitea.yml +++ b/compose.gitea.yml @@ -1,15 +1,14 @@ +--- version: '3.8' - services: app: environment: - WOODPECKER_GITEA=true - WOODPECKER_GITEA_URL - WOODPECKER_GITEA_CLIENT - - WOODPECKER_GITEA_SECRET + - WOODPECKER_GITEA_SECRET_FILE=/run/secrets/client_secret secrets: - client_secret - secrets: client_secret: name: ${STACK_NAME}_client_secret_${SECRET_CLIENT_SECRET_VERSION} diff --git a/compose.github.yml b/compose.github.yml index 6e76bab..6f2fd53 100644 --- a/compose.github.yml +++ b/compose.github.yml @@ -1,14 +1,13 @@ +--- version: '3.8' - services: app: environment: - WOODPECKER_GITHUB=true - WOODPECKER_GITHUB_CLIENT - - WOODPECKER_GITHUB_SECRET + - WOODPECKER_GITHUB_SECRET_FILE=/run/secrets/client_secret secrets: - client_secret - secrets: client_secret: name: ${STACK_NAME}_client_secret_${SECRET_CLIENT_SECRET_VERSION} diff --git a/compose.yml b/compose.yml index 4eae5a9..46f033e 100644 --- a/compose.yml +++ b/compose.yml @@ -6,9 +6,6 @@ services: image: woodpeckerci/woodpecker-server:v0.15.6-alpine volumes: - data:/var/lib/woodpecker/ - configs: - - source: woodpecker_env - target: .env environment: - WOODPECKER_OPEN - WOODPECKER_HOST=https://${DOMAIN} @@ -41,9 +38,6 @@ services: - WOODPECKER_MAX_PROCS networks: - internal - configs: - - source: woodpecker_env - target: .env secrets: - agent_secret deploy: @@ -58,14 +52,6 @@ networks: volumes: data: - - -configs: - woodpecker_env: - name: ${STACK_NAME}_woodpecker_env_${WOODPECKER_ENV_VERSION} - file: woodpecker.env.tmpl - template_driver: golang - secrets: agent_secret: name: ${STACK_NAME}_agent_secret_${SECRET_AGENT_SECRET_VERSION} diff --git a/woodpecker.env.tmpl b/woodpecker.env.tmpl deleted file mode 100644 index a166999..0000000 --- a/woodpecker.env.tmpl +++ /dev/null @@ -1,7 +0,0 @@ -WOODPECKER_AGENT_SECRET={{ secret "agent_secret" }} -{{ if (env "WOODPECKER_GITEA_CLIENT") }} -WOODPECKER_GITEA_SECRET={{ secret "client_secret" }} -{{ end }} -{{ if (env "WOODPECKER_GITHUB_CLIENT") }} -WOODPECKER_GITHUB_SECRET={{ secret "client_secret" }} -{{ end }} -- 2.54.0 From 496c4b4680cf7d00a5fb9abb854ba5b4622c8818 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 15:41:46 -0300 Subject: [PATCH 02/11] feat: split server and agent --- .env.sample | 14 +++++++++----- compose.server.yml | 27 +++++++++++++++++++++++++++ compose.yml | 34 +++------------------------------- 3 files changed, 39 insertions(+), 36 deletions(-) create mode 100644 compose.server.yml diff --git a/.env.sample b/.env.sample index d1f2949..844f767 100644 --- a/.env.sample +++ b/.env.sample @@ -1,12 +1,20 @@ TYPE=woodpecker - DOMAIN=woodpecker.example.com +COMPOSE_FILE="compose.yml" ## Domain aliases #EXTRA_DOMAINS=', `www.woodpecker.example.com`' LETS_ENCRYPT_ENV=production +# Change if you're only setting the agent on this machine +WOODPECKER_SERVER=server:9000 + +# Agent +WOODPECKER_MAX_PROCS=4 + +# Server +#COMPOSE_FILE="$COMPOSE_FILE:compose.server.yml" WOODPECKER_OPEN=true WOODPECKER_ADMIN= @@ -20,7 +28,3 @@ SECRET_CLIENT_SECRET_VERSION=v1 # generate=false #COMPOSE_FILE="compose.yml:compose.github.yml" #WOODPECKER_GITHUB_CLIENT= #SECRET_CLIENT_SECRET_VERSION=v1 # generate=false - -## Agent - -WOODPECKER_MAX_PROCS=4 diff --git a/compose.server.yml b/compose.server.yml new file mode 100644 index 0000000..b4cfe89 --- /dev/null +++ b/compose.server.yml @@ -0,0 +1,27 @@ +--- +version: "3.8" +services: + server: + image: woodpeckerci/woodpecker-server:v3.20.1 + volumes: + - data:/var/lib/woodpecker/ + environment: + - WOODPECKER_OPEN + - WOODPECKER_HOST=https://${DOMAIN} + - WOODPECKER_ADMIN + secrets: + - agent_secret + networks: + - proxy + - internal + deploy: + restart_policy: + condition: on-failure + labels: + - "traefik.enable=true" + - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8000" + - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})" + - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure" + - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}" +volumes: + data: diff --git a/compose.yml b/compose.yml index 46f033e..65c209e 100644 --- a/compose.yml +++ b/compose.yml @@ -1,32 +1,7 @@ --- version: "3.8" - services: app: - image: woodpeckerci/woodpecker-server:v0.15.6-alpine - volumes: - - data:/var/lib/woodpecker/ - environment: - - WOODPECKER_OPEN - - WOODPECKER_HOST=https://${DOMAIN} - - WOODPECKER_ADMIN - secrets: - - agent_secret - networks: - - proxy - - internal - deploy: - restart_policy: - condition: on-failure - labels: - - "traefik.enable=true" - - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8000" - - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})" - - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure" - - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}" - - "coop-cloud.${STACK_NAME}.version=0.1.0+v0.15.6-alpine" - - agent: image: woodpeckerci/woodpecker-agent:v0.15.6-alpine command: agent depends_on: @@ -34,7 +9,7 @@ services: volumes: - /var/run/docker.sock:/var/run/docker.sock environment: - - WOODPECKER_SERVER=app:9000 + - WOODPECKER_SERVER - WOODPECKER_MAX_PROCS networks: - internal @@ -43,15 +18,12 @@ services: deploy: restart_policy: condition: on-failure - + labels: + - "coop-cloud.${STACK_NAME}.version=0.1.0+v0.15.6-alpine" networks: proxy: external: true internal: - - -volumes: - data: secrets: agent_secret: name: ${STACK_NAME}_agent_secret_${SECRET_AGENT_SECRET_VERSION} -- 2.54.0 From 9e08a62ea30037f3eb57c6f7f410b615dad3f931 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 15:44:54 -0300 Subject: [PATCH 03/11] fix: gitea client is also a secret --- .env.sample | 1 + compose.gitea.yml | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.env.sample b/.env.sample index 844f767..49331c5 100644 --- a/.env.sample +++ b/.env.sample @@ -22,6 +22,7 @@ WOODPECKER_ADMIN= # https://woodpecker-ci.org/docs/administration/configuration/forges/gitea COMPOSE_FILE="compose.yml:compose.gitea.yml" WOODPECKER_GITEA_URL=https://git.example.org +SECRET_GITEA_CLIENT_VERSION=v1 # generate=false SECRET_CLIENT_SECRET_VERSION=v1 # generate=false # Github diff --git a/compose.gitea.yml b/compose.gitea.yml index 4ba281a..44775b2 100644 --- a/compose.gitea.yml +++ b/compose.gitea.yml @@ -5,7 +5,7 @@ services: environment: - WOODPECKER_GITEA=true - WOODPECKER_GITEA_URL - - WOODPECKER_GITEA_CLIENT + - WOODPECKER_GITEA_CLIENT_FILE=/run/secrets/gitea_client - WOODPECKER_GITEA_SECRET_FILE=/run/secrets/client_secret secrets: - client_secret @@ -13,3 +13,6 @@ secrets: client_secret: name: ${STACK_NAME}_client_secret_${SECRET_CLIENT_SECRET_VERSION} external: true + gitea_client: + name: ${STACK_NAME}_gitea_client_${SECRET_GITEA_CLIENT_VERSION} + external: true -- 2.54.0 From 2df1f0777a5db48d197f3bb2fa3f09a1341fe6b9 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 15:45:25 -0300 Subject: [PATCH 04/11] feat: agent secret as a file --- .env.sample | 1 + compose.server.yml | 1 + compose.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.env.sample b/.env.sample index 49331c5..0b90b5a 100644 --- a/.env.sample +++ b/.env.sample @@ -9,6 +9,7 @@ LETS_ENCRYPT_ENV=production # Change if you're only setting the agent on this machine WOODPECKER_SERVER=server:9000 +SECRET_AGENT_SECRET_VERSION=v1 # length=64 charset=hex # Agent WOODPECKER_MAX_PROCS=4 diff --git a/compose.server.yml b/compose.server.yml index b4cfe89..effa30e 100644 --- a/compose.server.yml +++ b/compose.server.yml @@ -9,6 +9,7 @@ services: - WOODPECKER_OPEN - WOODPECKER_HOST=https://${DOMAIN} - WOODPECKER_ADMIN + - WOODPECKER_AGENT_SECRET_FILE=/run/secrets/agent_secret secrets: - agent_secret networks: diff --git a/compose.yml b/compose.yml index 65c209e..653b387 100644 --- a/compose.yml +++ b/compose.yml @@ -11,6 +11,7 @@ services: environment: - WOODPECKER_SERVER - WOODPECKER_MAX_PROCS + - WOODPECKER_AGENT_SECRET_FILE=/run/secrets/agent_secret networks: - internal secrets: -- 2.54.0 From 4eacdac7c37381e66e0e3627446792797d0d2169 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 15:46:12 -0300 Subject: [PATCH 05/11] feat: woodpecker flags --- .env.sample | 6 ++++++ compose.server.yml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/.env.sample b/.env.sample index 0b90b5a..e686bb0 100644 --- a/.env.sample +++ b/.env.sample @@ -18,6 +18,12 @@ WOODPECKER_MAX_PROCS=4 #COMPOSE_FILE="$COMPOSE_FILE:compose.server.yml" WOODPECKER_OPEN=true WOODPECKER_ADMIN= +WOODPECKER_LOG_LEVEL=info +WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx +WOODPECKER_PLUGINS_TRUSTED_CLONE=woodpeckerci/plugin-docker-buildx +WOODPECKER_AUTHENTICATE_PUBLIC_REPOS=true +#WOODPECKER_DEFAULT_PIPELINE_TIMEOUT= +#WOODPECKER_MAX_PIPELINE_TIMEOUT= # Gitea # https://woodpecker-ci.org/docs/administration/configuration/forges/gitea diff --git a/compose.server.yml b/compose.server.yml index effa30e..fa077ea 100644 --- a/compose.server.yml +++ b/compose.server.yml @@ -10,6 +10,12 @@ services: - WOODPECKER_HOST=https://${DOMAIN} - WOODPECKER_ADMIN - WOODPECKER_AGENT_SECRET_FILE=/run/secrets/agent_secret + - WOODPECKER_LOG_LEVEL + - WOODPECKER_PLUGINS_PRIVILEGED + - WOODPECKER_PLUGINS_TRUSTED_CLONE + - WOODPECKER_AUTHENTICATE_PUBLIC_REPOS + - WOODPECKER_DEFAULT_PIPELINE_TIMEOUT=${WOODPECKER_DEFAULT_PIPELINE_TIMEOUT:-60} + - WOODPECKER_MAX_PIPELINE_TIMEOUT=${WOODPECKER_MAX_PIPELINE_TIMEOUT:-120} secrets: - agent_secret networks: -- 2.54.0 From 092f1a3972c58d5ff19fd3b2cf3d3e1cc7a19cc3 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 16:00:31 -0300 Subject: [PATCH 06/11] fix: merge compose files --- .env.sample | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.env.sample b/.env.sample index e686bb0..edfc300 100644 --- a/.env.sample +++ b/.env.sample @@ -27,12 +27,12 @@ WOODPECKER_AUTHENTICATE_PUBLIC_REPOS=true # Gitea # https://woodpecker-ci.org/docs/administration/configuration/forges/gitea -COMPOSE_FILE="compose.yml:compose.gitea.yml" +COMPOSE_FILE="$COMPOSE_FILE:compose.gitea.yml" WOODPECKER_GITEA_URL=https://git.example.org SECRET_GITEA_CLIENT_VERSION=v1 # generate=false SECRET_CLIENT_SECRET_VERSION=v1 # generate=false # Github -#COMPOSE_FILE="compose.yml:compose.github.yml" +#COMPOSE_FILE="$COMPOSE_FILE:compose.github.yml" #WOODPECKER_GITHUB_CLIENT= #SECRET_CLIENT_SECRET_VERSION=v1 # generate=false -- 2.54.0 From 03397b5561b65192d26763194438886db91a1292 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 16:02:25 -0300 Subject: [PATCH 07/11] fix: missing secret --- compose.gitea.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/compose.gitea.yml b/compose.gitea.yml index 44775b2..e952a31 100644 --- a/compose.gitea.yml +++ b/compose.gitea.yml @@ -9,6 +9,7 @@ services: - WOODPECKER_GITEA_SECRET_FILE=/run/secrets/client_secret secrets: - client_secret + - gitea_client secrets: client_secret: name: ${STACK_NAME}_client_secret_${SECRET_CLIENT_SECRET_VERSION} -- 2.54.0 From bbb77b0fff7965e052075b92dc09cd8a51501161 Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 16:03:45 -0300 Subject: [PATCH 08/11] fix: upgrade the agent too --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 653b387..5a76757 100644 --- a/compose.yml +++ b/compose.yml @@ -2,7 +2,7 @@ version: "3.8" services: app: - image: woodpeckerci/woodpecker-agent:v0.15.6-alpine + image: woodpeckerci/woodpecker-agent:v3.20.1 command: agent depends_on: - woodpecker-server -- 2.54.0 From 1146a99b7c51454e68a32021895d9b26d0dd88eb Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 16:14:57 -0300 Subject: [PATCH 09/11] feat: store agent configuration --- compose.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/compose.yml b/compose.yml index 5a76757..186efaa 100644 --- a/compose.yml +++ b/compose.yml @@ -8,6 +8,7 @@ services: - woodpecker-server volumes: - /var/run/docker.sock:/var/run/docker.sock + - agent:/etc/woodpecker environment: - WOODPECKER_SERVER - WOODPECKER_MAX_PROCS @@ -29,3 +30,5 @@ secrets: agent_secret: name: ${STACK_NAME}_agent_secret_${SECRET_AGENT_SECRET_VERSION} external: true +volumes: + agent: -- 2.54.0 From 06f7cb1ffd1ff5604295971f7884f2366f9830ef Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 16:35:31 -0300 Subject: [PATCH 10/11] fix: forge configs go to server --- compose.gitea.yml | 2 +- compose.github.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/compose.gitea.yml b/compose.gitea.yml index e952a31..4dd5426 100644 --- a/compose.gitea.yml +++ b/compose.gitea.yml @@ -1,7 +1,7 @@ --- version: '3.8' services: - app: + server: environment: - WOODPECKER_GITEA=true - WOODPECKER_GITEA_URL diff --git a/compose.github.yml b/compose.github.yml index 6f2fd53..1e858f9 100644 --- a/compose.github.yml +++ b/compose.github.yml @@ -1,7 +1,7 @@ --- version: '3.8' services: - app: + server: environment: - WOODPECKER_GITHUB=true - WOODPECKER_GITHUB_CLIENT -- 2.54.0 From ec7c9d81806bae8c69278f6949f009a8562505ef Mon Sep 17 00:00:00 2001 From: f Date: Fri, 30 Oct 2026 18:09:36 -0300 Subject: [PATCH 11/11] feat: customizable domain --- .env.sample | 1 + compose.server.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.env.sample b/.env.sample index edfc300..ddd4bd9 100644 --- a/.env.sample +++ b/.env.sample @@ -16,6 +16,7 @@ WOODPECKER_MAX_PROCS=4 # Server #COMPOSE_FILE="$COMPOSE_FILE:compose.server.yml" +WOODPECKER_HOST=https://${DOMAIN} WOODPECKER_OPEN=true WOODPECKER_ADMIN= WOODPECKER_LOG_LEVEL=info diff --git a/compose.server.yml b/compose.server.yml index fa077ea..99d378d 100644 --- a/compose.server.yml +++ b/compose.server.yml @@ -7,7 +7,7 @@ services: - data:/var/lib/woodpecker/ environment: - WOODPECKER_OPEN - - WOODPECKER_HOST=https://${DOMAIN} + - WOODPECKER_HOST - WOODPECKER_ADMIN - WOODPECKER_AGENT_SECRET_FILE=/run/secrets/agent_secret - WOODPECKER_LOG_LEVEL -- 2.54.0